fix: add NBXplorer cookie auth and WorkingDirectory for BTCPay service

- Add btcexplorercookiefile to BTCPay deterministic config so NBXplorer
  cookie authentication succeeds (fixes 401 Unauthorized)
- Set WorkingDirectory to package lib dir so ASP.NET Core can locate
  wwwroot and LanguageService.ctor does not throw ArgumentNullException
- Update regression test to assert cookie file path and WorkingDirectory

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>

tests/bitcoin-btcpay-hardening.nix

@@ -50,6 +50,7 @@ let
   nbxplorerPreStart = config.systemd.services.nbxplorer.preStart;
   bitcoindPreStart = config.systemd.services.bitcoind.preStart;
   btcpayExecStart = config.systemd.services.btcpayserver.serviceConfig.ExecStart;
+  btcpayWorkingDir = config.systemd.services.btcpayserver.serviceConfig.WorkingDirectory;
 
   nbxplorerConfigPath = extractAfter "install -m 600" nbxplorerPreStart;
   btcpayConfigPath = extractFlagValue "--conf" btcpayExecStart;
@@ -92,6 +93,13 @@ assert lib.assertMsg
     && lib.hasInfix "port=24444" nbxplorerConfig
     && lib.hasInfix "postgres=User ID=nbxplorer;Host=/run/postgresql;Database=nbxplorer" nbxplorerConfig)
   "nbxplorer base config must contain the expected non-secret settings";
+assert lib.assertMsg
+  (lib.hasInfix "btcexplorerurl=http://127.0.0.1:24444/" btcpayConfig
+    && lib.hasInfix "btcexplorercookiefile=/build/nbxplorer/Main/.cookie" btcpayConfig)
+  "btcpayserver config must contain btcexplorerurl and btcexplorercookiefile";
+assert lib.assertMsg
+  (lib.hasSuffix "/lib/btcpayserver" btcpayWorkingDir)
+  "btcpayserver WorkingDirectory must end with /lib/btcpayserver";
 assert lib.assertMsg
   (!lib.hasInfix "/build/btcpayserver/settings.config" btcpayExecStart
     && lib.hasInfix "--datadir='/build/btcpayserver'" btcpayExecStart)