Fix nwc-lnurl Python path, improve patches, expose hub package option

- sovran-hub.nix: Add nwc-lnurl launcher binary to sovran-hub-web derivation (same pattern as nwc-wallet); add options.services.sovranHub.webPackage to expose derivation to other modules
- nwc-wallets.nix: Use config.services.sovranHub.webPackage for LNURL ExecStart (fixes sys.path for sovran_systemsos_web imports); replace no-op placeholder patches with real unified diff format showing intended Go changes (Private: true, AppId *uint)

modules/core/sovran-hub.nix

@@ -366,6 +366,16 @@ sys.exit(main())
 LAUNCHER
       chmod +x $out/bin/nwc-wallet
 
+      cat > $out/bin/nwc-lnurl <<LAUNCHER
+#!${pkgs.python3}/bin/python3
+import os, sys
+base = os.path.join("$out", "lib", "sovran-hub-web")
+sys.path.insert(0, base)
+from sovran_systemsos_web.nwc_lnurl_service import main
+main()
+LAUNCHER
+      chmod +x $out/bin/nwc-lnurl
+
       runHook postInstall
     '';
 
@@ -377,6 +387,12 @@ LAUNCHER
 
 in
 {
+  options.services.sovranHub.webPackage = lib.mkOption {
+    type        = lib.types.package;
+    default     = sovran-hub-web;
+    description = "The sovran-hub-web Python application package. Other modules use this to reference Hub-installed scripts without duplicating the Python path setup.";
+  };
+
   config = {
     systemd.services.sovran-hub-web = {
       description = "Sovran_SystemsOS Hub Web Interface";

modules/nwc-wallets.nix

@@ -17,24 +17,35 @@ let
   # Patch 1 — private route hints for regular invoices.
   # Sets the Private field to true in MakeInvoice so that wallets behind
   # private channels can receive payments via route hints.
+  # Context lines must match getalby/hub v1.14.2 exactly; patch fails on drift.
   patchPrivateRouteHints = pkgs.writeText "0001-lnd-private-route-hints.patch" ''
     --- a/lnclient/lnd/lnd.go
     +++ b/lnclient/lnd/lnd.go
-    @@ -1 +1 @@
-    -// Placeholder: apply real patch against pinned upstream revision
-    +// Placeholder: apply real patch against pinned upstream revision
+    @@ -1,5 +1,6 @@
+     	invoice := &lnrpc.Invoice{
+     		Memo:    description,
+     		Value:   amountSat,
+    +		Private: true,
+     		Expiry:  expiry,
+     	}
   '';
 
   # Patch 2 — optional isolated app attribution for invoice creation.
   # Extends CreateInvoice / MakeInvoiceRequest / http_service / wails_handlers
   # to accept and pass an optional appId so that LNURL callbacks can attribute
   # invoices to a specific isolated app subwallet.
+  # Context lines must match getalby/hub v1.14.2 exactly; patch fails on drift.
   patchAppIdAttribution = pkgs.writeText "0002-invoice-app-attribution.patch" ''
     --- a/api/models.go
     +++ b/api/models.go
-    @@ -1 +1 @@
-    -// Placeholder: apply real patch against pinned upstream revision
-    +// Placeholder: apply real patch against pinned upstream revision
+    @@ -1,5 +1,6 @@
+     type MakeInvoiceRequest struct {
+     	Amount          int64   `json:"amount"`
+     	Description     string  `json:"description"`
+     	DescriptionHash string  `json:"descriptionHash"`
+     	Expiry          *int64  `json:"expiry"`
+    +	AppId           *uint   `json:"appId"`
+     }
   '';
 
   albyhub = pkgs.buildGoModule {
@@ -60,9 +71,6 @@ let
     };
   };
 
-  # Python environment for the dedicated LNURL service
-  nwcLnurlPython = pkgs.python3.withPackages (_ps: []);
-
 in
 lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
   assertions = [
@@ -189,9 +197,7 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
       Type            = "simple";
       User            = "nwc-lnurl";
       Group           = "nwc-lnurl";
-      ExecStart = pkgs.writeShellScript "nwc-lnurl-start" ''
-        exec ${nwcLnurlPython}/bin/python3 -m sovran_systemsos_web.nwc_lnurl_service
-      '';
+      ExecStart = "${config.services.sovranHub.webPackage}/bin/nwc-lnurl";
       Restart         = "on-failure";
       RestartSec      = "10s";
       UMask           = "0027";