Mempool: use preBuild cd instead of postUnpack so npmDeps fetcher finds lock files

postUnpack did not run in the npmDeps fixed-output derivation, so
prefetch-npm-deps couldn't find package-lock.json. preBuild runs in
both the fetcher and main build, ensuring consistent CWD for the lock
file lookup. Backend patch moved to prePatch/postPatch so it only
applies in the main build.

npmDepsHash values remain placeholders (lib.fakeHash).

packages/mempool/default.nix

@@ -80,10 +80,11 @@ in rec {
     pname = "mempool-backend";
     inherit version src;
 
-    # Use postUnpack (not sourceRoot) so the npmDeps fixed-output
+    # cd into the backend subdir during unpack so the npmDeps fetcher
-    # derivation hashes the same unpacked tree as the main build.
+    # finds package-lock.json at its CWD. This hook runs in both the
-    postUnpack = ''
+    # deps fetcher and the main build.
-      cd source/backend
+    preBuild = ''
+      cd backend
     '';
 
     # Placeholder: build once, then replace with the hash from the
@@ -96,6 +97,11 @@ in rec {
     ];
 
     # Apply patches only in the main build, not in the npmDeps fetcher.
+    # prePatch runs before patchPhase in the main build only.
+    prePatch = ''
+      cd backend
+    '';
+
     postPatch = ''
       patch -p1 < ${./0001-allow-disabling-mining-pool-fetching.patch}
     '';
@@ -148,10 +154,10 @@ in rec {
     pname = "mempool-frontend";
     inherit version src;
 
-    # Use postUnpack (not sourceRoot) so the npmDeps fixed-output
+    # cd into the frontend subdir so the npmDeps fetcher finds
-    # derivation hashes the same unpacked tree as the main build.
+    # package-lock.json at its CWD.
-    postUnpack = ''
+    preBuild = ''
-      cd source/frontend
+      cd frontend
     '';
 
     # Placeholder: build once, then replace with the hash from the