gitea-projects-api: support nix-update, add justfile targets

Refactor so `src` is a direct `fetchgit` (instead of a wrapper drv), and
move the package.json engine-strip into a `frontendSrc` derivation that
only fetchPnpmDeps sees. nix-update needs to introspect `src.url` and
`src.rev`; the previous wrapper hid them.

Expose `frontend.pnpmDeps` via passthru so nix-update finds the third
hash. Now `just gitea-update` does the full cycle:
  1. git ls-remote → latest commit on feat/projects-api
  2. set src.hash / pnpmDeps.hash / goModules.vendorHash to fakeHash
  3. nix-build each to capture real hashes
  4. nom build the package for final verification

nix-update rewrites version to nixpkgs `<tag>-unstable-<date>` style. Lose
the descriptive "-projects-api" suffix in the version, but pname is
unchanged so store paths still read `gitea-projects-api-*`.

justfile

@@ -28,3 +28,23 @@ antigravity-build-no-fhs:
 # Pull the latest jacopone/antigravity-nix pin
 antigravity-update:
     nix flake update antigravity-nix
+
+# ── gitea-projects-api ─────────────────────────────────────
+
+# Build the gitea fork (compiles Go 1.26.3 first time; ~5-8 min cold)
+gitea-build:
+    nix build .#gitea-projects-api --print-build-logs
+
+# Refresh gitea-projects-api: tracks feat/projects-api tip, updates rev + src/vendor/pnpmDeps hashes + version date
+gitea-update:
+    nix run nixpkgs#nix-update -- \
+        --flake gitea-projects-api \
+        --version=branch=feat/projects-api \
+        --build
+
+# Run gitea from the attic-cached build (no local recompile)
+gitea-run:
+    nix run \
+        --extra-substituters "https://nix-cache-custom.oleks.space/attic-infra-cache-k3s-1" \
+        --extra-trusted-public-keys "attic-infra-cache-k3s-1:qYSNK3DmttQXCFqn1t50qoWGtQNPRFWq9mgQjD05DeU=" \
+        git+https://git.oleks.space/oleks/flake-hub#gitea-projects-api -- --help

packages/gitea-projects-api.nix

@@ -24,9 +24,9 @@
 
 let
   pname = "gitea-projects-api";
-  version = "1.27.0-dev-projects-api";
+  version = "1.26.0-unstable-2026-05-11";
 
-  rawSrc = fetchgit {
+  src = fetchgit {
     url = "https://git.oleks.space/oleks/gitea.git";
     rev = "20f31b8967a4556fbdd32bc72c386d5a4c89bcc5";
     hash = "sha256-Ws8I+q6Y8/X13C3uAAFLUUF+DHZRgFrsuo5XG2Cvyns=";
@@ -35,10 +35,10 @@ let
   # Gitea's package.json requires pnpm >= 11; nixpkgs ships pnpm 10. The
   # lockfile is v9 (forward-compatible), so strip the engine constraint and
   # the packageManager preference before any pnpm tool sees the source.
-  src = stdenv.mkDerivation {
-    pname = "${pname}-src";
-    inherit version;
-    src = rawSrc;
+  # We only patch the source the frontend sees; the Go build doesn't care.
+  frontendSrc = stdenv.mkDerivation {
+    pname = "${pname}-frontend-src";
+    inherit version src;
     dontConfigure = true;
     dontBuild = true;
     installPhase = ''
@@ -57,7 +57,8 @@ let
 
   frontend = stdenv.mkDerivation (finalAttrs: {
     pname = "${pname}-frontend";
-    inherit version src;
+    inherit version;
+    src = frontendSrc;
 
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
@@ -127,6 +128,11 @@ buildGoModule {
       }
   '';
 
+  passthru = {
+    # Expose hashes nix-update needs to find when iterating.
+    pnpmDeps = frontend.pnpmDeps;
+  };
+
   meta = {
     description = "Gitea fork with Projects REST API (upstream PR #37518)";
     homepage = "https://git.oleks.space/oleks/gitea";