fix: patch tailscale to support a custom DERP port

nix/ssh-wasm.nix

@@ -22,7 +22,14 @@ in
     buildPhase = ''
       export GOOS=js
       export GOARCH=wasm
-      go build -o hp_ssh.wasm ./cmd/hp_ssh
+
+      # Patch Tailscale's derphttp to include DERPPort in WebSocket URLs.
+      # Without this, DERP servers on non-443 ports fail in WASM builds.
+      if [ -f patches/tailscale-derp-port.patch ]; then
+        patch -d vendor -p1 < patches/tailscale-derp-port.patch
+      fi
+
+      go build -mod=vendor -o hp_ssh.wasm ./cmd/hp_ssh
     '';
 
     installPhase = ''