mealie: apply upstream patch to fix usage with sops-nix

This commit applies the upstream PR
https://github.com/mealie-recipes/mealie/pull/4002, which fixes
permission errors that prevent mealie from starting when it does not
have permission to access '/run/secrets'.

When using sops-nix, this directory is created as `root:root`, preventing
the 'mealie' user from accessing it.

pkgs/by-name/me/mealie/package.nix

@@ -2,6 +2,7 @@
 , stdenv
 , callPackage
 , fetchFromGitHub
+, fetchpatch
 , makeWrapper
 , nixosTests
 , python3Packages
@@ -46,6 +47,16 @@ pythonpkgs.buildPythonApplication rec {
   inherit version src;
   pyproject = true;
 
+  patches = [
+    # Pull in https://github.com/mealie-recipes/mealie/pull/4002 manually until
+    # it lands in an upstream mealie release.
+    # See https://github.com/NixOS/nixpkgs/issues/321623.
+    ( fetchpatch {
+        url = "https://github.com/mealie-recipes/mealie/commit/65ece35966120479db903785b22e9f2645f72aa4.patch";
+        hash = "sha256-4Nc0dFJrZ7ElN9rrq+CFpayKsrRjRd24fYraUFTzcH8=";
+    })
+  ];
+
   build-system = with pythonpkgs; [ poetry-core ];
 
   nativeBuildInputs = [ makeWrapper ];