Add serve mode, fix binary tags, document CLI tools, improve Docker

- Add 'serve' subcommand for ephemeral RAM-based relay at /dev/shm with
  open ACL mode for testing and benchmarking
- Fix e-tag and p-tag decoding to use ValueHex()/ValueBinary() methods
  instead of Value() which returns raw bytes for binary-optimized storage
- Document all command-line tools in readme.adoc (relay-tester, benchmark,
  stresstest, blossomtest, aggregator, convert, FIND, policytest, etc.)
- Switch Docker images from Alpine to Debian for proper libsecp256k1
  Schnorr signature and ECDH support required by Nostr
- Upgrade Docker Go version from 1.21 to 1.25
- Add ramdisk mode (--ramdisk) to benchmark script for eliminating disk
  I/O bottlenecks in performance measurements
- Add docker-compose.ramdisk.yml for tmpfs-based benchmark volumes
- Add test coverage for privileged policy with binary-encoded p-tags
- Fix blossom test to expect 200 OK for anonymous uploads when auth is
  not required (RequireAuth=false with ACL mode 'none')
- Update follows ACL to handle both binary and hex p-tag formats
- Grant owner access to all users in serve mode via None ACL
- Add benchmark reports from multi-relay comparison run
- Update CLAUDE.md with binary tag handling documentation
- Bump version to v0.30.2

app/config/config.go

@@ -88,6 +88,10 @@ type C struct {
 
 	// Cluster replication configuration
 	ClusterPropagatePrivilegedEvents bool `env:"ORLY_CLUSTER_PROPAGATE_PRIVILEGED_EVENTS" default:"true" usage:"propagate privileged events (DMs, gift wraps, etc.) to relay peers for replication"`
+
+	// ServeMode is set programmatically by the 'serve' subcommand to grant full owner
+	// access to all users (no env tag - internal use only)
+	ServeMode bool
 }
 
 // New creates and initializes a new configuration object for the relay
@@ -193,6 +197,21 @@ func IdentityRequested() (requested bool) {
 	return
 }
 
+// ServeRequested checks if the first command line argument is "serve" and returns
+// whether the relay should start in ephemeral serve mode with RAM-based storage.
+//
+// Return Values
+//   - requested: true if the 'serve' subcommand was provided, false otherwise.
+func ServeRequested() (requested bool) {
+	if len(os.Args) > 1 {
+		switch strings.ToLower(os.Args[1]) {
+		case "serve":
+			requested = true
+		}
+	}
+	return
+}
+
 // KV is a key/value pair.
 type KV struct{ Key, Value string }
 
@@ -324,10 +343,14 @@ func PrintHelp(cfg *C, printer io.Writer) {
 	)
 	_, _ = fmt.Fprintf(
 		printer,
-		`Usage: %s [env|help]
+		`Usage: %s [env|help|identity|serve]
 
 - env: print environment variables configuring %s
 - help: print this help text
+- identity: print the relay identity secret and public key
+- serve: start ephemeral relay with RAM-based storage at /dev/shm/orlyserve
+         listening on 0.0.0.0:10547 with 'none' ACL mode (open relay)
+         useful for testing and benchmarking
 
 `,
 		cfg.AppName, cfg.AppName,

app/handle-delete.go

@@ -142,19 +142,26 @@ func (l *Listener) HandleDelete(env *eventenvelope.Submission) (err error) {
 		// if e tags are found, delete them if the author is signer, or one of
 		// the owners is signer
 		if utils.FastEqual(t.Key(), []byte("e")) {
-			val := t.Value()
-			if len(val) == 0 {
-				log.W.F("HandleDelete: empty e-tag value")
-				continue
-			}
-			log.I.F("HandleDelete: processing e-tag with value: %s", string(val))
+			// First try binary format (optimized storage for e-tags)
 			var dst []byte
-			if b, e := hex.Dec(string(val)); chk.E(e) {
-				log.E.F("HandleDelete: failed to decode hex event ID %s: %v", string(val), e)
-				continue
+			if binVal := t.ValueBinary(); binVal != nil {
+				dst = binVal
+				log.I.F("HandleDelete: processing binary e-tag event ID: %0x", dst)
 			} else {
-				dst = b
-				log.I.F("HandleDelete: decoded event ID: %0x", dst)
+				// Fall back to hex decoding for non-binary values
+				val := t.Value()
+				if len(val) == 0 {
+					log.W.F("HandleDelete: empty e-tag value")
+					continue
+				}
+				log.I.F("HandleDelete: processing e-tag with value: %s", string(val))
+				if b, e := hex.Dec(string(val)); chk.E(e) {
+					log.E.F("HandleDelete: failed to decode hex event ID %s: %v", string(val), e)
+					continue
+				} else {
+					dst = b
+					log.I.F("HandleDelete: decoded event ID: %0x", dst)
+				}
 			}
 			f := &filter.F{
 				Ids: tag.NewFromBytesSlice(dst),
@@ -164,7 +171,7 @@ func (l *Listener) HandleDelete(env *eventenvelope.Submission) (err error) {
 				log.E.F("HandleDelete: failed to get serials from filter: %v", err)
 				continue
 			}
-			log.I.F("HandleDelete: found %d serials for event ID %s", len(sers), string(val))
+			log.I.F("HandleDelete: found %d serials for event ID %0x", len(sers), dst)
 			// if found, delete them
 			if len(sers) > 0 {
 				// there should be only one event per serial, so we can just

app/privileged_events_test.go

@@ -54,9 +54,17 @@ func testPrivilegedEventFiltering(events event.S, authedPubkey []byte, aclMode s
 				// Check p tags
 				pTags := ev.Tags.GetAll([]byte("p"))
 				for _, pTag := range pTags {
-					var pt []byte
-					var err error
-					if pt, err = hex.Dec(string(pTag.Value())); err != nil {
+					// First try binary format (optimized storage)
+					if pt := pTag.ValueBinary(); pt != nil {
+						if bytes.Equal(pt, authedPubkey) {
+							authorized = true
+							break
+						}
+						continue
+					}
+					// Fall back to hex decoding for non-binary values
+					pt, err := hex.Dec(string(pTag.Value()))
+					if err != nil {
 						continue
 					}
 					if bytes.Equal(pt, authedPubkey) {