Add serve mode, fix binary tags, document CLI tools, improve Docker

- Add 'serve' subcommand for ephemeral RAM-based relay at /dev/shm with
  open ACL mode for testing and benchmarking
- Fix e-tag and p-tag decoding to use ValueHex()/ValueBinary() methods
  instead of Value() which returns raw bytes for binary-optimized storage
- Document all command-line tools in readme.adoc (relay-tester, benchmark,
  stresstest, blossomtest, aggregator, convert, FIND, policytest, etc.)
- Switch Docker images from Alpine to Debian for proper libsecp256k1
  Schnorr signature and ECDH support required by Nostr
- Upgrade Docker Go version from 1.21 to 1.25
- Add ramdisk mode (--ramdisk) to benchmark script for eliminating disk
  I/O bottlenecks in performance measurements
- Add docker-compose.ramdisk.yml for tmpfs-based benchmark volumes
- Add test coverage for privileged policy with binary-encoded p-tags
- Fix blossom test to expect 200 OK for anonymous uploads when auth is
  not required (RequireAuth=false with ACL mode 'none')
- Update follows ACL to handle both binary and hex p-tag formats
- Grant owner access to all users in serve mode via None ACL
- Add benchmark reports from multi-relay comparison run
- Update CLAUDE.md with binary tag handling documentation
- Bump version to v0.30.2

main.go

@@ -62,6 +62,34 @@ func main() {
 		os.Exit(0)
 	}
 
+	// Handle 'serve' subcommand: start ephemeral relay with RAM-based storage
+	if config.ServeRequested() {
+		const serveDataDir = "/dev/shm/orlyserve"
+		log.I.F("serve mode: configuring ephemeral relay at %s", serveDataDir)
+
+		// Delete existing directory completely
+		if err = os.RemoveAll(serveDataDir); err != nil && !os.IsNotExist(err) {
+			log.E.F("failed to remove existing serve directory: %v", err)
+			os.Exit(1)
+		}
+
+		// Create fresh directory
+		if err = os.MkdirAll(serveDataDir, 0755); chk.E(err) {
+			log.E.F("failed to create serve directory: %v", err)
+			os.Exit(1)
+		}
+
+		// Override configuration for serve mode
+		cfg.DataDir = serveDataDir
+		cfg.Listen = "0.0.0.0"
+		cfg.Port = 10547
+		cfg.ACLMode = "none"
+		cfg.ServeMode = true // Grant full owner access to all users
+
+		log.I.F("serve mode: listening on %s:%d with ACL mode '%s' (full owner access)",
+			cfg.Listen, cfg.Port, cfg.ACLMode)
+	}
+
 	// Ensure profiling is stopped on interrupts (SIGINT/SIGTERM) as well as on normal exit
 	var profileStopOnce sync.Once
 	profileStop := func() {}