Add serve mode, fix binary tags, document CLI tools, improve Docker

- Add 'serve' subcommand for ephemeral RAM-based relay at /dev/shm with
  open ACL mode for testing and benchmarking
- Fix e-tag and p-tag decoding to use ValueHex()/ValueBinary() methods
  instead of Value() which returns raw bytes for binary-optimized storage
- Document all command-line tools in readme.adoc (relay-tester, benchmark,
  stresstest, blossomtest, aggregator, convert, FIND, policytest, etc.)
- Switch Docker images from Alpine to Debian for proper libsecp256k1
  Schnorr signature and ECDH support required by Nostr
- Upgrade Docker Go version from 1.21 to 1.25
- Add ramdisk mode (--ramdisk) to benchmark script for eliminating disk
  I/O bottlenecks in performance measurements
- Add docker-compose.ramdisk.yml for tmpfs-based benchmark volumes
- Add test coverage for privileged policy with binary-encoded p-tags
- Fix blossom test to expect 200 OK for anonymous uploads when auth is
  not required (RequireAuth=false with ACL mode 'none')
- Update follows ACL to handle both binary and hex p-tag formats
- Grant owner access to all users in serve mode via None ACL
- Add benchmark reports from multi-relay comparison run
- Update CLAUDE.md with binary tag handling documentation
- Bump version to v0.30.2

pkg/acl/follows.go

@@ -123,14 +123,13 @@ func (f *Follows) Configure(cfg ...any) (err error) {
 				}
 				// log.I.F("admin follow list:\n%s", ev.Serialize())
 				for _, v := range ev.Tags.GetAll([]byte("p")) {
-					// log.I.F("adding follow: %s", v.Value())
-					var a []byte
-					if b, e := hex.DecodeString(string(v.Value())); chk.E(e) {
+					// log.I.F("adding follow: %s", v.ValueHex())
+					// ValueHex() automatically handles both binary and hex storage formats
+					if b, e := hex.DecodeString(string(v.ValueHex())); chk.E(e) {
 						continue
 					} else {
-						a = b
+						f.follows = append(f.follows, b)
 					}
-					f.follows = append(f.follows, a)
 				}
 			}
 		}
@@ -923,8 +922,15 @@ func (f *Follows) extractFollowedPubkeys(event *event.E) {
 
 	// Extract all 'p' tags (followed pubkeys) from the kind 3 event
 	for _, tag := range event.Tags.GetAll([]byte("p")) {
-		if len(tag.Value()) == 32 { // Valid pubkey length
-			f.AddFollow(tag.Value())
+		// First try binary format (optimized storage: 33 bytes = 32 hash + null)
+		if pubkey := tag.ValueBinary(); pubkey != nil {
+			f.AddFollow(pubkey)
+			continue
+		}
+		// Fall back to hex decoding for non-binary values
+		// ValueHex() handles both formats, but we already checked binary above
+		if pubkey, err := hex.DecodeString(string(tag.Value())); err == nil && len(pubkey) == 32 {
+			f.AddFollow(pubkey)
 		}
 	}
 }

pkg/acl/none.go

@@ -52,6 +52,11 @@ func (n *None) Configure(cfg ...any) (err error) {
 }
 
 func (n *None) GetAccessLevel(pub []byte, address string) (level string) {
+	// In serve mode, grant full owner access to everyone
+	if n.cfg != nil && n.cfg.ServeMode {
+		return "owner"
+	}
+
 	// Check owners first
 	for _, v := range n.owners {
 		if utils.FastEqual(v, pub) {