Add serve mode, fix binary tags, document CLI tools, improve Docker

- Add 'serve' subcommand for ephemeral RAM-based relay at /dev/shm with
  open ACL mode for testing and benchmarking
- Fix e-tag and p-tag decoding to use ValueHex()/ValueBinary() methods
  instead of Value() which returns raw bytes for binary-optimized storage
- Document all command-line tools in readme.adoc (relay-tester, benchmark,
  stresstest, blossomtest, aggregator, convert, FIND, policytest, etc.)
- Switch Docker images from Alpine to Debian for proper libsecp256k1
  Schnorr signature and ECDH support required by Nostr
- Upgrade Docker Go version from 1.21 to 1.25
- Add ramdisk mode (--ramdisk) to benchmark script for eliminating disk
  I/O bottlenecks in performance measurements
- Add docker-compose.ramdisk.yml for tmpfs-based benchmark volumes
- Add test coverage for privileged policy with binary-encoded p-tags
- Fix blossom test to expect 200 OK for anonymous uploads when auth is
  not required (RequireAuth=false with ACL mode 'none')
- Update follows ACL to handle both binary and hex p-tag formats
- Grant owner access to all users in serve mode via None ACL
- Add benchmark reports from multi-relay comparison run
- Update CLAUDE.md with binary tag handling documentation
- Bump version to v0.30.2

scripts/DOCKER_TESTING.md

@@ -83,7 +83,7 @@ docker-compose -f docker-compose-test.yml down -v
 Multi-stage build for ORLY:
 
 **Stage 1: Builder**
-- Based on golang:1.21-alpine
+- Based on golang:1.25-alpine
 - Downloads dependencies
 - Builds static binary with `CGO_ENABLED=0`
 - Copies libsecp256k1.so for crypto operations
@@ -365,7 +365,7 @@ start_period: 60s  # Default is 20-30s
 
 # Pre-pull images
 docker pull dgraph/standalone:latest
-docker pull golang:1.21-alpine
+docker pull golang:1.25-alpine
 ```
 
 **High memory usage**

scripts/Dockerfile.deploy-test

@@ -193,7 +193,7 @@ echo "=== All deployment script tests passed! ==="
 echo ""
 echo "The deployment script appears to be working correctly."
 echo "In a real deployment, it would:"
-echo "  1. Install Go 1.23.1 to ~/.local/go"
+echo "  1. Install Go 1.25.3 to ~/.local/go"
 echo "  2. Set up Go environment in ~/.goenv"
 echo "  3. Install build dependencies via ubuntu_install_libsecp256k1.sh"
 echo "  4. Build the relay with embedded web UI"

scripts/benchmark.sh

@@ -33,11 +33,11 @@ if [[ ! -x "$BENCHMARK_BIN" ]]; then
     echo "Building benchmark binary (pure Go + purego)..."
     cd "$REPO_ROOT/cmd/benchmark"
     CGO_ENABLED=0 go build -o "$BENCHMARK_BIN" .
-    # Download libsecp256k1.so from nostr repository (runtime optional)
-    wget -q https://git.mleku.dev/mleku/nostr/raw/branch/main/crypto/p8k/libsecp256k1.so \
-        -O "$(dirname "$BENCHMARK_BIN")/libsecp256k1.so" 2>/dev/null || \
-        echo "Warning: Failed to download libsecp256k1.so (optional for performance)"
-    chmod +x "$(dirname "$BENCHMARK_BIN")/libsecp256k1.so" 2>/dev/null || true
+    # Copy libsecp256k1.so from repo root (runtime optional)
+    if [[ -f "$REPO_ROOT/libsecp256k1.so" ]]; then
+        cp "$REPO_ROOT/libsecp256k1.so" "$(dirname "$BENCHMARK_BIN")/"
+        chmod +x "$(dirname "$BENCHMARK_BIN")/libsecp256k1.so" 2>/dev/null || true
+    fi
     cd "$REPO_ROOT"
 fi
 

scripts/deploy.sh

@@ -197,13 +197,12 @@ build_application() {
     log_info "Building binary in current directory (pure Go + purego)..."
     CGO_ENABLED=0 go build -o "$BINARY_NAME"
     
-    # Download libsecp256k1.so from nostr repository (optional, for runtime performance)
-    log_info "Downloading libsecp256k1.so from nostr repository..."
-    if wget -q https://git.mleku.dev/mleku/nostr/raw/branch/main/crypto/p8k/libsecp256k1.so -O libsecp256k1.so; then
+    # Verify libsecp256k1.so exists in repo (used by purego for runtime crypto)
+    if [[ -f "./libsecp256k1.so" ]]; then
         chmod +x libsecp256k1.so
-        log_success "Downloaded libsecp256k1.so successfully (runtime optional)"
+        log_success "Found libsecp256k1.so in repository"
     else
-        log_warning "Failed to download libsecp256k1.so - relay will still work but may have slower crypto"
+        log_warning "libsecp256k1.so not found in repo - relay will still work but may have slower crypto"
     fi
     
     if [[ -f "./$BINARY_NAME" ]]; then

scripts/runtests.sh

@@ -3,9 +3,8 @@
 # libsecp256k1 is loaded dynamically at runtime if available
 export CGO_ENABLED=0
 
-# Download libsecp256k1.so from nostr repository if not present
-if [ ! -f "libsecp256k1.so" ]; then
-    wget -q https://git.mleku.dev/mleku/nostr/raw/branch/main/crypto/p8k/libsecp256k1.so -O libsecp256k1.so 2>/dev/null || true
+# Verify libsecp256k1.so exists in repo (should be at repo root)
+if [ -f "libsecp256k1.so" ]; then
     chmod +x libsecp256k1.so 2>/dev/null || true
 fi
 

scripts/test.sh

@@ -3,12 +3,10 @@
 # libsecp256k1 is loaded dynamically at runtime if available
 export CGO_ENABLED=0
 
-# Download libsecp256k1.so from nostr repository if not present
+# Verify libsecp256k1.so exists in repo (should be at repo root)
 if [ ! -f "libsecp256k1.so" ]; then
-    echo "Downloading libsecp256k1.so from nostr repository..."
-    wget -q https://git.mleku.dev/mleku/nostr/raw/branch/main/crypto/p8k/libsecp256k1.so -O libsecp256k1.so || {
-        echo "Warning: Failed to download libsecp256k1.so - tests may fail"
-    }
+    echo "Warning: libsecp256k1.so not found in repo - tests may use fallback crypto"
+else
     chmod +x libsecp256k1.so 2>/dev/null || true
 fi