Relay 0.6.0: alles in een image, de app-map is leeg

Plan Eigenimage, fase 5, op keuze van de gebruiker: een image met de relay
erbij en geen tweede recept. agent.py, nginx.conf en index.html verhuizen
naar tools/evolu-relay/ naast src/; de Dockerfile blijft op node:24-slim en
haalt nginx en python3 uit apt. Drie containers uit een image: de relay als
node via de compose, de agent en nginx als root.

Anders dan alleen verplaatst: user www-data in nginx.conf (Debian heeft geen
gebruiker nginx), geen USER meer in de image, de versie in de kop via
api/status met RELAY_APP_VERSION. VERSION 0.6.0, manifest 0.6.0, drie keer
dezelfde tag in de compose, ongepind tot de eerste push.

Tests mee verhuisd; de vormtest toetst de drie tags tegen VERSION. Niet
gebouwd: er is hier geen Docker.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -39,32 +39,25 @@ trade-off is written out in [Docs/Referenties/Clients.md](Docs/Referenties/Clien
 
 ### Evolu Relay
 
-> **Packaged, never installed.** The manifest and compose are here; nothing has run on an Umbrel yet.
-
 Trezor Suite syncs labels and account names between devices, and by default that runs through a server
-operated by Trezor. That server is open source and called Evolu Relay. This app runs it on your own
-machine. The data is end to end encrypted on the device, so self-hosting does not change that guarantee,
-it only changes who holds the encrypted copy.
+operated by Trezor. That server is built on Evolu, and its relay is published as an npm package. This app
+runs that relay on your own machine, with an owner allowlist around it. The data is end to end encrypted
+on the device, so self-hosting does not change that guarantee, it only changes who holds the encrypted
+copy.
 
-Three containers, two images.
+Three containers, one image, built from [tools/evolu-relay/](tools/evolu-relay/) by its `build.sh`
+(node on Debian slim, plus nginx and python3). The app folder holds only the compose file, the manifest,
+the icon and your data.
 
 | Container | What it does |
 |-|-|
-| `relay` | the sync relay on 4000, reached through the app proxy on 3851 |
-| `quota-manager` | same image, different command; registers the storage limit the relay requires |
-| `db` (`postgres:17-alpine`) | storage, under `${APP_DATA_DIR}/data/postgres` |
+| `relay` | the sync relay, published on host port 3852; our `src/index.js` around `@evolu/nodejs`, adding the allowlist |
+| `agent` | same image, different command; serves the status API and drops commands from the page into a mailbox the relay empties |
+| `server` | same image; nginx serving the status page on port 80 behind the umbrelOS app proxy, with its sign-in |
 
-The app proxy runs with `PROXY_AUTH_ADD: "false"`, because Trezor Suite is not a browser with a session
-cookie. That is the same pattern Umbrel's own nostr-relay app uses. The flip side: anything that can reach
-port 3851 reaches the relay without signing in. What limits the damage is that the relay refuses any owner
-without a storage limit registered in its database.
-
-**Trezor publishes no image**, so it is built from their Dockerfile, pinned to a commit, by
-[tools/evolu-relay/build.sh](tools/evolu-relay/build.sh). Run that before installing.
-
-Still unverified: whether Trezor Suite accepts this address, whether the database schema creates itself,
-and how an owner gets registered. See
-[Docs/Referenties/Upstream-evolu-relay.md](Docs/Referenties/Upstream-evolu-relay.md).
+The relay publishes its own port because a sync client is not a browser with a session cookie; the page
+sits behind the app proxy because it is. New owners are admitted only while a two-minute learning window
+is open on the page; everyone else is refused and listed, so you can allow them by hand.
 
 ## Documentatie