Šepot — end-to-end encrypted messenger

Initial public release. Anonymous on-device identity (no phone number,
e-mail, or password), Signal-protocol cryptography (X3DH + PQXDH, Double
Ratchet, sealed sender) via libsignal, a metadata-minimizing relay,
group chats, disappearing messages, encrypted local storage, optional
Tor transport, and a UI localized into Czech, English, German, Russian,
and Italian.

Monorepo: Flutter client (app/), Rust relay + wire types (rust/),
protobuf definitions (proto/), self-host deploy (deploy/).

Licensed under AGPL-3.0 with an app-store distribution exception (§7).

rust/sepot-relay/migrations/0002_attachments.sql

@@ -0,0 +1,16 @@
+-- Přílohy: opaque šifrované bloby mimo message_queue.
+-- Relay vidí jen blob_id + velikost + expiraci. ŽÁDNÁ vazba na účet,
+-- zařízení ani zprávu — kdo blob nahrál/stáhl se neukládá (privacy).
+-- Samotná data leží na disku (SEPOT_ATTACHMENTS_DIR), v DB jen metadata
+-- kvůli TTL úklidu.
+
+CREATE TABLE attachments (
+    blob_id     BYTEA PRIMARY KEY,
+    size_bytes  BIGINT NOT NULL,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    expires_at  TIMESTAMPTZ NOT NULL,
+    CHECK (octet_length(blob_id) = 16),
+    CHECK (size_bytes > 0)
+);
+
+CREATE INDEX idx_attachments_expiry ON attachments(expires_at);