fix(relay): message loss on large queues, call wake-up throttling, identity reclaim, prekey upload

- stop counting ACK and Pong frames toward the per-connection frame window;
  draining a large queue used to trip the 429 limit, disconnect the client
  and, after eight rounds, drop the remaining envelopes
- deliver to online recipients with try_send: a recipient that stops reading
  its socket no longer pins the sender's task and memory
- throttle call wake-ups per recipient (1 per 10 s, 6 per 10 min) and
  ordinary wake-ups (1 per 5 s); collapse ids for APNs and FCM
- POST /v1/register accepts X-Sepot-Identity-Proof and lets a new device take
  over an existing identity (restore from the recovery phrase)
- POST /v1/keys uploads one-time prekeys and rotates signed/Kyber prekeys;
  PrekeysLow is sent after AUTH when fewer than 20 remain
- GET /v1/keys hands out at most 30 one-time prekeys per address per hour
- reqwest errors are logged without the URL; UnifiedPush POSTs pin the
  addresses the SSRF guard resolved; NAT64/6to4 embedded addresses are checked
- absolute AUTH deadline, at most 3 AUTH attempts, length limits on push
  endpoints and VoIP tokens
- TURN credentials live 12 h and are reissued per connection every 10 min
- global attachment storage cap (SEPOT_ATTACHMENTS_TOTAL_BYTES), nosniff and
  attachment disposition on downloads
- SEPOT_MAX_CONNS_PER_IP, /v1/ready backed by the database, graceful shutdown,
  RLIMIT_NOFILE raised to the hard limit, server-info reports source and revision
- Dockerfile: rust 1.99, GIT_SHA build arg for the image label and
  SEPOT_REVISION; Tor image on alpine 3.24

deploy/relay/Dockerfile

@@ -4,7 +4,7 @@
 # Build stage potřebuje: protoc (prost-build generuje z proto/sepot.proto),
 # git (libsignal-protocol je git dependency s [patch.crates-io] zrcadlem).
 
-FROM rust:1.96-slim AS build
+FROM rust:1.99-slim AS build
 RUN apt-get update && apt-get install -y --no-install-recommends \
       protobuf-compiler git pkg-config build-essential cmake \
     && rm -rf /var/lib/apt/lists/*
@@ -21,6 +21,12 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     && cp target/release/sepot-relay /sepot-relay
 
 FROM debian:bookworm-slim
+# Revize zdroje: label pro `docker inspect` a env pro /v1/server-info
+# (AGPL §13 — uživatel relaye má vědět, který commit běží).
+ARG GIT_SHA=dev
+LABEL org.opencontainers.image.revision=$GIT_SHA \
+      org.opencontainers.image.source="https://github.com/juliusjoska/sepot"
+ENV SEPOT_REVISION=$GIT_SHA
 RUN apt-get update && apt-get install -y --no-install-recommends \
       ca-certificates curl \
     && rm -rf /var/lib/apt/lists/* \