Phase 2 of the umbrella plan in #427.

Scope

Make the ACL generators emit relative acl:agent URIs when the owner WebID is hosted under the same pod. Update callers in src/handlers/container.js and src/server.js (createRootPodStructure) accordingly. The parser already resolves relative agent URIs against the ACL document URL — proven by PR #65 (bdbbbb7) which closed #64.

Generators in scope:

• generateOwnerAcl
• generatePrivateAcl
• generateInboxAcl
• generatePublicFolderAcl

(generatePublicReadAcl has no agent — unaffected.)

Concrete change

Each generator currently takes ownerWebId (absolute) and emits:

'acl:agent': { '@id': ownerWebId },

…and the caller passes ${podUri}profile/card.jsonld#me. After Phase 2:

• Caller passes the relative form: './profile/card.jsonld#me' (root pod) or './<name>/profile/card.jsonld#me' resolved against the .acl URL.
• Generator emits it verbatim.

Important asymmetry: the WebID as published in the user's profile (/profile/card.jsonld#me document body) stays absolute — that's the global identifier other servers dereference. Only the in-ACL reference becomes relative.

Why

After Phase 1, public read works across hosts. Owner read/write only works on the canonical host because acl:agent is still baked-in absolute. Making it relative:

1. Lets owner read/write work cross-host on the same machine (when the user authenticates against whichever host they're hitting).
2. Makes the on-disk pod truly portable — operators can move a pod to a new domain without rewriting ACLs.

Doesn't fix the cross-host auth case (token issued by host A, request to host B) — that's Phase 4.

Tests

• Unit: each affected generator emits the relative agent form when given a relative input.
• Round-trip: parser resolves ./profile/card.jsonld#me against http://anyhost/.acl to http://anyhost/profile/card.jsonld#me.
• Integration: owner-authenticated request lands a write across the same set of Host: rewrites used in Phase 1: emit relative acl:accessTo / acl:default in ACL generators (#427) #428's cross-host portability test.
• Regression: existing pods on disk with absolute agent URIs continue to authorize.

Acceptance

• All four generators emit relative acl:agent when callers pass it.
• Callers updated in container.js and server.js.
• Round-trip + cross-host owner-write integration tests pass.
• Profile document body unchanged — WebID still published as the absolute global identifier.
• No regression on absolute-agent ACLs already on disk.

Out of scope

• Cross-host auth normalization (token webid host vs request host) — Phase 4.
• Default landing page seeding — Phase 3.

Refs #427.