- fix(web): refresh Firebase ID token via onIdTokenChanged (API calls 401'd after ~1h)
- fix(web): nginx try_files to avoid trailing-slash 301 leaking the private port
- fix(deploy): correct Caddy /v1 pass-through and /api rewrite; init system user
- fix(api): make Cloudflare Turnstile optional when secret key is unconfigured
- feat(android): Docker build for the release APK with release signing config
- test(e2e): Playwright suite against the deployed site (real Chrome for Google sign-in)
- test(api): api-test.sh to send + poll + list received SMS
- docs: add 1&1 SMS-Flat usage restrictions

DID auth:
- verify ML-DSA-87 (FIPS 204) did:key signatures (multicodec 0x300001,
  KeyBundle/SignatureBundle, domain-separated SHA-256); dual ML+SLH keys
- signature-only verify: raw privkey is no longer sent or accepted, /resolve
  removed, and the challenge is verified (previously not)
- shared Redis nonce store (multi-replica safe): single-use, non-burning
- web: client-side PQ signing and key parsing; DID routes registered

Self-hosted cleanup: remove Firebase/GCP (FCM push, storage, auth), the
Google Cloud attachment/push services, and the Android Firebase service;
Android sends SMS via a worker.

Without FCM the phone had to poll on a timer (WorkManager min 15 min), so
sends waited for the next tick. Add an in-process MessageNotifier and a
`?wait=` long-poll on /v1/messages/outstanding/list: the server holds the
request until a message is queued for the user (or the wait elapses), so
delivery is push-like with no push service. PostSend/BulkSend notify; the
Android foreground service long-polls (25s) and enqueues a SendSmsWorker per
message, with the 15-min heartbeat kept as a backup.

- default server URL https://httpsms.bigt.ai (strings + Settings
  fallback), so users only enter API key + SIM number
- bigt.ai logo on the login header

- deploy.apk.sh: docker build (APK_TASK arg) -> extract ->
  upload versioned HttpSms-<type>-<sha>.apk + stable HttpSms.apk
  alias under the httpsms/ prefix (debug default, auto-signed)
- android/Dockerfile: APK_TASK build arg (was hardcoded release)
- ignore local out/

The Enable-SMS-Permission button only opened a help article, so users
who permanently denied the permission had no in-app path back — the
system dialog never reappears after two denials. Point it at the
app-details Settings page where the SMS toggle lives.

The public object lives at bucket httpsms/HttpSms.apk — not under
aifeeds-content/. Default S3_BUCKET to httpsms (empty prefix) and
clean up a misplaced upload path.

The login header now sends bigt.ai users to https://bigt.ai/#sms
(Data -> SMS, wallet-minted key) instead of httpsms.com/settings.

Some senders put GSM/ASCII bytes on the wire while declaring UCS-2
(DCS 0x08), so the platform pairs those bytes into UTF-16 code units and
the body arrives as CJK noise — "026-10-04 16:59:44 has/have been"
surfaces as "〲㘭㄰ⴰ㐠ㄶ㨵㤺㐴⁨慳⽨慶攠扥敮".

Repair in ReceivedReceiver before the body is encrypted for upload, and
in MessageReceive.Sanitize for unencrypted content from older app
builds. The heuristic only rewrites bodies whose code units all map onto
printable ASCII and which recover into text, so Chinese/Japanese/emoji
bodies pass through untouched.

…aller)

deploy.apk.sh now publishes httpsms-<type>-latest.json beside the APK it
uploads — {versionName, versionCode, url, sha256, mandatory} — and the app
fetches it ~4s after MainActivity starts and from Settings → Check for
updates. A newer build downloads to cache, is sha256-checked against the
manifest, then handed to PackageInstaller; UpdateReceiver lifts the system
consent sheet (STATUS_PENDING_USER_ACTION).

Two things make an install land:

- versionCode was pinned at 1, so no build could ever look newer; it is now
  the git commit count, the same input gradle already reads for versionName.
- every variant signs with the certificate pinned in android/signing.sha256
  (the wallet keystore). Debug builds used to auto-generate a fresh key per
  build, so no APK could install over the one on the device; deploy.apk.sh
  refuses to publish anything carrying a different signer. Builds published
  before this change still need one last uninstall/reinstall.

Bucket apps, prefix httpsms/apk; S3_ENDPOINT/EU host minio-s1002 (the apps
shard). OTA base + tests point at https://s3.bigt.ai/apps/httpsms/apk.

The Android app delivers messages by long-polling the API (foreground service +
WorkManager), so a fresh self-hosted install must not create a Firebase project
or drop a `google-services.json` into `android/app` — that instruction was the
one remaining way to reintroduce GMS into the build. Removes the "Setup
Firebase" step (FCM push, Firebase Auth, service-account creds), renumbers the
remaining steps and fixes the send-flow diagram and back-pressure wording.

Everything here is unused since the self-hosted/DID move:

- web: firebase runtime-config keys + FIREBASE_* entries in .env.docker /
  .env.production (consumed nowhere — nuxt.config was the only reader);
- web/firebase.json + .firebaserc and the Firebase Hosting CI step (upstream's
  project; the web deploys to Cloudflare Pages);
- api CI step + tests/generate-firebase-credentials.sh (no Go code reads
  FIREBASE_CREDENTIALS or GCP creds), and the stale test docs referencing them;
- .github/copilot-instructions.md described Firebase auth and FCM push, which
  the app no longer has;
- stale comments in api/.env.docker and the now-unused .gitignore entry.

GCP_PROJECT_ID stays: api/main.go reads it for the logger label.

The privacy policy and terms list the third-party services the app uses,
including Google Play Services and Google Analytics for Firebase. Neither is
used: the app links no GMS/Firebase code (verified on a debug build: 0
gms/firebase refs in every dex) and the web bundle has no Firebase SDK. Also
drops the now-unneeded jq/OpenSSL test prerequisites (they existed only for the
deleted fake-service-account generator).

The pin carried the wallet's certificate (2a9479a3…, CN=wallet.bigt.ai) — it
was copied along with the OTA-updater port. A local release build signs with
httpsms's own key (454a85f7…, CN=httpSMS), so deploy.apk.sh refused every
publish with "signer pin mismatch".

Point the keystore at the shared key store (keys live outside the repo now —
~/keys/app/httpsms-release.keystore, passwords in ~/keys/app/passwords.env) and
pin its certificate.

Note: the APK currently served from the bucket (com.httpsms ccc8215) is signed
with the wallet key, so those installs cannot be upgraded in place — the next
release needs a one-time uninstall/reinstall on them.

Adds `--fdroid`: after the normal upload it rebuilds an F-Droid repo
(fdroidserver in a venv, created on first use) from fdroid/metadata/ and mirrors
it to $FDROID_S3_PREFIX/repo (default httpsms/fdroid in the shared apps bucket).
The repo index is signed with the release key from android/app/keystore.properties
— the same certificate as the APK — so users verify one fingerprint; the URL and
fingerprint are printed at the end. Release APKs only (refused for debug).

First listing: fdroid/metadata/com.httpsms.yml (AGPL-3.0-or-later, Phone & SMS).

Verified against scratch prefixes: index HTTP 200, lists com.httpsms
(AGPL-3.0-or-later, Phone & SMS) with com.httpsms_2715.apk, and the deploy's
signer pin still passes (454a85f7…).