Kokkoja: first public assembly

Assembled from the development repository by tools/make_release.sh.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/kokkoja-relay.service

@@ -0,0 +1,29 @@
+# The Kokkoja relay as a system service.  Installed by deploy/setup_vps.sh
+# as /etc/systemd/system/kokkoja-relay.service.
+#
+# The relay listens on this computer only; nginx terminates TLS and
+# forwards wss://<site>/relay/... to it (deploy/nginx-site.conf).
+
+[Unit]
+Description=Kokkoja relay
+After=network.target
+
+[Service]
+User=kokkoja
+Group=kokkoja
+ExecStart=/opt/kokkoja/venv/bin/python /opt/kokkoja/relay/kokkoja_relay.py --host 127.0.0.1 --port 8770
+Restart=on-failure
+RestartSec=5
+# The relay needs nothing on the system but its own code.
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6
+MemoryDenyWriteExecute=yes
+
+[Install]
+WantedBy=multi-user.target