server: Go skeleton — control plane, UDP data plane, Docker + systemd modes

Pure stdlib. Implements the spec's core: enrollment (single-use tokens),
profile (SPKI pin, only real capabilities advertised), sessions with the
§2.4 HKDF-SHA256 key schedule; UDP data plane with the 32-byte ELT1
header, 4-byte HMAC gate, 1024-wide anti-replay window, ECHO_RESP with
observation block, TIMESYNC, and the §3.4 anti-amplification cap. Wire
format has tests (roundtrip + silent-drop cases); enroll→profile→session
smoke-tested live.

Modes: container (autodetect /.dockerenv|/run/.containerenv|cgroup, or
--docker/ECHOLOT_DOCKER=1; config via ECHOLOT_* env; distroless image;
network_mode host required — Docker NAT would falsify observed sources)
and native (--install-systemd/--uninstall-systemd with a hardened unit,
opt-in --self-update from Gitea releases; refused in containers).

CI: tests on any server/ push; server-v* tags build+push the image to the
Gitea registry and attach linux amd64/arm64 binaries + SHA256SUMS to a
release — the artifact self-update consumes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/compose.yaml

@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: 2026 Echolot contributors
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Reference deployment. host networking is REQUIRED, not an optimization:
+# behind Docker's NAT the observed source address, port-rebinding evidence and
+# TTLs — the things the probe protocol measures — would be the proxy's, not
+# the client's. With network_mode: host the ECHOLOT_*_LISTEN vars bind real
+# host ports; pick free ones.
+services:
+  echolot-server:
+    image: git.rambossek.at/echolot/echolot-server:latest
+    container_name: echolot-server
+    network_mode: host
+    restart: unless-stopped
+    environment:
+      ECHOLOT_NAME: homelab
+      ECHOLOT_CONTROL_LISTEN: ":8443"
+      ECHOLOT_UDP_LISTEN: ":8442"
+      ECHOLOT_TCP_LISTEN: ":8441"
+      # Admin stays loopback-only; reach it via SSH tunnel from the LAN host.
+      ECHOLOT_ADMIN_LISTEN: "127.0.0.1:8444"
+      # ECHOLOT_TLS_CERT / ECHOLOT_TLS_KEY: omit to self-sign into /state
+      #   (clients pin the SPKI — self-signed is first-class).
+    volumes:
+      - echolot-state:/state
+
+volumes:
+  echolot-state: