R5 the server's own settings: instance, rules, announcements, relays, media limits, the staff's log

A singleton ServerSettings (title, descriptions, contact, thumbnail, privacy policy, terms, rules, relays, media
overrides, PublishActivity), cached by InstanceSettings and read by the instance API, NodeInfo, the instance actor, the
web pages and the mailer; its defaults are the old literals, so nothing changes until an administrator edits.
/clientapi/admin/settings (and /thumbnail), /announcements, /relays for administrators; /clientapi/moderator/log, the
staff's log (AdminAction, written by domain blocks, backups, settings and the CLI; no IP, never a root paired with its
personas). The Mastodon API's rules, extended description, privacy policy, terms of service, domain blocks (Published,
Obfuscate), announcements (dismiss, reactions, streaming) and activity (only when published). Reports carry rule ids.
Media overrides clamped to hard caps. Relays named by the settings reconcile next to the configured ones.

Verified: interop.sh instance accounts relay with mastodon, relay, aoderelay and mailpit, 119 passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

FEDERATION.md

@@ -139,7 +139,9 @@ The names are the project's own and are stable; resolve actors through WebFinger
   personas made on the same day do not share a date. `indexable` is `false` unless the persona turns it on, and
   `discoverable` is `true` unless it turns that off.
 - The instance actor is `/peasants/privapub` (type `Application`). It signs every fetch PrivaPub makes, so no avatar's key
-  is used to read another server's content. It also answers at the server's root (`/`) for a request that asks for
+  is used to read another server's content. Its `name` is the server's name and its `summary` the server's short
+  description, as the administrator sets them (the server's settings; until then "PrivaPub" and a sentence saying what it
+  does); NodeInfo's `metadata.nodeName` and `nodeDescription` come from the same settings. It also answers at the server's root (`/`) for a request that asks for
   ActivityPub, as Lemmy's site actor does: PieFed sends a community's announces to the inbox of the Application at a
   peer's root, and to `/inbox` when there is none.
 - The reporter is `/peasants/privapub_reports` (type `Service`, "Reports from <host>"), one for the whole server with
@@ -254,7 +256,9 @@ replies to a persona's posts passed on to its followers. A deleted post answers
 - **Pinned posts** are the actor's `featured` collection (`/trophies`); `featuredTags` is `/tattoos`. A pin or an unpin
   is told to the post's audience as `Add` or `Remove` on `featured`, as Mastodon tells it.
 - **Blocks are sent.** A blocked remote account receives `Block` from the blocking account (and `Reject{Follow}` if it
-  followed); an unblock sends `Undo{Block}`.
+  followed); an unblock sends `Undo{Block}`. A server's block of a whole server sends that server nothing; the
+  administrator may list it at `/api/v1/instance/domain_blocks` (off for each block by default, its name partly hidden
+  when asked, with its SHA-256 digest), as Mastodon lists its blocks.
 - **Reports** are sent as `Flag`, never by the reporting account and never naming it.
   - To the reported account's server: from the instance actor, with the account and the posts as `object` and the
     persona's words in `content`.
@@ -364,10 +368,11 @@ days and shared by every account on the server. Images are served to clients onl
 
 ## Relays
 
-PrivaPub reads from the relays `Federation:Relays` names (by their actor's address, or their inbox's), none by default.
-Its instance actor follows `Public` at each, as Mastodon subscribes (`Federation/Relays/Relays.cs`, a minute after start
-and every six hours: an unanswered or refused subscription is asked again a day later, and a relay no longer named gets
-the `Undo`). What an accepted relay passes on comes to the federated timeline, never to anyone's home: a public post it
+PrivaPub reads from the relays `Federation:Relays` names, and those its administrator adds in the server's settings (by
+their actor's address, or their inbox's), none by default. Its instance actor follows `Public` at each, as Mastodon
+subscribes (`Federation/Relays/Relays.cs`, a minute after start, every six hours and at once when the administrator adds
+or removes one: an unanswered or refused subscription is asked again a day later, and a relay no longer named gets the
+`Undo`, unless the same relay is still named under another address). What an accepted relay passes on comes to the federated timeline, never to anyone's home: a public post it
 forwards as its author sent it (Activity-Relay), read again from its origin like any forwarded post, and a post it
 announces (aode-relay), kept as its author's and never as the relay's boost. Nothing else is taken from a relay. A
 persona's public post outside any group, its edit and its deletion also go to the relays that accepted us (owner decision