docs: record 1.7.54 Blossom quotas

AGENTS.md

@@ -2228,7 +2228,7 @@ session with **no other memory of this project**. So:
   instead of showing the error boundary.
 - **Baselines** (verified 2026-10-29): `npm test` → **0 errors, 0 warnings**,
   **156 tests**, build ok. The gate also type-checks the CVM server
-  (`tsc -p cvm-server/tsconfig.json`). `package.json` version **1.7.53**.
+  (`tsc -p cvm-server/tsconfig.json`). `package.json` version **1.7.54**.
   - ✅ Lint is **clean**: `no-explicit-any` = 0 · `react-hooks/exhaustive-deps` = 0
     · `no-unused-vars` = 0 · `react-refresh` = 0. Non-component exports were
     **split into their own modules** (`contexts/language.ts`, `lib/sortOptions.ts`,
@@ -2766,6 +2766,11 @@ Rules:
       alerts cover Cordn 429s/announce/TLS; Settings shows per-relay health pills;
       Crew coordinator card adds a Staircase/Cordn QR. APK sha256 `f124669c…`,
       versionCode 10753. Web live at `95ff486`.
+    - **1.7.54 (2026-10-30):** image-only Blossom quotas. Newlay per-object cap
+      10 MiB, signed per-npub quota proxy (50/250 MiB daily, admins 3×, per-IP
+      hourly backstop, 20 GB relay cap), app-side image/type/size guard and clear
+      errors; uploads use only our Blossom (mirrors are read-only fallbacks).
+      APK sha256 `f554d934…`, versionCode 10754. Web live at `465683c`.
 
 ### Relay archive (dataset backup)
 - **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):**
@@ -3120,6 +3125,17 @@ The community relay moved off the hosted relay.tools instance
   (`lib/imageFallback.ts`) includes it so reads fall back across all three.
   Verified end-to-end (signed PUT /upload → 201, GET /<sha> → 200). To fully
   self-host media later, drop the two public hosts from both lists.
+  **2026-10-30 — image-only quota proxy:** `[blossom] max_size_bytes` lowered
+  to **10 MiB**. Caddy routes only `PUT /upload` through
+  `skatespots-quota.service` (`scripts/quota-proxy.mjs`, `127.0.0.1:8790`);
+  reads and all other Blossom routes still go straight to Newlay. The proxy
+  verifies the BUD-11 token, enforces image types and per-npub daily budgets
+  (50 uploads/250 MiB; admins 3×), a per-IP hourly backstop (100/500 MiB), and a
+  20 GB relay-wide cap. State is `/home/ubuntu/skatespots-quota/usage.json`;
+  the service is enabled, and the host health check checks its `/health`, the
+  service, and >18 GiB media. App uploads now use **only** our Blossom; public
+  mirrors are read-side fallbacks only, so a quota rejection cannot silently
+  land on a third party. No video upload support was added.
 - **Cordn coordinator (2026-10-12):** the relay also runs Newlay's **embedded Cordn
   coordinator** for crew MLS chat (`[cordn] enabled`, `mode = "embedded"`,
   `data_dir = /var/lib/newlay/data/cordn` inside the volume, `relay_url =