per-plugin signing keys and a POST /api/claims relay; own writes signed; no filePath claims, no record delete when a file disappears

docker/nginx.conf

@@ -44,6 +44,19 @@ http {
             try_files $uri $uri/ /index.html;
         }
 
+        # Signed claims relay (plugins -> meta-sort -> meta-core). Exact match so
+        # a large claim batch is not cut at nginx's 1 MB default (the API takes
+        # up to 16 MB); reads of /api/meta/{cid}/claims use the /api/ block.
+        location = /api/claims {
+            client_max_body_size 16m;
+            proxy_pass http://api;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
         # API routes
         location /api/ {
             proxy_pass http://api;