relay: copy deployment-staged data (apps/relay/ip-country) into the runtime image (#42025)

The director's IP → country table (ORCA_RELAY_IP_COUNTRY_DB) is fetched and verified by the
deployment's image build and staged in apps/relay/ip-country. The directory holds only a README
here, so an image built from this repository alone is unchanged apart from that file.

cloud/apps/relay/Dockerfile

@@ -32,6 +32,9 @@ RUN pnpm install --prod --frozen-lockfile --filter @orca-cloud/relay... \
   && rm -rf /opt/pnpm /usr/local/lib/node_modules /opt/yarn-* /root/.cache /root/.local \
   && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack \
     /usr/local/bin/pnpm /usr/local/bin/pnpx /usr/local/bin/yarn /usr/local/bin/yarnpkg
+# Data a deployment stages into apps/relay/ip-country before the build (README there), e.g. the
+# director's IP → country table for ORCA_RELAY_IP_COUNTRY_DB. Holds only the README otherwise.
+COPY apps/relay/ip-country apps/relay/ip-country
 USER node
 EXPOSE 8080
 CMD ["node", "apps/relay/dist/index.js"]

cloud/apps/relay/ip-country/README.md

@@ -0,0 +1,12 @@
+# Relay image data
+
+The relay Dockerfile copies this directory into the runtime image at
+`/app/apps/relay/ip-country`. In this repository it holds only this README.
+
+A deployment may stage data files here before it builds the image. The director's
+IP → country table is one: a CSV of `first,last,CC` ranges (IPv4 and IPv6, inclusive,
+optionally gzipped) that `ORCA_RELAY_IP_COUNTRY_DB` names (`src/ip-country.ts`). Nothing
+reads a file here unless that variable points at it, so an image built without the table
+behaves exactly as before.
+
+Whoever stages a third-party table also stages its licence notice next to it.