feat(device-edge): add isolated B2 ingress domain

device-plane/README.md

@@ -28,6 +28,18 @@ The planned runtime services are:
 - `device-gateway`: raw TCP sessions, bounded codecs and presence;
 - `device-postgres`: private persistent state.
 
+`services/device-edge-relay` is a separate, disabled-by-default runtime for the
+dedicated Debian ingress host. It is an L4 byte relay: it neither decodes
+ARUSNAVI B2, acknowledges a device nor holds a Core token, database credential
+or command capability. The implemented backhaul forwards only through a
+restricted outbound SSH path to the Synology Gateway loopback listener. The
+reviewed ingress target gives only this container a fixed IPvlan L2 address on
+the Mini's single Ethernet link, so the host Amnezia full tunnel stays intact
+and Docker publishes no host port. The fixed relay address is
+`192.168.71.253`, explicitly outside the documented Deco DHCP pool
+`192.168.68.50`–`192.168.71.250`. See `docs/IMPLEMENTATION_BASELINE.md` for
+the remaining activation gates.
+
 The Foundry `Device Manager` is a canonical page template using a server-owned
 `device-plane-control` binding. It is not a service in this directory.