Signal chats in the app (desktop only) with a chat button on every screen

- signal.js: talks to signal-cli-rest-api (a linked device of your Signal account); keeps conversations in /data/signal; live updates; send/receive text, files, replies, reactions, groups, receipts
- Signal tab and a floating chat panel on every screen, shown only on desktop-class windows; new Signal permission per person
- compose: signal bridge container sharing the hub's network
- tools/signal-test.js (fake bridge), README

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -23,6 +23,7 @@ services:
       WEBMAIL_BACKEND_URL: http://127.0.0.1:80               # the bundled webmail (Cypht, below, shares this container's network); the hub shows it at /webmail/
       CYPHT_USER: ${CYPHT_USER:-hub}                         # the webmail's login; the Mail tab signs in with it for you
       CYPHT_PASSWORD: ${CYPHT_PASSWORD:-}
+      SIGNAL_API_URL: http://127.0.0.1:8085                  # the bundled Signal bridge (below, shares this container's network); remove this line and the service to skip Signal
       PODCAST_URL: ${PODCAST_URL:-https://podcast.necloud.us/}
       ONLYOFFICE_JWT_SECRET: ${ONLYOFFICE_JWT_SECRET:-}    # same value as the OnlyOffice server's JWT secret
       PUBLIC_URL: ${PUBLIC_URL:-}                           # e.g. https://hub.necloud.us (OnlyOffice posts saved edits here)
@@ -57,8 +58,24 @@ services:
     volumes:
       - cypht-data:/var/lib/hm3   # the webmail's database: your accounts and settings
 
+  # Signal messages (the Signal tab). This links to your Signal account as one more linked device (like Signal Desktop) through the community
+  # signal-cli-rest-api bridge. Not an official Signal product; its link to your account (keys) is kept in the signal-data volume. See README -> Signal.
+  signal:
+    image: bbernhard/signal-cli-rest-api:0.101
+    restart: unless-stopped
+    network_mode: "service:hub"       # reached by the hub at 127.0.0.1:8085 and by nothing else
+    depends_on:
+      - hub
+    environment:
+      MODE: json-rpc
+      PORT: "8085"
+    volumes:
+      - signal-data:/home/.local/share/signal-cli
+
 volumes:
   hub-data:
     name: nehub-data   # fixed name so the data survives redeploys and renamed stacks
   cypht-data:
     name: nehub-cypht
+  signal-data:
+    name: nehub-signal