docs(self-host): sovereign Sverige guide, backup/restore scripts, Speed Insights gate (#1744)

docs/SOVEREIGN.md (run Accounted on Swedish infrastructure: providers, self-hosted Supabase gotchas, backup/restore runbook, honest dependency list), scripts/self-host/backup.sh + restore.sh (pg_dump custom format, storage tar, SHA-256 manifest, S3-compatible upload; ACLs are preserved through the restore and re-verified against an acl-manifest including sequences; the resume hook always runs after a failed quiesce and the hooks must be configured as a pair), Vercel Speed Insights gated off for self-hosted, and stale self-host docs corrected (assistant Q&A and categorization run on BYO OpenAI-compatible models; SMTP via EMAIL_PROVIDER=smtp after #1746; connector subscription described as proposed only).

app/layout.tsx

@@ -22,6 +22,7 @@ import { PaletteProvider } from "@/components/providers/PaletteProvider";
 import { SWRProvider } from "@/components/providers/SWRProvider";
 import { ScrollbarReveal } from "@/components/ScrollbarReveal";
 import { ensureInitialized } from "@/lib/init";
+import { isSelfHosted } from "@/lib/env/public-flags";
 import { getBranding } from "@/lib/branding/service";
 import { resolveRequestBrand } from "@/lib/branding/request-brand";
 import { getBrandFontPair } from "@/lib/branding/fonts";
@@ -215,7 +216,11 @@ export default async function RootLayout({
             </ThemeProvider>
           </BrandProvider>
         </NextIntlClientProvider>
-        <SpeedInsights />
+        {/* Vercel Speed Insights is hosted-only telemetry: a self-hosted
+            (AGPL) instance must not report its users' page timings to our
+            Vercel project. Read through lib/env/public-flags, never compared
+            in place (the Docker build folds in-place NEXT_PUBLIC_* reads). */}
+        {!isSelfHosted() && <SpeedInsights />}
         <Script src="/sw-register.js" strategy="afterInteractive" />
       </body>
     </html>