The relay keeps the arm's first /servo-params read as the factory baseline under FORGE_APP_DATA, owner-only at GET /servo-params/factory #459

Replaces #444. That one was parked twice because a builder cannot reach the real arm. This version keeps the baseline in the app, so the real values are recorded on production by itself, with no one copying them by hand.

Done:

• [ ] When the relay's link to the arm server is up and no factory file exists yet, it reads GET /servo-params once. If every servo answered, it writes { recordedAt, armRun, servos } atomically to servo-factory.json under FORGE_APP_DATA. It never overwrites that file, and a partial read (any servo with error) is not saved and is retried on the next connect.
• [ ] GET /servo-params/factory on the relay returns that file to the owner, and 404 when none is recorded yet. Anyone else gets 404, the same as the rest of /admin.
• [ ] Software/README.md says, in two sentences, where the baseline lives and that #450's factory restore and the tuning pulls read from it.
• [ ] Tests with a fake arm server: the first connect records the file, a second connect does not change it, a partial read is not saved, a restart keeps the file, and a non-owner gets 404.
• [ ] bun --cwd Software/so101 test passes.

Files: Software/so101/src/relay.ts (or a small src/servo-baseline.ts it calls), its test, and Software/README.md. Risk: the read shares the Pi link with driving. Do it only while nobody holds a turn, and give up quietly when someone does.