Phase 4: per-child sessions, scan both children, items separated

Fetch and parse Harry and Finn with a stored Compass session per child and
store every item against the right children.id.

- cmd/school/session.go + internal/store/session.go: read and write the
  per-child harness session state in the SQLite `session` table. `show`
  prints metadata only; the state is never printed.
- scripts/compass-fetch-patchright.mjs: reuse the stored session, refresh it
  after login, resolve the child's userId from the parent page by name, and
  keep the shared calendar out of the per-child run (it would leak the
  eldest's timetable into the younger child).
- scripts/scan-compass.sh + make scan: scan one child or both; restore the
  session, fetch, persist the session, then parse. A failing child is
  recorded in `scans` with ok = 0 and the script exits non-zero (FR-12).
- cmd/school/scan.go: `school scan record` writes a fetch failure to the
  scans table. cmd/school/items.go: `school items purge` removes rows that a
  shared page stored against the wrong child.
- internal/store/store_test.go: prove items and sessions are separated by
  child. docs/phase-4-both-children-notes.md; README + image tag 0.3.0-phase4.

Live evidence: Harry 70 tasks / 1 message / 35 events (6 overdue); Finn
42 tasks / 1 message / 0 events (2 overdue). Finn's subjects are Year 7,
Harry's are Year 11. Both sessions stored.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Makefile

@@ -1,11 +1,14 @@
-IMAGE ?= compass-teams-nhs/school:0.2.0-phase3
-BUILD_VERSION ?= 0.2.0-phase3
+IMAGE ?= compass-teams-nhs/school:0.3.0-phase4
+BUILD_VERSION ?= 0.3.0-phase4
 
 # Parse options (see scripts/parse-compass.sh).
 CHILD ?= Harry
 RUN ?= latest
 CLASSIFY ?= auto
 
+# Scan target: 'all' scans every child; set SCAN_CHILD=Harry to narrow it.
+SCAN_CHILD ?= all
+
 # Bounded docker helper for the Go toolchain. The container runs as the current
 # user, so the repository and the module cache stay owned by you.
 GO_IMAGE ?= golang:1.25-alpine
@@ -13,7 +16,7 @@ GO_RUN = timeout 600 docker run --rm --network host --user "$$(id -u):$$(id -g)"
 	  -e HOME=/src/.gocache -e GOMODCACHE=/src/.gocache/mod -e GOCACHE=/src/.gocache/build \
 	  -v "$$PWD":/src -w /src $(GO_IMAGE)
 
-.PHONY: help test vet build up down restart logs ps deps fmt hash-password gen-secret verify-phase1 parse
+.PHONY: help test vet build up down restart logs ps deps fmt hash-password gen-secret verify-phase1 parse scan
 
 help:
 	@echo "make test           run go test ./... in golang:1.25-alpine"
@@ -27,6 +30,7 @@ help:
 	@echo "make hash-password  generate a bcrypt hash (PASSWORD=...)"
 	@echo "make gen-secret     print a fresh session secret"
 	@echo "make parse          parse stored Compass pages into SQLite (Phase 3)"
+	@echo "make scan           fetch + parse one or both children (Phase 4; SCAN_CHILD=Harry|Finn|all)"
 	@echo "make verify-phase1  prove /health, the login and the Caddy route"
 
 test:
@@ -70,6 +74,10 @@ gen-secret:
 parse:
 	CHILD=$(CHILD) RUN=$(RUN) CLASSIFY=$(CLASSIFY) IMAGE=$(IMAGE) scripts/parse-compass.sh
 
+# Phase 4: fetch + parse one child or both, with a per-child session.
+scan:
+	CLASSIFY=$(CLASSIFY) IMAGE=$(IMAGE) scripts/scan-compass.sh $(if $(filter-out all,$(SCAN_CHILD)),--child $(SCAN_CHILD))
+
 # Phase 1 definition of done: /health 200, login page + session login, and the
 # Caddy route on .35.
 verify-phase1: