Phase 5: per-child dashboard (overdue first), item detail, delete

- internal/dashboard: classify items into overdue / due today / due this week /
  no due date / messages; render the plain-text brief (FR-6, FR-7, FR-9).
- internal/store: ItemsForChild, ItemByID, DeleteItemByID, ScanSummaryForChild
  and the stored-brief CRUD helpers (FR-10).
- internal/web: routes /?child=, /items/{id}, POST /items/{id}/delete,
  POST /summaries/build, POST /summaries/{id}/delete, plus a per-child scan
  banner (FR-12) and a phone-first server-rendered template.
- Calendar events are never "overdue": a past lesson is history, not work.
- cmd/school brief build|list; scripts/screenshot-phase5.mjs for phone evidence.
- Tests: bucket classification, stored-brief round-trip, and HTTP routes
  including the NO SCAN / SCAN FAILED / healthy banner behaviour.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

README.md

@@ -4,8 +4,22 @@ A school service for Harry and Finn: **Compass** for the daily schedule and
 notices, **Teams** for homework and assignments. It stores what is due per child,
 puts overdue work first, and tells the family before work is late.
 
-> Build spec: [`AGENTS.md`](AGENTS.md). This repository is at **Phase 4** (both
-> children, per-child sessions). See §11 of the spec for the phase order.
+> Build spec: [`AGENTS.md`](AGENTS.md). This repository is at **Phase 5** (the
+> per-child dashboard). See §11 of the spec for the phase order.
+
+## Status — Phase 5
+
+Phase 5 adds the per-child dashboard: one tab per child, **overdue first**, then
+due today, due this week and messages, plus the item detail screen and the
+Delete actions. See [`docs/phase-5-dashboard-notes.md`](docs/phase-5-dashboard-notes.md).
+
+```bash
+# Phone-width evidence screenshots (writes under var/, git-ignored).
+SCHOOL_USER=sam SCHOOL_PASS=... node scripts/screenshot-phase5.mjs
+
+# Build a draft brief for one child.
+docker exec compass-teams-nhs /app/school brief build --child Harry
+```
 
 ## Status — Phase 4
 
@@ -41,9 +55,9 @@ Built and deployed on `.13`:
 - Its own container and port **8792**, behind Caddy at
   `school.lab.audasmedia.com.au`.
 
-Not built yet (later phases): the dashboard data, the calendar write,
-notifications, and the Hub API. The service itself does **not** scan the school;
-n8n triggers the scan later. Teams (FR-15) is a separate source.
+Not built yet (later phases): the calendar write, notifications and the Hub API.
+The service itself does **not** scan the school; n8n triggers the scan later.
+Teams (FR-15) is a separate source.
 
 ### Fail loudly (FR-12)
 
@@ -80,8 +94,8 @@ docker compose up -d --build
 Generate secrets with the built image:
 
 ```bash
-docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.3.0-phase4 gen-secret
-docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.3.0-phase4 hash-password 'the-password'
+docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.3.0-phase5 gen-secret
+docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.3.0-phase5 hash-password 'the-password'
 ```
 
 Note: Docker Compose interpolates `$VAR` inside `env_file`. A bcrypt hash