Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)

Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port
8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login
and GET /health.

- Go service (Go 1.25, modernc SQLite, no cgo) with its own image.
- SQLite schema per AGENTS.md §7: children, items, scans, notifications,
  session (internal/store/migrations/001_init.sql).
- Separate session login (signed cookie, CSRF double-submit), not SSO.
- HTMX server-rendered shell using the Family Home Lab tokens.css: canvas
  #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs,
  dark mode, phone-friendly.
- Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or
  error banner, never as an empty day.
- Dockerfile + docker-compose.yml (own container, own port 8792; uses
  network_mode bridge because .13 has no free default Docker address pool).
- Caddy snippet for .35 in deploy/caddy/, deployment notes, and
  deploy/verify-phase1.sh.

No school scan in this phase; the Compass login and fetch are Phase 2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Dockerfile

@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1
+
+# ---- build stage ----------------------------------------------------------
+# Compass / NHS — its own image, built from source.
+FROM golang:1.25-alpine AS build
+WORKDIR /src
+RUN apk add --no-cache git
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+ARG VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build \
+      -trimpath \
+      -ldflags "-s -w -X main.version=${VERSION}" \
+      -o /out/school ./cmd/school
+
+# ---- runtime stage --------------------------------------------------------
+FROM alpine:3.21
+RUN apk add --no-cache ca-certificates tzdata wget \
+ && addgroup -g 10002 -S school \
+ && adduser -S -D -H -u 10002 -G school school \
+ && mkdir -p /data && chown school:school /data
+
+USER school
+WORKDIR /app
+COPY --from=build /out/school /app/school
+
+EXPOSE 8792
+VOLUME ["/data"]
+ENTRYPOINT ["/app/school"]