Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)

Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port
8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login
and GET /health.

- Go service (Go 1.25, modernc SQLite, no cgo) with its own image.
- SQLite schema per AGENTS.md §7: children, items, scans, notifications,
  session (internal/store/migrations/001_init.sql).
- Separate session login (signed cookie, CSRF double-submit), not SSO.
- HTMX server-rendered shell using the Family Home Lab tokens.css: canvas
  #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs,
  dark mode, phone-friendly.
- Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or
  error banner, never as an empty day.
- Dockerfile + docker-compose.yml (own container, own port 8792; uses
  network_mode bridge because .13 has no free default Docker address pool).
- Caddy snippet for .35 in deploy/caddy/, deployment notes, and
  deploy/verify-phase1.sh.

No school scan in this phase; the Compass login and fetch are Phase 2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Makefile

@@ -0,0 +1,66 @@
+IMAGE ?= compass-teams-nhs/school:0.1.0-phase1
+BUILD_VERSION ?= 0.1.0-phase1
+
+# Bounded docker helper for the Go toolchain. The container runs as the current
+# user, so the repository and the module cache stay owned by you.
+GO_IMAGE ?= golang:1.25-alpine
+GO_RUN = timeout 600 docker run --rm --network host --user "$$(id -u):$$(id -g)" \
+	  -e HOME=/src/.gocache -e GOMODCACHE=/src/.gocache/mod -e GOCACHE=/src/.gocache/build \
+	  -v "$$PWD":/src -w /src $(GO_IMAGE)
+
+.PHONY: help test vet build up down restart logs ps deps fmt hash-password gen-secret verify-phase1
+
+help:
+	@echo "make test           run go test ./... in golang:1.25-alpine"
+	@echo "make vet            run go vet ./... in golang:1.25-alpine"
+	@echo "make build          build the container image ($(IMAGE))"
+	@echo "make up             docker compose up -d --build"
+	@echo "make down           docker compose down"
+	@echo "make logs           follow container logs"
+	@echo "make ps             docker compose ps"
+	@echo "make deps           go mod tidy + download (writes go.mod/go.sum)"
+	@echo "make hash-password  generate a bcrypt hash (PASSWORD=...)"
+	@echo "make gen-secret     print a fresh session secret"
+	@echo "make verify-phase1  prove /health, the login and the Caddy route"
+
+test:
+	$(GO_RUN) go test ./...
+
+vet:
+	$(GO_RUN) go vet ./...
+
+deps:
+	$(GO_RUN) sh -c 'go mod tidy'
+
+fmt:
+	$(GO_RUN) sh -c 'go fmt ./...'
+
+build:
+	docker build --build-arg VERSION=$(BUILD_VERSION) -t $(IMAGE) .
+
+up:
+	docker compose up -d --build
+
+down:
+	docker compose down
+
+restart:
+	docker compose restart school
+
+logs:
+	docker compose logs -f school
+
+ps:
+	docker compose ps
+
+hash-password:
+	@test -n "$(PASSWORD)" || (echo "usage: make hash-password PASSWORD=secret"; exit 2)
+	docker run --rm --entrypoint /app/school $(IMAGE) hash-password '$(PASSWORD)'
+
+gen-secret:
+	docker run --rm --entrypoint /app/school $(IMAGE) gen-secret
+
+# Phase 1 definition of done: /health 200, login page + session login, and the
+# Caddy route on .35.
+verify-phase1:
+	deploy/verify-phase1.sh