Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)

Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port
8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login
and GET /health.

- Go service (Go 1.25, modernc SQLite, no cgo) with its own image.
- SQLite schema per AGENTS.md §7: children, items, scans, notifications,
  session (internal/store/migrations/001_init.sql).
- Separate session login (signed cookie, CSRF double-submit), not SSO.
- HTMX server-rendered shell using the Family Home Lab tokens.css: canvas
  #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs,
  dark mode, phone-friendly.
- Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or
  error banner, never as an empty day.
- Dockerfile + docker-compose.yml (own container, own port 8792; uses
  network_mode bridge because .13 has no free default Docker address pool).
- Caddy snippet for .35 in deploy/caddy/, deployment notes, and
  deploy/verify-phase1.sh.

No school scan in this phase; the Compass login and fetch are Phase 2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

README.md

@@ -0,0 +1,80 @@
+# Compass / NHS
+
+A school service for Harry and Finn: **Compass** for the daily schedule and
+notices, **Teams** for homework and assignments. It stores what is due per child,
+puts overdue work first, and tells the family before work is late.
+
+> Build spec: [`AGENTS.md`](AGENTS.md). This repository is at **Phase 1** (the
+> skeleton). See §11 of the spec for the phase order.
+
+## Status — Phase 1
+
+Built and deployed on `.13`:
+
+- Go service, SQLite schema for `children`, `items`, `scans`, `notifications`,
+  `session` (`internal/store/migrations/001_init.sql`).
+- The service's **own session login** — a signed cookie, not SSO.
+- Server-rendered **HTMX** shell using the Family Home Lab design tokens
+  (`internal/web/static/tokens.css`), phone-friendly with dark mode.
+- `GET /health`.
+- Its own container and port **8792**, behind Caddy at
+  `school.lab.audasmedia.com.au`.
+
+Not built yet (later phases): the Compass login and fetch, parsing, both
+children's data, the dashboard data, the calendar write, notifications, and the
+Hub API. It does **not** scan the school in this phase.
+
+### Fail loudly (FR-12)
+
+A missing or failed scan is shown as an explicit warning or error, never as an
+empty day. The dashboard reads the `scans` table and shows one of:
+
+- **NO SCAN HAS RUN YET** — amber banner.
+- **SCAN FAILED** — red banner with the failure on record.
+- **Last scan completed** — green banner.
+
+## Layout
+
+```
+cmd/school/                 service entry point
+internal/config/            environment configuration
+internal/store/             SQLite: schema, migrations, queries
+internal/auth/              session login (signed cookies, CSRF)
+internal/web/               HTTP handlers, templates, static assets
+deploy/                     Caddy snippet, deployment notes, verify script
+environment.d/              env example (the real file is gitignored)
+```
+
+## Run
+
+```bash
+cp environment.d/school-service.env.example environment.d/school-service.env
+chmod 600 environment.d/school-service.env   # then fill in the secrets
+docker compose up -d --build
+```
+
+Generate secrets with the built image:
+
+```bash
+docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 gen-secret
+docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 hash-password 'the-password'
+```
+
+Note: Docker Compose interpolates `$VAR` inside `env_file`. A bcrypt hash
+contains `$`, so escape each one as `$$` in the env file.
+
+## Verify
+
+```bash
+make verify-phase1
+```
+
+It checks the container is healthy, `GET /health` returns 200, the login page
+renders and a session login succeeds, and Caddy serves the public URL.
+
+## Rules
+
+- **Read-only against the school.** Never post, message, or submit anything.
+- A failed scan must be loud — never report an empty day as "nothing due".
+- School credentials and harness session state are secrets; never commit them.
+- This project has its own folder, container, and port.