Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)

Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port
8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login
and GET /health.

- Go service (Go 1.25, modernc SQLite, no cgo) with its own image.
- SQLite schema per AGENTS.md §7: children, items, scans, notifications,
  session (internal/store/migrations/001_init.sql).
- Separate session login (signed cookie, CSRF double-submit), not SSO.
- HTMX server-rendered shell using the Family Home Lab tokens.css: canvas
  #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs,
  dark mode, phone-friendly.
- Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or
  error banner, never as an empty day.
- Dockerfile + docker-compose.yml (own container, own port 8792; uses
  network_mode bridge because .13 has no free default Docker address pool).
- Caddy snippet for .35 in deploy/caddy/, deployment notes, and
  deploy/verify-phase1.sh.

No school scan in this phase; the Compass login and fetch are Phase 2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deploy/DEPLOYMENT.md

@@ -0,0 +1,58 @@
+# Deployment — Compass / NHS (school.lab.audasmedia.com.au)
+
+Own image, own container, own port **8792**, host `.13` (nixos-desktop). Caddy
+on `.35` (sam-ubuntu1) terminates TLS and proxies to `192.168.20.13:8792`.
+
+## Ports
+
+| Port | Service |
+|---|---|
+| 8792 | Compass / NHS (this project) |
+
+## Host (.13)
+
+1. Project folder: `/home/sam/paseo/projects/compass_teams_nhs`.
+2. Data: the named volume `compass-teams-nhs_compass-teams-nhs-data` at `/data`
+   (SQLite `school.db`).
+3. Create the environment file from the example:
+
+   ```bash
+   cd /home/sam/paseo/projects/compass_teams_nhs
+   cp environment.d/school-service.env.example environment.d/school-service.env
+   chmod 600 environment.d/school-service.env
+   # fill SCHOOL_SESSION_SECRET, SCHOOL_ADMIN_PASSWORD_HASH
+   ```
+
+4. Build and start:
+
+   ```bash
+   docker compose up -d --build
+   docker compose ps          # compass-teams-nhs  Up (healthy)  0.0.0.0:8792->8792/tcp
+   ```
+
+5. Verify:
+
+   ```bash
+   make verify-phase1
+   ```
+
+## Caddy (.35)
+
+1. SSH: `ssh sam@192.168.20.35`.
+2. Append `deploy/caddy/Caddyfile.snippet` to `/Docker/Containers/caddy/Caddyfile`.
+3. Validate and reload (never restart):
+
+   ```bash
+   docker exec caddy caddy validate --config /etc/caddy/Caddyfile
+   docker exec caddy caddy reload   --config /etc/caddy/Caddyfile
+   ```
+
+4. Test: `curl -sS -o /dev/null -w '%{http_code}\n' https://school.lab.audasmedia.com.au/health`
+
+## Notes
+
+- `.13` has every default Docker address pool subnetted out. This single-container
+  service therefore uses `network_mode: bridge` and publishes 8792; it does not
+  create a project network.
+- The env file is gitignored. School credentials and harness session state are
+  secrets (AGENTS.md §10 rule 3); they never enter git.