Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)

Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port
8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login
and GET /health.

- Go service (Go 1.25, modernc SQLite, no cgo) with its own image.
- SQLite schema per AGENTS.md §7: children, items, scans, notifications,
  session (internal/store/migrations/001_init.sql).
- Separate session login (signed cookie, CSRF double-submit), not SSO.
- HTMX server-rendered shell using the Family Home Lab tokens.css: canvas
  #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs,
  dark mode, phone-friendly.
- Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or
  error banner, never as an empty day.
- Dockerfile + docker-compose.yml (own container, own port 8792; uses
  network_mode bridge because .13 has no free default Docker address pool).
- Caddy snippet for .35 in deploy/caddy/, deployment notes, and
  deploy/verify-phase1.sh.

No school scan in this phase; the Compass login and fetch are Phase 2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deploy/caddy/Caddyfile.snippet

@@ -0,0 +1,12 @@
+# Caddyfile addition for the Compass / NHS service.
+# Apply on .35 (sam-ubuntu1, 192.168.20.35) — append to /Docker/Containers/caddy/Caddyfile
+# and reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile
+#
+# The public zone lab.audasmedia.com.au already resolves to 144.6.86.11 -> router
+# -> .35. No Pi-hole local record is required.
+
+# Compass / NHS (AUD-103) — school.lab.audasmedia.com.au -> .13:8792
+# No basic-auth: the service has its own session login (AGENTS.md §9, §10).
+school.lab.audasmedia.com.au {
+    reverse_proxy 192.168.20.13:8792
+}