Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)

Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port
8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login
and GET /health.

- Go service (Go 1.25, modernc SQLite, no cgo) with its own image.
- SQLite schema per AGENTS.md §7: children, items, scans, notifications,
  session (internal/store/migrations/001_init.sql).
- Separate session login (signed cookie, CSRF double-submit), not SSO.
- HTMX server-rendered shell using the Family Home Lab tokens.css: canvas
  #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs,
  dark mode, phone-friendly.
- Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or
  error banner, never as an empty day.
- Dockerfile + docker-compose.yml (own container, own port 8792; uses
  network_mode bridge because .13 has no free default Docker address pool).
- Caddy snippet for .35 in deploy/caddy/, deployment notes, and
  deploy/verify-phase1.sh.

No school scan in this phase; the Compass login and fetch are Phase 2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docker-compose.yml

@@ -0,0 +1,40 @@
+# Compass / NHS — its own image, own container, own port (8792).
+# Deploy on .13:  cd /home/sam/paseo/projects/compass_teams_nhs && docker compose up -d --build
+#
+# Secrets live in environment.d/school-service.env (gitignored), never here.
+
+name: compass-teams-nhs
+
+services:
+  school:
+    build:
+      context: .
+      args:
+        VERSION: "0.1.0-phase1"
+    image: compass-teams-nhs/school:0.1.0-phase1
+    container_name: compass-teams-nhs
+    restart: unless-stopped
+    env_file:
+      - environment.d/school-service.env
+    ports:
+      - "8792:8792"
+    volumes:
+      - compass-teams-nhs-data:/data
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8792/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    # .13 has every default Docker address pool subnetted out (many projects),
+    # so this single-container service uses the host's default bridge and does
+    # not create a project network. The port is published above.
+    network_mode: bridge
+
+volumes:
+  compass-teams-nhs-data: