Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)

Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port
8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login
and GET /health.

- Go service (Go 1.25, modernc SQLite, no cgo) with its own image.
- SQLite schema per AGENTS.md §7: children, items, scans, notifications,
  session (internal/store/migrations/001_init.sql).
- Separate session login (signed cookie, CSRF double-submit), not SSO.
- HTMX server-rendered shell using the Family Home Lab tokens.css: canvas
  #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs,
  dark mode, phone-friendly.
- Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or
  error banner, never as an empty day.
- Dockerfile + docker-compose.yml (own container, own port 8792; uses
  network_mode bridge because .13 has no free default Docker address pool).
- Caddy snippet for .35 in deploy/caddy/, deployment notes, and
  deploy/verify-phase1.sh.

No school scan in this phase; the Compass login and fetch are Phase 2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

environment.d/school-service.env.example

@@ -0,0 +1,30 @@
+# Compass / NHS — service environment (EXAMPLE).
+#
+# Copy to environment.d/school-service.env and fill the secrets in. The real
+# file is gitignored; never commit it. Generate values with:
+#   docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 gen-secret
+#   docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 hash-password 'the-password'
+
+# Listen address inside the container. The host maps 8792 -> 8792.
+SCHOOL_ADDR=:8792
+
+# SQLite database in the named volume.
+SCHOOL_DB_PATH=/data/school.db
+
+# Signs the session cookie. Required, >= 16 characters. Secret.
+SCHOOL_SESSION_SECRET=change-me-32-bytes-of-random
+
+# The single dashboard login (Sam). Prefer the bcrypt hash over the plaintext.
+SCHOOL_ADMIN_USERNAME=sam
+SCHOOL_ADMIN_PASSWORD_HASH=
+SCHOOL_ADMIN_PASSWORD=
+
+# Keep true behind HTTPS (Caddy terminates TLS).
+SCHOOL_COOKIE_SECURE=true
+SCHOOL_SESSION_TTL=12h
+
+# Family timezone for due dates and briefs.
+SCHOOL_TIMEZONE=Australia/Sydney
+
+SCHOOL_LOG_LEVEL=info
+SCHOOL_APP_ENV=production