Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)

Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port
8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login
and GET /health.

- Go service (Go 1.25, modernc SQLite, no cgo) with its own image.
- SQLite schema per AGENTS.md §7: children, items, scans, notifications,
  session (internal/store/migrations/001_init.sql).
- Separate session login (signed cookie, CSRF double-submit), not SSO.
- HTMX server-rendered shell using the Family Home Lab tokens.css: canvas
  #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs,
  dark mode, phone-friendly.
- Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or
  error banner, never as an empty day.
- Dockerfile + docker-compose.yml (own container, own port 8792; uses
  network_mode bridge because .13 has no free default Docker address pool).
- Caddy snippet for .35 in deploy/caddy/, deployment notes, and
  deploy/verify-phase1.sh.

No school scan in this phase; the Compass login and fetch are Phase 2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/config/config.go

@@ -0,0 +1,129 @@
+// Package config loads the Compass/NHS service configuration from the process
+// environment. Every secret comes from the environment (environment.d); nothing
+// is compiled into the binary and nothing secret is read from a committed file.
+package config
+
+import (
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+	// Embed the IANA time zone database so SCHOOL_TIMEZONE resolves even in a
+	// container without tzdata.
+	_ "time/tzdata"
+)
+
+// Config is the fully resolved runtime configuration.
+type Config struct {
+	// Addr is the listen address, for example ":8792".
+	Addr string
+	// DBPath is the SQLite database file, for example "/data/school.db".
+	DBPath string
+	// SessionSecret signs the session cookie. Required, >= 16 bytes.
+	SessionSecret []byte
+	// AdminUsername is the single dashboard login name (Sam).
+	AdminUsername string
+	// AdminPassword is the plaintext password. Optional if AdminPasswordHash is set.
+	AdminPassword string
+	// AdminPasswordHash is a bcrypt hash. Optional if AdminPassword is set.
+	AdminPasswordHash string
+	// CookieSecure sets the Secure attribute on cookies. Keep true behind HTTPS.
+	CookieSecure bool
+	// SessionTTL is how long a session cookie stays valid.
+	SessionTTL time.Duration
+	// LogLevel is the slog level.
+	LogLevel slog.Level
+	// AppEnv is a label such as "production" or "development".
+	AppEnv string
+	// Version is injected at build time.
+	Version string
+	// Location is the family timezone. Due dates and briefs are wall-clock, so
+	// this must be the family's zone, not the container default of UTC.
+	Location *time.Location
+}
+
+// DefaultTimezone is the family timezone used when SCHOOL_TIMEZONE is unset.
+const DefaultTimezone = "Australia/Sydney"
+
+// Load reads and validates the configuration.
+func Load() (*Config, error) {
+	cfg := &Config{
+		Addr:              env("SCHOOL_ADDR", ":8792"),
+		DBPath:            env("SCHOOL_DB_PATH", "/data/school.db"),
+		AdminUsername:     env("SCHOOL_ADMIN_USERNAME", "sam"),
+		AdminPassword:     os.Getenv("SCHOOL_ADMIN_PASSWORD"),
+		AdminPasswordHash: os.Getenv("SCHOOL_ADMIN_PASSWORD_HASH"),
+		CookieSecure:      envBool("SCHOOL_COOKIE_SECURE", true),
+		AppEnv:            env("SCHOOL_APP_ENV", "production"),
+	}
+
+	secret := os.Getenv("SCHOOL_SESSION_SECRET")
+	if len(secret) < 16 {
+		return nil, errors.New("SCHOOL_SESSION_SECRET must be set and at least 16 characters")
+	}
+	cfg.SessionSecret = []byte(secret)
+
+	if cfg.AdminPassword == "" && cfg.AdminPasswordHash == "" {
+		return nil, errors.New("set SCHOOL_ADMIN_PASSWORD or SCHOOL_ADMIN_PASSWORD_HASH")
+	}
+	if cfg.AdminUsername == "" {
+		return nil, errors.New("SCHOOL_ADMIN_USERNAME must not be empty")
+	}
+
+	ttl, err := time.ParseDuration(env("SCHOOL_SESSION_TTL", "12h"))
+	if err != nil {
+		return nil, fmt.Errorf("SCHOOL_SESSION_TTL: %w", err)
+	}
+	cfg.SessionTTL = ttl
+
+	lvl, err := parseLevel(env("SCHOOL_LOG_LEVEL", "info"))
+	if err != nil {
+		return nil, err
+	}
+	cfg.LogLevel = lvl
+
+	loc, err := time.LoadLocation(env("SCHOOL_TIMEZONE", DefaultTimezone))
+	if err != nil {
+		return nil, fmt.Errorf("SCHOOL_TIMEZONE: %w", err)
+	}
+	cfg.Location = loc
+
+	return cfg, nil
+}
+
+func env(key, fallback string) string {
+	if v := strings.TrimSpace(os.Getenv(key)); v != "" {
+		return v
+	}
+	return fallback
+}
+
+func envBool(key string, fallback bool) bool {
+	v := strings.TrimSpace(os.Getenv(key))
+	if v == "" {
+		return fallback
+	}
+	b, err := strconv.ParseBool(v)
+	if err != nil {
+		return fallback
+	}
+	return b
+}
+
+func parseLevel(s string) (slog.Level, error) {
+	switch strings.ToLower(strings.TrimSpace(s)) {
+	case "debug":
+		return slog.LevelDebug, nil
+	case "info", "":
+		return slog.LevelInfo, nil
+	case "warn", "warning":
+		return slog.LevelWarn, nil
+	case "error":
+		return slog.LevelError, nil
+	default:
+		return 0, fmt.Errorf("SCHOOL_LOG_LEVEL: unknown level %q", s)
+	}
+}