Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)

Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port
8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login
and GET /health.

- Go service (Go 1.25, modernc SQLite, no cgo) with its own image.
- SQLite schema per AGENTS.md §7: children, items, scans, notifications,
  session (internal/store/migrations/001_init.sql).
- Separate session login (signed cookie, CSRF double-submit), not SSO.
- HTMX server-rendered shell using the Family Home Lab tokens.css: canvas
  #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs,
  dark mode, phone-friendly.
- Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or
  error banner, never as an empty day.
- Dockerfile + docker-compose.yml (own container, own port 8792; uses
  network_mode bridge because .13 has no free default Docker address pool).
- Caddy snippet for .35 in deploy/caddy/, deployment notes, and
  deploy/verify-phase1.sh.

No school scan in this phase; the Compass login and fetch are Phase 2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/templates/login.html

@@ -0,0 +1,41 @@
+{{define "login.html"}}<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="light dark">
+  <title>Sign in — Compass / Teams</title>
+  <link rel="stylesheet" href="/static/tokens.css">
+  <link rel="stylesheet" href="/static/app.css">
+  <script src="/static/theme.js" defer></script>
+</head>
+<body class="login-page">
+  <main class="login-band">
+    <div class="login-band__inner">
+      <p class="login-eyebrow">Compass / Teams</p>
+      <h1 class="login-headline">Good to see you,<br>Sam.</h1>
+      <p class="login-sub">Sign in to see what Harry and Finn have due.</p>
+    </div>
+
+    <section class="auth-card" aria-labelledby="signin-title">
+      <h2 id="signin-title" class="auth-card__title">Sign in</h2>
+      {{if .Error}}<p class="auth-error" role="alert">{{.Error}}</p>{{end}}
+      <form method="post" action="/login" class="auth-form" autocomplete="on">
+        <input type="hidden" name="csrf" value="{{.CSRF}}">
+        <label class="field">
+          <span class="field__label">Username</span>
+          <input class="text-input" type="text" name="username" value="{{.Username}}"
+                 autocomplete="username" autocapitalize="none" spellcheck="false" required>
+        </label>
+        <label class="field">
+          <span class="field__label">Password</span>
+          <input class="text-input" type="password" name="password"
+                 autocomplete="current-password" required>
+        </label>
+        <button class="button-primary" type="submit">Sign in</button>
+      </form>
+    </section>
+  </main>
+  <footer class="login-foot">Family Home Lab · Compass / Teams</footer>
+</body>
+</html>{{end}}