Phase 9: Hub API and Apprise alerts (/capabilities, /ask, /notify)

Build on Phases 1-8. Adds the project side of the frozen Hub contract
(central_ai_llm_master/docs/ask-contract.md) and the alert engine from
AGENTS.md §4 FR-12/FR-13, §8, §11 Phase 9.

- hub: internal/hub implements AskRequest/AskResponse/NotifyRequest and a
  deterministic, read-only Answerer. It answers screen time today/yesterday,
  what is blocked now, and device presence, scoped to one child or all kids.
  Screen time is the foreground-app total per device-day; the domain total is
  used only when a device reports no apps, so a report carrying both is never
  double-counted.
- apprise: internal/apprise is a small Apprise API client (stored key or
  stateless URL mode, optional bearer token, typed notifications).
- alert: internal/alert evaluates device state on an interval and raises one
  Apprise alert per transition: a limit hit (a device becomes blocked) or a
  device offline longer than the threshold. A never-seen device is never
  alerted, and the first observation seeds state without replaying an old
  limit. The alert is recorded before delivery, with its delivery outcome.
- store: migration 005 adds `alerts` (delivery outcome, audited) and
  `alert_state` (per-device dedup). New usage reads from the telemetry detail
  table so the daily answer can be checked independently.
- web: GET /capabilities, POST /ask (read-only) and POST /notify behind the
  shared CONTROL_HUB_TOKEN, separate from the session and admin API tokens.
  /notify accepts the contract's {from,level,message,person} and delivers it
  through Apprise (the future tamper-report path, FR-17).
- cmd/control: start the alert engine (CONTROL_ALERTS_ENABLED,
  CONTROL_ALERT_OFFLINE_AFTER, CONTROL_ALERT_INTERVAL) and add `alerts` and
  `usage` subcommands for read-only inspection.
- deploy/verify-phase9.sh + `make verify-phase9` prove the definition of done;
  version 0.7.0-phase9.

Measured on .13 (2026-10-13):
- GET /capabilities -> internet_use_control topics.
- POST /ask "how long have the kids been on screens today?" -> "The kids have
  had 1h 22m of screen time today." (total_seconds=4925); the independent
  count from the telemetry detail table is also 4925 (app=4925, domain=4800).
- A manual lock raised a delivered limit alert (id 4); an MQTT offline status
  raised a delivered offline alert (id 5); POST /notify delivered (id 6). All
  three report delivered=1 in `alerts`.

Tests: gofmt, go vet ./... and go test ./... pass in golang:1.25-alpine.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

environment.d/control-service.env.example

@@ -38,7 +38,7 @@ CONTROL_ADMIN_USERNAME=sam
 CONTROL_ADMIN_PASSWORD=change-me
 
 # Option B (preferred): a bcrypt hash; leave CONTROL_ADMIN_PASSWORD empty.
-# Generate: docker run --rm --entrypoint /app/control webrestrict/control:0.6.0-phase8 hash-password 'your-password'
+# Generate: docker run --rm --entrypoint /app/control webrestrict/control:0.7.0-phase9 hash-password 'your-password'
 # CONTROL_ADMIN_PASSWORD_HASH=$2a$10$...
 
 # --- Admin API (Phase 8) ---------------------------------------------------
@@ -51,7 +51,7 @@ CONTROL_ADMIN_API_TOKEN=change-me-to-a-long-random-token
 
 # The shared device keycode (one code, every device — AGENTS.md §10 rule 3).
 # Give a bcrypt hash, never the code itself. Generate one with:
-#   docker run --rm --entrypoint /app/control webrestrict/control:0.6.0-phase8 \
+#   docker run --rm --entrypoint /app/control webrestrict/control:0.7.0-phase9 \
 #     hash-password 'the-code'
 # The hash is seeded into SQLite at start-up and can be changed later with
 # `docker exec webrestrict-control /app/control keycode`.
@@ -87,3 +87,35 @@ CONTROL_MQTT_CA_FILE=/etc/webrestrict/tls/ca.crt
 # unless this is true, and it logs a warning when it is. Leave it false against
 # the shared Mosquitto (AGENTS.md §10 rule 6).
 CONTROL_MQTT_INSECURE=false
+
+# --- Hub API (Phase 9) -----------------------------------------------------
+# The project side of central_ai_llm_master/docs/ask-contract.md. The Hub sends
+# this bearer token; /capabilities and /ask refuse an unsigned request. When it
+# is empty the three endpoints answer 503 and nothing else changes.
+# Generate: openssl rand -hex 32
+CONTROL_HUB_TOKEN=change-me-to-a-long-random-token
+
+# --- Alerts (Phase 9) ------------------------------------------------------
+# Apprise: the house notification gateway on `.35` (AGENTS.md §8). Alerts and
+# accepted notifications are delivered through it (FR-13).
+CONTROL_APPRISE_URL=http://192.168.20.35:8210
+
+# Option A: a stored Apprise configuration key.
+# CONTROL_APPRISE_KEY=sam_email
+
+# Option B (lab default): the stateless destination list. This is the same
+# shared value as APPRISE_URLS in ~/.config/environment.d/10-secrets.conf.
+# CONTROL_APPRISE_URLS='mailto://user:app-password@gmail.com'
+
+# Optional bearer token if the Apprise API is protected. Empty in this lab.
+# CONTROL_APPRISE_TOKEN=
+
+# Turn the limit/offline alert engine on. MQTT-style: with it off the service
+# still answers /ask and /notify.
+CONTROL_ALERTS_ENABLED=true
+
+# How long a device may be unreachable before Sam is told. Go duration.
+CONTROL_ALERT_OFFLINE_AFTER=30m
+
+# How often the alert engine re-evaluates device state. Go duration.
+CONTROL_ALERT_INTERVAL=30s