Phase 9: Hub API and Apprise alerts (/capabilities, /ask, /notify)

Build on Phases 1-8. Adds the project side of the frozen Hub contract
(central_ai_llm_master/docs/ask-contract.md) and the alert engine from
AGENTS.md §4 FR-12/FR-13, §8, §11 Phase 9.

- hub: internal/hub implements AskRequest/AskResponse/NotifyRequest and a
  deterministic, read-only Answerer. It answers screen time today/yesterday,
  what is blocked now, and device presence, scoped to one child or all kids.
  Screen time is the foreground-app total per device-day; the domain total is
  used only when a device reports no apps, so a report carrying both is never
  double-counted.
- apprise: internal/apprise is a small Apprise API client (stored key or
  stateless URL mode, optional bearer token, typed notifications).
- alert: internal/alert evaluates device state on an interval and raises one
  Apprise alert per transition: a limit hit (a device becomes blocked) or a
  device offline longer than the threshold. A never-seen device is never
  alerted, and the first observation seeds state without replaying an old
  limit. The alert is recorded before delivery, with its delivery outcome.
- store: migration 005 adds `alerts` (delivery outcome, audited) and
  `alert_state` (per-device dedup). New usage reads from the telemetry detail
  table so the daily answer can be checked independently.
- web: GET /capabilities, POST /ask (read-only) and POST /notify behind the
  shared CONTROL_HUB_TOKEN, separate from the session and admin API tokens.
  /notify accepts the contract's {from,level,message,person} and delivers it
  through Apprise (the future tamper-report path, FR-17).
- cmd/control: start the alert engine (CONTROL_ALERTS_ENABLED,
  CONTROL_ALERT_OFFLINE_AFTER, CONTROL_ALERT_INTERVAL) and add `alerts` and
  `usage` subcommands for read-only inspection.
- deploy/verify-phase9.sh + `make verify-phase9` prove the definition of done;
  version 0.7.0-phase9.

Measured on .13 (2026-10-13):
- GET /capabilities -> internet_use_control topics.
- POST /ask "how long have the kids been on screens today?" -> "The kids have
  had 1h 22m of screen time today." (total_seconds=4925); the independent
  count from the telemetry detail table is also 4925 (app=4925, domain=4800).
- A manual lock raised a delivered limit alert (id 4); an MQTT offline status
  raised a delivered offline alert (id 5); POST /notify delivered (id 6). All
  three report delivered=1 in `alerts`.

Tests: gofmt, go vet ./... and go test ./... pass in golang:1.25-alpine.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/config/config_test.go

@@ -129,3 +129,60 @@ func TestMQTTDefaultsAndGuards(t *testing.T) {
 		t.Error("MQTTEnabled = true, want false when CONTROL_MQTT_ENABLED=false")
 	}
 }
+
+func TestPhase9HubAndAlertDefaults(t *testing.T) {
+	t.Setenv("CONTROL_SESSION_SECRET", "0123456789abcdef")
+	t.Setenv("CONTROL_ADMIN_PASSWORD", "hunter2")
+	t.Setenv("CONTROL_MQTT_INSECURE", "true")
+	for _, k := range []string{
+		"CONTROL_HUB_TOKEN", "CONTROL_APPRISE_KEY", "CONTROL_APPRISE_URLS",
+		"CONTROL_APPRISE_TOKEN", "CONTROL_ALERTS_ENABLED", "CONTROL_ALERT_OFFLINE_AFTER",
+		"CONTROL_APPRISE_URL",
+	} {
+		t.Setenv(k, "")
+	}
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.HubConfigured() {
+		t.Error("HubConfigured = true with no CONTROL_HUB_TOKEN")
+	}
+	if cfg.AppriseURL != DefaultAppriseURL {
+		t.Errorf("AppriseURL = %q, want %q", cfg.AppriseURL, DefaultAppriseURL)
+	}
+	if cfg.AppriseConfigured() {
+		t.Error("AppriseConfigured = true with no destination")
+	}
+	if !cfg.AlertsEnabled {
+		t.Error("AlertsEnabled = false, want true by default")
+	}
+	if cfg.AlertOfflineAfter != DefaultAlertOfflineAfter {
+		t.Errorf("AlertOfflineAfter = %v, want %v", cfg.AlertOfflineAfter, DefaultAlertOfflineAfter)
+	}
+
+	t.Setenv("CONTROL_HUB_TOKEN", "hub-secret")
+	t.Setenv("CONTROL_APPRISE_URLS", "mailto:sam@example.com pushover://x/y")
+	t.Setenv("CONTROL_ALERT_OFFLINE_AFTER", "10m")
+	t.Setenv("CONTROL_ALERTS_ENABLED", "false")
+	cfg, err = Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if !cfg.HubConfigured() {
+		t.Error("HubConfigured = false with a token set")
+	}
+	if !cfg.AppriseConfigured() {
+		t.Error("AppriseConfigured = false with CONTROL_APPRISE_URLS set")
+	}
+	if len(cfg.AppriseURLs) != 2 {
+		t.Errorf("AppriseURLs = %#v, want 2 entries", cfg.AppriseURLs)
+	}
+	if cfg.AlertOfflineAfter != 10*time.Minute {
+		t.Errorf("AlertOfflineAfter = %v, want 10m", cfg.AlertOfflineAfter)
+	}
+	if cfg.AlertsEnabled {
+		t.Error("AlertsEnabled = true, want false")
+	}
+}