Phase 9: Hub API and Apprise alerts (/capabilities, /ask, /notify)

Build on Phases 1-8. Adds the project side of the frozen Hub contract
(central_ai_llm_master/docs/ask-contract.md) and the alert engine from
AGENTS.md §4 FR-12/FR-13, §8, §11 Phase 9.

- hub: internal/hub implements AskRequest/AskResponse/NotifyRequest and a
  deterministic, read-only Answerer. It answers screen time today/yesterday,
  what is blocked now, and device presence, scoped to one child or all kids.
  Screen time is the foreground-app total per device-day; the domain total is
  used only when a device reports no apps, so a report carrying both is never
  double-counted.
- apprise: internal/apprise is a small Apprise API client (stored key or
  stateless URL mode, optional bearer token, typed notifications).
- alert: internal/alert evaluates device state on an interval and raises one
  Apprise alert per transition: a limit hit (a device becomes blocked) or a
  device offline longer than the threshold. A never-seen device is never
  alerted, and the first observation seeds state without replaying an old
  limit. The alert is recorded before delivery, with its delivery outcome.
- store: migration 005 adds `alerts` (delivery outcome, audited) and
  `alert_state` (per-device dedup). New usage reads from the telemetry detail
  table so the daily answer can be checked independently.
- web: GET /capabilities, POST /ask (read-only) and POST /notify behind the
  shared CONTROL_HUB_TOKEN, separate from the session and admin API tokens.
  /notify accepts the contract's {from,level,message,person} and delivers it
  through Apprise (the future tamper-report path, FR-17).
- cmd/control: start the alert engine (CONTROL_ALERTS_ENABLED,
  CONTROL_ALERT_OFFLINE_AFTER, CONTROL_ALERT_INTERVAL) and add `alerts` and
  `usage` subcommands for read-only inspection.
- deploy/verify-phase9.sh + `make verify-phase9` prove the definition of done;
  version 0.7.0-phase9.

Measured on .13 (2026-10-13):
- GET /capabilities -> internet_use_control topics.
- POST /ask "how long have the kids been on screens today?" -> "The kids have
  had 1h 22m of screen time today." (total_seconds=4925); the independent
  count from the telemetry detail table is also 4925 (app=4925, domain=4800).
- A manual lock raised a delivered limit alert (id 4); an MQTT offline status
  raised a delivered offline alert (id 5); POST /notify delivered (id 6). All
  three report delivered=1 in `alerts`.

Tests: gofmt, go vet ./... and go test ./... pass in golang:1.25-alpine.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/store/alerts_test.go

@@ -0,0 +1,134 @@
+package store
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+func TestAlertLifecycle(t *testing.T) {
+	ctx := context.Background()
+	st := testStore(t)
+	dev := mustCreateDevice(t, st, "Harry's phone", "Harry", "android")
+
+	a, err := st.CreateAlert(ctx, &dev.ID, AlertLimit, "Harry's phone reached its limit.")
+	if err != nil {
+		t.Fatalf("CreateAlert: %v", err)
+	}
+	if a.Delivered {
+		t.Error("a fresh alert must not be delivered")
+	}
+	if a.DeviceName != "Harry's phone" {
+		t.Errorf("device name = %q", a.DeviceName)
+	}
+
+	// The alert is audited.
+	audit, err := st.ListAudit(ctx, 10)
+	if err != nil {
+		t.Fatalf("ListAudit: %v", err)
+	}
+	if len(audit) == 0 || audit[0].Action != "alert.limit" {
+		t.Fatalf("audit = %#v, want an alert.limit row", audit)
+	}
+
+	if err := st.MarkAlertDelivered(ctx, a.ID, ""); err != nil {
+		t.Fatalf("MarkAlertDelivered: %v", err)
+	}
+	got, err := st.GetAlert(ctx, a.ID)
+	if err != nil {
+		t.Fatalf("GetAlert: %v", err)
+	}
+	if !got.Delivered || got.DeliveredAt == nil || got.Error != "" {
+		t.Errorf("delivered alert = %#v", got)
+	}
+
+	// A delivery failure is recorded, not hidden.
+	b, err := st.CreateAlert(ctx, nil, AlertNotify, "message")
+	if err != nil {
+		t.Fatalf("CreateAlert notify: %v", err)
+	}
+	if err := st.MarkAlertDelivered(ctx, b.ID, "post apprise: status 500"); err != nil {
+		t.Fatalf("MarkAlertDelivered: %v", err)
+	}
+	got, err = st.GetAlert(ctx, b.ID)
+	if err != nil {
+		t.Fatalf("GetAlert: %v", err)
+	}
+	if got.Delivered || got.Error != "post apprise: status 500" {
+		t.Errorf("failed alert = %#v", got)
+	}
+
+	if _, err := st.CreateAlert(ctx, nil, "bogus", "x"); err == nil {
+		t.Error("CreateAlert accepted an unknown kind")
+	}
+}
+
+func TestAlertStatesRoundTrip(t *testing.T) {
+	ctx := context.Background()
+	st := testStore(t)
+	dev := mustCreateDevice(t, st, "Finn's computer", "Finn", "windows")
+
+	states, err := st.AlertStates(ctx)
+	if err != nil {
+		t.Fatalf("AlertStates: %v", err)
+	}
+	if len(states) != 0 {
+		t.Fatalf("states = %#v, want empty", states)
+	}
+
+	if err := st.SetAlertState(ctx, dev.ID, true, false); err != nil {
+		t.Fatalf("SetAlertState: %v", err)
+	}
+	states, err = st.AlertStates(ctx)
+	if err != nil {
+		t.Fatalf("AlertStates: %v", err)
+	}
+	if st := states[dev.ID]; !st.Locked || st.Offline {
+		t.Fatalf("state = %#v, want locked only", st)
+	}
+
+	if err := st.SetAlertState(ctx, dev.ID, false, true); err != nil {
+		t.Fatalf("SetAlertState: %v", err)
+	}
+	states, _ = st.AlertStates(ctx)
+	if st := states[dev.ID]; st.Locked || !st.Offline {
+		t.Fatalf("state = %#v, want offline only", st)
+	}
+}
+
+func TestUsageByDeviceForDay(t *testing.T) {
+	ctx := context.Background()
+	st := testStore(t)
+	harry := mustCreateDevice(t, st, "Harry's phone", "Harry", "android")
+	finn := mustCreateDevice(t, st, "Finn's computer", "Finn", "windows")
+	day := time.Date(2026, 10, 13, 0, 0, 0, 0, time.UTC).Format("2006-01-02")
+
+	if _, err := st.InsertTelemetry(ctx, harry.ID, day, []TelemetryEntry{
+		{App: "com.spotify.music", Seconds: 3600},
+		{Domain: "youtube.com", Seconds: 900},
+	}); err != nil {
+		t.Fatalf("InsertTelemetry: %v", err)
+	}
+	if _, err := st.InsertTelemetry(ctx, finn.ID, day, []TelemetryEntry{{App: "chrome", Seconds: 1800}}); err != nil {
+		t.Fatalf("InsertTelemetry: %v", err)
+	}
+
+	rows, err := st.UsageByDeviceForDay(ctx, day)
+	if err != nil {
+		t.Fatalf("UsageByDeviceForDay: %v", err)
+	}
+	if len(rows) != 2 {
+		t.Fatalf("rows = %d, want 2", len(rows))
+	}
+	if rows[0].Name != "Harry's phone" || rows[0].AppSeconds != 3600 || rows[0].DomainSeconds != 900 {
+		t.Errorf("harry row = %#v", rows[0])
+	}
+	if rows[1].Child != "Finn" || rows[1].AppSeconds != 1800 {
+		t.Errorf("finn row = %#v", rows[1])
+	}
+
+	// A day with no reports returns nothing.
+	if rows, err := st.UsageByDeviceForDay(ctx, "2000-01-01"); err != nil || len(rows) != 0 {
+		t.Fatalf("empty day: rows=%#v err=%v", rows, err)
+	}
+}