Phase 9: Hub API and Apprise alerts (/capabilities, /ask, /notify)

Build on Phases 1-8. Adds the project side of the frozen Hub contract
(central_ai_llm_master/docs/ask-contract.md) and the alert engine from
AGENTS.md §4 FR-12/FR-13, §8, §11 Phase 9.

- hub: internal/hub implements AskRequest/AskResponse/NotifyRequest and a
  deterministic, read-only Answerer. It answers screen time today/yesterday,
  what is blocked now, and device presence, scoped to one child or all kids.
  Screen time is the foreground-app total per device-day; the domain total is
  used only when a device reports no apps, so a report carrying both is never
  double-counted.
- apprise: internal/apprise is a small Apprise API client (stored key or
  stateless URL mode, optional bearer token, typed notifications).
- alert: internal/alert evaluates device state on an interval and raises one
  Apprise alert per transition: a limit hit (a device becomes blocked) or a
  device offline longer than the threshold. A never-seen device is never
  alerted, and the first observation seeds state without replaying an old
  limit. The alert is recorded before delivery, with its delivery outcome.
- store: migration 005 adds `alerts` (delivery outcome, audited) and
  `alert_state` (per-device dedup). New usage reads from the telemetry detail
  table so the daily answer can be checked independently.
- web: GET /capabilities, POST /ask (read-only) and POST /notify behind the
  shared CONTROL_HUB_TOKEN, separate from the session and admin API tokens.
  /notify accepts the contract's {from,level,message,person} and delivers it
  through Apprise (the future tamper-report path, FR-17).
- cmd/control: start the alert engine (CONTROL_ALERTS_ENABLED,
  CONTROL_ALERT_OFFLINE_AFTER, CONTROL_ALERT_INTERVAL) and add `alerts` and
  `usage` subcommands for read-only inspection.
- deploy/verify-phase9.sh + `make verify-phase9` prove the definition of done;
  version 0.7.0-phase9.

Measured on .13 (2026-10-13):
- GET /capabilities -> internet_use_control topics.
- POST /ask "how long have the kids been on screens today?" -> "The kids have
  had 1h 22m of screen time today." (total_seconds=4925); the independent
  count from the telemetry detail table is also 4925 (app=4925, domain=4800).
- A manual lock raised a delivered limit alert (id 4); an MQTT offline status
  raised a delivered offline alert (id 5); POST /notify delivered (id 6). All
  three report delivered=1 in `alerts`.

Tests: gofmt, go vet ./... and go test ./... pass in golang:1.25-alpine.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/server.go

@@ -15,8 +15,10 @@ import (
 	"sync"
 	"time"
 
+	"gitea.lab.audasmedia.com.au/sam/internet_use_control/internal/apprise"
 	"gitea.lab.audasmedia.com.au/sam/internet_use_control/internal/auth"
 	"gitea.lab.audasmedia.com.au/sam/internet_use_control/internal/config"
+	"gitea.lab.audasmedia.com.au/sam/internet_use_control/internal/hub"
 	"gitea.lab.audasmedia.com.au/sam/internet_use_control/internal/store"
 )
 
@@ -40,6 +42,11 @@ type Server struct {
 	// code cannot be tried without limit.
 	keycodeMu sync.Mutex
 	keycode   map[string]keycodeAttempts
+
+	// The Hub contract surface (Phase 9): the read-only answerer and the
+	// Apprise client that delivers alerts and accepted notifications.
+	answerer *hub.Answerer
+	apprise  *apprise.Client
 }
 
 // Publisher pushes device config to the broker and reports the link's health.
@@ -68,16 +75,22 @@ func New(cfg *config.Config, st *store.Store, am *auth.Manager, log *slog.Logger
 		return nil, fmt.Errorf("parse templates: %w", err)
 	}
 	return &Server{
-		cfg:     cfg,
-		store:   st,
-		auth:    am,
-		tmpl:    tmpl,
-		log:     log,
-		pub:     pub,
-		keycode: make(map[string]keycodeAttempts),
+		cfg:      cfg,
+		store:    st,
+		auth:     am,
+		tmpl:     tmpl,
+		log:      log,
+		pub:      pub,
+		keycode:  make(map[string]keycodeAttempts),
+		answerer: hub.NewAnswerer(st, cfg.ScheduleLocation),
+		apprise:  apprise.New(cfg.AppriseURL, cfg.AppriseKey, cfg.AppriseURLs, cfg.AppriseToken, 0),
 	}, nil
 }
 
+// Apprise exposes the delivery client so the alert engine (cmd/control) can
+// share the one configured destination with the /notify handler.
+func (s *Server) Apprise() *apprise.Client { return s.apprise }
+
 // publishConfig pushes one device's desired state to the broker, retained. A
 // publish failure never fails the HTTP request: SQLite already holds the new
 // state, and the link republishes everything when it reconnects, so the broker
@@ -131,6 +144,13 @@ func (s *Server) Handler() http.Handler {
 	// not hold that secret. It is throttled and audited instead (admin_api.go).
 	mux.HandleFunc("POST "+api+"/device/override", s.handleDeviceOverride)
 
+	// The Hub contract (Phase 9, FR-12/FR-13). Bearer-token auth, separate
+	// from the dashboard session and the admin API token. /ask is read-only;
+	// /notify records and delivers a message through Apprise.
+	mux.HandleFunc("GET /capabilities", s.requireHub(s.handleCapabilities))
+	mux.HandleFunc("POST /ask", s.requireHub(s.handleAsk))
+	mux.HandleFunc("POST /notify", s.requireHub(s.handleNotify))
+
 	staticSub, err := fs.Sub(staticFS, "static")
 	if err != nil {
 		panic("web: embedded static dir missing: " + err.Error())