Phase 8: overrides (shared keycode + versioned admin lock/unlock/grant API)

Build on Phases 1–7. Adds the two override paths from AGENTS.md §4 FR-10/FR-11:
the shared device keycode and the versioned admin HTTP API the separate Kotlin
admin app will call.

- store: migration 004 adds state.grant_until and a settings table. New
  overrides.go records every override in `overrides` and verifies the shared
  keycode (bcrypt; one code for every device, §10 rule 3). ExpireLocks also
  clears an expired grant, and NextScheduleBoundary includes the grant end so a
  device re-locks on time.
- effective state: a grant unlocks a device inside a schedule window; a manual
  lock clears a grant and a grant clears a manual lock. The retained config
  payload gains grant_until (additive, v stays 1).
- web: /api/v1/admin/... (list, state, lock, unlock, grant) guarded by
  CONTROL_ADMIN_API_TOKEN, separate from the session login, plus the on-device
  keycode endpoint POST /api/v1/device/override with per-address throttling.
  A state change is published retained before the API responds.
- cmd/control: `keycode` subcommand and start-up seeding from
  CONTROL_DEVICE_KEYCODE_HASH.
- deploy/verify-phase8.sh + `make verify-phase8` prove the definition of done:
  an API lock reaches a real broker subscriber in well under a second.
- Version 0.6.0-phase8 (compose, Makefile, docs).

Measured on .13: the lock reached the TLS broker subscriber in 7 ms (handler
1 ms, request to retained publish accepted).

Tests: go vet ./... and go test -count=1 ./... pass in golang:1.25-alpine.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

environment.d/control-service.env.example

@@ -38,9 +38,25 @@ CONTROL_ADMIN_USERNAME=sam
 CONTROL_ADMIN_PASSWORD=change-me
 
 # Option B (preferred): a bcrypt hash; leave CONTROL_ADMIN_PASSWORD empty.
-# Generate: docker run --rm --entrypoint /app/control webrestrict/control:0.5.0-phase7 hash-password 'your-password'
+# Generate: docker run --rm --entrypoint /app/control webrestrict/control:0.6.0-phase8 hash-password 'your-password'
 # CONTROL_ADMIN_PASSWORD_HASH=$2a$10$...
 
+# --- Admin API (Phase 8) ---------------------------------------------------
+# The versioned HTTP API the separate Kotlin admin app (kotlin_phone_app_admin)
+# calls directly. Its bearer token is SEPARATE from the dashboard session login.
+# Generate a long random value: openssl rand -hex 32
+# When empty the API answers 503 "admin API is not configured" and nothing else
+# changes, so an older deployment keeps working.
+CONTROL_ADMIN_API_TOKEN=change-me-to-a-long-random-token
+
+# The shared device keycode (one code, every device — AGENTS.md §10 rule 3).
+# Give a bcrypt hash, never the code itself. Generate one with:
+#   docker run --rm --entrypoint /app/control webrestrict/control:0.6.0-phase8 \
+#     hash-password 'the-code'
+# The hash is seeded into SQLite at start-up and can be changed later with
+# `docker exec webrestrict-control /app/control keycode`.
+# CONTROL_DEVICE_KEYCODE_HASH=$2a$10$...
+
 # --- MQTT (Phase 3) --------------------------------------------------------
 # The broker is transport only. SQLite stays the source of truth, and only the
 # Control Service publishes config (AGENTS.md §10 rules 5-6).