Phase 8: overrides (shared keycode + versioned admin lock/unlock/grant API)

Build on Phases 1–7. Adds the two override paths from AGENTS.md §4 FR-10/FR-11:
the shared device keycode and the versioned admin HTTP API the separate Kotlin
admin app will call.

- store: migration 004 adds state.grant_until and a settings table. New
  overrides.go records every override in `overrides` and verifies the shared
  keycode (bcrypt; one code for every device, §10 rule 3). ExpireLocks also
  clears an expired grant, and NextScheduleBoundary includes the grant end so a
  device re-locks on time.
- effective state: a grant unlocks a device inside a schedule window; a manual
  lock clears a grant and a grant clears a manual lock. The retained config
  payload gains grant_until (additive, v stays 1).
- web: /api/v1/admin/... (list, state, lock, unlock, grant) guarded by
  CONTROL_ADMIN_API_TOKEN, separate from the session login, plus the on-device
  keycode endpoint POST /api/v1/device/override with per-address throttling.
  A state change is published retained before the API responds.
- cmd/control: `keycode` subcommand and start-up seeding from
  CONTROL_DEVICE_KEYCODE_HASH.
- deploy/verify-phase8.sh + `make verify-phase8` prove the definition of done:
  an API lock reaches a real broker subscriber in well under a second.
- Version 0.6.0-phase8 (compose, Makefile, docs).

Measured on .13: the lock reached the TLS broker subscriber in 7 ms (handler
1 ms, request to retained publish accepted).

Tests: go vet ./... and go test -count=1 ./... pass in golang:1.25-alpine.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/config/config.go

@@ -30,6 +30,15 @@ type Config struct {
 	AdminPassword string
 	// AdminPasswordHash is a bcrypt hash. Optional if AdminPassword is set.
 	AdminPasswordHash string
+	// AdminAPIToken authenticates the versioned admin API (Phase 8). It is
+	// separate from the session login and comes from environment.d. When it is
+	// empty the admin API answers 503 and nothing else changes.
+	AdminAPIToken string
+	// DeviceKeycodeHash is a bcrypt hash of the shared device keycode (Phase 8).
+	// It is optional: the code is seeded into SQLite at start-up and can be
+	// changed at runtime with `control keycode`. It is never stored in plaintext
+	// and never logged.
+	DeviceKeycodeHash string
 	// CookieSecure sets the Secure attribute on cookies. Keep true behind HTTPS.
 	CookieSecure bool
 	// SessionTTL is how long a session cookie stays valid.
@@ -74,6 +83,8 @@ func Load() (*Config, error) {
 		AdminUsername:     env("CONTROL_ADMIN_USERNAME", "sam"),
 		AdminPassword:     os.Getenv("CONTROL_ADMIN_PASSWORD"),
 		AdminPasswordHash: os.Getenv("CONTROL_ADMIN_PASSWORD_HASH"),
+		AdminAPIToken:     os.Getenv("CONTROL_ADMIN_API_TOKEN"),
+		DeviceKeycodeHash: os.Getenv("CONTROL_DEVICE_KEYCODE_HASH"),
 		CookieSecure:      envBool("CONTROL_COOKIE_SECURE", true),
 		AppEnv:            env("CONTROL_APP_ENV", "production"),
 		MQTTEnabled:       envBool("CONTROL_MQTT_ENABLED", true),