Phase 8: overrides (shared keycode + versioned admin lock/unlock/grant API)

Build on Phases 1–7. Adds the two override paths from AGENTS.md §4 FR-10/FR-11:
the shared device keycode and the versioned admin HTTP API the separate Kotlin
admin app will call.

- store: migration 004 adds state.grant_until and a settings table. New
  overrides.go records every override in `overrides` and verifies the shared
  keycode (bcrypt; one code for every device, §10 rule 3). ExpireLocks also
  clears an expired grant, and NextScheduleBoundary includes the grant end so a
  device re-locks on time.
- effective state: a grant unlocks a device inside a schedule window; a manual
  lock clears a grant and a grant clears a manual lock. The retained config
  payload gains grant_until (additive, v stays 1).
- web: /api/v1/admin/... (list, state, lock, unlock, grant) guarded by
  CONTROL_ADMIN_API_TOKEN, separate from the session login, plus the on-device
  keycode endpoint POST /api/v1/device/override with per-address throttling.
  A state change is published retained before the API responds.
- cmd/control: `keycode` subcommand and start-up seeding from
  CONTROL_DEVICE_KEYCODE_HASH.
- deploy/verify-phase8.sh + `make verify-phase8` prove the definition of done:
  an API lock reaches a real broker subscriber in well under a second.
- Version 0.6.0-phase8 (compose, Makefile, docs).

Measured on .13: the lock reached the TLS broker subscriber in 7 ms (handler
1 ms, request to retained publish accepted).

Tests: go vet ./... and go test -count=1 ./... pass in golang:1.25-alpine.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/store/schedules.go

@@ -53,9 +53,13 @@ type EffectiveState struct {
 	DeviceID int64
 	Locked   bool
 	Until    *time.Time
-	// Reason is "manual" (a lock from the dashboard), "schedule" (an active
-	// weekly window) or "" (not blocked).
+	// Reason is "manual" (a lock from the dashboard or the admin API),
+	// "schedule" (an active weekly window), "grant" (a time-limited exemption)
+	// or "" (not blocked).
 	Reason string
+	// GrantUntil is set when a grant is active: the device is unlocked, and a
+	// schedule window must not block it before this instant (Phase 8).
+	GrantUntil *time.Time
 	// Allow and Block are the configured list values, always non-nil.
 	Allow []string
 	Block []string
@@ -279,8 +283,13 @@ func atClock(now time.Time, minutes int) time.Time {
 }
 
 // EffectiveState computes the desired state for one device at now: a manual
-// lock, an active schedule window, or neither. While blocked, the configured
-// allowlist is honoured: the device blocks Block except Allow (FR-4).
+// lock, an active schedule window, a time-limited grant, or none of them.
+// While blocked, the configured allowlist is honoured: the device blocks Block
+// except Allow (FR-4).
+//
+// A grant wins over a schedule window but not over a manual lock; the write
+// paths keep the two mutually exclusive (a lock clears a grant, a grant clears
+// a lock), so the order below only matters for hand-edited data.
 //
 // A manual lock with no end time ("until I unlock") never lifts, so it wins over
 // a schedule end. Otherwise Until is the latest of the manual end and the
@@ -314,6 +323,10 @@ func (s *Store) EffectiveState(ctx context.Context, dev Device, now time.Time) (
 		if dev.Until != nil && schedUntil != nil && schedUntil.After(*dev.Until) {
 			eff.Until = schedUntil
 		}
+	case dev.GrantUntil != nil && dev.GrantUntil.After(now):
+		eff.Locked = false
+		eff.Reason = "grant"
+		eff.GrantUntil = dev.GrantUntil
 	case scheduled:
 		eff.Locked = true
 		eff.Reason = "schedule"
@@ -346,26 +359,30 @@ func (s *Store) NextScheduleBoundary(ctx context.Context, now time.Time) (*time.
 	}
 	best := NextWindowBoundary(schedules, now)
 
-	// A manual lock that expires is a boundary too, so the loop lifts it from
-	// the device promptly instead of waiting for the next interval.
+	// A manual lock that expires and a grant that ends are boundaries too, so
+	// the loop lifts or re-locks from the device promptly instead of waiting for
+	// the next interval. A grant end matters because the device may be unlocked
+	// only because of the grant: when it passes, an active window must re-lock.
 	lockRows, err := s.db.QueryContext(ctx,
-		`SELECT until FROM state WHERE locked = 1 AND until IS NOT NULL`)
+		`SELECT until, grant_until FROM state WHERE (locked = 1 AND until IS NOT NULL) OR grant_until IS NOT NULL`)
 	if err != nil {
 		return nil, fmt.Errorf("next lock boundary: %w", err)
 	}
 	defer lockRows.Close()
 	for lockRows.Next() {
-		var until sql.NullString
-		if err := lockRows.Scan(&until); err != nil {
+		var until, grantUntil sql.NullString
+		if err := lockRows.Scan(&until, &grantUntil); err != nil {
 			return nil, fmt.Errorf("scan lock until: %w", err)
 		}
-		t := parseTime(until.String)
-		if t.IsZero() || !t.After(now) {
-			continue
-		}
-		if best == nil || t.Before(*best) {
-			c := t
-			best = &c
+		for _, ns := range []sql.NullString{until, grantUntil} {
+			t := parseTime(ns.String)
+			if t.IsZero() || !t.After(now) {
+				continue
+			}
+			if best == nil || t.Before(*best) {
+				c := t
+				best = &c
+			}
 		}
 	}
 	if err := lockRows.Err(); err != nil {