Phase 8: overrides (shared keycode + versioned admin lock/unlock/grant API)

Build on Phases 1–7. Adds the two override paths from AGENTS.md §4 FR-10/FR-11:
the shared device keycode and the versioned admin HTTP API the separate Kotlin
admin app will call.

- store: migration 004 adds state.grant_until and a settings table. New
  overrides.go records every override in `overrides` and verifies the shared
  keycode (bcrypt; one code for every device, §10 rule 3). ExpireLocks also
  clears an expired grant, and NextScheduleBoundary includes the grant end so a
  device re-locks on time.
- effective state: a grant unlocks a device inside a schedule window; a manual
  lock clears a grant and a grant clears a manual lock. The retained config
  payload gains grant_until (additive, v stays 1).
- web: /api/v1/admin/... (list, state, lock, unlock, grant) guarded by
  CONTROL_ADMIN_API_TOKEN, separate from the session login, plus the on-device
  keycode endpoint POST /api/v1/device/override with per-address throttling.
  A state change is published retained before the API responds.
- cmd/control: `keycode` subcommand and start-up seeding from
  CONTROL_DEVICE_KEYCODE_HASH.
- deploy/verify-phase8.sh + `make verify-phase8` prove the definition of done:
  an API lock reaches a real broker subscriber in well under a second.
- Version 0.6.0-phase8 (compose, Makefile, docs).

Measured on .13: the lock reached the TLS broker subscriber in 7 ms (handler
1 ms, request to retained publish accepted).

Tests: go vet ./... and go test -count=1 ./... pass in golang:1.25-alpine.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/devices.go

@@ -29,6 +29,7 @@ type deviceView struct {
 	Locked        bool
 	ManualLocked  bool
 	Scheduled     bool
+	Granted       bool
 	Until         *time.Time
 	UntilLocal    string
 	TimeLeft      string
@@ -81,9 +82,14 @@ func buildDeviceViews(devs []store.Device, effs map[int64]store.EffectiveState,
 			v.ReasonLabel = "by schedule"
 		case "manual":
 			v.ReasonLabel = "manually"
+		case "grant":
+			v.Granted = true
+			v.ReasonLabel = "time granted"
 		}
 		if eff.Locked {
 			v.StateLabel = "Locked"
+		} else if v.Granted {
+			v.StateLabel = "Granted"
 		} else {
 			v.StateLabel = "Unlocked"
 		}
@@ -92,6 +98,12 @@ func buildDeviceViews(devs []store.Device, effs map[int64]store.EffectiveState,
 			v.UntilLocal = local.Format("Mon 15:04")
 			v.TimeLeft = timeLeft(*eff.Until)
 		}
+		if eff.GrantUntil != nil {
+			v.Until = eff.GrantUntil
+			local := eff.GrantUntil.In(loc)
+			v.UntilLocal = local.Format("Mon 15:04")
+			v.TimeLeft = timeLeft(*eff.GrantUntil)
+		}
 		if d.LastSeen != nil {
 			v.LastSeen = d.LastSeen.In(loc).Format("Mon 02 Jan 15:04")
 			v.HasLastSeen = true
@@ -167,6 +179,18 @@ func auditLabel(action string) string {
 		return "Unlocked"
 	case "state.expired":
 		return "Lock expired"
+	case "override.granted":
+		return "Time granted"
+	case "override.keycode":
+		return "Keycode override"
+	case "override.keycode_rejected":
+		return "Keycode rejected"
+	case "override.keycode_throttled":
+		return "Keycode throttled"
+	case "keycode.updated":
+		return "Keycode changed"
+	case "admin.token_rejected":
+		return "Admin API rejected"
 	case "schedule.updated":
 		return "Schedule saved"
 	case "list.added":