Phase 2: device registry, dashboard cards, manual lock/unlock, audit

- Device registry: add/edit name, child and platform, persisted in devices.
- Stable per-device topic derived from name + id, unchanged by renames.
- Desired state persisted in state; timed locks expire and are audited.
- Dashboard cards: name, child, platform, status dot, state and time left.
- Manual lock/unlock forms with CSRF; every change appends to audit (FR-15).
- Append-only activity list on the dashboard. No hard deletes (rule 10).
- Store and handler tests; version bumped to 0.2.0-phase2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

cmd/control/main.go

@@ -1,8 +1,8 @@
 // Command control is the Internet Use Control Control Service.
 //
 // It is the single source of truth for the family's device rules
-// (SYSTEM_MAP.md). Phase 1: HTTP skeleton, SQLite schema, config from the
-// environment, and a separate session login.
+// (SYSTEM_MAP.md). Phase 2: device registry, desired state in SQLite, manual
+// lock/unlock from the dashboard, and the audit log.
 package main
 
 import (