Phase 2: device registry, dashboard cards, manual lock/unlock, audit

- Device registry: add/edit name, child and platform, persisted in devices.
- Stable per-device topic derived from name + id, unchanged by renames.
- Desired state persisted in state; timed locks expire and are audited.
- Dashboard cards: name, child, platform, status dot, state and time left.
- Manual lock/unlock forms with CSRF; every change appends to audit (FR-15).
- Append-only activity list on the dashboard. No hard deletes (rule 10).
- Store and handler tests; version bumped to 0.2.0-phase2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/templates/device-form.html

@@ -0,0 +1,80 @@
+{{define "device-form.html"}}<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="light dark">
+  <title>{{.Title}} — Internet Use Control</title>
+  <link rel="stylesheet" href="/static/tokens.css">
+  <link rel="stylesheet" href="/static/app.css">
+</head>
+<body class="app">
+  <nav class="nav-bar">
+    <a class="nav-bar__brand" href="/">
+      <span class="nav-bar__mark" aria-hidden="true"></span>
+      Internet Use Control
+    </a>
+    <div class="nav-bar__right">
+      <span class="nav-bar__user">{{.Username}}</span>
+    </div>
+  </nav>
+
+  <main class="container container--narrow">
+    <header class="page-head">
+      <p class="page-head__eyebrow"><a href="/">← Dashboard</a></p>
+      <h1 class="heading-1">{{.Heading}}</h1>
+      <p class="page-head__sub">{{.Sub}}</p>
+    </header>
+
+    {{if .Error}}<p class="flash flash--error" role="alert">{{.Error}}</p>{{end}}
+
+    <section class="card-panel">
+      <form method="post" action="{{.FormAction}}" class="stack-form">
+        <input type="hidden" name="csrf" value="{{.CSRF}}">
+
+        <label class="field">
+          <span class="field__label">Device name</span>
+          <input class="text-input" type="text" name="name" value="{{.Name}}"
+                 placeholder="Harry's Pixel" maxlength="80" required
+                 autocapitalize="words" spellcheck="false">
+        </label>
+
+        <label class="field">
+          <span class="field__label">Child</span>
+          <input class="text-input" type="text" name="child" value="{{.Child}}"
+                 list="children" placeholder="Harry" maxlength="40" required autocapitalize="words">
+          <datalist id="children">
+            <option value="Harry"></option>
+            <option value="Finn"></option>
+          </datalist>
+        </label>
+
+        <fieldset class="field">
+          <legend class="field__label">Platform</legend>
+          <div class="radio-row">
+            <label class="radio-chip">
+              <input type="radio" name="platform" value="android" {{if eq .Platform "android"}}checked{{end}}>
+              <span>Android</span>
+            </label>
+            <label class="radio-chip">
+              <input type="radio" name="platform" value="windows" {{if eq .Platform "windows"}}checked{{end}}>
+              <span>Windows</span>
+            </label>
+          </div>
+        </fieldset>
+
+        <div class="form-actions">
+          <button class="button-primary" type="submit">Save device</button>
+          <a class="button-utility" href="/">Cancel</a>
+        </div>
+      </form>
+    </section>
+  </main>
+
+  <footer class="app-foot">
+    <span>Control Service · {{.Version}} · {{.AppEnv}}</span>
+    <span class="app-foot__sep">·</span>
+    <span>{{year}} Family Home Lab</span>
+  </footer>
+</body>
+</html>{{end}}