Phase 2: device registry, dashboard cards, manual lock/unlock, audit

- Device registry: add/edit name, child and platform, persisted in devices.
- Stable per-device topic derived from name + id, unchanged by renames.
- Desired state persisted in state; timed locks expire and are audited.
- Dashboard cards: name, child, platform, status dot, state and time left.
- Manual lock/unlock forms with CSRF; every change appends to audit (FR-15).
- Append-only activity list on the dashboard. No hard deletes (rule 10).
- Store and handler tests; version bumped to 0.2.0-phase2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/templates/partials/audit-list.html

@@ -0,0 +1,14 @@
+{{define "audit-list.html"}}<ul class="audit-list">
+  {{range .Audit}}
+  <li class="audit-item">
+    <span class="audit-item__badge">{{.ActionLabel}}</span>
+    <span class="audit-item__body">
+      {{if .DeviceName}}<strong>{{.DeviceName}}</strong>{{end}}
+      {{if .Detail}}<span class="audit-item__detail">{{.Detail}}</span>{{end}}
+    </span>
+    <span class="audit-item__meta">{{.Actor}} · {{.CreatedAtLocal}}</span>
+  </li>
+  {{else}}
+  <li class="audit-item audit-item--empty">No activity yet.</li>
+  {{end}}
+</ul>{{end}}