Phase 2: device registry, dashboard cards, manual lock/unlock, audit

- Device registry: add/edit name, child and platform, persisted in devices.
- Stable per-device topic derived from name + id, unchanged by renames.
- Desired state persisted in state; timed locks expire and are audited.
- Dashboard cards: name, child, platform, status dot, state and time left.
- Manual lock/unlock forms with CSRF; every change appends to audit (FR-15).
- Append-only activity list on the dashboard. No hard deletes (rule 10).
- Store and handler tests; version bumped to 0.2.0-phase2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/templates/partials/device-cards.html

@@ -0,0 +1,49 @@
+{{define "device-cards.html"}}<div class="device-grid">
+  {{range .Devices}}
+  <article class="device-card">
+    <header class="device-card__head">
+      <div class="device-card__id">
+        <h3 class="device-card__name">{{.Name}}</h3>
+        <p class="device-card__meta">{{.Child}} · {{.PlatformLabel}}</p>
+      </div>
+      <span class="status-pill {{if .Locked}}status-pill--off{{else}}status-pill--on{{end}}">
+        <span class="dot {{if .Locked}}dot--off{{else}}dot--on{{end}}"></span>{{.StateLabel}}
+      </span>
+    </header>
+
+    <p class="device-card__state">
+      {{if .Locked}}Blocked{{if .TimeLeft}} · {{.TimeLeft}}{{end}}{{else}}No block active{{end}}
+    </p>
+    {{if .Until}}<p class="device-card__until">Lifts {{.UntilLocal}}</p>{{end}}
+
+    <div class="device-card__actions">
+      <form method="post" action="/devices/{{.ID}}/lock" class="inline-form">
+        <input type="hidden" name="csrf" value="{{$.CSRF}}">
+        <select class="select-input" name="minutes" aria-label="Lock duration">
+          <option value="0">until I unlock</option>
+          <option value="15">15 min</option>
+          <option value="30" selected>30 min</option>
+          <option value="60">1 hour</option>
+        </select>
+        <button class="button-primary" type="submit">{{if .Locked}}Re-lock{{else}}Lock{{end}}</button>
+      </form>
+      {{if .Locked}}
+      <form method="post" action="/devices/{{.ID}}/unlock" class="inline-form">
+        <input type="hidden" name="csrf" value="{{$.CSRF}}">
+        <button class="button-utility" type="submit">Unlock</button>
+      </form>
+      {{end}}
+      <a class="button-utility" href="/devices/{{.ID}}/edit">Edit</a>
+    </div>
+
+    <p class="device-card__foot">
+      <span class="device-card__presence">
+        <span class="dot {{if .Online}}dot--on{{else}}dot--faint{{end}}"></span>
+        {{if .Online}}online{{else}}offline{{end}}
+      </span>
+      {{if .HasLastSeen}}<span>· last seen {{.LastSeen}}</span>{{else}}<span>· never connected</span>{{end}}
+    </p>
+    <p class="device-card__topic"><code>{{.Topic}}</code></p>
+  </article>
+  {{end}}
+</div>{{end}}