Phase 6: schedules, blocklists, allowlists (editors + effective state)

- Weekly schedule editor per device: a Monday-Sunday grid of blocking
  windows, including windows that cross midnight.
- Blocklist/allowlist editor per device: app (Android package / Windows
  process) and site (hostname) entries, tagged by the device platform.
- Effective desired state: a manual lock, an active schedule window, or
  neither. While blocked the allowlist is honoured (Spotify stays while
  other apps are blocked). Published retained with reason schedule/manual.
- Boundary-aware republish loop so a window turns on and off on time,
  and manual lock expiry is cleared promptly.
- CONTROL_TIMEZONE (default Australia/Sydney) with embedded tzdata, so
  wall-clock windows are evaluated in the family zone, not the container.
- Every change is written to the append-only audit log (FR-15).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

environment.d/control-service.env.example

@@ -16,6 +16,10 @@ CONTROL_DB_PATH=/data/control.db
 CONTROL_APP_ENV=production
 CONTROL_LOG_LEVEL=info
 
+# Timezone weekly schedule windows are evaluated in. Windows are wall-clock, so
+# this must be the family's zone, not the container's default of UTC.
+CONTROL_TIMEZONE=Australia/Sydney
+
 # Signs the session cookie. Set to a long random string (>= 16 chars).
 # Generate: openssl rand -hex 32
 CONTROL_SESSION_SECRET=change-me-to-a-long-random-string