Phase 7: telemetry and usage (daily rollup + week dashboard)

Build on Phases 1–6. Telemetry already arrived on
restrict/<device>/telemetry; this phase stores it in a daily rollup and
shows it.

- store: migration 003 adds telemetry_daily (device, day, app seconds,
  site seconds). InsertTelemetry maintains the affected days in the same
  transaction; RebuildRollups backfills and repairs it. UsageRange and
  TopUsage serve the week grid and top lists. CapAudit enforces the
  size-capped append-only audit log from AGENTS.md §7.
- web: GET /devices/{id}/usage — Monday-to-Sunday totals plus the top 10
  apps and top 10 sites, using CSP-safe native <progress> bars.
- theme.js: light/dark from the OS preference, with a nav toggle, loaded
  as an external script so the strict CSP still holds.
- cmd/control: `rollup` subcommand; rollup rebuild and audit cap at
  start-up and every 15 minutes.
- Version 0.5.0-phase7 (compose, Makefile, docs).

Tests: go test ./... and go vet ./... pass in golang:1.25-alpine.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/store/reports_test.go

@@ -185,3 +185,137 @@ func TestDeviceListsAndTopicLookup(t *testing.T) {
 		t.Errorf("unknown topic error = %v, want ErrNotFound", err)
 	}
 }
+
+func TestTelemetryRollupAndWeekQueries(t *testing.T) {
+	st, dev := newTestDevice(t)
+	ctx := context.Background()
+
+	// Three days of usage. Apps and domains are reported for the same day on
+	// purpose, to prove the rollup keeps them apart instead of double-counting.
+	days := []struct {
+		day     string
+		app     string
+		appSecs int
+		domain  string
+		webSecs int
+	}{
+		{"2026-10-12", "com.spotify.music", 600, "youtube.com", 120},
+		{"2026-10-13", "com.spotify.music", 900, "youtube.com", 300},
+		{"2026-10-13", "com.roblox.client", 1800, "roblox.com", 1800},
+		{"2026-10-14", "com.roblox.client", 3600, "roblox.com", 3600},
+	}
+	for _, d := range days {
+		if _, err := st.InsertTelemetry(ctx, dev.ID, d.day, []TelemetryEntry{
+			{App: d.app, Seconds: d.appSecs},
+			{Domain: d.domain, Seconds: d.webSecs},
+		}); err != nil {
+			t.Fatalf("InsertTelemetry %s: %v", d.day, err)
+		}
+	}
+
+	usage, err := st.UsageRange(ctx, dev.ID, "2026-10-12", "2026-10-14")
+	if err != nil {
+		t.Fatalf("UsageRange: %v", err)
+	}
+	if len(usage) != 3 {
+		t.Fatalf("usage rows = %d, want 3", len(usage))
+	}
+	if usage[0].Day != "2026-10-12" || usage[0].AppSeconds != 600 || usage[0].DomainSeconds != 120 {
+		t.Errorf("day 1 = %+v", usage[0])
+	}
+	if usage[1].AppSeconds != 2700 || usage[1].DomainSeconds != 2100 {
+		t.Errorf("day 2 = %+v, want apps 2700 and domains 2100 (no cross-counting)", usage[1])
+	}
+	if usage[2].AppSeconds != 3600 || usage[2].DomainSeconds != 3600 {
+		t.Errorf("day 3 = %+v", usage[2])
+	}
+
+	// A repeated report replaces the day's total, and the rollup follows.
+	if _, err := st.InsertTelemetry(ctx, dev.ID, "2026-10-13", []TelemetryEntry{
+		{App: "com.roblox.client", Seconds: 200},
+	}); err != nil {
+		t.Fatalf("InsertTelemetry replace: %v", err)
+	}
+	usage, _ = st.UsageRange(ctx, dev.ID, "2026-10-13", "2026-10-13")
+	if len(usage) != 1 || usage[0].AppSeconds != 1100 {
+		t.Errorf("day 2 after replace = %+v, want apps 1100 (spotify 900 + roblox 200)", usage)
+	}
+
+	// Top lists are ordered by total seconds.
+	topApps, err := st.TopUsage(ctx, dev.ID, "2026-10-12", "2026-10-14", "app", 10)
+	if err != nil {
+		t.Fatalf("TopUsage app: %v", err)
+	}
+	if len(topApps) != 2 || topApps[0].Name != "com.roblox.client" || topApps[0].Seconds != 3800 {
+		t.Errorf("top apps = %+v, want roblox first with 3800", topApps)
+	}
+	topDomains, err := st.TopUsage(ctx, dev.ID, "2026-10-12", "2026-10-14", "domain", 10)
+	if err != nil {
+		t.Fatalf("TopUsage domain: %v", err)
+	}
+	if len(topDomains) != 2 || topDomains[0].Name != "roblox.com" || topDomains[0].Seconds != 5400 {
+		t.Errorf("top domains = %+v", topDomains)
+	}
+
+	// An unknown kind and a range with no data are both empty, not errors.
+	if got, err := st.TopUsage(ctx, dev.ID, "2026-10-12", "2026-10-14", "nonsense", 10); err != nil || len(got) != 0 {
+		t.Errorf("TopUsage nonsense = (%+v, %v), want empty", got, err)
+	}
+	if got, err := st.UsageRange(ctx, dev.ID, "2020-01-01", "2020-01-07"); err != nil || len(got) != 0 {
+		t.Errorf("UsageRange empty = (%+v, %v), want empty", got, err)
+	}
+}
+
+func TestRebuildRollupsAndCapAudit(t *testing.T) {
+	st, dev := newTestDevice(t)
+	ctx := context.Background()
+
+	// Simulate pre-Phase-7 data: telemetry written before the rollup existed.
+	if _, err := st.DB().ExecContext(ctx,
+		`INSERT INTO telemetry (device_id, app, domain, seconds, day) VALUES (?, '', 'example.com', 300, '2026-10-13')`,
+		dev.ID); err != nil {
+		t.Fatalf("seed telemetry: %v", err)
+	}
+	var count int
+	if err := st.DB().QueryRowContext(ctx, `SELECT COUNT(*) FROM telemetry_daily`).Scan(&count); err != nil {
+		t.Fatalf("count rollups: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("telemetry_daily has %d rows before rebuild, want 0", count)
+	}
+	n, err := st.RebuildRollups(ctx)
+	if err != nil {
+		t.Fatalf("RebuildRollups: %v", err)
+	}
+	if n != 1 {
+		t.Errorf("RebuildRollups = %d rows, want 1", n)
+	}
+	usage, err := st.UsageRange(ctx, dev.ID, "2026-10-13", "2026-10-13")
+	if err != nil || len(usage) != 1 || usage[0].DomainSeconds != 300 {
+		t.Fatalf("usage after rebuild = (%+v, %v)", usage, err)
+	}
+
+	// The audit cap keeps the newest rows and never edits the rest.
+	for i := 0; i < 25; i++ {
+		if err := st.Audit(ctx, "sam", "test", nil, "row"); err != nil {
+			t.Fatalf("Audit: %v", err)
+		}
+	}
+	removed, err := st.CapAudit(ctx, 10)
+	if err != nil {
+		t.Fatalf("CapAudit: %v", err)
+	}
+	if removed == 0 {
+		t.Error("CapAudit removed nothing, want the oldest rows gone")
+	}
+	if err := st.DB().QueryRowContext(ctx, `SELECT COUNT(*) FROM audit`).Scan(&count); err != nil {
+		t.Fatalf("count audit: %v", err)
+	}
+	if count != 10 {
+		t.Errorf("audit rows = %d, want 10", count)
+	}
+	// A no-op cap leaves the log alone.
+	if n, err := st.CapAudit(ctx, 100); err != nil || n != 0 {
+		t.Errorf("CapAudit(100) = (%d, %v), want (0, nil)", n, err)
+	}
+}