Phase 1: Control Service skeleton (Go, SQLite, session login, Docker, Caddy)

- Go service with its own multi-stage Dockerfile and docker-compose.yml; runs
  as container webrestrict-control on port 8791.
- SQLite schema for the full AGENTS.md §7 data model via versioned migrations
  (PRAGMA user_version); audit log is append-only.
- Configuration from the process environment; the real env file is gitignored
  and a template is committed. No secrets in the repo.
- Separate session login (signed HMAC cookie + CSRF) for Sam.
- GET /health; HTMX + server-rendered dashboard styled with the Family Home Lab
  tokens.css (copied) and Inter fonts; dark mode; phone-friendly.
- Caddy vhost for webrestrict.lab.audasmedia.com.au applied on .35 (Let's
  Encrypt cert issued); route recorded in deploy/caddy/webrestrict.caddy.
- Unit tests for config, auth and store.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Dockerfile

@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1
+
+# ---- build stage ----------------------------------------------------------
+# Fix project name: Internet Use Control — its own image, built from source.
+FROM golang:1.25-alpine AS build
+WORKDIR /src
+RUN apk add --no-cache git
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+ARG VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build \
+      -trimpath \
+      -ldflags "-s -w -X main.version=${VERSION}" \
+      -o /out/control ./cmd/control
+
+# ---- runtime stage --------------------------------------------------------
+FROM alpine:3.21
+RUN apk add --no-cache ca-certificates tzdata wget \
+ && addgroup -g 10001 -S control \
+ && adduser -S -D -H -u 10001 -G control control \
+ && mkdir -p /data && chown control:control /data
+
+USER control
+WORKDIR /app
+COPY --from=build /out/control /app/control
+
+EXPOSE 8791
+VOLUME ["/data"]
+ENTRYPOINT ["/app/control"]