Phase 1: Control Service skeleton (Go, SQLite, session login, Docker, Caddy)

- Go service with its own multi-stage Dockerfile and docker-compose.yml; runs
  as container webrestrict-control on port 8791.
- SQLite schema for the full AGENTS.md §7 data model via versioned migrations
  (PRAGMA user_version); audit log is append-only.
- Configuration from the process environment; the real env file is gitignored
  and a template is committed. No secrets in the repo.
- Separate session login (signed HMAC cookie + CSRF) for Sam.
- GET /health; HTMX + server-rendered dashboard styled with the Family Home Lab
  tokens.css (copied) and Inter fonts; dark mode; phone-friendly.
- Caddy vhost for webrestrict.lab.audasmedia.com.au applied on .35 (Let's
  Encrypt cert issued); route recorded in deploy/caddy/webrestrict.caddy.
- Unit tests for config, auth and store.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Makefile

@@ -0,0 +1,49 @@
+IMAGE ?= webrestrict/control:0.1.0-phase1
+BUILD_VERSION ?= 0.1.0-phase1
+
+.PHONY: help test vet build up down restart logs ps hash-password fmt
+
+help:
+	@echo "make test           run go test ./... in golang:1.25-alpine"
+	@echo "make vet            run go vet ./... in golang:1.25-alpine"
+	@echo "make build          build the container image ($(IMAGE))"
+	@echo "make up             docker compose up -d --build"
+	@echo "make down           docker compose down"
+	@echo "make logs           follow container logs"
+	@echo "make hash-password  generate a bcrypt hash (PASSWORD=...)"
+
+test:
+	docker run --rm --network host \
+	  -v "$$PWD":/src -w /src \
+	  -v webrestrict-go-mod:/go/pkg/mod \
+	  -v webrestrict-go-build:/root/.cache/go-build \
+	  golang:1.25-alpine sh -c 'go test ./...'
+
+vet:
+	docker run --rm --network host \
+	  -v "$$PWD":/src -w /src \
+	  -v webrestrict-go-mod:/go/pkg/mod \
+	  -v webrestrict-go-build:/root/.cache/go-build \
+	  golang:1.25-alpine sh -c 'go vet ./...'
+
+build:
+	docker build --build-arg VERSION=$(BUILD_VERSION) -t $(IMAGE) .
+
+up:
+	docker compose up -d --build
+
+down:
+	docker compose down
+
+restart:
+	docker compose restart control
+
+logs:
+	docker compose logs -f control
+
+ps:
+	docker compose ps
+
+hash-password:
+	@test -n "$(PASSWORD)" || (echo "usage: make hash-password PASSWORD=secret"; exit 2)
+	docker run --rm --entrypoint /app/control $(IMAGE) hash-password '$(PASSWORD)'