Phase 1: Control Service skeleton (Go, SQLite, session login, Docker, Caddy)

- Go service with its own multi-stage Dockerfile and docker-compose.yml; runs
  as container webrestrict-control on port 8791.
- SQLite schema for the full AGENTS.md §7 data model via versioned migrations
  (PRAGMA user_version); audit log is append-only.
- Configuration from the process environment; the real env file is gitignored
  and a template is committed. No secrets in the repo.
- Separate session login (signed HMAC cookie + CSRF) for Sam.
- GET /health; HTMX + server-rendered dashboard styled with the Family Home Lab
  tokens.css (copied) and Inter fonts; dark mode; phone-friendly.
- Caddy vhost for webrestrict.lab.audasmedia.com.au applied on .35 (Let's
  Encrypt cert issued); route recorded in deploy/caddy/webrestrict.caddy.
- Unit tests for config, auth and store.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deploy/caddy/webrestrict.caddy

@@ -0,0 +1,29 @@
+# Caddy route for the Control Service.
+#
+# APPLIED 2026-10-13 (AUD-78). This file records the live configuration.
+#
+# DNS:    webrestrict.lab.audasmedia.com.au
+# Owner:  the Caddy container on .35 (sam-Ubuntu1), Caddyfile bind-mounted at
+#         /Docker/Containers/caddy/Caddyfile (owned by sam:sam).
+# Result: https://webrestrict.lab.audasmedia.com.au -> 192.168.20.13:8791
+#         Let's Encrypt certificate issued via HTTP-01 on 2026-10-13.
+# Backup: /Docker/Containers/caddy/Caddyfile.bak.aud78-<timestamp>
+
+webrestrict.lab.audasmedia.com.au {
+	reverse_proxy 192.168.20.13:8791
+}
+
+# No basic-auth: the Control Service has its own session login (AGENTS.md §9),
+# matching the paperclip.lab and mail.lab vhosts.
+#
+# .13:8791 is reachable from .35 through the Docker-published port without a
+# firewall rule. If that ever stops working, add 8791 to
+# networking.firewall.allowedTCPPorts on .13 and rebuild.
+#
+# To apply this block on another host:
+#   ssh sam@192.168.20.35
+#   cp /Docker/Containers/caddy/Caddyfile /Docker/Containers/caddy/Caddyfile.bak
+#   cat >> /Docker/Containers/caddy/Caddyfile   # append the block above
+#   docker exec caddy caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
+#   docker exec caddy caddy reload   --config /etc/caddy/Caddyfile --adapter caddyfile
+#   curl -s https://webrestrict.lab.audasmedia.com.au/health