Phase 1: Control Service skeleton (Go, SQLite, session login, Docker, Caddy)

- Go service with its own multi-stage Dockerfile and docker-compose.yml; runs
  as container webrestrict-control on port 8791.
- SQLite schema for the full AGENTS.md §7 data model via versioned migrations
  (PRAGMA user_version); audit log is append-only.
- Configuration from the process environment; the real env file is gitignored
  and a template is committed. No secrets in the repo.
- Separate session login (signed HMAC cookie + CSRF) for Sam.
- GET /health; HTMX + server-rendered dashboard styled with the Family Home Lab
  tokens.css (copied) and Inter fonts; dark mode; phone-friendly.
- Caddy vhost for webrestrict.lab.audasmedia.com.au applied on .35 (Let's
  Encrypt cert issued); route recorded in deploy/caddy/webrestrict.caddy.
- Unit tests for config, auth and store.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docker-compose.yml

@@ -0,0 +1,35 @@
+# Internet Use Control — Control Service (own image, own container, own port).
+# Deploy on .13:  cd /home/sam/paseo/projects/internet_use_control && docker compose up -d --build
+# The service is the single source of truth (SYSTEM_MAP.md). Only it publishes config.
+
+name: webrestrict
+
+services:
+  control:
+    build:
+      context: .
+      args:
+        VERSION: "0.1.0-phase1"
+    image: webrestrict/control:0.1.0-phase1
+    container_name: webrestrict-control
+    restart: unless-stopped
+    env_file:
+      - environment.d/control-service.env
+    ports:
+      - "8791:8791"
+    volumes:
+      - webrestrict-data:/data
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8791/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+volumes:
+  webrestrict-data: