Phase 1: Control Service skeleton (Go, SQLite, session login, Docker, Caddy)

- Go service with its own multi-stage Dockerfile and docker-compose.yml; runs
  as container webrestrict-control on port 8791.
- SQLite schema for the full AGENTS.md §7 data model via versioned migrations
  (PRAGMA user_version); audit log is append-only.
- Configuration from the process environment; the real env file is gitignored
  and a template is committed. No secrets in the repo.
- Separate session login (signed HMAC cookie + CSRF) for Sam.
- GET /health; HTMX + server-rendered dashboard styled with the Family Home Lab
  tokens.css (copied) and Inter fonts; dark mode; phone-friendly.
- Caddy vhost for webrestrict.lab.audasmedia.com.au applied on .35 (Let's
  Encrypt cert issued); route recorded in deploy/caddy/webrestrict.caddy.
- Unit tests for config, auth and store.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/store/store_test.go

@@ -0,0 +1,52 @@
+package store
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+)
+
+func TestMigrateAndFoundation(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "control.db")
+
+	st, err := Open(path)
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	defer st.Close()
+
+	if err := st.Migrate(ctx); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+	// Migrate is idempotent.
+	if err := st.Migrate(ctx); err != nil {
+		t.Fatalf("second Migrate: %v", err)
+	}
+
+	n, err := st.CountDevices(ctx)
+	if err != nil {
+		t.Fatalf("CountDevices: %v", err)
+	}
+	if n != 0 {
+		t.Errorf("CountDevices = %d, want 0", n)
+	}
+
+	if err := st.Audit(ctx, "sam", "test", nil, "phase1"); err != nil {
+		t.Fatalf("Audit: %v", err)
+	}
+
+	// Every §7 table must exist after migration.
+	want := []string{
+		"devices", "schedules", "blocklist", "allowlist",
+		"state", "telemetry", "overrides", "audit",
+	}
+	for _, table := range want {
+		var name string
+		err := st.DB().QueryRowContext(ctx,
+			`SELECT name FROM sqlite_master WHERE type='table' AND name=?`, table).Scan(&name)
+		if err != nil {
+			t.Errorf("table %q missing: %v", table, err)
+		}
+	}
+}