Phase 1: Control Service skeleton (Go, SQLite, session login, Docker, Caddy)

- Go service with its own multi-stage Dockerfile and docker-compose.yml; runs
  as container webrestrict-control on port 8791.
- SQLite schema for the full AGENTS.md §7 data model via versioned migrations
  (PRAGMA user_version); audit log is append-only.
- Configuration from the process environment; the real env file is gitignored
  and a template is committed. No secrets in the repo.
- Separate session login (signed HMAC cookie + CSRF) for Sam.
- GET /health; HTMX + server-rendered dashboard styled with the Family Home Lab
  tokens.css (copied) and Inter fonts; dark mode; phone-friendly.
- Caddy vhost for webrestrict.lab.audasmedia.com.au applied on .35 (Let's
  Encrypt cert issued); route recorded in deploy/caddy/webrestrict.caddy.
- Unit tests for config, auth and store.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/templates/dashboard.html

@@ -0,0 +1,54 @@
+{{define "dashboard.html"}}<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="light dark">
+  <title>{{.Title}} — Internet Use Control</title>
+  <link rel="stylesheet" href="/static/tokens.css">
+  <link rel="stylesheet" href="/static/app.css">
+  <script src="/static/htmx.min.js" defer></script>
+</head>
+<body class="app">
+  <nav class="nav-bar">
+    <a class="nav-bar__brand" href="/">
+      <span class="nav-bar__mark" aria-hidden="true"></span>
+      Internet Use Control
+    </a>
+    <div class="nav-bar__right">
+      <span class="nav-bar__user">{{.Username}}</span>
+      <form method="post" action="/logout" class="nav-bar__logout">
+        <input type="hidden" name="csrf" value="{{.CSRF}}">
+        <button class="button-utility" type="submit">Sign out</button>
+      </form>
+    </div>
+  </nav>
+
+  <main class="container">
+    <header class="page-head">
+      <h1 class="heading-1">Dashboard</h1>
+      <p class="page-head__sub">Phase 1 skeleton — the Control Service is up and answering.</p>
+    </header>
+
+    {{template "status.html" .}}
+
+    <section class="section" aria-labelledby="devices-title">
+      <div class="section__head">
+        <h2 id="devices-title" class="heading-2">Devices</h2>
+        <span class="category-pill"><span class="dot dot--faint"></span>0 registered</span>
+      </div>
+      <div class="empty-state">
+        <p class="empty-state__title">No devices yet</p>
+        <p class="empty-state__body">Device registration arrives in Phase 2. Until then the
+          dashboard, session login and <code>/health</code> are the working pieces.</p>
+      </div>
+    </section>
+  </main>
+
+  <footer class="app-foot">
+    <span>Control Service · {{.Version}} · {{.AppEnv}}</span>
+    <span class="app-foot__sep">·</span>
+    <span>{{year}} Family Home Lab</span>
+  </footer>
+</body>
+</html>{{end}}