Phase 1: Control Service skeleton (Go, SQLite, session login, Docker, Caddy)

- Go service with its own multi-stage Dockerfile and docker-compose.yml; runs
  as container webrestrict-control on port 8791.
- SQLite schema for the full AGENTS.md §7 data model via versioned migrations
  (PRAGMA user_version); audit log is append-only.
- Configuration from the process environment; the real env file is gitignored
  and a template is committed. No secrets in the repo.
- Separate session login (signed HMAC cookie + CSRF) for Sam.
- GET /health; HTMX + server-rendered dashboard styled with the Family Home Lab
  tokens.css (copied) and Inter fonts; dark mode; phone-friendly.
- Caddy vhost for webrestrict.lab.audasmedia.com.au applied on .35 (Let's
  Encrypt cert issued); route recorded in deploy/caddy/webrestrict.caddy.
- Unit tests for config, auth and store.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/templates/partials/status.html

@@ -0,0 +1,34 @@
+{{define "status.html"}}<section class="card-grid" id="status" hx-get="/partials/status" hx-trigger="every 10s" hx-swap="outerHTML">
+  <article class="tool-card">
+    <div class="tool-card__icon tool-card__icon--green" aria-hidden="true">●</div>
+    <h3 class="tool-card__title">Service</h3>
+    <p class="tool-card__desc">
+      {{if .DBHealthy}}Running{{else}}Database error{{end}}
+    </p>
+    <span class="status-pill {{if .DBHealthy}}status-pill--on{{else}}status-pill--off{{end}}">
+      <span class="dot {{if .DBHealthy}}dot--on{{else}}dot--off{{end}}"></span>
+      {{if .DBHealthy}}online{{else}}offline{{end}}
+    </span>
+  </article>
+
+  <article class="tool-card">
+    <div class="tool-card__icon tool-card__icon--sky" aria-hidden="true">▤</div>
+    <h3 class="tool-card__title">Database</h3>
+    <p class="tool-card__desc">SQLite · source of truth</p>
+    <span class="status-pill status-pill--muted">{{if .DBHealthy}}ok{{else}}error{{end}}</span>
+  </article>
+
+  <article class="tool-card">
+    <div class="tool-card__icon tool-card__icon--purple" aria-hidden="true">⏱</div>
+    <h3 class="tool-card__title">Uptime</h3>
+    <p class="tool-card__desc">{{.ServerUp}}</p>
+    <span class="status-pill status-pill--muted">since boot</span>
+  </article>
+
+  <article class="tool-card">
+    <div class="tool-card__icon tool-card__icon--orange" aria-hidden="true">⌚</div>
+    <h3 class="tool-card__title">Server time</h3>
+    <p class="tool-card__desc">{{.ServerTime}}</p>
+    <span class="status-pill status-pill--muted">local</span>
+  </article>
+</section>{{end}}