feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/billing/usage.go

@@ -195,6 +195,10 @@ type quotaRow struct {
 }
 
 func CheckQuotaTx(ctx context.Context, tx pgx.Tx, identity deviceauth.Identity, now time.Time) (*BudgetSnapshot, error) {
+	// New and legacy call admissions share the same tenant concurrency boundary.
+	if _, err := tx.Exec(ctx, `SELECT pg_advisory_xact_lock(hashtextextended($1,19))`, identity.TenantID); err != nil {
+		return nil, err
+	}
 	tenantPolicy, err := readActiveQuota(ctx, tx, identity.TenantID, "TENANT", nil)
 	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
 		return nil, err
@@ -256,7 +260,7 @@ func CheckQuotaTx(ctx context.Context, tx pgx.Tx, identity deviceauth.Identity,
 	}
 	for _, policy := range policies {
 		var active int
-		query := `SELECT count(*) FROM conversation WHERE tenant_id=$1::uuid AND status IN ('PREPARING','ROOM_ISSUED','STARTING_AGENT','ACTIVE','STOPPING')`
+		query := `SELECT count(*) FROM (SELECT tenant_id,device_id FROM conversation WHERE status IN ('PREPARING','ROOM_ISSUED','STARTING_AGENT','ACTIVE','STOPPING') UNION ALL SELECT tenant_id,device_id FROM call_session WHERE manifest_status IN ('ISSUED','REVOKED') AND NOT(local_audio_off AND sdk_stopped AND remote_state IN ('NOT_STARTED','STOPPED_OBSERVED'))) admitted WHERE tenant_id=$1::uuid`
 		args := []any{identity.TenantID}
 		if hasDevicePolicy && policy.id == devicePolicy.id {
 			query += ` AND device_id=$2::uuid`