feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/httpapi/onboarding_customer_auth.go

@@ -11,9 +11,23 @@ func onboardingCustomerAuth(service *onboarding.Service, bearer, next http.Handl
 		return bearer
 	}
 	cookie := service.CustomerAuth(next)
+	operator := service.OperatorAuth(next)
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		path := r.URL.Path
-		allowed := path == "/api/v1/me" || path == "/api/v1/households" || strings.HasPrefix(path, "/api/v1/households/") || strings.HasPrefix(path, "/api/v1/subjects/") || strings.HasPrefix(path, "/api/v1/devices/")
+		if strings.HasPrefix(r.Header.Get("Authorization"), "Mini ") {
+			if operatorCookieRequest(r) {
+				operator.ServeHTTP(w, r)
+				return
+			}
+			if customerCookieRequest(r) {
+				cookie.ServeHTTP(w, r)
+				return
+			}
+		}
+		if r.Header.Get("Authorization") == "" && operatorCookieRequest(r) {
+			operator.ServeHTTP(w, r)
+			return
+		}
+		allowed := customerCookieRequest(r)
 		if r.Header.Get("Authorization") == "" && allowed {
 			cookie.ServeHTTP(w, r)
 			return
@@ -21,3 +35,32 @@ func onboardingCustomerAuth(service *onboarding.Service, bearer, next http.Handl
 		bearer.ServeHTTP(w, r)
 	})
 }
+
+func operatorCookieRequest(r *http.Request) bool {
+	path := r.URL.Path
+	if path == "/api/v1/ops" || strings.HasPrefix(path, "/api/v1/ops/") {
+		return true
+	}
+	if path == "/api/v1/content-models" || strings.HasPrefix(path, "/api/v1/content-models/") {
+		return r.Method != http.MethodGet || r.Header.Get("X-Login-Portal") == "operator"
+	}
+	return (path == "/api/v1/me" || path == "/api/v1/events") && r.Header.Get("X-Login-Portal") == "operator"
+}
+
+func customerCookieRequest(r *http.Request) bool {
+	// The portal reads the active model after loading a household. Model writes
+	// remain under the original operator authentication and authorization.
+	return customerCookiePath(r.URL.Path) || (r.Method == http.MethodGet && r.URL.Path == "/api/v1/content-models")
+}
+
+func customerCookiePath(path string) bool {
+	// Explicit customer resources only. Operations, provider and device protocol
+	// endpoints still require their original authentication.
+	for _, resource := range []string{"me", "households", "subjects", "devices", "device-claims", "member-invitations", "events", "conversations", "stories", "memoirs", "memories", "privacy-requests", "exports", "sharing-grants", "recording-access-grants", "media-segments", "firmware-releases", "firmware-rollouts"} {
+		root := "/api/v1/" + resource
+		if path == root || strings.HasPrefix(path, root+"/") {
+			return true
+		}
+	}
+	return false
+}