feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/objectstore/store.go

@@ -108,6 +108,18 @@ func (s *Store) PresignUpload(ctx context.Context, objectRef string, ttl time.Du
 	return signed.String(), nil
 }
 
+func (s *Store) OpenDownload(ctx context.Context, objectRef string) (io.ReadSeekCloser, error) {
+	object, err := s.internal.GetObject(ctx, s.bucket, objectRef, minio.GetObjectOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("open private download object: %w", err)
+	}
+	if _, err := object.Stat(); err != nil {
+		object.Close()
+		return nil, fmt.Errorf("stat private download object: %w", err)
+	}
+	return object, nil
+}
+
 func (s *Store) VerifyDigest(ctx context.Context, objectRef, expectedDigest string, expectedSize int64) error {
 	object, err := s.internal.GetObject(ctx, s.bucket, objectRef, minio.GetObjectOptions{})
 	if err != nil {
@@ -163,6 +175,15 @@ func (s *Store) PresignMediaDownload(ctx context.Context, objectRef string, ttl
 	return signed.String(), nil
 }
 
+// FreezeFirmware separates expiring upload URLs from published firmware objects.
+func (s *Store) FreezeFirmware(ctx context.Context, source, target, digest string, size int64) error {
+	_, err := s.internal.CopyObject(ctx, minio.CopyDestOptions{Bucket: s.bucket, Object: target}, minio.CopySrcOptions{Bucket: s.bucket, Object: source})
+	if err != nil {
+		return err
+	}
+	return s.VerifyDigest(ctx, target, digest, size)
+}
+
 func (s *Store) Remove(ctx context.Context, objectRef string) error {
 	if objectRef == "" {
 		return nil