feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/onboarding/admin_phone_account_test.go

@@ -0,0 +1,41 @@
+package onboarding
+
+import (
+	"github.com/google/uuid"
+	"testing"
+)
+
+func TestAdminPhoneProvisionPreservesIdentityAndRefusesConflicts(t *testing.T) {
+	f := newLoginFixture(t)
+	const user = "10000000-0000-0000-0000-000000000101"
+	const issuer = "http://localhost:58180/realms/voice-local"
+	const subject = "00000000-0000-0000-0000-000000000101"
+	created, err := f.s.ProvisionCustomerPhone(f.ctx, user, issuer, subject, f.phone, "InitialOnly123!", uuid.NewString())
+	must(t, err)
+	if !created {
+		t.Fatal("not created")
+	}
+	created, err = f.s.ProvisionCustomerPhone(f.ctx, user, issuer, subject, f.phone, "InitialOnly123!", uuid.NewString())
+	must(t, err)
+	if created {
+		t.Fatal("retry changed credential")
+	}
+	if _, err = f.s.ProvisionCustomerPhone(f.ctx, user, issuer, subject, f.phone, "DifferentOnly123!", uuid.NewString()); err == nil {
+		t.Fatal("password overwritten")
+	}
+	if _, err = f.s.ProvisionCustomerPhone(f.ctx, user, issuer, "wrong-identity", f.phone, "InitialOnly123!", uuid.NewString()); err == nil {
+		t.Fatal("wrong identity accepted")
+	}
+	// The existing customer identity is used even when login starts with SMS.
+	account, csrf := f.smsAccount()
+	p, err := f.s.AccountPrincipal(f.ctx, account.Value, csrf, true)
+	must(t, err)
+	if p.Issuer != issuer || p.Subject != subject {
+		t.Fatal("SMS created a second identity")
+	}
+	var count int
+	must(t, f.s.pool.QueryRow(f.ctx, `SELECT count(*) FROM customer_phone_credential WHERE issuer=$1 AND subject=$2`, issuer, subject).Scan(&count))
+	if count != 1 {
+		t.Fatal("duplicate credential")
+	}
+}