feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/onboarding/crypto.go

@@ -89,6 +89,20 @@ func keyAAD(device string, version int64) string {
 	return fmt.Sprintf("ONBOARDING-KEY1\n%s\n%d", device, version)
 }
 
+// SealDeviceKey stores a device HMAC key in the same format consumed by the
+// physical-confirm authentication path. The plaintext key is returned to the
+// caller only at device creation or explicit rotation time.
+func SealDeviceKey(masterKey, deviceID string, version int64, key []byte) ([]byte, error) {
+	if len(key) != 32 || !uuidValid(deviceID) || version < 1 {
+		return nil, errors.New("invalid onboarding device key input")
+	}
+	crypt, err := newCryptor(masterKey)
+	if err != nil {
+		return nil, err
+	}
+	return crypt.seal(key, keyAAD(deviceID, version)), nil
+}
+
 // Validate JSON before decoding structs: Go's regular decoder accepts duplicate
 // keys and repairs invalid UTF-8, both of which are forbidden by this contract.
 func StrictJSON(raw []byte, target any) error {