feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/onboarding/integration_test.go

@@ -3,13 +3,9 @@ package onboarding
 import (
 	"bytes"
 	"context"
-	"crypto/rand"
-	"crypto/rsa"
 	"crypto/sha256"
-	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
-	"encoding/pem"
 	"errors"
 	"net/http"
 	"net/http/httptest"
@@ -24,6 +20,7 @@ import (
 	"data-terminal-cloud/internal/hardwareprovision"
 	"data-terminal-cloud/internal/identity"
 	"data-terminal-cloud/internal/outbox"
+	"data-terminal-cloud/internal/saas"
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/redis/go-redis/v9"
@@ -83,6 +80,7 @@ func newFixture(t *testing.T) *fixture {
 	f.s, err = NewService(pool, cache, Options{Enabled: true, MasterKey: strings.Repeat("15", 32), ProviderMasterKey: strings.Repeat("25", 32), EntryURL: "https://platform.example/onboarding/entry", SelfSignupTenantIDs: []string{f.tenantPublic}, ActivationEnabled: true, Registrar: f.registrar, InstanceID: "test-instance", ProductKey: "test-product", ProductSecret: "fixture-product-secret-at-least-32-bytes", BotID: "test-bot", Transport: "high_quality", MinimumSDKVersion: "1.0.0"})
 	must(t, err)
 	_, err = pool.Exec(ctx, `INSERT INTO tenant(id,public_id,name) VALUES($1::uuid,$2::uuid,'onboarding integration')`, f.tenant, f.tenantPublic)
+	f.s.options.LegacyDeviceRegistration = true // Existing tests exercise old-device migration contracts.
 	must(t, err)
 	_, err = pool.Exec(ctx, `INSERT INTO user_account(id,tenant_id,oidc_issuer,oidc_subject,display_name,platform_role,account_kind) VALUES($1::uuid,$2::uuid,$3,$4,'生产管理员','ops_admin','operator')`, f.operatorID, f.tenant, f.p.Issuer, f.p.Subject)
 	must(t, err)
@@ -99,14 +97,14 @@ func newFixture(t *testing.T) *fixture {
 	}
 	public := inv["platform_device_id"].(string)
 	job := inv["enrollment_job_id"].(string)
-	receiver, err := rsa.GenerateKey(rand.Reader, 2048)
-	must(t, err)
-	pub, err := x509.MarshalPKIXPublicKey(&receiver.PublicKey)
-	must(t, err)
-	_, err = f.s.DeliverCredential(ctx, f.p, f.tenantPublic, public, uuid.NewString(), DeliveryInput{JobID: job, ReceiverKey: string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: pub}))})
-	must(t, err)
-	_, err = f.s.ReleaseInventory(ctx, f.p, f.tenantPublic, public, uuid.NewString(), ReleaseInput{JobID: job, Evidence: "fixture-burn-readback", ExpectedVersion: 1})
-	must(t, err)
+	if inv["released"] != true {
+		t.Fatal("new inventory did not become immediately claimable")
+	}
+	var lifecycle, keyStatus, jobStatus string
+	must(t, f.s.pool.QueryRow(ctx, `SELECT d.activation_state,k.status,ej.status FROM device d JOIN device_onboarding_key k ON k.device_id=d.id AND k.key_version=1 JOIN device_enrollment_job ej ON ej.device_id=d.id AND ej.id=$2::uuid WHERE d.public_id=$1::uuid`, public, job).Scan(&lifecycle, &keyStatus, &jobStatus))
+	if lifecycle != "CLAIMABLE" || keyStatus != "ACTIVE" || jobStatus != "RELEASED" {
+		t.Fatalf("direct inventory state lifecycle=%s key=%s job=%s", lifecycle, keyStatus, jobStatus)
+	}
 	f.d, err = f.s.findFactoryDevice(ctx, "KP01-"+mac, 1)
 	must(t, err)
 	boot := uuid.NewString()
@@ -144,7 +142,7 @@ func newFixture(t *testing.T) *fixture {
 	must(t, err)
 	f.web, err = f.s.webSession(ctx, pool, digest([]byte(credentials.Token)))
 	must(t, err)
-	profile := ProfileInput{HouseholdName: "测试家庭", Name: "奶奶"}
+	profile := ProfileInput{HouseholdName: "测试家庭", Name: "奶奶", InitialConsents: saas.InitialConsentSelection{Types: []string{saas.ConsentTranscriptStorage, saas.ConsentPersonalMemory}, Confirmed: true}}
 	result, err := f.s.CreateProfile(ctx, f.web, uuid.NewString(), requestJSON(profile), profile)
 	must(t, err)
 	f.elder = result["elder_id"].(string)