feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/onboarding/local_phone_account.go

@@ -0,0 +1,25 @@
+package onboarding
+
+import (
+	"context"
+	"errors"
+)
+
+// ProvisionLocalDemoPhone links only the checked-in synthetic owner fixture.
+// It has no HTTP route and never replaces an existing password.
+func (s *Service) ProvisionLocalDemoPhone(ctx context.Context, password string) error {
+	if !s.options.AllowLocalHTTP || !validNewPassword(password) {
+		return errors.New("local demo provisioning requires local HTTP and a valid password")
+	}
+	var issuer, subject string
+	err := s.pool.QueryRow(ctx, `SELECT oidc_issuer,oidc_subject FROM user_account WHERE id='10000000-0000-0000-0000-000000000101' AND oidc_issuer='http://localhost:58180/realms/voice-local' AND oidc_subject='00000000-0000-0000-0000-000000000101' AND account_kind='customer' AND platform_role='customer' AND status='active'`).Scan(&issuer, &subject)
+	if err != nil {
+		return err
+	}
+	encoded, err := hashPassword(ctx, password)
+	if err != nil {
+		return err
+	}
+	_, err = s.pool.Exec(ctx, `INSERT INTO customer_phone_credential(phone_digest,phone_masked,issuer,subject,password_hash) VALUES($1,'+86138****0000',$2,$3,$4) ON CONFLICT DO NOTHING`, domainMAC(s.crypt.hashKey, "PHONE1\n+8613800000000"), issuer, subject, encoded)
+	return err
+}