feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/onboarding/logout.go

@@ -14,12 +14,12 @@ func (s *Service) accountSessionHTTP(r *http.Request) (any, error) {
 	if err != nil {
 		return nil, err
 	}
-	token := randomToken(32)
-	_, err = s.pool.Exec(r.Context(), `UPDATE onboarding_account_session SET csrf_hash=$2 WHERE token_hash=$1 AND revoked_at IS NULL AND expires_at>now()`, digest([]byte(cookie.Value)), digest([]byte(token)))
+	token := s.sessionCSRF("ACCOUNT-CSRF1", cookie.Value)
+	_, err = s.pool.Exec(r.Context(), `UPDATE `+s.accountSessionTable()+` SET csrf_hash=$2 WHERE token_hash=$1 AND revoked_at IS NULL AND expires_at>now()`, digest([]byte(cookie.Value)), digest([]byte(token)))
 	if err != nil {
 		return nil, err
 	}
-	if c, e := r.Cookie(s.cookieName(false)); e == nil && validB64(c.Value, 32) {
+	if c, e := r.Cookie(s.cookieName(false)); !s.operatorLogin && e == nil && validB64(c.Value, 32) {
 		_, err = s.pool.Exec(r.Context(), `UPDATE onboarding_web_session SET csrf_hash=$2 WHERE token_hash=$1 AND issuer=$3 AND subject=$4 AND revoked_at IS NULL AND expires_at>now()`, digest([]byte(c.Value)), digest([]byte(token)), p.Issuer, p.Subject)
 		if err != nil {
 			return nil, err
@@ -39,14 +39,14 @@ func (s *Service) logoutHTTP(w http.ResponseWriter, r *http.Request) (any, error
 		return nil, err
 	}
 	// Expired cookies can be cleared without treating them as a live login.
-	for _, account := range []bool{true, false} {
+	for _, account := range s.logoutKinds() {
 		c, e := r.Cookie(s.cookieName(account))
 		if e != nil {
 			continue
 		}
 		table := "onboarding_web_session"
 		if account {
-			table = "onboarding_account_session"
+			table = s.accountSessionTable()
 		}
 		var live bool
 		err = s.pool.QueryRow(r.Context(), `SELECT EXISTS(SELECT 1 FROM `+table+` WHERE token_hash=$1 AND revoked_at IS NULL AND expires_at>now())`, digest([]byte(c.Value))).Scan(&live)
@@ -64,20 +64,20 @@ func (s *Service) logoutHTTP(w http.ResponseWriter, r *http.Request) (any, error
 			}
 		}
 	}
-	for _, account := range []bool{true, false} {
+	for _, account := range s.logoutKinds() {
 		c, e := r.Cookie(s.cookieName(account))
 		if e != nil {
 			continue
 		}
 		table := "onboarding_web_session"
 		if account {
-			table = "onboarding_account_session"
+			table = s.accountSessionTable()
 		}
 		if _, err = s.pool.Exec(r.Context(), `UPDATE `+table+` SET revoked_at=COALESCE(revoked_at,now()) WHERE token_hash=$1`, digest([]byte(c.Value))); err != nil {
 			return nil, err
 		}
 	}
-	for _, account := range []bool{false, true} {
+	for _, account := range s.logoutKinds() {
 		http.SetCookie(w, &http.Cookie{Name: s.cookieName(account), Value: "", Path: "/", HttpOnly: true, Secure: !s.options.AllowLocalHTTP, SameSite: http.SameSiteLaxMode, MaxAge: -1})
 	}
 	return map[string]any{"signed_out": true}, nil