feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/onboarding/voice_runtime_test.go

@@ -0,0 +1,37 @@
+package onboarding
+
+import (
+	"github.com/google/uuid"
+	"testing"
+)
+
+func TestVoiceRuntimeRequiresCurrentBootAndBinding(t *testing.T) {
+	f := newFixture(t)
+	code, _ := f.deviceCall("voice-runtime", VoiceRuntimeInput{BootID: uuid.NewString()}, "", true)
+	if code != 409 {
+		t.Fatalf("wrong boot: %d", code)
+	}
+	_, err := f.s.BindBLE(f.ctx, f.d, uuid.NewString(), BLEBindInput{Token: f.bleToken()})
+	must(t, err)
+	f.refresh()
+	boot := uuid.NewString()
+	_, err = f.s.pool.Exec(f.ctx, `UPDATE device SET onboarding_boot_id=$2::uuid WHERE id=$1::uuid`, f.d.ID, boot)
+	must(t, err)
+	f.refresh()
+	code, out := f.deviceCall("voice-runtime", VoiceRuntimeInput{BootID: boot}, "", true)
+	data := dataOK(t, code, out, "state command call_contract")
+	if data["call_contract"] != "CALL-MEMORY-1.1" || data["command"] == nil {
+		t.Fatal("missing signed activation command")
+	}
+	// Reading the command must never contact the provider or mark the device READY.
+	if f.registrar.calls.Load() != 0 {
+		t.Fatal("runtime read consumed provider activation")
+	}
+	if data["state"].(map[string]any)["activation_state"] == "READY" {
+		t.Fatal("runtime read bypassed first test")
+	}
+	code, _ = f.deviceCall("voice-runtime", VoiceRuntimeInput{BootID: boot}, "", false)
+	if code != 400 {
+		t.Fatalf("HTTP accepted: %d", code)
+	}
+}