feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/onboarding/web.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"data-terminal-cloud/internal/identity"
+	"data-terminal-cloud/internal/saas"
 	"github.com/jackc/pgx/v5"
 )
 
@@ -17,10 +18,11 @@ type WebSession struct {
 	Expires                                time.Time
 }
 type BrowserCredentials struct {
-	Token        string         `json:"-"`
-	CSRF         string         `json:"csrf_token"`
-	AccountToken string         `json:"-"`
-	Data         map[string]any `json:"data"`
+	TrustedDeviceToken string         `json:"-"`
+	Token              string         `json:"-"`
+	CSRF               string         `json:"csrf_token"`
+	AccountToken       string         `json:"-"`
+	Data               map[string]any `json:"data"`
 }
 
 func (s *Service) webSession(ctx context.Context, q queryer, hash string) (WebSession, error) {
@@ -389,12 +391,16 @@ func (s *Service) Profiles(ctx context.Context, w WebSession) (map[string]any, e
 }
 
 type ProfileInput struct {
-	HouseholdID   string `json:"household_id,omitempty"`
-	HouseholdName string `json:"household_name,omitempty"`
-	Name          string `json:"preferred_name"`
+	InitialConsents saas.InitialConsentSelection `json:"initial_consents,omitempty"`
+	HouseholdID     string                       `json:"household_id,omitempty"`
+	HouseholdName   string                       `json:"household_name,omitempty"`
+	Name            string                       `json:"preferred_name"`
 }
 
 func (s *Service) CreateProfile(ctx context.Context, w WebSession, requestID string, raw []byte, in ProfileInput) (map[string]any, error) {
+	if err := saas.ValidateInitialConsents(in.InitialConsents); err != nil {
+		return nil, fail(400, "VALIDATION_FAILED", "请逐项选择授权并确认用途")
+	}
 	if w.UserID == "" || !nonempty(in.Name, 120) || (in.HouseholdID == "" && !nonempty(in.HouseholdName, 200)) || (in.HouseholdID != "" && !uuidValid(in.HouseholdID)) {
 		return nil, fail(400, "VALIDATION_FAILED", "家庭和使用者信息不正确")
 	}
@@ -424,6 +430,9 @@ func (s *Service) CreateProfile(ctx context.Context, w WebSession, requestID str
 		if err != nil {
 			return nil, err
 		}
+		if err = saas.InitializeSubjectMemory(ctx, tx, d.TenantID, id, w.UserID, requestID, in.InitialConsents); err != nil {
+			return nil, err
+		}
 		if err = s.auditEvent(ctx, tx, d, "user", accountPublicID(ctx, tx, w.UserID), "onboarding.profile.create", requestID, map[string]any{"subject_id": id}); err != nil {
 			return nil, err
 		}