feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/orchestration/hardware_agent.go

@@ -25,6 +25,7 @@ import (
 var (
 	ErrHardwareSessionProof  = errors.New("hardware agent session proof is invalid")
 	ErrHardwareEventConflict = errors.New("hardware agent event conflicts with stored event")
+	ErrCallContractRequired  = errors.New("CALL-MEMORY-1.1 required after a critical memory change")
 )
 
 func (s *Service) CreateHardwareAgent(ctx context.Context, identity deviceauth.Identity, idempotencyKey, requestID string, rawRequest []byte, input HardwareAgentCreateInput) (HardwareAgentCreateResponse, bool, error) {
@@ -32,13 +33,6 @@ func (s *Service) CreateHardwareAgent(ctx context.Context, identity deviceauth.I
 	request := idempotency.Request{TenantID: &tenantID, ActorKey: "device:" + identity.PublicID,
 		Scope: "POST /device/v3/agent-sessions", Key: idempotencyKey,
 		RequestHash: idempotency.Hash(rawRequest), ExpiresAfter: 24 * time.Hour}
-	if identity.EnrollmentMode != "physical_confirm" {
-		if cached, found, err := s.executor.Lookup(ctx, request); err != nil {
-			return HardwareAgentCreateResponse{}, false, err
-		} else if found {
-			return s.finalizeHardwareCreate(cached)
-		}
-	}
 	memoryVector, memoryPolicy, err := s.prepareMemoryQuery(ctx, identity, input.RequestedGoal)
 	if err != nil {
 		return HardwareAgentCreateResponse{}, false, err