feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/orchestration/onboarding.go

@@ -16,6 +16,14 @@ var ErrOnboardingState = errors.New("onboarding state or test permit is no longe
 
 func onboardingCreateGuard(identity deviceauth.Identity, input HardwareAgentCreateInput) idempotency.Guard {
 	return func(ctx context.Context, tx pgx.Tx, cached *idempotency.Result) error {
+		var epoch int64
+		epochErr := tx.QueryRow(ctx, `SELECT us.privacy_epoch FROM memory_user_state us JOIN device_binding b ON b.subject_id=us.subject_id WHERE b.device_id=$1::uuid AND b.unbound_at IS NULL FOR UPDATE OF us`, identity.ID).Scan(&epoch)
+		if epochErr != nil && !errors.Is(epochErr, pgx.ErrNoRows) {
+			return epochErr
+		}
+		if epoch > 0 {
+			return ErrCallContractRequired
+		}
 		var mode, status, lifecycle string
 		var generation int64
 		err := tx.QueryRow(ctx, `SELECT enrollment_mode,status,activation_state,binding_generation FROM device WHERE id=$1::uuid AND tenant_id=$2::uuid FOR UPDATE`, identity.ID, identity.TenantID).Scan(&mode, &status, &lifecycle, &generation)