feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/outbox/errors.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"net"
+	"time"
 
 	"github.com/jackc/pgx/v5/pgconn"
 )
@@ -18,6 +19,33 @@ type retryableError struct{ cause error }
 func (e retryableError) Error() string { return e.cause.Error() }
 func (e retryableError) Unwrap() error { return e.cause }
 
+type retryAfterError struct {
+	cause error
+	delay time.Duration
+}
+
+func (e retryAfterError) Error() string             { return e.cause.Error() }
+func (e retryAfterError) Unwrap() error             { return e.cause }
+func (e retryAfterError) RetryAfter() time.Duration { return e.delay }
+
+// RetryAfter requests a minimum delay for a retryable dependency failure.
+// The worker still enforces its normal attempt limit and exponential backoff.
+func RetryAfter(err error, delay time.Duration) error {
+	if err == nil {
+		return nil
+	}
+	return retryAfterError{cause: Retryable(err), delay: max(delay, RetryDelay(err))}
+}
+
+// RetryDelay finds the optional dependency backoff through wrapped errors.
+func RetryDelay(err error) time.Duration {
+	var delayed interface{ RetryAfter() time.Duration }
+	if errors.As(err, &delayed) {
+		return max(delayed.RetryAfter(), 0)
+	}
+	return 0
+}
+
 // Retryable marks an error as safe to execute again with the same idempotency
 // boundary. A nil error remains nil so callers can wrap return values directly.
 func Retryable(err error) error {

internal/outbox/worker.go

@@ -96,7 +96,7 @@ func (w *Worker) ProcessOnce(ctx context.Context) (int, error) {
 			errorCode := "HANDLER_PERMANENT_FAILURE"
 			if retryable {
 				maxAttempts = w.options.MaxAttempts
-				nextAttempt = w.nextAttempt(event.AttemptCount)
+				nextAttempt = w.nextAttemptForError(event.AttemptCount, err)
 				errorCode = "HANDLER_TEMPORARY_FAILURE"
 			}
 			w.logger.Warn("outbox handler failed", "event_id", event.ID, "event_type", event.EventType, "attempt", event.AttemptCount, "retryable", retryable)
@@ -127,6 +127,14 @@ func (w *Worker) nextAttempt(attempt int) time.Time {
 	return time.Now().Add(delay)
 }
 
+func (w *Worker) nextAttemptForError(attempt int, err error) time.Time {
+	next := w.nextAttempt(attempt)
+	if requested := time.Now().Add(RetryDelay(err)); requested.After(next) {
+		return requested
+	}
+	return next
+}
+
 func randomFraction() float64 {
 	var value [8]byte
 	if _, err := rand.Read(value[:]); err != nil {

internal/outbox/worker_test.go

@@ -69,3 +69,24 @@ func TestRetryableErrorAllowList(t *testing.T) {
 		t.Fatal("wrapped marker must remain discoverable")
 	}
 }
+
+func TestWorkerHonorsOptionalDependencyRetryDelay(t *testing.T) {
+	worker := NewWorker(nil, discardLogger(), WorkerOptions{BaseRetry: time.Second, MaxRetry: 3 * time.Second})
+	cause := errors.New("provider rate limited")
+	delayed := fmt.Errorf("privacy deletion: %w", RetryAfter(cause, time.Minute))
+	if !IsRetryable(delayed) || !errors.Is(delayed, cause) || RetryDelay(delayed) != time.Minute {
+		t.Fatalf("retry metadata lost through wrapping: %v", delayed)
+	}
+	if delay := time.Until(worker.nextAttemptForError(1, delayed)); delay < 59*time.Second || delay > 61*time.Second {
+		t.Fatalf("dependency cooldown was not honored: %s", delay)
+	}
+	if delay := time.Until(worker.nextAttemptForError(1, Retryable(cause))); delay < 400*time.Millisecond || delay > 1100*time.Millisecond {
+		t.Fatalf("ordinary retries changed: %s", delay)
+	}
+	if RetryAfter(nil, time.Minute) != nil || RetryDelay(cause) != 0 || RetryDelay(RetryAfter(cause, -time.Second)) != 0 {
+		t.Fatal("nil, ordinary or negative retry delay was not handled")
+	}
+	if RetryDelay(RetryAfter(delayed, time.Second)) != time.Minute {
+		t.Fatal("outer wrapper shortened dependency cooldown")
+	}
+}