feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/outbox/errors.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"net"
+	"time"
 
 	"github.com/jackc/pgx/v5/pgconn"
 )
@@ -18,6 +19,33 @@ type retryableError struct{ cause error }
 func (e retryableError) Error() string { return e.cause.Error() }
 func (e retryableError) Unwrap() error { return e.cause }
 
+type retryAfterError struct {
+	cause error
+	delay time.Duration
+}
+
+func (e retryAfterError) Error() string             { return e.cause.Error() }
+func (e retryAfterError) Unwrap() error             { return e.cause }
+func (e retryAfterError) RetryAfter() time.Duration { return e.delay }
+
+// RetryAfter requests a minimum delay for a retryable dependency failure.
+// The worker still enforces its normal attempt limit and exponential backoff.
+func RetryAfter(err error, delay time.Duration) error {
+	if err == nil {
+		return nil
+	}
+	return retryAfterError{cause: Retryable(err), delay: max(delay, RetryDelay(err))}
+}
+
+// RetryDelay finds the optional dependency backoff through wrapped errors.
+func RetryDelay(err error) time.Duration {
+	var delayed interface{ RetryAfter() time.Duration }
+	if errors.As(err, &delayed) {
+		return max(delayed.RetryAfter(), 0)
+	}
+	return 0
+}
+
 // Retryable marks an error as safe to execute again with the same idempotency
 // boundary. A nil error remains nil so callers can wrap return values directly.
 func Retryable(err error) error {