feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/outbox/worker_test.go

@@ -69,3 +69,24 @@ func TestRetryableErrorAllowList(t *testing.T) {
 		t.Fatal("wrapped marker must remain discoverable")
 	}
 }
+
+func TestWorkerHonorsOptionalDependencyRetryDelay(t *testing.T) {
+	worker := NewWorker(nil, discardLogger(), WorkerOptions{BaseRetry: time.Second, MaxRetry: 3 * time.Second})
+	cause := errors.New("provider rate limited")
+	delayed := fmt.Errorf("privacy deletion: %w", RetryAfter(cause, time.Minute))
+	if !IsRetryable(delayed) || !errors.Is(delayed, cause) || RetryDelay(delayed) != time.Minute {
+		t.Fatalf("retry metadata lost through wrapping: %v", delayed)
+	}
+	if delay := time.Until(worker.nextAttemptForError(1, delayed)); delay < 59*time.Second || delay > 61*time.Second {
+		t.Fatalf("dependency cooldown was not honored: %s", delay)
+	}
+	if delay := time.Until(worker.nextAttemptForError(1, Retryable(cause))); delay < 400*time.Millisecond || delay > 1100*time.Millisecond {
+		t.Fatalf("ordinary retries changed: %s", delay)
+	}
+	if RetryAfter(nil, time.Minute) != nil || RetryDelay(cause) != 0 || RetryDelay(RetryAfter(cause, -time.Second)) != 0 {
+		t.Fatal("nil, ordinary or negative retry delay was not handled")
+	}
+	if RetryDelay(RetryAfter(delayed, time.Second)) != time.Minute {
+		t.Fatal("outer wrapper shortened dependency cooldown")
+	}
+}