feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/saas/fleet_service.go

@@ -0,0 +1,51 @@
+package saas
+
+import (
+	"context"
+	"data-terminal-cloud/internal/devicefleet"
+	"data-terminal-cloud/internal/identity"
+	"errors"
+	"github.com/jackc/pgx/v5"
+)
+
+func (s *Service) FleetTenant(ctx context.Context, p identity.Principal, public string, mutate bool) (string, error) {
+	if s.Fleet == nil {
+		return "", errors.New("fleet unavailable")
+	}
+	a, err := resolveOpsFirmwareAccess(ctx, s.pool, p, public, mutate)
+	return a.tenantID, err
+}
+func (s *Service) FleetState(ctx context.Context, p identity.Principal, public, tenant string) (devicefleet.State, error) {
+	if s.Fleet == nil {
+		return devicefleet.State{}, errors.New("fleet unavailable")
+	}
+	var id string
+	if tenant != "" {
+		a, err := resolveOpsFirmwareAccess(ctx, s.pool, p, tenant, false)
+		if err != nil {
+			return devicefleet.State{}, err
+		}
+		if err = s.pool.QueryRow(ctx, `SELECT id::text FROM device WHERE public_id=$1 AND tenant_id=$2`, public, a.tenantID).Scan(&id); err != nil {
+			return devicefleet.State{}, ErrAccessDenied
+		}
+	} else {
+		a, _, err := resolveDevice(ctx, s.pool, p, public, identity.CapabilityHouseholdRead, false)
+		if err != nil {
+			return devicefleet.State{}, err
+		}
+		id = a.deviceID
+	}
+	return s.Fleet.State(ctx, id)
+}
+func (s *Service) FleetOTA(ctx context.Context, p identity.Principal, public, request string, code int64) (devicefleet.Task, error) {
+	if s.Fleet == nil {
+		return devicefleet.Task{}, errors.New("fleet unavailable")
+	}
+	return s.Fleet.Start(ctx, request, code, func(tx pgx.Tx) (string, error) {
+		a, _, err := resolveDevice(ctx, tx, p, public, identity.CapabilityDeviceManage, true)
+		if err != nil {
+			return "", err
+		}
+		return a.deviceID, nil
+	})
+}