feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/webevents/history_integration_test.go

@@ -0,0 +1,64 @@
+package webevents
+
+import (
+	"context"
+	"data-terminal-cloud/internal/identity"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"os"
+	"testing"
+	"time"
+)
+
+func TestHistorySurvivesRefreshAndEnforcesHouseholdBoundary(t *testing.T) {
+	url := os.Getenv("TEST_DATABASE_URL")
+	if url == "" {
+		t.Skip("TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer pool.Close()
+	owner := identity.Principal{Issuer: "http://localhost:58180/realms/voice-local", Subject: "00000000-0000-0000-0000-000000000101"}
+	outsider := identity.Principal{Issuer: owner.Issuer, Subject: "00000000-0000-0000-0000-000000000103"}
+	ids := []string{uuid.NewString(), uuid.NewString(), uuid.NewString()}
+	defer pool.Exec(ctx, `DELETE FROM web_event WHERE resource_public_id=ANY($1::uuid[])`, ids)
+	for index, id := range ids {
+		age := time.Duration(index+1) * time.Hour
+		expiry := time.Now().Add(24 * time.Hour)
+		if index == 2 {
+			expiry = time.Now().Add(-time.Hour)
+		}
+		_, err = pool.Exec(ctx, `INSERT INTO web_event(tenant_id,household_id,event_type,resource_type,resource_public_id,status,occurred_at,expires_at) VALUES('10000000-0000-0000-0000-000000000001','10000000-0000-0000-0000-000000000201','conversation.completed','conversation',$1::uuid,'COMPLETED',$2,$3)`, id, time.Now().Add(-age), expiry)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	service := NewService(pool)
+	for attempt := 0; attempt < 2; attempt++ {
+		items, err := service.History(ctx, owner, time.Now().Add(-7*24*time.Hour), 200)
+		if err != nil {
+			t.Fatal(err)
+		}
+		found := map[string]bool{}
+		for _, item := range items {
+			found[item.ResourceID] = true
+		}
+		if !found[ids[0]] || !found[ids[1]] || found[ids[2]] {
+			t.Fatal("missing retained history or returned expired metadata")
+		}
+	}
+	items, err := service.History(ctx, outsider, time.Now().Add(-7*24*time.Hour), 200)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, item := range items {
+		for _, id := range ids {
+			if item.ResourceID == id {
+				t.Fatal("history exposed another household")
+			}
+		}
+	}
+}