feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

scripts/test-device-protocol-c.cjs

@@ -0,0 +1,33 @@
+// Compile the portable documentation examples with real Mbed TLS, no device/network.
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { execFileSync } = require('node:child_process');
+const { vectors } = require('../docs/embedded-signing-reference.cjs');
+const compiler = process.env.VL_HOST_CC || 'E:/Qt/Tools/mingw1120_64/bin/gcc.exe';
+const tls = process.env.VL_MBEDTLS_DIR || 'E:/Codex/toolchains/esp-idf-v5.5.1/components/mbedtls/mbedtls';
+const sources = path.resolve(__dirname, '../docs/device-protocol-c');
+const output = fs.mkdtempSync(path.join(os.tmpdir(), 'vl-protocol-test-'));
+const vector = vectors();
+const key = Buffer.from(vector.testKeyHex, 'hex');
+const payload = '{"device_id":"OFFLINE-TEST","server_time_ms":1789459200000}';
+const base64 = Buffer.from(payload).toString('base64url');
+const hmac = text => crypto.createHmac('sha256', key).update(text).digest('hex');
+const sha = text => crypto.createHash('sha256').update(text).digest('hex');
+const definitions = { TEST_KEY: vector.testKeyHex, BODY_SHA: vector.bodySha256,
+  HTTP_SIGNATURE: vector.signature, EMPTY_SHA: sha(''), ABC_SHA: sha('abc'),
+  PAYLOAD_JSON: payload, PAYLOAD_B64: base64, TIME_MAC: hmac('TIME1\n' + base64), CFG_MAC: hmac('CFG1\n' + base64) };
+fs.writeFileSync(path.join(output, 'vectors.generated.h'), Object.entries(definitions)
+  .map(([name, value]) => `#define ${name} ${JSON.stringify(value)}`).join('\n'));
+const exe = path.join(output, 'test-protocol.exe');
+const args = ['-std=c99', '-Wall', '-Wextra', '-Werror', '-O2',
+  '-DMBEDTLS_CONFIG_FILE="host_mbedtls_config.h"', '-I' + sources, '-I' + output,
+  '-I' + path.join(tls, 'include'), '-I' + path.join(tls, 'library'),
+  path.join(sources, 'vl_protocol.c'), path.join(sources, 'test_protocol.c'),
+  ...['md.c', 'sha256.c', 'base64.c', 'platform.c', 'platform_util.c', 'constant_time.c'].map(file => path.join(tls, 'library', file)),
+  '-o', exe];
+const env = { ...process.env, PATH: path.dirname(compiler) + path.delimiter + process.env.PATH };
+execFileSync(compiler, args, { stdio: 'inherit', windowsHide: true, env });
+process.stdout.write(execFileSync(exe, [], { encoding: 'utf8', windowsHide: true, env }));
+console.log(JSON.stringify({ output, networkRequests: 0, liveDeviceKeysUsed: false }));