feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

web/test/family-control-policy.test.mjs

@@ -0,0 +1,47 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { familyControlMode, familyControlReady, familyControlDangerous } from '../src/pages/family-control-policy.ts';
+
+const draft = kind => ({ kind, acknowledged: false, confirmation: '' });
+
+test('ordinary saves and authorized media access can execute without a second acknowledgement', () => {
+  for (const kind of ['household_create', 'fact_create', 'subject_update', 'device_twin_update', 'invitation_create', 'recording_play_address', 'recording_download_address', 'privacy_access_request', 'privacy_export_download', 'firmware_release_resume']) {
+    assert.equal(familyControlMode(kind), 'direct');
+    assert.equal(familyControlReady(draft(kind)), true);
+    assert.equal(familyControlDangerous(kind), false);
+  }
+});
+
+test('permission and device-impact actions still require a review surface', () => {
+  for (const kind of ['invitation_accept', 'recording_access_grant', 'sharing_grant_create', 'privacy_export_request', 'member_remove', 'consent_withdraw', 'firmware_key_register', 'firmware_key_revoke', 'firmware_rollout_start', 'firmware_release_retire', 'firmware_pause', 'firmware_rollback', 'device_diagnostics']) {
+    assert.equal(familyControlMode(kind), 'review', kind);
+  }
+});
+
+test('creating a subject never silently accepts data consent', () => {
+  assert.equal(familyControlMode('subject_create'), 'consent');
+  assert.equal(familyControlReady(draft('subject_create')), false);
+  assert.equal(familyControlReady({ ...draft('subject_create'), acknowledged: true }), true);
+});
+
+test('ownership transfer requires the exact named recipient, while removal needs a single review', () => {
+  const transfer = { ...draft('ownership_transfer'), item: { display_name: '测试家人' } };
+  assert.equal(familyControlMode(transfer.kind), 'typed');
+  for (const confirmation of ['', '测试', '另一位家人']) assert.equal(familyControlReady({ ...transfer, confirmation }), false);
+  assert.equal(familyControlReady({ ...transfer, confirmation: '测试家人' }), true);
+  assert.equal(familyControlReady({ ...transfer, confirmation: ' 测试家人 ' }), true);
+  assert.equal(familyControlReady({ ...draft('member_remove'), item: transfer.item }), true);
+});
+
+test('unchanged roles cannot be submitted even after confirming', () => {
+  const role = { ...draft('member_role_change'), item: { role: 'viewer' }, targetRole: 'viewer', acknowledged: true };
+  assert.equal(familyControlReady(role), false);
+  assert.equal(familyControlReady({ ...role, targetRole: 'editor', acknowledged: false }), true);
+});
+
+test('danger styling distinguishes granting access from losing it', () => {
+  assert.equal(familyControlDangerous('recording_access_grant'), false);
+  assert.equal(familyControlDangerous('recording_access_revoke'), true);
+  assert.equal(familyControlDangerous('ownership_transfer'), true);
+  assert.equal(familyControlDangerous('firmware_release_retire'), true);
+});