refactor!: unify control state and add durable connection notifications

[leonfox28]

Replace fragmented control state and transient notification delivery with one transactional control database and a durable outbox. SMS operations resolve the current Agent/device/SIM identity, and a lost response after submission remains unconfirmed without automatic resend.

Behavior

• Initialize the administrator and instance readiness during installation; login opens the management UI directly.
• Add VoWiFi and cellular connected/disconnected notifications. The first confirmed online observation notifies, and every confirmed transition is queued without a disconnect delay. Unknown observations preserve the previous state.
• Persist notification checkpoints, stream cursors and delivery tasks atomically. Retry temporary failures with 15-second to 5-minute backoff, recover after restart, preserve per-connection delivery order, and cancel pending tasks when subscriptions or associated objects are removed.
• Separate application ports from protocol, HTTP, persistence, file and process adapters; split HTTP handlers and move production IMS code out of HIL. Drain requests and background work before closing resources.
• Tighten C bridge validation and netd mounts; reorganize Web features and session/SMS state handling. Synchronize OpenAPI, generated clients, sqlc, installation guidance and ADR 0028.

Breaking changes

The previous API/setup flow and database layout are incompatible. New installations use data/control-v2; legacy layouts fail closed without automatic migration or deletion. The Agent SMS recovery database remains separate. A new release containing this change is required for the updated installation instructions.

Validation

• Go package tests and full race run; final affected-package race checks.
• 65 Web tests, TypeScript, desktop/mobile browser fixtures, and a real-backend Simulator browser flow covering installation/login, modems/lines, SMS, calls and connection notifications.
• Build, vet/actionlint, formatting, documentation, generated-file consistency, module verification and container contracts.
• C fixtures with AddressSanitizer/UndefinedBehaviorSanitizer; dependency audits and a redacted secret scan of the complete proposed source tree.

Detailed evidence and limitations: acceptance record. No deployment or real-hardware operations were performed. External notification response loss can cause duplicate delivery; cellular polling cannot capture every change between samples.