feat: access extension — NFC door access via boltcards SUN + Home Assistant

Promoted from the door-portal scratch repo to its own repo for install via the
aiolabs catalog. Authenticates a tapped Bolt Card via boltcards /verify,
authorizes against per-door grants, and fires the door's local Home Assistant
webhook to unlock a Z-Wave lock. Fails closed; logs every attempt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

migrations.py

@@ -0,0 +1,45 @@
+async def m001_initial(db):
+    """Doors (resources), grants (card→door permissions), and an access log."""
+    await db.execute(
+        f"""
+        CREATE TABLE access.doors (
+            id TEXT PRIMARY KEY UNIQUE,
+            wallet TEXT NOT NULL,
+            name TEXT NOT NULL,
+            controller_token TEXT NOT NULL,
+            ha_webhook_url TEXT NOT NULL DEFAULT '',
+            boltcards_base_url TEXT NOT NULL DEFAULT '',
+            unlock_timeout_ms INT NOT NULL DEFAULT 2500,
+            enabled BOOL NOT NULL DEFAULT true,
+            time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
+        );
+    """
+    )
+
+    await db.execute(
+        f"""
+        CREATE TABLE access.grants (
+            id TEXT PRIMARY KEY UNIQUE,
+            door_id TEXT NOT NULL,
+            external_id TEXT NOT NULL,
+            label TEXT NOT NULL DEFAULT '',
+            enabled BOOL NOT NULL DEFAULT true,
+            expires_at TIMESTAMP,
+            time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
+        );
+    """
+    )
+
+    await db.execute(
+        f"""
+        CREATE TABLE access.logs (
+            id TEXT PRIMARY KEY UNIQUE,
+            door_id TEXT NOT NULL,
+            external_id TEXT NOT NULL DEFAULT '',
+            decision TEXT NOT NULL,
+            reason TEXT NOT NULL DEFAULT '',
+            ip TEXT NOT NULL DEFAULT '',
+            time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
+        );
+    """
+    )