v0.287.0: CHANGELOG, README, REUSE (the family gate)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -1972,6 +1972,13 @@ that folder is never a dead end, and an install never runs into it silently (R-6
   into app.yaml + one `compose up -d`, or a command) set when the gate opens, after the block. The window lifts and the
   loop re-applies it. `POST /apps/<slug>/close-signup` for an app installed before the rule: lock record
   (`opened_by: close-signup`), block, switch; never a gate. Code: `internal/stacks/after_setup.go`.
+- **The family gate (v0.287.0, decisions 63/64)** — `.felhom.yml` `family_gate: true` puts a PERMANENT door in front of
+  the app: only the household's family members (each with their own name and password, „Család" card on the security
+  page) and the household itself get through; `family_gate_except:` lists literal path prefixes left to the app's own
+  login (anchored `^/prefix(/|$)`). Door file `family-gate-<app>.yml`, written before the first start; answerer
+  `/__felhom_gate/family`; sign-in pages `/__family/start|login|logout` on the dashboard host; sessions 30 days in
+  `family.json`. A family cookie never opens the dashboard. `min_controller:` refuses a template too new for the box.
+  Code: `internal/family/`, `internal/stacks/family_gate.go`, `internal/web/family_gate.go`.
 - **A removed app restored from its backup gets its lock back (v0.286.0, R-773)** — with no app.yaml left, the restore
   (`PersistUnitRedeployConfig`) writes the lock record (`opened_by: restore`) and the block BEFORE anything starts; the
   loop sets the app's own switch. An installed app the household never closed keeps what it had (decision 49).