family link: which accounts belong to a household, and GET /api/admin/family

household_people joins a roster family to the accounts of its parents; a
household can have two, a person can rarely be on two. PUT
/roster/households/{id}/people sets it (admin and above). GET /family
(account:self) returns the signed-in person's own households with scouts
and this year's checklist, and nothing else - the parent view of the
roster, read only. Inactive households drop off it.

tests/smoke_admin.py 141 -> 147.

app/store.py

@@ -125,6 +125,15 @@ CREATE TABLE IF NOT EXISTS scouts (
     updated_at    TEXT NOT NULL
 );
 CREATE INDEX IF NOT EXISTS idx_scouts_unit ON scouts(unit_id, active, den);
+-- Which accounts belong to which family. A household can have two parents
+-- with accounts; a person can, rarely, be on two households. This is what
+-- lets a signed-in parent see their own scouts and nobody else's.
+CREATE TABLE IF NOT EXISTS household_people (
+    household_id TEXT NOT NULL REFERENCES households(id),
+    person_id    TEXT NOT NULL,
+    PRIMARY KEY (household_id, person_id)
+);
+CREATE INDEX IF NOT EXISTS idx_household_people_person ON household_people(person_id);
 CREATE TABLE IF NOT EXISTS roster_checks (
     scout_id TEXT NOT NULL REFERENCES scouts(id),
     year     TEXT NOT NULL,
@@ -1029,3 +1038,35 @@ def set_check(sid, year, item, done, done_by=None, note=None):
         return dict(r) if r else {"scout_id": sid, "year": year, "item": item, "done_at": None}
     finally:
         con.close()
+
+
+def household_people(hid):
+    con = connect()
+    try:
+        return [r["person_id"] for r in con.execute("SELECT person_id FROM household_people WHERE household_id=?", (hid,))]
+    finally:
+        con.close()
+
+
+def set_household_people(hid, person_ids):
+    """Replace the accounts linked to a family."""
+    con = connect()
+    try:
+        if not con.execute("SELECT 1 FROM households WHERE id=?", (hid,)).fetchone():
+            return None
+        con.execute("DELETE FROM household_people WHERE household_id=?", (hid,))
+        for pid in sorted(set(p for p in person_ids or [] if p)):
+            con.execute("INSERT INTO household_people (household_id, person_id) VALUES (?,?)", (hid, pid))
+        con.commit()
+        return sorted(set(p for p in person_ids or [] if p))
+    finally:
+        con.close()
+
+
+def households_for_person(person_id, year):
+    con = connect()
+    try:
+        ids = [r["household_id"] for r in con.execute("SELECT household_id FROM household_people WHERE person_id=?", (person_id,))]
+    finally:
+        con.close()
+    return [h for h in (get_household(i, year) for i in ids) if h and h.get("active")]