Kaspersky Safe Kids. I chose it after experimenting with a bunch of options, it was the only one that wasn't trivial to bypass on my phone.

Basic setup is that I wrote a script (against Kaspersky ToS) that can login and change the lock/unlock schedule and enable/disable website/application restrictions.

So it unlocks after I tell it to check Fitbits API, and disables restrictions after I tell it to check one of the challenge websites. Locking happens on at a configured time each night.