feat(nav): promote Subscriptions to a top-level section with its own tabs

Subscriptions, Plans, and Tariff Lab were tabs under /setup. Moved them into a
standalone /subscriptions section with its own header nav entry (between Turni and
Konfigurimi) and a tab bar: Abonimet (/subscriptions), Planet
(/subscriptions/plans), Lab Tarife (/subscriptions/tariff-lab).

- New SubscriptionsLayout (tab bar + <Outlet>); the three screens are now its
  child routes at the top level, not under setupRoute.
- Removed Subscriptions/Plans/Tariff-Lab from SetupLayout and SETUP_TABS. Setup
  now holds Devices/Tariff/Site/Users/Roles/Shifts/Logs.
- Header gains the "Abonimet" link, gated on subscription:read OR subscription:plan
  OR tariff:read (shown if the user can reach any sub-tab).
- Tabs are permission-gated; the /subscriptions index redirects a user lacking
  subscription:read to the first sub-tab they can see (or the booth).
- Legacy redirects: /setup/subscriptions → /subscriptions, /setup/plans →
  /subscriptions/plans, /setup/tariff-lab → /subscriptions/tariff-lab. Dropped the
  old /subscriptions → /setup redirect (it's a real route now).
- The Tariff COMPOSER stays in Setup; only the Tariff LAB simulator moved.

Verified at runtime (Playwright): header order Kabina·Turni·Abonimet·Konfigurimi,
the three sub-tabs render, Setup no longer lists them, /setup/subscriptions
redirects cleanly. build+lint 14/14.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -1268,3 +1268,15 @@ before signing the irreversible Z-report. Opening stays immediate. (3) Fixed dar
 <select> popups rendering WHITE on WebKitGTK (Tauri Linux) via color-scheme + explicit option colours.
 Verified the split on a read-only DB copy (tickets 0, subs 10,200 = 10,000 sale + 200 out-of-window,
 reconciles). build+lint 14/14, i18n parity (sq+en). See [[shift]] "Takings split by source".
+
+## [2026-06-21] feat | Promote Subscriptions to a top-level section with its own tabs
+Moved Subscriptions out of /setup into a standalone /subscriptions section with a header nav entry
+(Kabina · Turni · Abonimet · Konfigurimi) and its own tab bar: Abonimet (/subscriptions), Planet
+(/subscriptions/plans), Lab Tarife (/subscriptions/tariff-lab). Removed those three tabs from the Setup
+layout (Setup now: Pajisjet · Tarifa · Park · Përdoruesit · Rolet · Turnet · Loget). Tabs are
+permission-gated (subscription:read / subscription:plan / tariff:read), so an operator with only
+subscription:read sees just Abonimet; the index redirects to the first allowed sub-tab otherwise.
+Legacy /setup/subscriptions, /setup/plans, /setup/tariff-lab redirect to the new paths; the old
+/subscriptions→/setup redirect was removed (it's a real route now). Verified at runtime via Playwright
+(header order, the 3 sub-tabs, Setup no longer shows them, /setup/subscriptions redirects). The Tariff
+COMPOSER stays in Setup; only the Tariff LAB simulator moved. build+lint 14/14.