devices: pool-of-spaces model — drop lane, per-relay direction

A parking lot is one pool of spaces with a flexible set of entry/exit
points — no "lane". Direction is a property of each RELAY inside an access
controller; readers/cameras bind to a controller relay and inherit it.

Schema:
- drop `lane` from ledger_events, device_events, sessions
- rename lane_devices -> devices (no lane/direction columns)
- access config.relays=[{relay,direction,button?}]; reader/camera
  config.controllerId+relay binding
- fresh 0000_baseline migration (history reset; dev data was throwaway)

Signed ledger:
- remove `lane` from canonicalize(); bump signer keyId sw-hmac-v1 -> v2
  (v1 events won't verify under v2 — intentional, gated per-event by keyId)

Server:
- new device-resolve.ts (replaces lane-map.ts): relayForButton,
  relayForDevice, firstRelayByDirection, devicesByDirection
- entry-flow: button terminal -> its relay; exit/permit: reader's bound
  relay; dispatcher resolves the bound relay + inherited direction
- camera snapshots fire by direction site-wide, async, never block open
- DeviceConfig widened to nested JSON for relays[]

Web:
- wizard: no lane selector; add controllers (relay map + entry-button
  terminal) first, then bind readers/cameras/printers to a controller relay

Wiki: new entry-exit-points.md (replaces lane-direction); reworked
entry-exit-readers, parking-session, first-run-setup, device-registry,
append-only-event-chain, device-events; removed stale lane/LaneMap mentions.

wiki/concepts/append-only-event-chain.md

@@ -89,16 +89,13 @@ The [[parking-session]] domain folds over these **signed ledger** events:
 A session is a **projection** over this chain, never a mutable table — the same anti-fraud reason
 the chain exists. See [[parking-session]].
 
-### ⚠️ As-built vs. the table split (pending)
+### As-built (table split done)
 
-The current code records Dingtian **input (button) pushes** as `input_received` rows **in the
-signed chain** (with `lane` resolved via the `LaneMap`, `source` null, device provenance in
-`identity`). Per the 2026-06-15 split (above), a raw button press is **device telemetry** and
-belongs in **`device_events`**, *not* the signed ledger — only the business `vehicle_entry` it
-drives gets signed. So `input_received`-in-the-ledger is **transitional**; the pending refactor
-moves raw inputs to `device_events` and renames the chain table to `ledger_events`. (`LaneMap`
-lane-resolution and the "never stamp `lane: 0` for an unmapped device" rule carry over to whichever
-stream records the event.)
+The split above is implemented: raw Dingtian **input (button) pushes** are **device telemetry** in
+**`device_events`** (unsigned, prunable), keyed to the firing `devices` instance. Only the business
+`vehicle_entry` the press drives is signed into **`ledger_events`**. The signed events carry **no
+`lane`** — the pool-of-spaces model has none (dropped 2026-06-16; see [[entry-exit-points]]), and
+the canonical form bumped `sw-hmac-v1` → `sw-hmac-v2` accordingly.
 
 ### ⚠️ Limitation: the log captures HOST-ORIGINATED actions only