devices: pool-of-spaces model — drop lane, per-relay direction

A parking lot is one pool of spaces with a flexible set of entry/exit
points — no "lane". Direction is a property of each RELAY inside an access
controller; readers/cameras bind to a controller relay and inherit it.

Schema:
- drop `lane` from ledger_events, device_events, sessions
- rename lane_devices -> devices (no lane/direction columns)
- access config.relays=[{relay,direction,button?}]; reader/camera
  config.controllerId+relay binding
- fresh 0000_baseline migration (history reset; dev data was throwaway)

Signed ledger:
- remove `lane` from canonicalize(); bump signer keyId sw-hmac-v1 -> v2
  (v1 events won't verify under v2 — intentional, gated per-event by keyId)

Server:
- new device-resolve.ts (replaces lane-map.ts): relayForButton,
  relayForDevice, firstRelayByDirection, devicesByDirection
- entry-flow: button terminal -> its relay; exit/permit: reader's bound
  relay; dispatcher resolves the bound relay + inherited direction
- camera snapshots fire by direction site-wide, async, never block open
- DeviceConfig widened to nested JSON for relays[]

Web:
- wizard: no lane selector; add controllers (relay map + entry-button
  terminal) first, then bind readers/cameras/printers to a controller relay

Wiki: new entry-exit-points.md (replaces lane-direction); reworked
entry-exit-readers, parking-session, first-run-setup, device-registry,
append-only-event-chain, device-events; removed stale lane/LaneMap mentions.

wiki/concepts/first-run-setup.md

@@ -8,8 +8,10 @@ updated: 2026-06-15
 # First-Run Setup (device selection)
 
 The admin install flow that makes the system **device-agnostic in practice**: on first run, an
-admin assigns devices **per lane** by choosing from the [[device-registry]] catalog and entering
-each device's connection config.
+admin adds **controllers** (each declaring its relays — entry/exit/both — and the entry-button
+terminal) and then **readers/cameras/printers** bound to a controller relay, choosing from the
+[[device-registry]] catalog and entering each device's connection config. There is **no lane** —
+the pool-of-spaces model; see [[entry-exit-points]].
 
 > Implementation-derived (from `apps/server` + `apps/web`), not the source doc.
 
@@ -26,7 +28,7 @@ each device's connection config.
    device**: fixes preconditions (e.g. disables `input_link_relay`) and sets up the Digest-
    authenticated input push ([[device-input-flow]]) — the admin never touches the device's own web
    UI. **Fails the save** (no DB row) if the device can't be configured, so there are no
-   orphan/half-configured rows. On success persists to `lane_devices`.
+   orphan/half-configured rows. On success persists to `devices`.
 4. **Remove** — `DELETE /api/setup/assign/:id` (admin-only) drops one instance's row. Only our
    row is removed; the device itself is not un-hardened/un-configured (a stale push from an
    unknown device id is already rejected, and re-assigning reconfigures it).
@@ -34,25 +36,25 @@ each device's connection config.
 
 ## Config granularity — multi-instance per category
 
-The data model is **multi-instance**: `lane_devices` holds **one row per instance**, keyed by a
-generated `id`, with no one-per-(lane, category) constraint. So a lane can have **more than one of
-every category** — e.g. two printers (an entry dispenser + a booth printer; see
-[[printer-roles-failover]]), multiple readers, multiple cameras. `assign` always inserts a new row
-(never an upsert), and `state` returns the full list.
+The data model is **multi-instance**: `devices` holds **one row per instance**, keyed by a
+generated `id`. So the site can have **more than one of every category** — multiple controllers,
+readers, cameras, and printers (e.g. an entry dispenser + a booth printer; see
+[[printer-roles-failover]]). `assign` always inserts a new row (never an upsert), and `state`
+returns the full list.
 
-The `SetupWizard` reflects this: each category shows the **list of assigned instances** for the
-current lane (with **Remove**) plus an **Add another** form — not a single fixed slot. `select`-type
-config fields (e.g. a printer's role) render as dropdowns.
+The `SetupWizard` reflects this: each category shows the **list of assigned instances** (with
+**Remove**) plus an **Add another** form — not a single fixed slot. `select`-type config fields
+(e.g. a printer's role) render as dropdowns.
 
-Organized **per lane** — each lane gets its access controller(s), reader(s), camera(s), and
-printer(s), each with its own connection settings. Matches the architecture's "mixable per lane"
-reality (a lane can serve permit holders via [[wiegand]] and casual via host-side reads on one
-relay — see [[entry-exit-readers]]).
+There is **no lane**. Direction lives on each access **relay**; readers/cameras **bind** to a
+controller relay (`config.controllerId` + `relay`) — the barrier they serve — and inherit its
+direction. The wizard adds controllers first, then binds the other devices to a relay. See
+[[entry-exit-points]], [[entry-exit-readers]].
 
 ## Security notes
 
 - The assign/state/delete/complete endpoints require the **admin** role ([[local-jwt-auth]]).
-- Device **credentials are stored in `lane_devices.config`** — protect at rest
+- Device **credentials are stored in `devices.config`** — protect at rest
   ([[disk-os-hardening]]); device hosts belong on the isolated VLAN ([[network-isolation]]).
 - **Secrets are stripped on the way out**: `assign` and `state` both redact `pushPassword`,
   `webPassword`, and `relayPassword` from the returned config (the UI lists devices; it never