feat(vision): vehicle stage, phase A — YOLOX-S (Apache-2.0 ONNX) beside the plate recognizer

Fills /analyze vehicle.body_type + confidence (car / motorcycle / bus / truck from COCO,
mapped to the shared vocabulary) for the Car Wash desk's category suggestion
(venue-modules.md §Vehicle category from vision). Advisory: the operator decides, a
confident downgrade is flagged, nothing is gated on it.

- vision_service/vehicle.py: pure numpy/cv2 letterbox (pad 114, raw BGR), stride-grid
  decode, class-agnostic NMS, one vehicle per frame (the box holding the plate's centre,
  else the largest); YoloxVehicleDetector on onnxruntime CPU, 2 intra-op threads.
- recognizer.py: WithVehicle composes the stage over any plate recognizer (stub included);
  a failing stage yields vehicle=null + a "vehicle: …" note in /health.detail — never
  costs the plate read. model_version reads "<plate>+yolox:yolox_s.onnx@640".
- settings: VISION_VEHICLE_MODEL_PATH (unset = off), _INPUT_SIZE (640), _MIN_CONFIDENCE
  (0.4, the detector's floor; the flag threshold is site config).
- Dockerfile bakes yolox_s.onnx (best-effort curl at build; no network → stage off) and
  sets the path; compose forwards it (empty = off); .env.example documents it.
- Measured on four real dev entry frames (DS-2CD1047G3H, 2560×1440): car at 0.83–0.88 in
  ~240–330 ms; empty lane with a person → none.
- tests/test_vehicle.py: decode/NMS/pick/letterbox on synthetic tensors, the composition,
  and a missing-model /health. Wiki: opencv-anpr-service, venue-modules, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/entities/opencv-anpr-service.md

@@ -249,11 +249,36 @@ service's `/health` each tick and shows a **"Vision" chip** in the booth footer
 - Per-camera **opt-in** — ✅ **built**: `config.anpr === true` enables ANPR on a camera (set via the
   SetupWizard checkbox); ANPR then runs on that camera's entry/exit snapshot.
 
-## Vehicle body type (advisory) — contract only, 2026-09-06
+## Vehicle body type (advisory) — the vehicle stage, phase A (2026-09-06)
 
-`/analyze` may now populate `vehicle.body_type` + `vehicle.confidence` from the shared vocabulary
+`/analyze` populates `vehicle.body_type` + `vehicle.confidence` from the shared vocabulary
 (car, sedan, hatchback, suv, minivan, pickup, van, truck, bus, motorcycle). Node records it beside
 the plate and the Car Wash desk pre-selects the category the site maps it to; the operator
-decides, a confident downgrade is flagged, nothing is gated on it. No bundled recognizer emits
-it yet — see [[venue-modules]] §Vehicle category from vision for the model plan (COCO detector
-first, body-type classifier on own frames second).
+decides, a confident downgrade is flagged, nothing is gated on it ([[venue-modules]] §Vehicle
+category from vision).
+
+**Phase A = YOLOX-S (Megvii, Apache-2.0) as ONNX** on the same ONNX Runtime the plate stage uses
+— the licence rule that keeps Ultralytics (AGPL) out. `vision_service/vehicle.py`: pure numpy/cv2
+letterbox (pad 114, raw 0–255 BGR — YOLOX's exported graphs are not normalised), stride-grid
+decode, class-agnostic NMS, COCO `car/motorcycle/bus/truck` → the vocabulary, and ONE vehicle per
+frame: the box holding the plate's centre when a plate was read (the car that was read, not the
+one behind), else the largest box. `WithVehicle` in `recognizer.py` wraps whichever plate
+recognizer runs (stub included, so the stage is testable without fast-alpr); a failing stage
+yields `vehicle: null` and a `vehicle: …` note in `/health.detail` — it never costs the plate
+read. Composed `model_version` reads `<plate>+yolox:yolox_s.onnx@640`.
+
+- **Config:** `VISION_VEHICLE_MODEL_PATH` (unset = stage off), `VISION_VEHICLE_INPUT_SIZE` (640),
+  `VISION_VEHICLE_MIN_CONFIDENCE` (0.4 — the detector's floor; the SITE threshold that decides a
+  flag lives in Setup → Car wash). The Docker image bakes the weights at `/app/models/yolox_s.onnx`
+  (best-effort curl at build; no network → stage off) and sets the path, so the air-gapped
+  appliance never fetches at runtime and no operator-writable path holds a model
+  ([[vision-service-hardening]]). Compose forwards the var; set it EMPTY in the stack env to
+  switch the stage off. Locally: curl the release file into `apps/vision/models/` (gitignored).
+- **Measured on dev (2026-09-06), four real 2560×1440 entry frames from the DS-2CD1047G3H:** three
+  with a car → `car` at 0.83–0.88, ~240–330 ms each on the dev CPU with 2 intra-op threads; the
+  empty-lane frame with a person at the camera → no vehicle (correct: a person is not a class we
+  keep). One frame per entry, so the cost is invisible to the lane.
+- **What it cannot do:** SUV vs sedan — COCO has one `car`. For a Vetura/SUV price list every car
+  maps to Vetura and no downgrade fires; vans, trucks, buses and motorcycles do separate. Phase B
+  (a body-type classifier on the pilot's own frames — every wash order is a labelled frame) is
+  what closes that gap; the detector's box is the crop it will classify.