docs(wiki): record session findings — snapshot fix, booth rework, db reset

- entry-exit-points.md: the snapshot content-type bug + serve-side cleanType
  fix (Hikvision image/jpeg; charset="UTF-8" broke every legacy render).
- booth-exit-flow.md: the Active-Sessions/modal rework — inline barrier button
  removed -> modal; closed-within-grace view; live grace countdown; actual paid
  amount; read-only snapshot review in the closed-session view.
- local-dev-workflow.md: the gated `pnpm db:reset` training tool + flag table +
  the booth (docker exec, no pnpm) note.
- appliance-provisioning.md: new §7d — reset on the booth via docker exec into
  the server container (script ships in the deploy bundle; DATABASE_URL=
  /data/parking.sqlite), ledger-truncation warning + the two safety gates.
- index.md catalog line; log.md entries.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/booth-exit-flow.md

@@ -2,7 +2,7 @@
 type: concept
 tags: [parking, domain, booth, exit, payment, threat-model]
 sources: []
-updated: 2026-06-18
+updated: 2026-06-30
 status: open
 ---
 
@@ -162,6 +162,22 @@ server-side in `reopenBarrier`: allow only when `subscription` OR (`paidAt != nu
 paidAt + graceExitMin`). A future reason-required *force exit* for genuine disputes (car already gone)
 would be a separately-audited path — see Open.
 
+> **Open-barrier moved INTO the modal — the inline row button is gone (2026-06-30).** The audited
+> re-pulse was previously an inline button on the paid-in-grace Active Sessions *row*. It was removed:
+> clicking any row now opens the modal, which carries the Open-barrier action. Why: a paid-and-exited
+> session is `open=false`, so clicking its row used to dead-end on *"This session is already closed"* —
+> useless for the very case (paid, barrier didn't confirm) where the operator needs to re-pulse. The
+> modal now recognizes a **closed-within-grace** transient (`found && !open && withinGrace`) and renders
+> the session view + **Open barrier** instead of the dead-end notice. The server guard is unchanged
+> (`reopenBarrier` already handled the closed-but-in-grace case — the T-397815c0 fix above). The
+> Active Sessions list distinguishes these rows with a **live grace-remaining countdown** badge
+> (`exited · M:SS`, ticking each second off `graceExpiresAt`) instead of a static "exited" label.
+> Settled amounts now show the **actual sum paid** (new `SessionLookup.paidMinor`, summed across
+> payments) rather than a flat "PAID" badge. And a **fully-closed (grace-expired) session** is no longer
+> a pure dead-end: its modal shows a read-only **review view** — figures + paid amount + the entry/exit
+> [[entry-exit-points#camera-snapshots-evidence-not-a-gate|snapshot strip]] — so an operator can review
+> evidence for a car that just left (disputes/audits), with no pay/exit/open controls.
+
 ### Subscription occurrences in the booth (built 2026-06-18)
 
 A subscriber's car shows in Active Sessions as a **subscription** session (badge "abonim"; labelled by