docs(wiki): record session findings — snapshot fix, booth rework, db reset

- entry-exit-points.md: the snapshot content-type bug + serve-side cleanType
  fix (Hikvision image/jpeg; charset="UTF-8" broke every legacy render).
- booth-exit-flow.md: the Active-Sessions/modal rework — inline barrier button
  removed -> modal; closed-within-grace view; live grace countdown; actual paid
  amount; read-only snapshot review in the closed-session view.
- local-dev-workflow.md: the gated `pnpm db:reset` training tool + flag table +
  the booth (docker exec, no pnpm) note.
- appliance-provisioning.md: new §7d — reset on the booth via docker exec into
  the server container (script ships in the deploy bundle; DATABASE_URL=
  /data/parking.sqlite), ledger-truncation warning + the two safety gates.
- index.md catalog line; log.md entries.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/decisions/appliance-provisioning.md

@@ -351,6 +351,42 @@ ENV=prod ./booth.sh up
 `booth.sh` runs from wherever it sits next to the compose files (the booth deploys them flat, e.g.
 `/opt/parking_systems/`). See [[container-deployment]].
 
+### 7d. Reset the DB for TRAINING/DEMO — `docker exec`, not `pnpm` (2026-06-30)
+
+A site is sometimes run live to **train** operators/admins on the real app; afterwards the demo data
+must go without leaving an obvious self-serve button (the [[threat-model|operator must not be able to
+wipe history]]). The reset is a **CLI script** (`packages/db/scripts/reset-db.mjs`), and on the booth
+there is **no `pnpm`** — only the running containers. So run it the same way as the seed-admin step in
+§7b: **`docker exec` into the `server` container**, where the script ships inside the deploy bundle at
+`node_modules/@parking/db/scripts/reset-db.mjs` (the same place the boot migrator lives — see the
+entrypoint). `DATABASE_URL` in-container is **`/data/parking.sqlite`** (the `parking-data` volume).
+
+```bash
+# On the booth (or via Komodo's terminal on the server container). Category flags:
+#   --financial  ledger (entry/exit/payment/void/shift/cash/anomaly) + device_events + snapshots +
+#                subscription INSTANCES/credentials/plates + blocklist. KEEPS users/devices/config/
+#                tariffs/subscription PLANS.
+#   --config     site_config, devices, setup_state (re-runs first-run setup), tariffs + versions, plans.
+#   --users      users, roles, role_permissions, auth sessions.   --all  every table.
+docker exec -it \
+  -e RESET_ALLOWED=1 \
+  -e DATABASE_URL=/data/parking.sqlite \
+  park-buzi-server-1 \
+  node node_modules/@parking/db/scripts/reset-db.mjs --financial
+```
+
+> **⚠ `--financial`/`--all` TRUNCATE the append-only, signed [[append-only-event-chain|ledger]]** —
+> the anti-fraud record. A *partial* delete would break the hash chain, so a financial reset wipes the
+> whole ledger back to empty (re-seeding starts a NEW chain under the **same** `EVENT_SIGNING_KEY`/
+> `BACKUP_KEY` — the keys are **not** touched). This is the opposite of how the ledger is meant to
+> behave, hence the two gates: it refuses unless **`RESET_ALLOWED=1`** is set (a real booth never sets
+> it) **and** you type the DB filename to confirm (`parking.sqlite`; `--yes` skips that for scripted
+> setup only). It is a **training/demo** tool — never run on a production booth's data.
+
+After `--users`/`--all` (users cleared), re-seed the first admin exactly as in §7b
+(`docker exec … node scripts/seed-admin.mjs`) so someone can log back in. For dev (where `pnpm` exists)
+the same script is `pnpm db:reset --financial` — see [[local-dev-workflow]].
+
 ### Healthy startup + web-access
 
 Healthy logs: vision `Initialized LicensePlateDetector …` with NO "Downloading" (baked weights),