feat(booth): refusal snapshots, subscriber access medium, one-car-one-ticket entry

Three booth-integrity improvements that share the entry/exit flows and activity log.

Refusal snapshots: previously only an accepted open captured a camera image; now
every refusal/hold anomaly fires the directional camera too (a turned-away car is
exactly the evidence wanted) — entry refused-full/held, exit refused
closed/no-session/unpaid/grace-expired (booth + reader paths), refused subscription.
A refused entry has no ticket id, so a synthetic REFUSED- ref keys the anomaly + photo
together. Same fire-and-forget contract; failed captures still show as tiles.

Subscriber access medium: the subscription flow already signed `via`
(qr|card|plate) into entry/exit payloads; surface it as a typed LedgerPayload.via, a
cyan chip in the ticker, and an "Entry medium" modal row (sq+en). Display-only.

One car = one ticket: the entry button could be mashed to mint many tickets per car
(corrupting occupancy + enabling ticket-shopping at exit) — the old #inFlight guard
only blocked overlapping presses. Add a per-relay guard configured on the relay spec:
PRESENCE mode (presenceInput ties ticketing to a vehicle loop on a Dingtian input —
one ticket per car, re-armed when the loop clears) or COOLDOWN fallback
(entryCooldownSec) when there's no barrier feedback. A suppressed press is unsigned
device_events telemetry, not a signed anomaly. SetupWizard exposes both fields.
Fail-closed entry and barrier-is-not-a-door invariants untouched; guard state is
in-memory/rebuildable, starts armed after restart.

Wiki: new entry-double-press; updated entry-exit-points, booth-console, index.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/booth-console.md

@@ -90,6 +90,18 @@ what happened." Now every event is **self-describing and clickable**:
   operator can tell "no camera" from "camera failed". (Surfaced a real incident: a subscriber's entry
   snapshot failed `EHOSTUNREACH` while the exit one succeeded — by design a snapshot is *evidence, not
   a gate*, so the open proceeded and only the image was missing.)
+- **Subscriber access medium (`via`).** A subscription entry/exit row now shows HOW the subscriber was
+  identified — **QR code / RFID card·chip / plate** — as a cyan chip in the ticker and a labelled
+  "Entry medium" row in the detail modal. The flow already signed `via` (`"qr"|"card"|"plate"`) into
+  the [[subscription]] entry/exit payload; this just surfaces it (a lost-card investigation can now see
+  which credential opened a barrier). Rides the existing localized-display pattern, not a new signed
+  field.
+- **Refused entry/exit now carry a snapshot too (2026-06-19).** Previously only an *accepted* open
+  captured an image. Now refusal/hold anomalies fire the directional camera as well (the photo of a
+  turned-away car is exactly the evidence an operator/auditor wants) — so the detail modal's snapshot
+  strip is populated for "lot full", unpaid-exit, no-session, and refused-subscription events. See
+  [[entry-exit-points]] for the coverage list and the synthetic `REFUSED-…` key used when a refused
+  entry has no ticket id.
 
 ## The shift control (header) + the booth gate