feat(entry): operator-issued entry + exit plate-swap reconciliation

Two halves of one anti-fraud design.

(A) Operator-issued entry — when the physical entry button is broken, an
operator can issue an entry ticket so a real car isn't blocked out of the lot.
This hands the operator-adversary a mint, so it is:
  - PRESENCE-GATED like the physical button: a real car must be present (radar/
    loop AND camera busy). Enforced BOTH sides — the server re-checks current
    presence so a direct POST can't bypass a disabled button; no presence loop
    => feature unavailable; a no-presence attempt signs an anomaly.
  - FLAGGED: vehicle_entry source=manual + operatorInitiated + operator, PLUS a
    companion entry.operatorIssued anomaly (the adversary path always leaves a
    red-flag row).
  - capacity-OVERRIDE allowed but stamped lotFull (a broken button mustn't trap
    a legit car).
  New session:create permission (migration 0019 -> operator role, admin-
  revocable), POST /api/entry/issue (open-shift gated), EntryFlow.
  issueForOperator; the fraud-critical print->sign->open->snapshot sequence is
  factored into one shared #issueTicket (button + operator). UI: the entry
  BarrierLight becomes a clickable issue-control when presence+permission+shift
  meet (confirm -> issue).

(B) Exit plate-swap reconciliation — defends the ticket-swap fraud the mint
enables (paid car let out on a fresh $0 ticket, original ticket lingers
"inside", occupancy drifts up by phantom cars). The plate is the invariant:
ExitFlow.#reconcilePlateAtExit compares the exiting plate against all OPEN
sessions' entry plates, EXACT + HIGH-CONFIDENCE only (>=0.85; a fuzzy read never
gates — ANPR is advisory). On a match under a DIFFERENT ticket:
  - BOOTH path: returns swap_suspected + signs exit.plateSwapSuspected; the
    pay/exit modal shows a red warning + "Override & release" (override signs an
    attributed exit.plateSwapOverride). Flag+override, never a silent hard block
    (exit fails-open; a plate is never the sole gate).
  - READER path (no operator): log-only anomaly + fail-open.
  Extended BoothExitResult + /api/exit (override); boothExit client returns a
  structured swap result.

Verified: full monorepo build/lint/test green (229 server tests incl. 4 new:
hold-on-swap, override-releases-with-attribution, low-confidence-no-warning,
own-plate-no-warning). New wiki: operator-issued-entry.md +
plate-reconciliation.md; cross-linked from entry-exit-points, capacity-
occupancy, index. Preserves "a plate never OPENS a barrier alone — and now never
TRAPS a car alone either."

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -2108,3 +2108,34 @@ DrawerManager.tsx, drawer.* i18n (sq+en). Verified: full monorepo build/lint/tes
 tests incl. the op1-denied → op2-drawer-unchanged regression); Playwright end-to-end on /drawer
 (record disbursement → pending → authorize → status flips, ledger shows cash_out + cash_review with no
 authorizedBy). Recorded in shift.md "Drawer review".
+
+## [2026-07-01] feat | Operator-issued entry + exit plate-swap reconciliation (one anti-fraud design)
+
+Two halves of one design. (A) When the physical entry button is broken, an operator can ISSUE an entry
+ticket so a real car isn't blocked out of the lot — but this hands the operator-adversary a mint, so
+it's (1) PRESENCE-GATED exactly like the physical button (radar/loop present AND camera busy = a real
+car; enforced BOTH sides, server re-checks so a direct POST can't bypass a disabled button; no presence
+loop → feature unavailable; a no-presence attempt signs an entry.issue.noPresence anomaly), (2) FLAGGED
+(vehicle_entry source=manual + operatorInitiated + operator, PLUS a companion entry.operatorIssued
+anomaly), (3) capacity-OVERRIDE allowed but stamped lotFull (a broken button mustn't trap a legit car).
+New session:create permission (migration 0019 → operator role; admin-revocable), POST /api/entry/issue
+(open-shift gated), EntryFlow.issueForOperator; the fraud-critical print→sign→open→snapshot sequence
+factored into one shared #issueTicket (button + operator). UI: the entry BarrierLight becomes a
+clickable issue-control when presence+permission+shift meet (confirm → issue).
+
+(B) Plate-swap fraud (user's scenario): operator scans exiting ticket 1234 (owes 10000), pockets cash
+WITHOUT recording payment, mints fresh 1237 (owes ~0), lets the car out on 1237 → 1234 lingers "inside"
+forever, occupancy drifts up by phantom cars. Defense = ANPR plate as invariant: the car's plate is the
+same either way. ExitFlow.#reconcilePlateAtExit compares the exiting plate against all OPEN sessions'
+entry plates — EXACT, HIGH-CONFIDENCE only (≥0.85; a fuzzy/low read never gates, ANPR is advisory). On
+a match under a DIFFERENT ticket: BOOTH path returns swap_suspected + signs exit.plateSwapSuspected
+anomaly + the pay/exit modal shows a red warning with "Override & release" (override signs an attributed
+exit.plateSwapOverride) — flag+override, never a silent hard block (exit fails-open, plate never the
+sole gate). READER path (no operator) = log-only anomaly + fail-open (user's call). Extended
+BoothExitResult + /api/exit (override param), boothExit client returns a structured swap result.
+
+Verified: full monorepo build/lint/test green (229 server tests incl. 4 new: hold-on-swap,
+override-releases-with-attribution, low-confidence-no-warning, own-plate-no-warning). New wiki pages
+operator-issued-entry.md + plate-reconciliation.md; cross-linked from entry-exit-points,
+capacity-occupancy, index. Preserves "a plate never OPENS a barrier alone — and now never TRAPS a car
+alone either."