server: GEE/Dingtian QR reader endpoint + synchronous ReadOutcome

The reader HTTP-GETs on each scan and beeps/acts on our JSON reply (host-in-the-
loop, synchronous). New route GET/POST /qa/mcardsea.php parses the SDK query,
runs the scan through the read dispatcher (permit match -> permit flow; else
transient exit), and replies the SDK verdict: status 1=valid (beep 2x) /
0=invalid (beep 1x), output, time-sync.

Refactored the read flows to return a ReadOutcome {accepted, direction, reason}
so the reply reflects the real accept/reject decision (ReadDispatcher.dispatch,
ExitFlow.handleAt, PermitFlow.run). Fire-and-forget readers ignore it.

Reader's lane is keyed off its serial (cjihao) as lane_devices.id for now;
endpoint is public (reader has no auth, on the device subnet).

Verified via inject: valid permit QR -> status:1 + open; re-scan -> permit exit;
unknown QR -> status:0; barrier-less lane -> status:0.

apps/server/src/permit-flow.ts

@@ -1,7 +1,7 @@
 import { and, eq, laneDevices, ledgerEvents, permitCredentials, permitPlates, permits, sessions, type Db } from "@parking/db";
 import { registry, type AccessControlDevice } from "@parking/devices";
 import type { FastifyBaseLogger } from "fastify";
-import type { DeviceReadEvent } from "./device-events.js";
+import type { DeviceReadEvent, ReadOutcome } from "./device-events.js";
 import type { EventLog } from "./event-log.js";
 
 // PERMIT flow: a subscriber identified by card/QR/plate enters/exits without paying.
@@ -58,22 +58,23 @@ export class PermitFlow {
   }
 
   /** Run the permit entry/exit for a matched read at a lane. */
-  async run(lane: number, e: DeviceReadEvent, m: PermitMatch): Promise<void> {
+  async run(lane: number, e: DeviceReadEvent, m: PermitMatch): Promise<ReadOutcome> {
     const key = `${m.permitId}:${m.carKey}`;
-    if (this.#inFlight.has(key)) return;
+    if (this.#inFlight.has(key)) return { accepted: false, reason: "duplicate read in flight" };
     this.#inFlight.add(key);
     try {
-      await this.#run(lane, e, m);
+      return await this.#run(lane, e, m);
     } catch (err) {
       this.#logger.error(`permit-flow failed (lane ${lane}): ${(err as Error).message}`);
+      return { accepted: false, reason: (err as Error).message };
     } finally {
       this.#inFlight.delete(key);
     }
   }
 
-  async #run(lane: number, e: DeviceReadEvent, m: PermitMatch): Promise<void> {
+  async #run(lane: number, e: DeviceReadEvent, m: PermitMatch): Promise<ReadOutcome> {
     const permit = this.#db.select().from(permits).where(eq(permits.id, m.permitId)).get();
-    if (!permit) return;
+    if (!permit) return { accepted: false, reason: "permit not found" };
 
     // Validity: active + within the coverage window.
     const now = new Date().toISOString();
@@ -82,8 +83,9 @@ export class PermitFlow {
       (permit.validFrom != null && now < permit.validFrom) ||
       (permit.validTo != null && now > permit.validTo);
     if (invalid) {
-      await this.#reject(lane, m, `permit ${permit.status}/out-of-window`);
-      return;
+      const reason = `permit ${permit.status}/out-of-window`;
+      await this.#reject(lane, m, reason);
+      return { accepted: false, reason };
     }
 
     const carOpen = this.#carHasOpenSession(m.carKey);
@@ -100,15 +102,16 @@ export class PermitFlow {
       });
       await this.#open(lane, m.carKey, "permit exit");
       this.#closeCache(m.carKey);
-      return;
+      return { accepted: true, direction: "exit" };
     }
 
     // ENTRY: enforce the car-count binding (maxConcurrent), then sign + open.
     if (permit.maxConcurrent != null) {
       const open = this.#permitOpenCount(m.permitId);
       if (open >= permit.maxConcurrent) {
-        await this.#reject(lane, m, `permit at capacity (${open}/${permit.maxConcurrent} cars in)`);
-        return;
+        const reason = `permit at capacity (${open}/${permit.maxConcurrent} cars in)`;
+        await this.#reject(lane, m, reason);
+        return { accepted: false, direction: "entry", reason };
       }
     }
 
@@ -131,6 +134,7 @@ export class PermitFlow {
     } catch (err) {
       this.#logger.error(`session-cache insert failed for ${m.carKey}: ${(err as Error).message}`);
     }
+    return { accepted: true, direction: "entry" };
   }
 
   /** Does this specific car (credential value) have an open session right now? */