fix(setup): render boolean config fields as a checkbox (not a text box)

The generic config-field loop had no boolean branch, so a type:"boolean"
field (e.g. the camera's alarmPushEnabled) fell through to a TEXT input and
saved the STRING "true" instead of a real boolean. Downstream checks use
=== true, so the feature read as disabled even when the admin ticked it.

- Web: render type:"boolean" config fields as a real checkbox; store/merge
  a true/false boolean (and persist false on edit so toggling off sticks);
  normalize a legacy string "true"/"false" on load.
- Server: isOn() coerces the flag when reading config (accepts true/"true"/
  1/"yes"/"on") so an existing row saved as the string "true" still works
  without a re-save, and no other boolean field hits the same trap.

Tests: hik-alarm accepts string "true" for alarmPushEnabled. server
112/112; web typecheck + build green.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/src/routes/hikvision-alarm.test.ts

@@ -95,6 +95,21 @@ describe("Hikvision Alarm Server push", () => {
     expect(String(d.rawHead)).toContain("EventNotificationAlert");
   });
 
+  it("accepts the legacy string \"true\" for alarmPushEnabled (setup form quirk)", async () => {
+    // The setup checkbox historically saved a STRING "true" instead of a boolean; the
+    // guard must coerce it, not silently reject a feature the admin enabled.
+    seedHikCamera({ alarmPushEnabled: "true" });
+    const res = await app.inject({
+      method: "POST",
+      url: `/api/devices/hikvision/${CAM_ID}/event`,
+      headers: { "content-type": "application/xml" },
+      payload: VEHICLE_XML,
+      remoteAddress: CAM_IP,
+    });
+    expect(res.statusCode).toBe(200);
+    expect(alarmEvents()).toHaveLength(1);
+  });
+
   it("pulls a plate out of an ANPR-style payload when present", async () => {
     seedHikCamera();
     const anpr = `<EventNotificationAlert><eventType>ANPR</eventType>