feat(vision): configurability — SetupWizard ANPR toggle, footer health chip, env docs

Make the vision service genuinely configurable (was env-only).

- SetupWizard: an "ANPR" checkbox on the camera form (writes config.anpr; persisted
  only when on; sq+en) — opt-in is no longer raw JSON.
- DeviceMonitor optionally takes the VisionClient and probes /health each tick, emitting
  a "vision" pseudo-device → a Vision chip (ready/degraded/offline + recognizer) in the
  booth footer when VISION_ENABLED, no chip when off. Widened the DeviceStatus category
  union (server + web) + footer maps + devices.catVision. Verified: ready/fast_alpr when
  up, 0 chips when disabled.
- apps/vision/.env.example (Python service) + a VISION_* block in apps/server/.env.example
  (Node side) + a Configuration section in opencv-anpr-service.md covering all four
  layers and the caveats: the two processes share the VISION_ prefix but need SEPARATE
  .env files; bind /analyze to 127.0.0.1; cache model weights at deploy; an unbound anpr
  camera recognizes but every read is refused.

Build + lint green.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/vision/.env.example

@@ -0,0 +1,22 @@
+# apps/vision — the ANPR microservice's own env (copy to apps/vision/.env).
+# This is the PYTHON SERVICE's config only. The Node server has its OWN VISION_* vars
+# (in apps/server/.env) — keep the two .env files SEPARATE (they share the VISION_
+# prefix but are different processes). See wiki/entities/opencv-anpr-service.md "Configuration".
+
+# Recognizer: "stub" (no models, recognizes nothing — boots anywhere, for dev/CI) or
+# "fast_alpr" (the real MIT YOLOv9+CCT/ONNX stack — needs `uv sync --extra alpr`).
+VISION_RECOGNIZER=fast_alpr
+
+# Bind. On the appliance prefer 127.0.0.1 — the Node backend is the only caller, so the
+# /analyze endpoint should NOT be reachable off-host. (0.0.0.0 only if you must.)
+VISION_HOST=127.0.0.1
+VISION_PORT=8089
+
+# fast-alpr models (only used when recognizer=fast_alpr). The defaults won the Albanian
+# benchmark; change the OCR to european-plates-mobile-vit-v2-model only to re-test.
+VISION_DETECTOR_MODEL=yolo-v9-t-384-license-plate-end2end
+VISION_OCR_MODEL=cct-xs-v2-global-model
+
+# Confidence floor — a best plate below this is flagged low_confidence so the Node side
+# treats it as advisory and falls back to the ticket path. Keep in sync with the server.
+VISION_MIN_CONFIDENCE=0.5

apps/vision/README.md

@@ -57,12 +57,21 @@ country European model to benchmark Albanian plates. For GPU/NPU, install `onnxr
 The Node side POSTs `Snapshot.bytes` directly (no multipart). `vehicle` is scaffolded but not yet
 populated — fast-alpr is plate-only; the vehicle stage (Job 2) is built later on the same runtime.
 
-## Config (env, prefix `VISION_`)
+## Config (env, prefix `VISION_`) — see `.env.example`
+
+This service's env only. The **Node server has its own `VISION_*`** (`apps/server/.env`:
+`VISION_ENABLED`, `VISION_URL`, `VISION_POLL_MS`, …) — same prefix, **separate process, separate
+`.env`**. Don't merge them.
 
 | Var | Default | Meaning |
 | --- | --- | --- |
 | `VISION_RECOGNIZER` | `stub` | `stub` (no models) or `fast_alpr` (real) |
-| `VISION_PORT` | `8089` | listen port |
+| `VISION_HOST` | `0.0.0.0` | bind address — prefer `127.0.0.1` on the appliance (Node is the only caller) |
+| `VISION_PORT` | `8089` | listen port (must match the server's `VISION_URL`) |
 | `VISION_DETECTOR_MODEL` | `yolo-v9-t-384-license-plate-end2end` | fast-alpr detector |
-| `VISION_OCR_MODEL` | `cct-xs-v2-global-model` | fast-alpr OCR |
+| `VISION_OCR_MODEL` | `cct-xs-v2-global-model` | fast-alpr OCR (won the AL benchmark) |
 | `VISION_MIN_CONFIDENCE` | `0.5` | below this → `low_confidence=true` |
+
+To use it from the booth: set `VISION_ENABLED=1` on the **server**, run this service, then tick
+**ANPR** on a camera in the SetupWizard (the camera must also be bound to a barrier). The booth footer
+shows a **Vision** chip when enabled. Full config guide: `wiki/entities/opencv-anpr-service.md`.