feat(vision): configurability — SetupWizard ANPR toggle, footer health chip, env docs

Make the vision service genuinely configurable (was env-only).

- SetupWizard: an "ANPR" checkbox on the camera form (writes config.anpr; persisted
  only when on; sq+en) — opt-in is no longer raw JSON.
- DeviceMonitor optionally takes the VisionClient and probes /health each tick, emitting
  a "vision" pseudo-device → a Vision chip (ready/degraded/offline + recognizer) in the
  booth footer when VISION_ENABLED, no chip when off. Widened the DeviceStatus category
  union (server + web) + footer maps + devices.catVision. Verified: ready/fast_alpr when
  up, 0 chips when disabled.
- apps/vision/.env.example (Python service) + a VISION_* block in apps/server/.env.example
  (Node side) + a Configuration section in opencv-anpr-service.md covering all four
  layers and the caveats: the two processes share the VISION_ prefix but need SEPARATE
  .env files; bind /analyze to 127.0.0.1; cache model weights at deploy; an unbound anpr
  camera recognizes but every read is refused.

Build + lint green.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/api.ts

@@ -647,7 +647,7 @@ export function fetchOccupancy(): Promise<Occupancy> {
 export interface DeviceStatus {
   deviceId: string;
   driverId: string;
-  category: "access" | "reader" | "camera" | "printer";
+  category: "access" | "reader" | "camera" | "printer" | "vision";
   /** Role/direction token for the footer label (NOT the vendor) — the client
    *  localises it next to the category, e.g. "Lexuesi hyrje", "Printer kabina". */
   roleKind: "entry" | "exit" | "both" | "mixed" | "lane" | "booth" | null;