feat: subscription v2 — quantity pricing, plan timeframes (tariff bridge), reserved spots

Three subscriber enhancements driven by real scenarios (migration 0011, all
additive columns — backward-compatible).

1. QUANTITY. One subscription covers N cars (a family pays once for two). Sale
   amount = span price × quantity; maxConcurrent defaults to the quantity so all
   N cars can be inside. Quantity rides in the payment payload.

2. PLAN TIMEFRAMES → TARIFF BRIDGE. A plan may restrict WHEN a subscriber may
   park (e.g. weekday 20:00→08:00, weekend all-day). A scan outside the window is
   NOT refused — the out-of-window minutes are charged at the normal TRANSIENT
   tariff (the subscriber is a transient for that time):
     - early entry: arrival → window-open, DEFERRED (signed as windowOwedMinor on
       the vehicle_entry payload), collected at exit;
     - late exit: window-close → departure, and exit is GATED
       (sub.refused.unpaidWindow) until paid at the booth.
   Pure, tz-aware outOfWindowGap in @parking/shared (12 unit tests); pricing
   reuses computeFee + the active tariff version
   (apps/server/src/subscription-window.ts). The exit refusal is a host-ONLINE
   business gate — the fail-open rule still governs the offline path.

3. RESERVED SPOTS. Site toggle reserve_subscriber_spots: occupancy holds
   max(0, quantity − itsCarsInside) per active subscription, so transients see
   "full" sooner; effectiveFree = capacity − count − reserved. Subscribers are
   never gated by full.

UI: quantity field + ×N quote (SubscriptionManager); timeframes editor
(SubscriptionPlansManager); reserve checkbox (SiteSettings); booth pay modal
shows an "OUT-OF-WINDOW" charge and takes payment to clear the exit gate.

Verified on a copy of the live DB: qty 2 = 2× price; a night-plan 19:30 entry →
30min/15,000 ALL owed, stamped + paid → gate clears, chain verifies; the reserve
toggle holds a qty-2 sub's 2 spots. Build+lint 12/12; 80 shared tests pass.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/capacity-occupancy.md

@@ -33,6 +33,23 @@ editable and drifts; the chain is the truth). Spaces-free = `capacity − occupa
   loop count, or the [[opencv-anpr-service|vision]] count) reconciles it — surfaced as an anomaly,
   not silently corrected.
 
+## Reserved subscriber spots (admin toggle, built 2026-06-20)
+
+By default occupancy counts only cars **physically inside** — a subscriber who isn't parked frees
+their spot to transients, and the operator handles any overflow by valet/key-juggling. A site can
+instead **hold a spot for every active subscriber**, so the lot reads "full" to transients sooner and
+the subscriber's place is guaranteed:
+
+- `site_config.reserve_subscriber_spots` (bool, default off). When ON,
+  `reservedSubscriberSpots(db)` sums, over every **active** subscription (status active AND
+  `now ∈ [validFrom, validTo]`), `max(0, quantity − itsCarsCurrentlyInside)` — i.e. it reserves only
+  the **not-yet-parked** portion of each subscription's [[subscription|quantity]] (a parked
+  subscriber already occupies a real spot; counting them twice would over-reserve).
+- `getOccupancy` gains `reserved` + `effectiveFree = capacity − count − reserved`. The transient FULL
+  gate becomes **`count + reserved ≥ capacity`**. Subscribers are still **never** gated by full
+  (their flow ignores it) — reservation only tightens the *transient* gate.
+- OFF = the prior behaviour exactly (`reserved = 0`).
+
 ## "Full" is a soft, operator-configurable policy
 
 Refusing at capacity is the **default**, not an absolute. An operator may opt into