feat(subscription): rename permit→subscription + monthly pricing

The "permit/lejet" feature is really a subscription. Full rename of the
mutable master data, plus a recurring monthly price.

- DB (migration 0004, data-preserving ALTER RENAME): permits→subscriptions,
  permit_credentials/_plates→subscription_*, sessions.permit_id→subscription_id.
- Pricing: per-subscription priceMinor + period(monthly) + currency, with a
  site default (site_config.subscription_monthly_price_minor) pre-filling the form.
- Server: subscription-flow.ts (SubscriptionFlow), routes/subscriptions.ts
  (/api/subscriptions). Web: SubscriptionManager, route, i18n (sq Abonimet/en).
- The signed ledger `permitId` payload is intentionally kept — immutable
  hash-chained history; renaming it would break verification of past events.

Deferred (wiki notes): fee collection into the ledger/shift (a shift-attributed
payment), LPR/ANPR plate source, time-of-day access windows (overnight subscriber).

Also carries the device-footer UI surface (api DeviceStatus, router mount,
i18n devices) due to shared-file overlap with the preceding footer commit.

Verified end-to-end on a fresh DB and migration on a live-DB copy (sessions
preserved). Live DB migrated. Full monorepo builds clean.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/decisions/session-model.md

@@ -19,7 +19,7 @@ The starting decision for the **business layer**, taken 2026-06-15 as the projec
    events. A cache table is allowed for query speed but is always rebuildable and never
    authoritative.
 2. **Transient-first, mixed site.** Model the casual pay-for-duration session + [[tariff]] first;
-   layer [[permit]] holders on top as a second identity source that short-circuits payment
+   layer [[subscription]] holders on top as a second identity source that short-circuits payment
    ([[entry-exit-readers]]).
 3. **Pay-on-foot / pay station.** Payment is **decoupled from exit**: the customer pays at a
    central station; the exit lane only validates the session is paid and within the walk-back
@@ -48,7 +48,7 @@ pay-station and exit-validation flows. Schema (`packages/db`) + shared types fol
 
 - Rate card, currency, grace windows, caps — operator/procurement input ([[tariff]]).
 - Tariff versioning (effective-dated) for historical repricing.
-- [[permit]] data model + lapsed-mid-stay handling.
+- [[subscription]] data model + lapsed-mid-stay handling.
 - Wire payment capture to a concrete pay-station terminal ([[open-questions]] #3) — kept abstract
   (payment = an independent signed event referencing a session) until procurement settles.
 - Reconciliation of sessions/payments against an external authority remains [[open-questions]] #4