feat(carwash): advisory vehicle category from the entry camera — mapping, pre-select, downgrade flag

The app plumbing for venue-modules.md §"Vehicle category from vision"; the model is the
open half (no bundled recognizer emits body_type yet, so the desk shows nothing until
phase A lands in the vision service).

- Shared: VEHICLE_CLASSES vocabulary, VehicleRead, CARWASH_VISION_THRESHOLD_DEFAULT,
  reason code carwash.categoryDowngrade; settings/order/lookup views carry the read.
- Vision contract: /analyze vehicle.body_type + confidence (service schema); the Node
  client normalises to the vocabulary and drops the rest.
- Record: snapshot.ts stores the read in the plate's device_events row (or its own when
  the plate was unreadable); vehicleForIdentity() resolves it like the plate.
- Car wash: carwash_categories.vision_classes (site mapping "car, sedan → Vetura"),
  carwash_config.vision_threshold (signed config_change when it moves), four vision
  columns on orders — migration 0030. Lookup returns vision + suggestedCategoryId.
- Desk pre-selects the mapped category and shows the read + snapshot thumbnail; Setup
  offers class chips per category and the threshold. Operator decides.
- Flag: a read at/above the threshold whose mapped category prices HIGHER than the chosen
  one signs one `anomaly` (both categories/prices, operator, snapshot) and stores its id on
  the order. Equal/upgrade/unsure/unmapped → nothing. Recorded only, never blocks, no
  reason prompt (user, 2026-09-06).

Tests in carwash.test.ts; wiki venue-modules (As built), opencv-anpr-service, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

apps/vision/vision_service/schemas.py

@@ -31,10 +31,18 @@ class PlateResult(BaseModel):
 
 
 class VehicleResult(BaseModel):
-    """Job 2 — vehicle attributes / fingerprint (anti-spoofing). Not yet produced."""
+    """Job 2 — vehicle attributes. `body_type` is ADVISORY: the Node server records it
+    beside the plate and the Car Wash desk pre-selects the site category it maps to; the
+    operator decides, a disagreement is flagged, nothing is ever gated on it. Values come
+    from the shared vocabulary (car, sedan, hatchback, suv, minivan, pickup, van, truck,
+    bus, motorcycle) — anything else is ignored by Node. Phase A (a COCO detector) emits
+    car/truck/bus/motorcycle; the finer classes need the body-type classifier. Not yet
+    produced by any bundled recognizer."""
 
     colour: str | None = None
     body_type: str | None = None
+    # Confidence of `body_type` (0–1). Node compares it to the site's threshold.
+    confidence: float | None = Field(default=None, ge=0.0, le=1.0)
     make: str | None = None
     model: str | None = None