feat(anpr): subscriber-entry bridge + admin disable toggle

Wire the lane camera's vehicle event into the gated subscription flow: on a
vehicle/active push from an opt-in (config.anpr) camera, AnprBridge pulls a fresh
snapshot, runs ANPR, applies a stricter entry confidence floor, debounces, and —
matching the plate to a subscription BEFORE emitting — emits a kind:"plate" read.
The existing ReadDispatcher -> SubscriptionFlow then signs the entry/exit and opens
the barrier. A plate is never the sole authority: it routes through the same gate
(active/window/blocklist/car-count) as any credential. Fail-soft, fire-and-forget,
subscriber-only by construction. Field-verified end to end (plate AA504LX opened the
entry barrier and appended a signed vehicle_entry).

Add an admin master switch (site_config.anpr_entry_enabled, default ON) in Site
Settings that disables ONLY the barrier-driving bridge; advisory snapshot-ANPR and
lane busy/free are unaffected. Read live per event, so toggling takes effect with no
restart. Migration 0013 (additive ALTER ADD COLUMN, default 1).

- New: apps/server/src/anpr-entry.ts (AnprBridge) + tests (9)
- hikvision-alarm.ts hands vehicle detections to the bridge (fire-and-forget) + wiring tests (3)
- server.ts reorders the read flows above the hik-alarm registration
- snapshot.ts exports buildCamera for reuse
- env: VISION_ENTRY_MIN_CONFIDENCE (0.85), ANPR_DEBOUNCE_MS (12000)
- site route + SiteSettings checkbox + i18n (sq/en parity)
- wiki: lane-presence-and-anpr-entry / lpr-camera / index / log -> BUILT

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/src/routes/hikvision-alarm.ts

@@ -5,6 +5,7 @@ import { deviceEvents } from "../device-events.js";
 import { requirePermission } from "../auth.js";
 import { verifyDigest } from "../digest-auth.js";
 import type { LaneStatus } from "../lane-status.js";
+import type { AnprBridge } from "../anpr-entry.js";
 
 // Hikvision "Alarm Server" event PUSH ingress. The newer-firmware cameras (Event →
 // Smart/VCA with "Detection Target: Human/Vehicle", Notify Surveillance Center, Alarm
@@ -95,7 +96,12 @@ function summarize(body: string): AlarmSummary {
   };
 }
 
-export async function hikvisionAlarmRoutes(app: FastifyInstance, db: Db, laneStatus?: LaneStatus): Promise<void> {
+export async function hikvisionAlarmRoutes(
+  app: FastifyInstance,
+  db: Db,
+  laneStatus?: LaneStatus,
+  anprBridge?: AnprBridge,
+): Promise<void> {
   // Accept ANY content-type as a raw Buffer (the camera may POST application/xml,
   // multipart/form-data with a JPEG, or text). Fastify's default JSON parser would 415
   // or empty these — we want the bytes verbatim. Scoped to THIS app instance via a
@@ -199,14 +205,22 @@ export async function hikvisionAlarmRoutes(app: FastifyInstance, db: Db, laneSta
     // for the booth barrier lights). Only on a vehicle target that's `active` — an
     // `inactive` (leave) isn't sent by this camera class, so the lane auto-clears on a
     // timeout in LaneStatus. We filter to vehicle per the booth's "vehicle only" intent.
-    if (
-      laneStatus &&
+    const isVehicleActive =
       (summary.target ?? "").toLowerCase() === "vehicle" &&
-      (summary.eventState ?? "active").toLowerCase() !== "inactive"
-    ) {
+      (summary.eventState ?? "active").toLowerCase() !== "inactive";
+    if (laneStatus && isVehicleActive) {
       laneStatus.vehicleDetected(deviceId);
     }
 
+    // ANPR BRIDGE: on a vehicle detection, if this camera opts into ANPR (config.anpr),
+    // pull a snapshot → read the plate → if it matches a SUBSCRIBER, emit a plate read
+    // onto the bus, which the existing gated SubscriptionFlow turns into an entry/exit +
+    // barrier open. Fire-and-forget — NEVER awaited on the 200 path (the camera must get
+    // a prompt ack or it retry-storms), and fail-soft inside the bridge. See anpr-entry.ts.
+    if (anprBridge && isVehicleActive) {
+      void anprBridge.onVehicleDetected(deviceId);
+    }
+
     // Surface on the in-process bus as a generic breadcrumb so a live listener can show
     // "camera saw a vehicle". NOT a DeviceReadEvent yet — that (plate identity driving
     // entry/exit) is the deliberate next step once we know the real payload.