feat(anpr): subscriber-entry bridge + admin disable toggle

Wire the lane camera's vehicle event into the gated subscription flow: on a
vehicle/active push from an opt-in (config.anpr) camera, AnprBridge pulls a fresh
snapshot, runs ANPR, applies a stricter entry confidence floor, debounces, and —
matching the plate to a subscription BEFORE emitting — emits a kind:"plate" read.
The existing ReadDispatcher -> SubscriptionFlow then signs the entry/exit and opens
the barrier. A plate is never the sole authority: it routes through the same gate
(active/window/blocklist/car-count) as any credential. Fail-soft, fire-and-forget,
subscriber-only by construction. Field-verified end to end (plate AA504LX opened the
entry barrier and appended a signed vehicle_entry).

Add an admin master switch (site_config.anpr_entry_enabled, default ON) in Site
Settings that disables ONLY the barrier-driving bridge; advisory snapshot-ANPR and
lane busy/free are unaffected. Read live per event, so toggling takes effect with no
restart. Migration 0013 (additive ALTER ADD COLUMN, default 1).

- New: apps/server/src/anpr-entry.ts (AnprBridge) + tests (9)
- hikvision-alarm.ts hands vehicle detections to the bridge (fire-and-forget) + wiring tests (3)
- server.ts reorders the read flows above the hik-alarm registration
- snapshot.ts exports buildCamera for reuse
- env: VISION_ENTRY_MIN_CONFIDENCE (0.85), ANPR_DEBOUNCE_MS (12000)
- site route + SiteSettings checkbox + i18n (sq/en parity)
- wiki: lane-presence-and-anpr-entry / lpr-camera / index / log -> BUILT

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/src/server.ts

@@ -26,6 +26,7 @@ import { roleRoutes } from "./routes/roles.js";
 import { deviceRoutes } from "./routes/devices.js";
 import { hikvisionAlarmRoutes } from "./routes/hikvision-alarm.js";
 import { LaneStatus } from "./lane-status.js";
+import { AnprBridge } from "./anpr-entry.js";
 import { eventRoutes } from "./routes/events.js";
 import { reportRoutes } from "./routes/reports.js";
 import { recycleBinRoutes } from "./routes/recycle-bin.js";
@@ -121,11 +122,9 @@ export async function buildServer(opts: BuildOptions = {}): Promise<FastifyInsta
   const laneStatus = new LaneStatus(db, app.log);
   app.addHook("onClose", async () => laneStatus.stop());
 
-  // Hikvision "Alarm Server" event push: the camera POSTs an EventNotificationAlert on
-  // each detected target (vehicle). Source-IP guarded + optional Digest; records the raw
-  // payload as a `kind:"alarm"` device_event AND drives lane busy/free for vehicles.
-  // See routes/hikvision-alarm.ts.
-  await hikvisionAlarmRoutes(app, db, laneStatus);
+  // NB: the Hikvision Alarm Server routes are registered LOWER DOWN — after the read
+  // flows are constructed — because the ANPR bridge they carry depends on the
+  // SubscriptionFlow. See the hikvisionAlarmRoutes() call below the read-flow wiring.
 
   // Live printer-status monitor: polls printers (paper/cover/cutter/offline) and
   // pushes changes to the booth UI. setupRoutes() has already registered the
@@ -199,6 +198,19 @@ export async function buildServer(opts: BuildOptions = {}): Promise<FastifyInsta
   });
   app.addHook("onClose", async () => unsubscribeRead());
 
+  // ANPR bridge: a subscriber's plate, read off the lane camera's vehicle detection,
+  // admits them through the SAME gated SubscriptionFlow a QR/card scan uses (it emits a
+  // plate read onto the bus, which the dispatcher above turns into a gated entry/exit).
+  // Advisory + fail-soft + subscriber-only — never the sole reason a barrier opens. Needs
+  // the subscriptionFlow constructed just above. See anpr-entry.ts.
+  const anprBridge = new AnprBridge(db, visionClient, subscriptionFlow, app.log);
+
+  // Hikvision "Alarm Server" event push: the camera POSTs an EventNotificationAlert on
+  // each detected target (vehicle). Source-IP guarded + optional Digest; records the raw
+  // payload as a `kind:"alarm"` device_event, drives lane busy/free, AND hands a vehicle
+  // detection to the ANPR bridge above. See routes/hikvision-alarm.ts.
+  await hikvisionAlarmRoutes(app, db, laneStatus, anprBridge);
+
   // Credential capture ("enroll a card"): lets the operator present an RFID card to a
   // CHOSEN reader to populate a subscription credential, without blocking the other
   // reader's live flow. Single-shot + TTL. See credential-capture.ts.