Device-agnostic driver registry + first-run setup

Make the device-adapter pattern selectable so the admin chooses hardware at
install — per lane, from a catalog of supported drivers. Adding a device =
registering one more driver; no business-logic change.

packages/devices:
- interfaces.ts: AccessControlDevice / ReaderDevice / CameraDevice / PrinterDevice
  (adds CameraDevice for entry/exit snapshot-on-event; access relay stays
  intent-only per "a barrier is not a door").
- registry.ts: driver catalog with per-driver config fields + factory, config
  validation, and a catalog payload for the setup UI.
- drivers/: stub adapters — access (zkteco, esp32-relay), reader (wiegand,
  tcp-ip), camera (hikvision, dahua). Real vendor protocols TBD.

packages/db:
- lane_devices + setup_state tables (migration 0001); re-export query helpers.

apps/server:
- routes/setup.ts: GET /api/setup/catalog (public schema), and admin-only
  /assign, /state, /complete with registry validation before persisting.
- extract auth.ts (requireJwtSecret, requireRole, JWT type aug).

apps/web:
- SetupWizard scaffold + api client: pick a driver per category for a lane,
  render its config fields.

wiki: device-registry + first-run-setup concept pages; cross-link from
device-adapter-pattern; index + log updated.

Verified: full turbo build (5/5); catalog lists all drivers; admin assign
persists; missing-config and no-token requests are rejected.

packages/db/src/schema.ts

@@ -37,5 +37,34 @@ export const events = sqliteTable("events", {
   signature: text("signature").notNull(),
 });
 
+// Per-lane device assignments chosen by the admin during first-run setup.
+// One row per (lane, category, instance). `driverId` references a driver in the
+// @parking/devices registry; `config` is that driver's JSON config (host, port,
+// credentials…). Lets the system stay device-agnostic and admin-configurable.
+// See wiki/concepts/device-registry.md and first-run-setup.md.
+export const laneDevices = sqliteTable("lane_devices", {
+  id: text("id").primaryKey(),
+  lane: integer("lane").notNull(),
+  category: text("category", {
+    enum: ["access", "reader", "camera", "printer"],
+  }).notNull(),
+  driverId: text("driver_id").notNull(),
+  // Driver-specific connection config as JSON (validated against the driver's
+  // declared config fields before persisting). Secrets live here — protect at rest.
+  config: text("config", { mode: "json" }).notNull().$type<Record<string, unknown>>(),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`(current_timestamp)`),
+});
+
+// Tracks whether first-run setup has been completed (single-row marker).
+export const setupState = sqliteTable("setup_state", {
+  id: integer("id").primaryKey(), // always 1
+  completedAt: text("completed_at"),
+});
+
 export type UserRow = typeof users.$inferSelect;
 export type EventRow = typeof events.$inferSelect;
+export type LaneDeviceRow = typeof laneDevices.$inferSelect;
+export type SetupStateRow = typeof setupState.$inferSelect;