Device-agnostic driver registry + first-run setup

Make the device-adapter pattern selectable so the admin chooses hardware at
install — per lane, from a catalog of supported drivers. Adding a device =
registering one more driver; no business-logic change.

packages/devices:
- interfaces.ts: AccessControlDevice / ReaderDevice / CameraDevice / PrinterDevice
  (adds CameraDevice for entry/exit snapshot-on-event; access relay stays
  intent-only per "a barrier is not a door").
- registry.ts: driver catalog with per-driver config fields + factory, config
  validation, and a catalog payload for the setup UI.
- drivers/: stub adapters — access (zkteco, esp32-relay), reader (wiegand,
  tcp-ip), camera (hikvision, dahua). Real vendor protocols TBD.

packages/db:
- lane_devices + setup_state tables (migration 0001); re-export query helpers.

apps/server:
- routes/setup.ts: GET /api/setup/catalog (public schema), and admin-only
  /assign, /state, /complete with registry validation before persisting.
- extract auth.ts (requireJwtSecret, requireRole, JWT type aug).

apps/web:
- SetupWizard scaffold + api client: pick a driver per category for a lane,
  render its config fields.

wiki: device-registry + first-run-setup concept pages; cross-link from
device-adapter-pattern; index + log updated.

Verified: full turbo build (5/5); catalog lists all drivers; admin assign
persists; missing-config and no-token requests are rejected.

packages/devices/src/drivers/common.ts

@@ -0,0 +1,46 @@
+import type { ConfigField } from "../registry.js";
+
+// Shared config-field presets so drivers stay terse and consistent.
+
+export const hostField: ConfigField = {
+  key: "host",
+  label: "IP address / host",
+  type: "host",
+  required: true,
+  help: "On the isolated device VLAN. See wiki/concepts/network-isolation.md.",
+};
+
+export function portField(def: number): ConfigField {
+  return { key: "port", label: "Port", type: "port", required: true, default: def };
+}
+
+export const usernameField: ConfigField = {
+  key: "username",
+  label: "Username",
+  type: "string",
+  required: false,
+};
+
+export const passwordField: ConfigField = {
+  key: "password",
+  label: "Password",
+  type: "secret",
+  required: false,
+};
+
+/**
+ * Sink for stub/diagnostic device messages. Defaults to a no-op so the package
+ * has no host/runtime dependency; the server sets this to its Fastify logger.
+ */
+export type DeviceLogSink = (line: string) => void;
+
+let sink: DeviceLogSink = () => {};
+
+export function setDeviceLogSink(fn: DeviceLogSink): void {
+  sink = fn;
+}
+
+/** Stubs log instead of performing real I/O. Replaced with real protocols later. */
+export function stubLog(driverId: string, msg: string): void {
+  sink(`[device:${driverId}] ${msg}`);
+}