wiki: design the business layer (session, tariff, permit, vision, shift, ops)

Pivot from the hardware/integrity layer to the parking operation. All
wiki-only; no code yet. Core principle throughout: business entities are
projections over the signed append-only event log, never mutable tables.

New concepts: parking-session, tariff (composable/versioned, FX-ready),
shift (manned-only Z-report), capacity-occupancy, validation-discounts,
reporting-analytics, clock-integrity, ticket-encoding, anti-passback.
New entities: permit, opencv-anpr-service, blocklist.
Decisions: session-model, vision-service (host-side ANPR + vehicle
verification; scoped AGPL exception for the isolated service).

Updates: append-only-event-chain (new event types + vision witness),
local-jwt-auth (drop 8h expiry -> until logout; code change pending),
lpr-camera (host-side recognition supersedes edge-AI), standing-decisions
(AGPL exception), open-questions (+FX, +pay-station money corners, backup).

Deferred + flagged: intercom/help-call, receipts/refunds/change, FX engine,
lane topology (#1).

wiki/entities/lpr-camera.md

@@ -7,12 +7,17 @@ updated: 2026-06-15
 
 # LPR Camera
 
-License-plate-recognition camera (recommended: **Milesight edge-AI LPR**). For
-**casual/transient** vehicles, the **plate acts as ticket + an independent record**. (See
-[[parking-system-architecture]] §8, §9.)
+License-plate-recognition camera. For **casual/transient** vehicles, the **plate acts as ticket +
+an independent record**. (See [[parking-system-architecture]] §8, §9.)
 
-- **Edge AI**: recognition runs **on-device**, so it keeps working with no internet — fits
-  [[offline-first]].
+> **Superseded direction (2026-06-15):** recognition now runs **host-side** on snapshots from
+> ordinary Hikvision/Dahua cameras via the [[opencv-anpr-service]], **not** on a dedicated edge-AI
+> LPR camera — see [[vision-service]]. The edge-AI camera below is kept as the original assumption /
+> a fallback option, but is no longer the planned path. The host-side service also does **vehicle
+> verification** (anti-plate-spoofing), which an edge-LPR camera does not.
+
+- **Edge AI (original assumption)**: recognition runs **on-device**, so it keeps working with no
+  internet — fits [[offline-first]].
 - It's a **host-side** identity source: only the host sees the read; the host decides and
   commands the relay open (the [[uhppote-controller]] is demoted to a commanded relay for that
   lane). See [[entry-exit-readers]].