feat(carwash): Car Wash v1 + per-till shifts + site-level pay-at + till access by module permission

Car Wash — the pilot venue module (wiki/decisions/venue-modules.md):
- Master data (categories × services price matrix) at /setup/carwash; the desk at /wash
  (ticket lookup → order; open queue oldest-first: Done / Paid cash / Paid card / Void;
  Finished list). Orders freeze names + price; their life is signed (carwash_order,
  carwash_payment). Migration 0027.
- Where money is taken is a SITE setting (carwash_config.pay_at, migration 0028, signed
  config_change on a flip) — no per-order radio; a stale client is refused (409).
- Core seams: PayStation charge providers (a booth-paid wash rides the parking payment as
  chargeLines) + applyValidation() shared with the merchant route. A bay-paid, done wash
  signs the $0 parking payment so the exit reader releases the car.
- "Parking discount" modes for the wash: free while the wash runs (+ tolerance) and wash
  price off the fee (floored at 0), resolved at done and anchored at the order's intake
  (the entry-anchored version comped a 74-day stay); typed-amount and percent hidden for
  the wash. Long durations render y/d/h/m.

Tills — a shift belongs to a till, not the site (wiki/concepts/shift.md §Tills):
- TillId booth|carwash; every money event names its till (absent = booth, so the chain
  re-folds identically). ShiftService is per till: single-open, folds, X/Z-reports,
  vouchers, carry-forward. A bay payment needs the carwash shift.
- Working a till needs that till's module permission (manifest tillPermission; 403
  till_forbidden); /api/shift/tills lists only the role's tills.
- Web: ShiftButton per till (header = booth, wash desk = carwash); shift hub lists every
  open shift with till badges + filter; drawer hub switches tills.

Modules: landing per module (index route resolves booth → module landing → shifts →
profile); guards bounce to "/", /booth needs session:read.

Tests: carwash e2e suite (settings, intake, booth/bay paths, modes, void, gate, pay-at
policy, till permissions), 6 per-till shift tests; suite green (1 pre-existing flaky
backup test under the parallel run).

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

apps/web/src/lib/use-shift.ts

@@ -1,18 +1,19 @@
 import { useQuery } from "@tanstack/react-query";
-import { fetchShift, type ShiftStatus } from "../api.js";
+import { fetchShift, type ShiftStatus, type TillId } from "../api.js";
 import { qk } from "./query.js";
 
 // Shared shift status for the whole app — the header control, the booth screen's
 // per-shift log scope, and the pay/exit modal's gate all read this one Query so
 // they never disagree about whether a shift is open and whose it is. A shift is a
-// SITE-WIDE single-open accountability period (at most one open at a time). The WS
-// invalidates qk.shift on shift_open/shift_z_report/cash_movement, so this stays
-// live without polling. See wiki/concepts/shift.md.
+// per-TILL single-open accountability period (at most one open per till). The
+// default till is the booth; the wash desk reads its own (`useShift("carwash")`).
+// The WS invalidates qk.shift (a prefix, so every till) on shift_open/shift_z_report/
+// cash movements, so this stays live without polling. See wiki/concepts/shift.md.
 
 export interface ShiftState {
   /** Raw status from the server (null while loading / on error). */
   status: ShiftStatus | undefined;
-  /** Is ANY shift open site-wide? */
+  /** Is a shift open on this till? */
   isOpen: boolean;
   /** Is the open shift the logged-in operator's (so they may close it / operate)? */
   isMine: boolean;
@@ -25,8 +26,12 @@ export interface ShiftState {
   isLoading: boolean;
 }
 
-export function useShift(): ShiftState {
-  const q = useQuery({ queryKey: qk.shift, queryFn: fetchShift });
+/** Query key of one till's shift status — under the qk.shift prefix so the WS
+ *  invalidation reaches every till. */
+export const shiftKey = (till: TillId) => [...qk.shift, "current", till] as const;
+
+export function useShift(till: TillId = "booth"): ShiftState {
+  const q = useQuery({ queryKey: shiftKey(till), queryFn: () => fetchShift(till) });
   const s = q.data;
   const isOpen = s?.open != null;
   const isMine = s?.isMine ?? false;