feat(carwash): Car Wash v1 + per-till shifts + site-level pay-at + till access by module permission

Car Wash — the pilot venue module (wiki/decisions/venue-modules.md):
- Master data (categories × services price matrix) at /setup/carwash; the desk at /wash
  (ticket lookup → order; open queue oldest-first: Done / Paid cash / Paid card / Void;
  Finished list). Orders freeze names + price; their life is signed (carwash_order,
  carwash_payment). Migration 0027.
- Where money is taken is a SITE setting (carwash_config.pay_at, migration 0028, signed
  config_change on a flip) — no per-order radio; a stale client is refused (409).
- Core seams: PayStation charge providers (a booth-paid wash rides the parking payment as
  chargeLines) + applyValidation() shared with the merchant route. A bay-paid, done wash
  signs the $0 parking payment so the exit reader releases the car.
- "Parking discount" modes for the wash: free while the wash runs (+ tolerance) and wash
  price off the fee (floored at 0), resolved at done and anchored at the order's intake
  (the entry-anchored version comped a 74-day stay); typed-amount and percent hidden for
  the wash. Long durations render y/d/h/m.

Tills — a shift belongs to a till, not the site (wiki/concepts/shift.md §Tills):
- TillId booth|carwash; every money event names its till (absent = booth, so the chain
  re-folds identically). ShiftService is per till: single-open, folds, X/Z-reports,
  vouchers, carry-forward. A bay payment needs the carwash shift.
- Working a till needs that till's module permission (manifest tillPermission; 403
  till_forbidden); /api/shift/tills lists only the role's tills.
- Web: ShiftButton per till (header = booth, wash desk = carwash); shift hub lists every
  open shift with till badges + filter; drawer hub switches tills.

Modules: landing per module (index route resolves booth → module landing → shifts →
profile); guards bounce to "/", /booth needs session:read.

Tests: carwash e2e suite (settings, intake, booth/bay paths, modes, void, gate, pay-at
policy, till permissions), 6 per-till shift tests; suite green (1 pre-existing flaky
backup test under the parallel run).

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

apps/web/src/modules/carwash/api.ts

@@ -0,0 +1,55 @@
+import type { CarWashPayAt, CarwashOrderView, CarwashSettingsView, Tender } from "@parking/shared";
+import { apiFetch } from "../../api.js";
+
+// The Car Wash module's API client — module-local so apps/web/src/api.ts (the core
+// client) never learns about wash endpoints. Shapes come from @parking/shared.
+
+export type { CarWashPayAt, CarwashOrderView, CarwashSettingsView };
+
+export interface CarwashTicketLookup {
+  identity: string;
+  found: boolean;
+  open: boolean;
+  subscription: boolean;
+  plate: string | null;
+  enteredAt: string | null;
+  currency: string | null;
+  orders: CarwashOrderView[];
+}
+
+export interface CarwashSettingsBody {
+  categories?: { id?: string; name: string; active?: boolean }[];
+  services?: { id?: string; name: string; active?: boolean }[];
+  prices?: { categoryId: string; serviceId: string; priceMinor: number }[];
+  /** Where wash money is taken at this site (site-level; the desk no longer asks). */
+  payAt?: CarWashPayAt;
+}
+
+export function fetchCarwashSettings(): Promise<CarwashSettingsView> {
+  return apiFetch("/api/carwash/settings");
+}
+export function saveCarwashSettings(body: CarwashSettingsBody): Promise<CarwashSettingsView> {
+  return apiFetch("/api/carwash/settings", { method: "PUT", body: JSON.stringify(body) });
+}
+export function lookupCarwashTicket(identity: string): Promise<CarwashTicketLookup> {
+  return apiFetch(`/api/carwash/session/${encodeURIComponent(identity.trim())}`);
+}
+export function fetchCarwashOrders(scope: "open" | "recent" = "open"): Promise<{ orders: CarwashOrderView[] }> {
+  return apiFetch(`/api/carwash/orders?scope=${scope}`);
+}
+export function createCarwashOrder(body: {
+  identity: string;
+  categoryId: string;
+  serviceId: string;
+}): Promise<CarwashOrderView> {
+  return apiFetch("/api/carwash/orders", { method: "POST", body: JSON.stringify(body) });
+}
+export function markCarwashDone(id: string): Promise<CarwashOrderView> {
+  return apiFetch(`/api/carwash/orders/${encodeURIComponent(id)}/done`, { method: "POST" });
+}
+export function payCarwashAtBay(id: string, tender: Tender): Promise<CarwashOrderView> {
+  return apiFetch(`/api/carwash/orders/${encodeURIComponent(id)}/pay`, { method: "POST", body: JSON.stringify({ tender }) });
+}
+export function voidCarwashOrder(id: string, reason: string): Promise<CarwashOrderView> {
+  return apiFetch(`/api/carwash/orders/${encodeURIComponent(id)}/void`, { method: "POST", body: JSON.stringify({ reason }) });
+}