tariff composer: admin publishes rate-card versions (pay station now operable)

validateTariffStructure (shared): non-negative ints, ascending block bounds,
only the last block open-ended — a malformed card can't be published.

Routes: GET /api/tariff (active + history, any signed-in role), POST
/api/tariff/versions (publish an immutable, effective-dated version; admin
only). The single site tariff row is created lazily. Editing = publish a new
version; past sessions keep their pricing.

Web: TariffComposer in the admin shell — edit currency, grace windows,
increment, daily cap, lost-ticket fee, and add/remove rate blocks (major-unit
input -> minor on submit); shows active version + history.

Verified via inject: empty -> active null; invalid blocks -> 400 with problem;
valid -> 201; readonly publish -> 403; after publishing, the pay station quote
returns 404 (no session) instead of 409 (no tariff) -- it now prices against the
active card.

wiki/log.md

@@ -534,3 +534,17 @@ guarantee. Recorded in [[dingtian-relay]] (new Hardening section).
   raw-SQL backdate in one test correctly broke the chain — the tamper-evidence working, not a flow bug.)
 - Updated [[tariff]] (settled edges + as-built), [[parking-session]] (pay station as-built; full
   loop passes).
+
+## [2026-06-15] build | Tariff composer (makes the pay station operable)
+- `validateTariffStructure` in `packages/shared` — non-negative ints, ascending block bounds, only
+  the last block open-ended; a malformed card can't be published.
+- Routes (`apps/server/src/routes/tariffs.ts`): `GET /api/tariff` (active + history, any role) and
+  `POST /api/tariff/versions` (publish immutable version, ADMIN only). Single site `tariffs` row
+  created lazily. Editing = publish a new version (effective-dated, immutable).
+- UI (`apps/web/src/TariffComposer.tsx`, admin shell next to SetupWizard): currency, grace windows,
+  increment, daily cap, lost-ticket, add/remove rate blocks; major-unit input → minor on submit;
+  shows active + history.
+- VERIFIED via Fastify inject: GET empty→active null; invalid (out-of-order blocks)→400 w/ problem;
+  valid→201 createdBy=admin; readonly publish→403; after publish the pay station quote returns 404
+  (session) not 409 (no tariff) — i.e. it now sees the active card. Full build 5/5.
+- Updated [[tariff]] (composer as-built).