feat: show recognized plate in live feed + active sessions

Surface the advisory ANPR plate (device_events kind="read", keyed by
session identity — unsigned, prunable, never an access decision) next to
entry/exit events in the live feed and on active-session rows.

Resolved at serialize time (new plate-lookup.ts; prefers an entry read;
one device_events scan per page) like subscriber-name enrichment — the
signed ledger is untouched. Adds plate? to the shared LedgerEvent and to
ActiveSession/SessionLookup; a small amber badge in the UI.

Caveat: a vehicle_entry is signed + pushed over WS before the async ANPR
read lands, so a fresh feed row may show no plate until reload; always
present on active sessions.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/ActiveSessions.tsx

@@ -155,6 +155,14 @@ export function ActiveSessions({ onPick }: { onPick: (identity: string) => void
                     <span className="text-term-text">
                       {s.subscription ? `★ ${s.subscriptionHolder ?? t("subs.unnamed")}` : s.identity}
                     </span>
+                    {s.plate && (
+                      <span
+                        className="rounded border border-term-border px-1 font-semibold tracking-wide text-term-amber"
+                        title={t("booth.plateTitle")}
+                      >
+                        {s.plate}
+                      </span>
+                    )}
                     <span className="text-term-muted">{formatRelativeDateTime(s.enteredAt, t)}</span>
                     <span className="text-term-muted">{formatDuration(s.enteredAt, new Date().toISOString())}</span>
                     <span