feat: show recognized plate in live feed + active sessions

Surface the advisory ANPR plate (device_events kind="read", keyed by
session identity — unsigned, prunable, never an access decision) next to
entry/exit events in the live feed and on active-session rows.

Resolved at serialize time (new plate-lookup.ts; prefers an entry read;
one device_events scan per page) like subscriber-name enrichment — the
signed ledger is untouched. Adds plate? to the shared LedgerEvent and to
ActiveSession/SessionLookup; a small amber badge in the UI.

Caveat: a vehicle_entry is signed + pushed over WS before the async ANPR
read lands, so a fresh feed row may show no plate until reload; always
present on active sessions.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

packages/shared/src/index.ts

@@ -97,6 +97,11 @@ export interface LedgerEvent {
    *  name here so the UI shows "Aqif Kopertoni" instead of "SUBSESS-08cd1c52…".
    *  Absent on non-subscription events and on legacy serializers. */
   readonly subscriberLabel?: string | null;
+  /** READ-TIME ENRICHMENT — not signed, not stored. A licence plate ADVISORILY
+   *  recognized for this session (ANPR-on-snapshot, device_events kind="read"), shown
+   *  next to entry/exit events. Uppercased, no confidence/region (those live on the
+   *  snapshot review panel). Absent when no plate was read or for non-entry/exit events. */
+  readonly plate?: string | null;
 }
 
 /** Business/accountability events that live in the SIGNED, hash-chained ledger. */