refactor(vision): ANPR rides the entry/exit snapshot, drop polling reader

Rework the ANPR trigger to the real design: when a transient presses the button or a
subscriber passes QR/RFID, the entry/exit fires and takes its evidence snapshot — that
is the moment to recognize. snapshotAsync now takes the VisionClient and, after storing
each snapshot from an opt-in (config.anpr) camera, runs ANPR on the SAME image and
records the plate against the SAME session identity (device_events kind:"read" with
plate/confidence/region/snapshotId/source:"entry-exit-snapshot"). One image serves both
evidence and plate extraction; recognition fires only on a real entry/exit — no polling.

The entry/exit/subscription flows take an optional VisionClient and pass it through;
server.ts wires it. Removed the polling VisionReader and VISION_POLL_MS/VISION_DEDUPE_MS.

Advisory + fire-and-forget: a low-confidence/no-plate result records nothing, a vision
failure never delays or changes the open, and the plate does not feed the access
decision. Verified e2e: a simulated entry snapshot on an anpr camera (live fast_alpr)
stored the snapshot for the session and recorded {identity, plate:AA558EE, 0.999,
region:Albania, snapshotId}. Build + lint green.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/src/entry-flow.ts

@@ -17,6 +17,7 @@ import { getOccupancy } from "./occupancy.js";
 import type { EventLog } from "./event-log.js";
 import { devicesByDirection, relayForButton, relayForPresence, type ResolvedRelay } from "./device-resolve.js";
 import { snapshotAsync } from "./snapshot.js";
+import type { VisionClient } from "./vision-client.js";
 
 // The transient ENTRY flow: a button press → print a ticket → sign a vehicle_entry
 // → open the barrier. The button is wired into an access controller's input; the
@@ -69,11 +70,14 @@ export class EntryFlow {
   readonly #inFlight = new Set<string>();
   /** Per-relay one-car-one-ticket state (presence + cooldown), keyed controllerId:relay. */
   readonly #guard = new Map<string, RelayGuardState>();
+  /** Optional vision client — passed to snapshotAsync so ANPR runs on the entry image. */
+  readonly #vision: VisionClient | null;
 
-  constructor(db: Db, log: EventLog, logger: FastifyBaseLogger) {
+  constructor(db: Db, log: EventLog, logger: FastifyBaseLogger, vision: VisionClient | null = null) {
     this.#db = db;
     this.#log = log;
     this.#logger = logger;
+    this.#vision = vision;
   }
 
   /** Handle a device input edge. Two kinds of edge matter to this flow:
@@ -308,8 +312,8 @@ export class EntryFlow {
    *  Used on both the OPEN path and the refused/held anomaly paths — a turned-away or
    *  held car is exactly when the operator wants the photo. */
   #fireSnapshot(direction: "entry", identity: string): void {
-    void snapshotAsync({ db: this.#db, direction, identity, logger: this.#logger }).catch((err) =>
-      this.#logger.error(`entry snapshot error: ${(err as Error).message}`),
+    void snapshotAsync({ db: this.#db, direction, identity, logger: this.#logger, vision: this.#vision }).catch(
+      (err) => this.#logger.error(`entry snapshot error: ${(err as Error).message}`),
     );
   }