docs(wiki): vision-service hardening backlog + boot-migration data-seed note

Two unrelated leftover wiki edits from earlier sessions:
- NEW concepts/vision-service-hardening.md: the prioritised to-do list from the
  2026-07-02 code + security reviews of apps/vision/ (DoS gaps, unauthenticated/
  operator-writable model weights, 0.0.0.0 default bind). Cross-linked from
  opencv-anpr-service.md ("consult before touching this service").
- container-deployment.md: note that a boot-time migration can be a DATA SEED
  (e.g. an RBAC permission granted to the operator role via INSERT OR IGNORE),
  and that a built-in-role grant does not auto-apply to a custom role.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/entities/opencv-anpr-service.md

@@ -230,6 +230,11 @@ service's `/health` each tick and shows a **"Vision" chip** in the booth footer
 > vision service must reach that VLAN to pull snapshots — but its own `/analyze` should bind
 > **localhost** (Node is the only caller). Keep the AGPL/heavy stack contained to this process.
 
+> **Hardening / fix backlog** ([[vision-service-hardening]]): the 2026-07-02 code + security reviews
+> logged a prioritised to-do list against `apps/vision/` — DoS gaps (body-cap-after-buffering,
+> pixel-bomb, inference on the async event loop), unauthenticated + operator-writable model weights,
+> and `0.0.0.0`-by-default binding lead it. **Consult it before touching this service.**
+
 ## Open
 
 - **Recognizer choice** — **fast-alpr (MIT, YOLOv9+CCT on ONNX) is the baseline, AL-benchmarked**: the