feat(devices): live device-status footer across all categories

Generalise printer-only monitoring to every configured device. New
DeviceMonitor polls all enabled devices each tick (default 8s): printers
via rich readStatus(), relays/readers/cameras via the generic healthCheck()
reachability probe, flattened to one traffic-light (ready/degraded/offline)
+ detail, deduped (emit on change only), fail-toward-offline.

- device-status bus event + GET /api/devices/status snapshot.
- Pushed over the existing /api/ws (hello carries the initial set;
  device-status frame per change).
- Web: live-store devices map, WS handler, DeviceFooter chip-per-device
  (role label not vendor; click a degraded/offline chip for an issues panel).

Verified roleKind resolution + change-only emit on a fresh DB.

Note: the footer's UI surface (api type, router mount, i18n devices) rides
in the subsequent subscription commit due to shared-file overlap.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/booth-console.md

@@ -83,6 +83,15 @@ the Active-Sessions "Open barrier" is disabled the same way. The server enforces
 (`requireShift` 409 `no_shift`) — the UI just front-runs the rejection. The live feed is **scoped to
 the open shift's window** (empty when no shift is open). See [[shift]] for the rule and the routes.
 
+## The device-status footer
+
+A **fixed footer** in the app shell shows the live status of every configured device — relays,
+readers, cameras, printers — one chip each (coloured dot + name + fault detail), with an "all ready
+/ N offline" roll-up. Fed by the unified [[device-status-monitoring|DeviceMonitor]] over the same
+`/api/ws` socket (`hello` carries the initial set; a `device-status` frame per change), held in the
+live store keyed by device id, with `GET /api/devices/status` as the seed/fallback. Visible on every
+screen, so the operator always sees the barrier relay's reachability and the printer's paper state.
+
 ## Dev notes
 - Vite proxies `/api/ws` (`ws: true`) to the backend; the backend's Origin allowlist must include the
   dev SPA origin (`WS_ALLOWED_ORIGINS=http://localhost:5173`). In production Fastify serves the SPA