docs(wiki): collector live on park-2; secrets shape, DNS vs bind, token format, every-entry sampling, CI extra rule

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/decisions/vision-service-packaging.md

@@ -87,6 +87,11 @@ The skeleton is **built and wired** (no recognizer models yet):
   (env `VISION_*`), `schemas.py` (the `/analyze` contract incl. a not-yet-populated `vehicle` field
   for Job 2), `recognizer.py` (a `Recognizer` **Protocol** + `StubRecognizer` and `FastAlprRecognizer`
   — the [[device-adapter-pattern]] applied to the model).
+- **CI runs WITHOUT the extra** (`uv sync --frozen` in ci.yml and build-images.yml): a test that
+  imports numpy/cv2 at module level breaks collection there even though it passes in a local venv
+  that has `alpr`. Rule (2026-09-07, after three red runs): pure post-processing tests get numpy
+  from the **dev group**; anything needing OpenCV uses `pytest.importorskip("cv2")`; the service
+  itself imports both lazily inside functions.
 - **Light-core, heavy-optional:** core deps boot in **stub mode** (no model download) so `uv sync` +
   tests work offline; the real stack is the `alpr` extra (`uv sync --extra alpr` →
   fast-alpr + onnxruntime). `VISION_RECOGNIZER=fast_alpr` switches it on.