Real Hikvision/Dahua camera driver; gate Backend-push-IP on capability

Replace the camera stub with HttpCamera: Hikvision ISAPI and Dahua CGI
snapshots over client-side HTTP Digest (new drivers/http-digest.ts).
healthCheck() now pulls a real frame instead of returning ready/stub.
Snapshot carries bytes (driver fetches); storage/imageRef is the caller's
job, keeping the adapter free of storage deps.

Fix the cosmetic Backend-push-IP field: add pushesToBackend to DeviceDriver
(only Dingtian sets it), expose as pushCapable in the catalog, and gate the
wizard's backend-IP fetch + field on it so pull-only devices hide it.

Verified on hardware (Hikvision 10.0.10.121): healthCheck ready,
captureSnapshot returns a valid JPEG.

packages/devices/src/interfaces.ts

@@ -179,10 +179,15 @@ export interface SnapshotContext {
 }
 
 export interface Snapshot {
-  /** Storage reference for the captured image (file path / blob id). */
-  readonly imageRef: string;
+  /** The captured image bytes. The DRIVER fetches them over the network; the
+   *  CALLER (entry/exit flow) owns storage and minting a durable reference —
+   *  keeping the device adapter free of any filesystem/blob-store dependency. */
+  readonly bytes: Buffer;
   readonly contentType: string;
   readonly capturedAt: string; // ISO-8601
+  /** Storage reference (file path / blob id), set once the caller has stored
+   *  the bytes. Absent on the value the driver returns. */
+  readonly imageRef?: string;
 }
 
 // --- Printers (ticket dispenser / booth printer) -------------------------