fix(deploy): pass the USB printer (usblp) into the host-net server container

The USB ESC/POS printer is the host's /dev/usb/lpN (usblp char device, major 180),
but the container has its own /dev — `docker exec server ls /dev/usb` → "No such
file or directory", so probeUsb's open() ENOENTs and the printer is always offline
regardless of the path set in setup. Containerization isolates host hardware (same
root cause as the network fix); USB needs explicit passthrough:

- volumes: /dev/usb:/dev/usb  → the lpN NODES appear inside the container
- device_cgroup_rules: 'c 180:* rmw'  → permit the usblp char major (180), and the
  `:*` minor wildcard survives lp0/lp1/lp2 renumbering across replug/boot-order.

Binding the /dev/usb DIR (not a single `devices:` node) is what survives renumber.
Merge verified: parking-data ledger volume preserved (lists append), host net intact,
config valid. Booth prereq: `usblp` loaded at boot + printer attached before start,
else /dev/usb is absent.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

docker-compose.prod.yml

@@ -51,6 +51,19 @@ services:
     # there is no separate namespace, and runc REFUSES it ("not allowed in host network
     # namespace"). Reader liveness ping uses the HOST's setting instead — the booth host must
     # set net.ipv4.ping_group_range (see appliance-provisioning §7 / disk-os-hardening).
+    #
+    # USB PRINTER PASSTHROUGH. A USB ESC/POS printer (Rongta/Cashino) is the kernel `usblp` char
+    # device /dev/usb/lpN on the HOST — the container has its own /dev and can't see it (probeUsb
+    # open() → ENOENT → printer always "offline"). Two parts, both needed:
+    #   - bind-mount /dev/usb so the lpN NODES appear inside the container, and
+    #   - a device-cgroup rule permitting the usblp char major (180) so the kernel allows the
+    #     open(). `180:*` covers lp0/lp1/lp2… so a USB replug/boot-order renumber still works
+    #     (the printer's path can move; set Connection=USB + the matching /dev/usb/lpN in setup).
+    # (Bind-mounting the dir, not a single `devices:` node, is what survives renumbering.)
+    volumes:
+      - /dev/usb:/dev/usb
+    device_cgroup_rules:
+      - "c 180:* rmw"
     logging:
       driver: json-file
       options: