devices: pool-of-spaces model — drop lane, per-relay direction

A parking lot is one pool of spaces with a flexible set of entry/exit
points — no "lane". Direction is a property of each RELAY inside an access
controller; readers/cameras bind to a controller relay and inherit it.

Schema:
- drop `lane` from ledger_events, device_events, sessions
- rename lane_devices -> devices (no lane/direction columns)
- access config.relays=[{relay,direction,button?}]; reader/camera
  config.controllerId+relay binding
- fresh 0000_baseline migration (history reset; dev data was throwaway)

Signed ledger:
- remove `lane` from canonicalize(); bump signer keyId sw-hmac-v1 -> v2
  (v1 events won't verify under v2 — intentional, gated per-event by keyId)

Server:
- new device-resolve.ts (replaces lane-map.ts): relayForButton,
  relayForDevice, firstRelayByDirection, devicesByDirection
- entry-flow: button terminal -> its relay; exit/permit: reader's bound
  relay; dispatcher resolves the bound relay + inherited direction
- camera snapshots fire by direction site-wide, async, never block open
- DeviceConfig widened to nested JSON for relays[]

Web:
- wizard: no lane selector; add controllers (relay map + entry-button
  terminal) first, then bind readers/cameras/printers to a controller relay

Wiki: new entry-exit-points.md (replaces lane-direction); reworked
entry-exit-readers, parking-session, first-run-setup, device-registry,
append-only-event-chain, device-events; removed stale lane/LaneMap mentions.

wiki/concepts/device-input-flow.md

@@ -39,7 +39,7 @@ neither is the real boundary:
 
 - **Relay control (host → device)** — UDP, now via the Dingtian **binary protocol on :60000 with a
   `relay_pw`** (the only authenticated relay option; the string protocol has none). Set on the
-  device + stored in `lane_devices` by the harden step (below).
+  device + stored in `devices` by the harden step (below).
 - **Input push (device → host)** — guarded by **HTTP Digest auth** + a **source-IP allowlist**.
 - **The real guarantee is the signed log:** every barrier open is a host decision, recorded as a
   signed event BEFORE the relay fires ([[append-only-event-chain]]). An out-of-band open (which a
@@ -55,7 +55,7 @@ fix preconditions (disable `input_link_relay`) → **harden** → set up input p
 capability ([[device-registry|HardenableDevice]]):
 
 - **Sets a random `relay_pw`** (1–9999) so binary relay commands need it; stores it in
-  `lane_devices` so the backend can keep commanding the relay.
+  `devices` so the backend can keep commanding the relay.
 - **Disables unused protocol channels** (rs485, can, tcp×2, mqtt → `p:255`), keeping only UDP1
   binary (relay control) + UDP2 string (status read) — fewer open doors.
 
@@ -81,7 +81,7 @@ the clear. We **empirically tested the device** to pick the strongest achievable
 → **HTTP Digest** (MD5, qop=auth). The password is never sent (only a nonce-keyed hash); nonces
 are **single-use** (replay resistance). Per-device credentials (`pushUser`/`pushPassword`) are
 generated by the backend on **device assign**, written to the device's `input_link_url` config,
-and stored in `lane_devices` — the admin never types a URL or secret. HTTPS would be stronger but
+and stored in `devices` — the admin never types a URL or secret. HTTPS would be stronger but
 the device can't do it here; Digest + the signed log is the practical answer on a flat network.
 See `apps/server/src/digest-auth.ts`.