devices: pool-of-spaces model — drop lane, per-relay direction

A parking lot is one pool of spaces with a flexible set of entry/exit
points — no "lane". Direction is a property of each RELAY inside an access
controller; readers/cameras bind to a controller relay and inherit it.

Schema:
- drop `lane` from ledger_events, device_events, sessions
- rename lane_devices -> devices (no lane/direction columns)
- access config.relays=[{relay,direction,button?}]; reader/camera
  config.controllerId+relay binding
- fresh 0000_baseline migration (history reset; dev data was throwaway)

Signed ledger:
- remove `lane` from canonicalize(); bump signer keyId sw-hmac-v1 -> v2
  (v1 events won't verify under v2 — intentional, gated per-event by keyId)

Server:
- new device-resolve.ts (replaces lane-map.ts): relayForButton,
  relayForDevice, firstRelayByDirection, devicesByDirection
- entry-flow: button terminal -> its relay; exit/permit: reader's bound
  relay; dispatcher resolves the bound relay + inherited direction
- camera snapshots fire by direction site-wide, async, never block open
- DeviceConfig widened to nested JSON for relays[]

Web:
- wizard: no lane selector; add controllers (relay map + entry-button
  terminal) first, then bind readers/cameras/printers to a controller relay

Wiki: new entry-exit-points.md (replaces lane-direction); reworked
entry-exit-readers, parking-session, first-run-setup, device-registry,
append-only-event-chain, device-events; removed stale lane/LaneMap mentions.

wiki/decisions/open-questions.md

@@ -56,3 +56,9 @@ status: open
    change what the `payment` event must store) and **refunds / overpayment / change** (cash change,
    "exact change only", a refund as a signed reversal event). Both depend on the unmanned-vs-manned
    payment subsystem (#3) and the note/coin/card acceptor hardware. Revisit at procurement.
+10. **Snapshot retention.** _(Raised by the [[entry-exit-points]] camera-snapshot build, 2026-06-16.)_
+    Entry/exit snapshots are stored as BLOBs in the [[sqlite]] `snapshots` table. This grows the
+    single DB file fast (~100–300 KB per image × every entry **and** exit), and SQLite doesn't
+    reclaim deleted-blob pages without `VACUUM`. **Undecided:** pruning policy (age-based vs.
+    total-size cap), VACUUM cadence, and how this interacts with the #5 backup strategy (blobs
+    bloat every backup). Until decided, snapshots accumulate unbounded. See [[entry-exit-points]].