feat(vision): vehicle stage, phase A — YOLOX-S (Apache-2.0 ONNX) beside the plate recognizer

Fills /analyze vehicle.body_type + confidence (car / motorcycle / bus / truck from COCO,
mapped to the shared vocabulary) for the Car Wash desk's category suggestion
(venue-modules.md §Vehicle category from vision). Advisory: the operator decides, a
confident downgrade is flagged, nothing is gated on it.

- vision_service/vehicle.py: pure numpy/cv2 letterbox (pad 114, raw BGR), stride-grid
  decode, class-agnostic NMS, one vehicle per frame (the box holding the plate's centre,
  else the largest); YoloxVehicleDetector on onnxruntime CPU, 2 intra-op threads.
- recognizer.py: WithVehicle composes the stage over any plate recognizer (stub included);
  a failing stage yields vehicle=null + a "vehicle: …" note in /health.detail — never
  costs the plate read. model_version reads "<plate>+yolox:yolox_s.onnx@640".
- settings: VISION_VEHICLE_MODEL_PATH (unset = off), _INPUT_SIZE (640), _MIN_CONFIDENCE
  (0.4, the detector's floor; the flag threshold is site config).
- Dockerfile bakes yolox_s.onnx (best-effort curl at build; no network → stage off) and
  sets the path; compose forwards it (empty = off); .env.example documents it.
- Measured on four real dev entry frames (DS-2CD1047G3H, 2560×1440): car at 0.83–0.88 in
  ~240–330 ms; empty lane with a person → none.
- tests/test_vehicle.py: decode/NMS/pick/letterbox on synthetic tensors, the composition,
  and a missing-model /health. Wiki: opencv-anpr-service, venue-modules, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

apps/vision/vision_service/settings.py

@@ -32,6 +32,16 @@ class Settings(BaseSettings):
     # Node side can fall back to the ticket path rather than trust it.
     min_confidence: float = 0.5
 
+    # Vehicle stage (phase A — venue-modules.md §Vehicle category from vision): a YOLOX
+    # ONNX graph (Apache-2.0) run beside the plate recognizer. Unset = stage off (the
+    # response's `vehicle` stays null). Bake the file into the image (models/), never a
+    # path an operator can write (vision-service-hardening.md).
+    vehicle_model_path: str | None = None
+    vehicle_input_size: int = 640
+    # Detection score floor for a vehicle box to count at all (the Node side applies the
+    # site's own, stricter threshold before it FLAGS anything).
+    vehicle_min_confidence: float = 0.4
+
 
 def get_settings() -> Settings:
     return Settings()