server: GEE/Dingtian QR reader endpoint + synchronous ReadOutcome

The reader HTTP-GETs on each scan and beeps/acts on our JSON reply (host-in-the-
loop, synchronous). New route GET/POST /qa/mcardsea.php parses the SDK query,
runs the scan through the read dispatcher (permit match -> permit flow; else
transient exit), and replies the SDK verdict: status 1=valid (beep 2x) /
0=invalid (beep 1x), output, time-sync.

Refactored the read flows to return a ReadOutcome {accepted, direction, reason}
so the reply reflects the real accept/reject decision (ReadDispatcher.dispatch,
ExitFlow.handleAt, PermitFlow.run). Fire-and-forget readers ignore it.

Reader's lane is keyed off its serial (cjihao) as lane_devices.id for now;
endpoint is public (reader has no auth, on the device subnet).

Verified via inject: valid permit QR -> status:1 + open; re-scan -> permit exit;
unknown QR -> status:0; barrier-less lane -> status:0.

apps/server/src/exit-flow.ts

@@ -2,7 +2,7 @@ import { and, eq, laneDevices, ledgerEvents, sessions, type Db } from "@parking/
 import { registry, type AccessControlDevice } from "@parking/devices";
 import type { LedgerPayload } from "@parking/shared";
 import type { FastifyBaseLogger } from "fastify";
-import type { DeviceReadEvent } from "./device-events.js";
+import type { DeviceReadEvent, ReadOutcome } from "./device-events.js";
 import type { EventLog } from "./event-log.js";
 
 // The EXIT flow (pay-on-foot model): a credential read at the exit lane → look up
@@ -46,32 +46,34 @@ export class ExitFlow {
 
   /** Handle a transient-ticket read at a known exit lane (lane pre-resolved by the
    *  read dispatcher, which has already ruled out a permit match). */
-  async handleAt(lane: number, e: DeviceReadEvent): Promise<void> {
+  async handleAt(lane: number, e: DeviceReadEvent): Promise<ReadOutcome> {
     const key = `${e.deviceId}:${e.value}`;
-    if (this.#inFlight.has(key)) return;
+    if (this.#inFlight.has(key)) return { accepted: false, reason: "duplicate read in flight" };
     this.#inFlight.add(key);
     try {
-      await this.#runExit(lane, e);
+      return await this.#runExit(lane, e);
     } catch (err) {
       this.#logger.error(`exit-flow failed (lane ${lane}): ${(err as Error).message}`);
+      return { accepted: false, reason: (err as Error).message };
     } finally {
       this.#inFlight.delete(key);
     }
   }
 
-  async #runExit(lane: number, e: DeviceReadEvent): Promise<void> {
+  async #runExit(lane: number, e: DeviceReadEvent): Promise<ReadOutcome> {
     const view = this.#sessionFor(e.value);
 
     // No matching open session — unknown/duplicate ticket. Reject + log.
     if (!view || !view.open) {
+      const reason = view ? "exit refused — session already closed" : "exit refused — no open session for credential";
       await this.#log.append({
         type: "anomaly",
         lane,
         identity: e.value,
-        payload: { reason: view ? "exit refused — session already closed" : "exit refused — no open session for credential", exitRefused: true },
+        payload: { reason, exitRefused: true },
       });
       this.#logger.warn(`exit refused (lane ${lane}): no open session for ${e.value}`);
-      return;
+      return { accepted: false, direction: "exit", reason };
     }
 
     // PAID + within walk-back grace?
@@ -92,7 +94,7 @@ export class ExitFlow {
         payload: { reason, exitRefused: true, sessionRef: e.value },
       });
       this.#logger.warn(`exit refused (lane ${lane}, ${e.value}): ${reason}`);
-      return;
+      return { accepted: false, direction: "exit", reason };
     }
 
     // Valid: sign the exit BEFORE opening, then open, then update the cache.
@@ -121,6 +123,7 @@ export class ExitFlow {
     } catch (err) {
       this.#logger.error(`session-cache close failed for ${e.value}: ${(err as Error).message}`);
     }
+    return { accepted: true, direction: "exit" };
   }
 
   /** Fold the signed ledger into a session view for one identity (authoritative). */