feat(vision): configurability — SetupWizard ANPR toggle, footer health chip, env docs

Make the vision service genuinely configurable (was env-only).

- SetupWizard: an "ANPR" checkbox on the camera form (writes config.anpr; persisted
  only when on; sq+en) — opt-in is no longer raw JSON.
- DeviceMonitor optionally takes the VisionClient and probes /health each tick, emitting
  a "vision" pseudo-device → a Vision chip (ready/degraded/offline + recognizer) in the
  booth footer when VISION_ENABLED, no chip when off. Widened the DeviceStatus category
  union (server + web) + footer maps + devices.catVision. Verified: ready/fast_alpr when
  up, 0 chips when disabled.
- apps/vision/.env.example (Python service) + a VISION_* block in apps/server/.env.example
  (Node side) + a Configuration section in opencv-anpr-service.md covering all four
  layers and the caveats: the two processes share the VISION_ prefix but need SEPARATE
  .env files; bind /analyze to 127.0.0.1; cache model weights at deploy; an unbound anpr
  camera recognizes but every read is refused.

Build + lint green.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/ui/DeviceFooter.tsx

@@ -32,6 +32,7 @@ const CATEGORY_KEY: Record<DeviceStatus["category"], string> = {
   reader: "devices.catReader",
   camera: "devices.catCamera",
   printer: "devices.catPrinter",
+  vision: "devices.catVision",
 };
 
 /** i18n key for the role/direction token (null = no suffix). */
@@ -45,6 +46,7 @@ const ORDER: Record<DeviceStatus["category"], number> = {
   reader: 1,
   camera: 2,
   printer: 3,
+  vision: 4,
 };
 
 /** "Lexuesi hyrje" — category word + localised role/direction (when known). */