feat: subscription v2 — quantity pricing, plan timeframes (tariff bridge), reserved spots

Three subscriber enhancements driven by real scenarios (migration 0011, all
additive columns — backward-compatible).

1. QUANTITY. One subscription covers N cars (a family pays once for two). Sale
   amount = span price × quantity; maxConcurrent defaults to the quantity so all
   N cars can be inside. Quantity rides in the payment payload.

2. PLAN TIMEFRAMES → TARIFF BRIDGE. A plan may restrict WHEN a subscriber may
   park (e.g. weekday 20:00→08:00, weekend all-day). A scan outside the window is
   NOT refused — the out-of-window minutes are charged at the normal TRANSIENT
   tariff (the subscriber is a transient for that time):
     - early entry: arrival → window-open, DEFERRED (signed as windowOwedMinor on
       the vehicle_entry payload), collected at exit;
     - late exit: window-close → departure, and exit is GATED
       (sub.refused.unpaidWindow) until paid at the booth.
   Pure, tz-aware outOfWindowGap in @parking/shared (12 unit tests); pricing
   reuses computeFee + the active tariff version
   (apps/server/src/subscription-window.ts). The exit refusal is a host-ONLINE
   business gate — the fail-open rule still governs the offline path.

3. RESERVED SPOTS. Site toggle reserve_subscriber_spots: occupancy holds
   max(0, quantity − itsCarsInside) per active subscription, so transients see
   "full" sooner; effectiveFree = capacity − count − reserved. Subscribers are
   never gated by full.

UI: quantity field + ×N quote (SubscriptionManager); timeframes editor
(SubscriptionPlansManager); reserve checkbox (SiteSettings); booth pay modal
shows an "OUT-OF-WINDOW" charge and takes payment to clear the exit gate.

Verified on a copy of the live DB: qty 2 = 2× price; a night-plan 19:30 entry →
30min/15,000 ALL owed, stamped + paid → gate clears, chain verifies; the reserve
toggle holds a qty-2 sub's 2 spots. Build+lint 12/12; 80 shared tests pass.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

packages/db/drizzle/0011_subscription_plan_v2.sql

@@ -0,0 +1,7 @@
+-- Subscription plans v2: per-plan allowed-time windows (tariff bridge), per-subscription
+-- car quantity, and a site toggle to reserve subscriber spots in the occupancy count.
+-- All additive ALTER ADD COLUMN — backward-compatible (existing rows take the defaults:
+-- timeframes null = 24/7, quantity 1, reserve off). SQLite ADD COLUMN is in-place.
+ALTER TABLE `subscription_plans` ADD `timeframes` text;--> statement-breakpoint
+ALTER TABLE `subscriptions` ADD `quantity` integer DEFAULT 1 NOT NULL;--> statement-breakpoint
+ALTER TABLE `site_config` ADD `reserve_subscriber_spots` integer DEFAULT 0 NOT NULL;

packages/db/drizzle/meta/_journal.json

@@ -78,6 +78,13 @@
       "when": 1781885300000,
       "tag": "0010_subscription_plans",
       "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "6",
+      "when": 1781885400000,
+      "tag": "0011_subscription_plan_v2",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema.ts

@@ -218,6 +218,14 @@ export const siteConfig = sqliteTable("site_config", {
    *  own price and may differ. null = no site default set. See
    *  wiki/entities/subscription.md. */
   subscriptionMonthlyPriceMinor: integer("subscription_monthly_price_minor"),
+  /** When ON, the occupancy/full gate RESERVES a spot for each active subscriber's car
+   *  (by quantity) even when they're not parked — so transients see "full" sooner and
+   *  the subscriber's spot is held. When OFF (default), only cars physically inside
+   *  count (the operator handles overflow by valet/key-juggling). Stored 0/1.
+   *  See wiki/concepts/capacity-occupancy.md. */
+  reserveSubscriberSpots: integer("reserve_subscriber_spots", { mode: "boolean" })
+    .notNull()
+    .default(false),
   /** IANA timezone the site operates in (e.g. "Europe/Tirane"). Used to evaluate a
    *  tariff's wall-clock pricing windows (happy hour / night / seasonal). COPIED into
    *  each published tariff version's structure.tz so the windows are frozen/immutable
@@ -295,6 +303,11 @@ export const subscriptionPlans = sqliteTable("subscription_plans", {
   currency: text("currency").notNull(),
   // Latest version with effectiveFrom ≤ the sale instant prices the sale.
   effectiveFrom: text("effective_from").notNull(),
+  // Composed allowed-time windows (PlanTimeframes in @parking/shared); null = 24/7, no
+  // restriction. When set, a scan OUTSIDE the window is charged the transient tariff for
+  // the out-of-window minutes (a "night plan" subscriber arriving early owes that gap).
+  // Evaluated in the site timezone. See wiki/entities/subscription.md (tariff bridge).
+  timeframes: text("timeframes", { mode: "json" }).$type<Record<string, unknown>>(),
   // Soft-retire (0) without deleting history; active=1 plans are sellable.
   active: integer("active", { mode: "boolean" }).notNull().default(true),
   createdBy: text("created_by"),
@@ -321,8 +334,11 @@ export const subscriptions = sqliteTable("subscriptions", {
   // tariffVersionId.
   planId: text("plan_id"),
   planVersionId: text("plan_version_id"),
+  // How many cars this ONE subscription covers (e.g. a family pays once for 2 cars).
+  // Sale amount = plan span price × quantity; maxConcurrent defaults to it. Default 1.
+  quantity: integer("quantity").notNull().default(1),
   // Car-count binding: how many of the subscription's cars may be inside at once.
-  // null = unbound. Default 1.
+  // null = unbound. Defaults to `quantity` at sale.
   maxConcurrent: integer("max_concurrent").default(1),
   validFrom: text("valid_from"),
   validTo: text("valid_to"),