feat(subscription): rename permit→subscription + monthly pricing

The "permit/lejet" feature is really a subscription. Full rename of the
mutable master data, plus a recurring monthly price.

- DB (migration 0004, data-preserving ALTER RENAME): permits→subscriptions,
  permit_credentials/_plates→subscription_*, sessions.permit_id→subscription_id.
- Pricing: per-subscription priceMinor + period(monthly) + currency, with a
  site default (site_config.subscription_monthly_price_minor) pre-filling the form.
- Server: subscription-flow.ts (SubscriptionFlow), routes/subscriptions.ts
  (/api/subscriptions). Web: SubscriptionManager, route, i18n (sq Abonimet/en).
- The signed ledger `permitId` payload is intentionally kept — immutable
  hash-chained history; renaming it would break verification of past events.

Deferred (wiki notes): fee collection into the ledger/shift (a shift-attributed
payment), LPR/ANPR plate source, time-of-day access windows (overnight subscriber).

Also carries the device-footer UI surface (api DeviceStatus, router mount,
i18n devices) due to shared-file overlap with the preceding footer commit.

Verified end-to-end on a fresh DB and migration on a live-DB copy (sessions
preserved). Live DB migrated. Full monorepo builds clean.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/api.ts

@@ -277,41 +277,45 @@ export function publishTariffVersion(body: {
   return apiFetch("/api/tariff/versions", { method: "POST", body: JSON.stringify(body) });
 }
 
-// --- Permits --------------------------------------------------------------
+// --- Subscriptions --------------------------------------------------------
 
-export interface PermitCredential {
+export interface SubscriptionCredential {
   kind: "rf" | "qr";
   value: string;
 }
-export interface Permit {
+export interface Subscription {
   id: string;
   holderName: string | null;
   contact: string | null;
+  /** Recurring price in minor units (e.g. 1000000 = 10,000.00). null = not set. */
+  priceMinor: number | null;
+  period: "monthly";
+  currency: string | null;
   maxConcurrent: number | null;
   validFrom: string | null;
   validTo: string | null;
   status: "active" | "suspended" | "revoked";
-  credentials: PermitCredential[];
+  credentials: SubscriptionCredential[];
   plates: string[];
 }
-export type PermitInput = Omit<Permit, "id" | "status"> & {
-  status?: Permit["status"];
+export type SubscriptionInput = Omit<Subscription, "id" | "status"> & {
+  status?: Subscription["status"];
 };
 
-export function fetchPermits(): Promise<{ permits: Permit[] }> {
-  return apiFetch("/api/permits");
+export function fetchSubscriptions(): Promise<{ subscriptions: Subscription[] }> {
+  return apiFetch("/api/subscriptions");
 }
-export function createPermit(body: PermitInput): Promise<Permit> {
-  return apiFetch("/api/permits", { method: "POST", body: JSON.stringify(body) });
+export function createSubscription(body: SubscriptionInput): Promise<Subscription> {
+  return apiFetch("/api/subscriptions", { method: "POST", body: JSON.stringify(body) });
 }
-export function updatePermit(id: string, body: PermitInput): Promise<Permit> {
-  return apiFetch(`/api/permits/${id}`, { method: "PUT", body: JSON.stringify(body) });
+export function updateSubscription(id: string, body: SubscriptionInput): Promise<Subscription> {
+  return apiFetch(`/api/subscriptions/${id}`, { method: "PUT", body: JSON.stringify(body) });
 }
-export function revokePermit(id: string): Promise<Permit> {
-  return apiFetch(`/api/permits/${id}/revoke`, { method: "POST" });
+export function revokeSubscription(id: string): Promise<Subscription> {
+  return apiFetch(`/api/subscriptions/${id}/revoke`, { method: "POST" });
 }
-export function deletePermit(id: string): Promise<void> {
-  return apiFetch(`/api/permits/${id}`, { method: "DELETE" });
+export function deleteSubscription(id: string): Promise<void> {
+  return apiFetch(`/api/subscriptions/${id}`, { method: "DELETE" });
 }
 
 // --- Shifts ---------------------------------------------------------------
@@ -378,6 +382,8 @@ export interface SiteConfig {
   capacity: number | null;
   /** Default for the booth "print exit ticket" checkbox (booth-geography knob). */
   exitVoucherDefault: boolean;
+  /** Site default monthly subscription price (minor units); pre-fills the form. */
+  subscriptionMonthlyPriceMinor: number | null;
   parkName: string | null;
   operatorName: string | null;
   /** NIUS — Albanian tax/identification number. */
@@ -391,6 +397,28 @@ export function fetchOccupancy(): Promise<Occupancy> {
   return apiFetch("/api/occupancy");
 }
 
+// --- Device status (the booth footer) -------------------------------------
+
+/** Live status of one configured device — mirrors the server's DeviceStatusEvent.
+ *  Every enabled device is polled (printers via rich readStatus, the rest via
+ *  healthCheck) and flattened to one traffic-light. Pushed over the WS; the REST
+ *  snapshot below is the initial load / fallback. */
+export interface DeviceStatus {
+  deviceId: string;
+  driverId: string;
+  category: "access" | "reader" | "camera" | "printer";
+  /** Role/direction token for the footer label (NOT the vendor) — the client
+   *  localises it next to the category, e.g. "Lexuesi hyrje", "Printer kabina". */
+  roleKind: "entry" | "exit" | "both" | "mixed" | "lane" | "booth" | null;
+  state: "ready" | "degraded" | "offline";
+  detail?: string;
+  checkedAt: string;
+}
+
+export function fetchDeviceStatus(): Promise<{ devices: DeviceStatus[] }> {
+  return apiFetch("/api/devices/status");
+}
+
 // --- Ledger events (the signed audit trail; read-only) --------------------
 
 /** A persisted ledger row. Re-exported from shared so UI code has one source of