feat(subscription): rename permit→subscription + monthly pricing

The "permit/lejet" feature is really a subscription. Full rename of the
mutable master data, plus a recurring monthly price.

- DB (migration 0004, data-preserving ALTER RENAME): permits→subscriptions,
  permit_credentials/_plates→subscription_*, sessions.permit_id→subscription_id.
- Pricing: per-subscription priceMinor + period(monthly) + currency, with a
  site default (site_config.subscription_monthly_price_minor) pre-filling the form.
- Server: subscription-flow.ts (SubscriptionFlow), routes/subscriptions.ts
  (/api/subscriptions). Web: SubscriptionManager, route, i18n (sq Abonimet/en).
- The signed ledger `permitId` payload is intentionally kept — immutable
  hash-chained history; renaming it would break verification of past events.

Deferred (wiki notes): fee collection into the ledger/shift (a shift-attributed
payment), LPR/ANPR plate source, time-of-day access windows (overnight subscriber).

Also carries the device-footer UI surface (api DeviceStatus, router mount,
i18n devices) due to shared-file overlap with the preceding footer commit.

Verified end-to-end on a fresh DB and migration on a live-DB copy (sessions
preserved). Live DB migrated. Full monorepo builds clean.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/anti-passback.md

@@ -14,7 +14,7 @@ session projection.
 
 ## The rule
 
-An identity (ticket id, [[permit]] credential, or plate) **must not enter while it already has an
+An identity (ticket id, [[subscription]] credential, or plate) **must not enter while it already has an
 OPEN [[parking-session|session]].** At entry:
 
 ```
@@ -25,13 +25,13 @@ identify vehicle → is there already an OPEN session for this id?
 
 This is a **fold over the signed [[append-only-event-chain]]** ("does an entry for this id exist
 with no matching exit?") — not a mutable in/out flag that could be edited. Same projection that
-powers [[capacity-occupancy]] and [[permit]] `maxConcurrent`.
+powers [[capacity-occupancy]] and [[subscription]] `maxConcurrent`.
 
 ## Interaction with the limits already designed
 
 - **Transient ticket** — a single ticket id is inherently one session; a second entry on the same
   id is always a violation (or a re-print/duplication attempt).
-- **Permit** — passback is the *per-car* case of the permit's `maxConcurrent` ([[permit]]): a
+- **Permit** — passback is the *per-car* case of the permit's `maxConcurrent` ([[subscription]]): a
   multi-car permit legitimately has several open sessions, but **the same car/credential** entering
   twice is still a violation. So enforce per-identity, *under* the permit's concurrency allowance.