feat(subscription): rename permit→subscription + monthly pricing

The "permit/lejet" feature is really a subscription. Full rename of the
mutable master data, plus a recurring monthly price.

- DB (migration 0004, data-preserving ALTER RENAME): permits→subscriptions,
  permit_credentials/_plates→subscription_*, sessions.permit_id→subscription_id.
- Pricing: per-subscription priceMinor + period(monthly) + currency, with a
  site default (site_config.subscription_monthly_price_minor) pre-filling the form.
- Server: subscription-flow.ts (SubscriptionFlow), routes/subscriptions.ts
  (/api/subscriptions). Web: SubscriptionManager, route, i18n (sq Abonimet/en).
- The signed ledger `permitId` payload is intentionally kept — immutable
  hash-chained history; renaming it would break verification of past events.

Deferred (wiki notes): fee collection into the ledger/shift (a shift-attributed
payment), LPR/ANPR plate source, time-of-day access windows (overnight subscriber).

Also carries the device-footer UI surface (api DeviceStatus, router mount,
i18n devices) due to shared-file overlap with the preceding footer commit.

Verified end-to-end on a fresh DB and migration on a live-DB copy (sessions
preserved). Live DB migrated. Full monorepo builds clean.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/parking-session.md

@@ -43,7 +43,7 @@ A session needs a key that survives from entry to exit. Two populations, two key
 
 - **Transient:** a **ticket id** (printed, ideally on pre-numbered stock — see [[reconciliation]])
   or a **plate** read by [[lpr-camera|LPR]]. This id is carried in the event's `identity` field.
-- **Permit holder:** a **credential** (card / plate / QR) matched to a [[permit]] record. A valid
+- **Permit holder:** a **credential** (card / plate / QR) matched to a [[subscription]] record. A valid
   permit means the session owes nothing — the PAY step is skipped (see below).
 
 ## Lifecycle (pay-on-foot / pay station model)
@@ -71,7 +71,7 @@ States, as derived from events:
 | **CLOSED** | a matching `vehicle_exit` event exists |
 | **VOIDED** | a `void` event references the session (lost ticket written off, error correction) |
 
-Permit sessions skip PAID: a valid [[permit]] at exit is itself the authorization to close.
+Permit sessions skip PAID: a valid [[subscription]] at exit is itself the authorization to close.
 
 ## Edge cases the model must name (not yet designed in full)
 
@@ -106,7 +106,7 @@ follow this page and [[tariff]]; the decision is recorded in [[session-model]].
   fails. See [[device-input-flow]].
 - **Read dispatch** (`apps/server/src/read-dispatch.ts`): a credential read routes to the
   **permit flow** if it matches a permit (card/QR/bound plate), else to the transient **exit flow**.
-  Lane resolved once (`readerLaneWithAccess`). See [[permit]] as-built.
+  Lane resolved once (`readerLaneWithAccess`). See [[subscription]] as-built.
 - **Exit flow** (`apps/server/src/exit-flow.ts`): a credential **read** (the `read` bus channel) →
   fold the signed ledger for that identity → validate **open + PAID + within `gracePeriodExitMin`**
   → signed `vehicle_exit` → `pulseOpen`. Unpaid / expired / unknown → signed `anomaly`, barrier