docs(wiki): booth bring-up fixes — relay password, secret re-merge, lamp concurrency

- dingtian-relay: the "offline despite ping" gotcha (relay_pw in every binary frame,
  missing form field → Test connection sent 0 → timeout) + the identity-gated secret
  re-merge that stops a redirected probe exfiltrating the password.
- button-light-indicator: serialized desired-state worker (UDP is unordered → the lamp
  stuck on/off) and hot-reload of the lamp config (no restart).
- log entry for the three fixes (commits 420542c / fd15988 / 830993b).

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -1570,3 +1570,21 @@ picker; i18n parity (sq+en). Tests: `button-light.test.ts` (truth table + blink
 `access-dingtian.test.ts` (active-level inversion). Workspace build+lint+test green (158 server tests).
 A radar detection NEVER opens a barrier on its own — it only gates the button ([[threat-model]]). See
 [[hikvision-radar]], [[button-light-indicator]], [[entry-double-press]], [[dingtian-relay]].
+
+## [2026-06-24] fix | Booth bring-up fixes — relay password, form split, lamp concurrency
+Three fixes from wiring the radar/lamp on the first booth (committed 420542c, fd15988, 830993b on
+top of the 2915d14 feature). (1) **"Offline despite ping"** — the Dingtian's `relay_pw` is in every
+binary frame incl. the status read, but had NO form field, so Test connection sent 0 → device
+silently drops the packet → "offline" (ping is ICMP, unrelated). Added a **"Relay control password"**
+secret field; because the secret is redacted, the test endpoint re-merges it by device id but ONLY
+when host/port/driver match the stored row (a redirected probe can't exfiltrate it — `setup-secrets.test.ts`).
+(2) **Form split** — the controller editor now has separate **Outputs** (relays + pulse-open + lamp)
+and **Inputs** (button + presence/radar terminals, "For relay N") sections; UI-only, storage
+unchanged. `pulse open (ms)` clarified as a relay/output setting, not an input. (3) **Lamp stuck
+on/off** — the blink fired fire-and-forget `setAux` over UNORDERED UDP; concurrent on/off packets
+reordered and the relay latched on the last-processed one. Replaced with a serialized desired-state
+worker (one in-flight send/lamp, re-converges to the latest state → final state authoritative). Also
+**hot-reload**: the lamp map now reconciles against live config each event, so a button light added
+in the UI works without a server restart. Workspace build+lint+test green (163 server tests). See
+[[dingtian-relay]] ("offline despite ping" + secret re-merge), [[button-light-indicator]] (serialized
+sends + hot-reload).