feat(carwash): advisory vehicle category from the entry camera — mapping, pre-select, downgrade flag

The app plumbing for venue-modules.md §"Vehicle category from vision"; the model is the
open half (no bundled recognizer emits body_type yet, so the desk shows nothing until
phase A lands in the vision service).

- Shared: VEHICLE_CLASSES vocabulary, VehicleRead, CARWASH_VISION_THRESHOLD_DEFAULT,
  reason code carwash.categoryDowngrade; settings/order/lookup views carry the read.
- Vision contract: /analyze vehicle.body_type + confidence (service schema); the Node
  client normalises to the vocabulary and drops the rest.
- Record: snapshot.ts stores the read in the plate's device_events row (or its own when
  the plate was unreadable); vehicleForIdentity() resolves it like the plate.
- Car wash: carwash_categories.vision_classes (site mapping "car, sedan → Vetura"),
  carwash_config.vision_threshold (signed config_change when it moves), four vision
  columns on orders — migration 0030. Lookup returns vision + suggestedCategoryId.
- Desk pre-selects the mapped category and shows the read + snapshot thumbnail; Setup
  offers class chips per category and the threshold. Operator decides.
- Flag: a read at/above the threshold whose mapped category prices HIGHER than the chosen
  one signs one `anomaly` (both categories/prices, operator, snapshot) and stores its id on
  the order. Equal/upgrade/unsure/unmapped → nothing. Recorded only, never blocks, no
  reason prompt (user, 2026-09-06).

Tests in carwash.test.ts; wiki venue-modules (As built), opencv-anpr-service, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

packages/shared/src/index.ts

@@ -446,6 +446,10 @@ export const REASON_CODES = [
   // ticket (e.g. a motion radar dropped the stationary car and re-armed the button).
   // Post-hoc + advisory (ANPR never gates); the operator voids the duplicate.
   "entry.duplicatePlate",
+  // Car Wash: vision read the vehicle as a class that maps to a PRICIER category than the
+  // one the operator chose, above the site's confidence threshold. Recorded only (never
+  // blocks, no reason prompt — user, 2026-09-06); the reviewer sees both on one row.
+  "carwash.categoryDowngrade",
   // exit refusals
   "exit.refused.closed",
   "exit.refused.noSession",
@@ -498,6 +502,7 @@ export const REASON_EN: Record<ReasonCode, string> = {
   "entry.operatorIssued": "entry ticket issued by operator {operator} (physical button)",
   "entry.issue.noPresence": "operator entry refused — no vehicle detected at the entry",
   "entry.duplicatePlate": "possible duplicate entry — plate {plate} is already inside under ticket {otherIdentity}",
+  "carwash.categoryDowngrade": "wash category downgraded — camera saw {visionClass} ({visionCategory}), operator {operator} chose {chosenCategory}",
   "exit.refused.closed": "exit refused — session already closed",
   "exit.refused.noSession": "exit refused — no open session for ticket",
   "exit.refused.unpaid": "exit refused — not paid (take payment first)",
@@ -2024,8 +2029,31 @@ export interface ChargeLine {
 
 /** Setup → Car wash: the admin-maintained master data, as read/written by
  *  GET/PUT /api/carwash/settings. Ids are stable; names are display text. */
+/** What the vision service may call a vehicle's body type — a FIXED vocabulary the site
+ *  maps onto its own price categories (Setup → Car wash: "car, sedan, hatchback → Vetura").
+ *  Phase A (a COCO detector) only ever emits car/truck/bus/motorcycle; the finer classes
+ *  arrive with the body-type classifier (venue-modules.md §Vehicle category from vision). */
+export const VEHICLE_CLASSES = [
+  "car", "sedan", "hatchback", "suv", "minivan", "pickup", "van", "truck", "bus", "motorcycle",
+] as const;
+export type VehicleClass = (typeof VEHICLE_CLASSES)[number];
+export function isVehicleClass(v: unknown): v is VehicleClass {
+  return typeof v === "string" && (VEHICLE_CLASSES as readonly string[]).includes(v);
+}
+/** Below this confidence a vision class is shown but never flags a downgrade. Site
+ *  config (Setup → Car wash); this is the default. */
+export const CARWASH_VISION_THRESHOLD_DEFAULT = 0.8;
+
+/** The advisory vehicle read for a session, off the entry snapshot (unsigned device
+ *  event, like the plate). Never a tariff input by itself. */
+export interface VehicleRead {
+  readonly bodyType: VehicleClass;
+  readonly confidence: number;
+  readonly snapshotId: string | null;
+}
+
 export interface CarwashSettingsView {
-  readonly categories: { id: string; name: string; sortOrder: number; active: boolean }[];
+  readonly categories: { id: string; name: string; sortOrder: number; active: boolean; visionClasses: VehicleClass[] }[];
   readonly services: { id: string; name: string; sortOrder: number; active: boolean }[];
   /** One entry per priced (category, service) pair. */
   readonly prices: { categoryId: string; serviceId: string; priceMinor: number }[];
@@ -2033,6 +2061,8 @@ export interface CarwashSettingsView {
   /** Where wash money is taken at this site (booth = on the parking ticket; bay = the
    *  wash operator's till). Site-level; the desk no longer asks per order. */
   readonly payAt: CarWashPayAt;
+  /** Confidence floor for a vision class to flag a downgrade (0–1). */
+  readonly visionThreshold: number;
 }
 
 /** A wash order as the desk sees it (GET /api/carwash/orders). */
@@ -2060,6 +2090,12 @@ export interface CarwashOrderView {
   readonly validationEventId: string | null;
   readonly voidBy: string | null;
   readonly voidReason: string | null;
+  /** What the camera saw at entry (advisory), the category it mapped to, and the
+   *  anomaly signed when the operator chose a cheaper one. Null when vision read nothing. */
+  readonly visionClass: VehicleClass | null;
+  readonly visionConfidence: number | null;
+  readonly visionCategoryId: string | null;
+  readonly downgradeEventId: string | null;
 }
 
 export function isModuleId(v: unknown): v is ModuleId {