feat(anpr): subscriber-entry bridge + admin disable toggle

Wire the lane camera's vehicle event into the gated subscription flow: on a
vehicle/active push from an opt-in (config.anpr) camera, AnprBridge pulls a fresh
snapshot, runs ANPR, applies a stricter entry confidence floor, debounces, and —
matching the plate to a subscription BEFORE emitting — emits a kind:"plate" read.
The existing ReadDispatcher -> SubscriptionFlow then signs the entry/exit and opens
the barrier. A plate is never the sole authority: it routes through the same gate
(active/window/blocklist/car-count) as any credential. Fail-soft, fire-and-forget,
subscriber-only by construction. Field-verified end to end (plate AA504LX opened the
entry barrier and appended a signed vehicle_entry).

Add an admin master switch (site_config.anpr_entry_enabled, default ON) in Site
Settings that disables ONLY the barrier-driving bridge; advisory snapshot-ANPR and
lane busy/free are unaffected. Read live per event, so toggling takes effect with no
restart. Migration 0013 (additive ALTER ADD COLUMN, default 1).

- New: apps/server/src/anpr-entry.ts (AnprBridge) + tests (9)
- hikvision-alarm.ts hands vehicle detections to the bridge (fire-and-forget) + wiring tests (3)
- server.ts reorders the read flows above the hik-alarm registration
- snapshot.ts exports buildCamera for reuse
- env: VISION_ENTRY_MIN_CONFIDENCE (0.85), ANPR_DEBOUNCE_MS (12000)
- site route + SiteSettings checkbox + i18n (sq/en parity)
- wiki: lane-presence-and-anpr-entry / lpr-camera / index / log -> BUILT

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/src/routes/hikvision-alarm.test.ts

@@ -1,8 +1,11 @@
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import Fastify, { type FastifyInstance as RawFastify } from "fastify";
 import { createTestDb } from "@parking/db/testing";
 import { and, eq, inArray, devices, deviceEvents as deviceEventsTable, type Db } from "@parking/db";
 import type { FastifyInstance } from "fastify";
 import { buildServer } from "../server.js";
+import { hikvisionAlarmRoutes } from "./hikvision-alarm.js";
+import type { AnprBridge } from "../anpr-entry.js";
 import { seedUser, login } from "../test-helpers.js";
 
 // Hikvision Alarm Server push ingress. Verifies the discovery endpoint: a vehicle-
@@ -222,3 +225,65 @@ describe("Hikvision Alarm Server push", () => {
     expect(res.statusCode).toBe(401);
   });
 });
+
+// The ANPR bridge is handed each vehicle detection (fire-and-forget). We register the
+// routes on a bare instance with a SPY bridge to assert exactly when it's invoked —
+// only on a vehicle target that isn't `inactive`. (The bridge's own logic is covered in
+// anpr-entry.test.ts.)
+describe("Hikvision Alarm Server → ANPR bridge wiring", () => {
+  let rawApp: RawFastify;
+  let rawDb: Db;
+  let rawClose: () => void;
+  let onVehicleDetected: ReturnType<typeof vi.fn>;
+
+  beforeEach(async () => {
+    const t = createTestDb();
+    rawDb = t.db;
+    rawClose = t.close;
+    onVehicleDetected = vi.fn(async () => {});
+    const bridge = { onVehicleDetected } as unknown as AnprBridge;
+    rawApp = Fastify();
+    await hikvisionAlarmRoutes(rawApp, rawDb, undefined, bridge);
+    await rawApp.ready();
+    rawDb.insert(devices).values({
+      id: CAM_ID,
+      category: "camera",
+      driverId: "hikvision",
+      config: { host: CAM_IP, alarmPushEnabled: true },
+      enabled: true,
+    }).run();
+  });
+  afterEach(async () => {
+    await rawApp.close();
+    rawClose();
+  });
+
+  async function post(payload: string) {
+    return rawApp.inject({
+      method: "POST",
+      url: `/api/devices/hikvision/${CAM_ID}/event`,
+      headers: { "content-type": "application/xml" },
+      payload,
+      remoteAddress: CAM_IP,
+    });
+  }
+
+  it("hands a vehicle (active) detection to the bridge", async () => {
+    const res = await post(VEHICLE_XML);
+    expect(res.statusCode).toBe(200);
+    expect(onVehicleDetected).toHaveBeenCalledTimes(1);
+    expect(onVehicleDetected).toHaveBeenCalledWith(CAM_ID);
+  });
+
+  it("does NOT call the bridge for a human target", async () => {
+    const human = VEHICLE_XML.replace("vehicle", "human");
+    await post(human);
+    expect(onVehicleDetected).not.toHaveBeenCalled();
+  });
+
+  it("does NOT call the bridge on an `inactive` (leave) vehicle event", async () => {
+    const leave = VEHICLE_XML.replace("<eventState>active</eventState>", "<eventState>inactive</eventState>");
+    await post(leave);
+    expect(onVehicleDetected).not.toHaveBeenCalled();
+  });
+});