Device-agnostic driver registry + first-run setup

Make the device-adapter pattern selectable so the admin chooses hardware at
install — per lane, from a catalog of supported drivers. Adding a device =
registering one more driver; no business-logic change.

packages/devices:
- interfaces.ts: AccessControlDevice / ReaderDevice / CameraDevice / PrinterDevice
  (adds CameraDevice for entry/exit snapshot-on-event; access relay stays
  intent-only per "a barrier is not a door").
- registry.ts: driver catalog with per-driver config fields + factory, config
  validation, and a catalog payload for the setup UI.
- drivers/: stub adapters — access (zkteco, esp32-relay), reader (wiegand,
  tcp-ip), camera (hikvision, dahua). Real vendor protocols TBD.

packages/db:
- lane_devices + setup_state tables (migration 0001); re-export query helpers.

apps/server:
- routes/setup.ts: GET /api/setup/catalog (public schema), and admin-only
  /assign, /state, /complete with registry validation before persisting.
- extract auth.ts (requireJwtSecret, requireRole, JWT type aug).

apps/web:
- SetupWizard scaffold + api client: pick a driver per category for a lane,
  render its config fields.

wiki: device-registry + first-run-setup concept pages; cross-link from
device-adapter-pattern; index + log updated.

Verified: full turbo build (5/5); catalog lists all drivers; admin assign
persists; missing-config and no-token requests are rejected.

packages/devices/src/drivers/camera.ts

@@ -0,0 +1,57 @@
+import type { CameraDevice, DeviceHealth, Snapshot, SnapshotContext } from "../interfaces.js";
+import type { CameraDriver, DeviceConfig } from "../registry.js";
+import { hostField, passwordField, portField, usernameField, stubLog } from "./common.js";
+
+// Camera drivers — entry/exit snapshot-on-event. The image is stored and
+// referenced from the signed event as an independent fraud-control record.
+// Hikvision (ISAPI) and Dahua (CGI) differ only in the snapshot URL. STUBS only.
+
+class StubCamera implements CameraDevice {
+  constructor(
+    readonly driverId: string,
+    protected readonly config: DeviceConfig,
+    protected readonly snapshotPath: string,
+  ) {}
+  async connect(): Promise<void> {
+    stubLog(this.driverId, `connect ${this.config.host} (${this.snapshotPath})`);
+  }
+  async disconnect(): Promise<void> {
+    stubLog(this.driverId, "disconnect");
+  }
+  async healthCheck(): Promise<DeviceHealth> {
+    return { status: "ready", detail: "stub" };
+  }
+  async captureSnapshot(ctx: SnapshotContext): Promise<Snapshot> {
+    // Real driver: GET http(s)://host{snapshotPath}, store bytes, return ref.
+    stubLog(this.driverId, `captureSnapshot lane=${ctx.lane} ${ctx.direction}`);
+    return {
+      imageRef: `stub://${this.driverId}/lane${ctx.lane}/${ctx.direction}/${Date.now()}`,
+      contentType: "image/jpeg",
+      capturedAt: new Date().toISOString(),
+    };
+  }
+}
+
+const cameraConfigFields = [hostField, portField(80), usernameField, passwordField, { key: "channel", label: "Channel", type: "number" as const, required: false, default: 1 }];
+
+export const hikvisionDriver: CameraDriver = {
+  id: "hikvision",
+  category: "camera",
+  label: "Hikvision camera",
+  description: "Hikvision snapshot via ISAPI.",
+  transports: ["tcp-ip"],
+  configFields: cameraConfigFields,
+  // /ISAPI/Streaming/channels/<id>/picture
+  create: (c) => new StubCamera("hikvision", c, "/ISAPI/Streaming/channels/101/picture"),
+};
+
+export const dahuaDriver: CameraDriver = {
+  id: "dahua",
+  category: "camera",
+  label: "Dahua camera",
+  description: "Dahua snapshot via CGI.",
+  transports: ["tcp-ip"],
+  configFields: cameraConfigFields,
+  // /cgi-bin/snapshot.cgi?channel=<n>
+  create: (c) => new StubCamera("dahua", c, "/cgi-bin/snapshot.cgi"),
+};