Device-agnostic driver registry + first-run setup

Make the device-adapter pattern selectable so the admin chooses hardware at
install — per lane, from a catalog of supported drivers. Adding a device =
registering one more driver; no business-logic change.

packages/devices:
- interfaces.ts: AccessControlDevice / ReaderDevice / CameraDevice / PrinterDevice
  (adds CameraDevice for entry/exit snapshot-on-event; access relay stays
  intent-only per "a barrier is not a door").
- registry.ts: driver catalog with per-driver config fields + factory, config
  validation, and a catalog payload for the setup UI.
- drivers/: stub adapters — access (zkteco, esp32-relay), reader (wiegand,
  tcp-ip), camera (hikvision, dahua). Real vendor protocols TBD.

packages/db:
- lane_devices + setup_state tables (migration 0001); re-export query helpers.

apps/server:
- routes/setup.ts: GET /api/setup/catalog (public schema), and admin-only
  /assign, /state, /complete with registry validation before persisting.
- extract auth.ts (requireJwtSecret, requireRole, JWT type aug).

apps/web:
- SetupWizard scaffold + api client: pick a driver per category for a lane,
  render its config fields.

wiki: device-registry + first-run-setup concept pages; cross-link from
device-adapter-pattern; index + log updated.

Verified: full turbo build (5/5); catalog lists all drivers; admin assign
persists; missing-config and no-token requests are rejected.

wiki/log.md

@@ -18,3 +18,13 @@ property). Marked [[esp32-custom-controller]] `status: deferred` per decision no
 implement device-level auth for now (access control stays on UHPPOTE + network
 isolation); noted in [[open-questions]] #6. Updated [[local-jwt-auth]] (hardened secret
 handling + 8h expiry, asymmetric-key pointer) and the index.
+
+## [2026-06-15] decision | Device-agnostic registry + first-run setup
+From app work. Made the [[device-adapter-pattern]] selectable: added a
+[[device-registry]] (catalog of drivers per category) and a [[first-run-setup]]
+flow so the admin picks a device per lane at install. Categories: access
+(ZKTeco / ESP32 relay), reader (Wiegand / TCP-IP), camera (Hikvision / Dahua,
+snapshot-on-event), printer. Added a `CameraDevice` interface; new `lane_devices`
++ `setup_state` tables (migration 0001); admin-only setup endpoints. Stub drivers
+for now (no real vendor protocols yet). Verified catalog + assign + validation +
+auth end to end.