fix(deploy): forward MODULES_ENTITLED into the server container (default parking,validation)

The Komodo stack env alone is compose interpolation input; only variables in the
service's environment: block reach the container. Without it every booth on 55d6242
had Car Wash entitled (unset = every module).

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

apps/server/.env.example

@@ -82,6 +82,8 @@ WS_ALLOWED_ORIGINS=http://localhost:5173,tauri://localhost,http://tauri.localhos
 # Comma-separated ids of the modules this site is ENTITLED to (a vendor/deployment
 # decision — set in the Komodo stack env, never by a site role). The site admin then
 # ACTIVATES within this set in Setup → Site; effective = entitled ∩ activated. Unset or
-# blank = every registered module (parking,validation). Required modules (parking) are
-# always on. See wiki/decisions/venue-modules.md.
+# blank = every registered module (parking,validation,carwash) — a DEV convenience. In
+# Docker, docker-compose.yml forwards it with a default of parking,validation, so a booth
+# is never entitled to a module its Komodo stack env does not name. Required modules
+# (parking) are always on. See wiki/decisions/venue-modules.md.
 #MODULES_ENTITLED=parking,validation

docker-compose.yml

@@ -35,6 +35,12 @@ services:
       # The booth WS live feed checks the browser Origin — must list the address operators
       # actually hit (e.g. http://<booth-ip>:3000), or the live feed is rejected.
       WS_ALLOWED_ORIGINS: ${WS_ALLOWED_ORIGINS:-}
+      # Venue modules this site is ENTITLED to (vendor decision, per stack in Komodo; the site
+      # admin activates within this set in Setup → Site). Only variables listed HERE reach the
+      # container — a value in the Komodo stack env alone does nothing (found 2026-09-06: every
+      # booth had Car Wash on). Default = what booths had before modules existed; the server
+      # treats a BLANK value as "every module", so never set it to "" on a booth.
+      MODULES_ENTITLED: ${MODULES_ENTITLED:-parking,validation}
     volumes:
       - parking-data:/data
     depends_on:

wiki/decisions/venue-modules.md

@@ -348,6 +348,13 @@ at the two seams the design names, and the registry earned its keep: **one manif
 - **Modules reach the core only via `ServerModuleDeps`** (db, eventLog, payStation,
   shiftService) — no module imports another; `dependsOn: ["parking", "validation"]` is enforced
   by the activation rules (verified: carwash cannot be on with validation off).
+- **Deploy gotcha (2026-09-06):** `MODULES_ENTITLED` reaches the container ONLY through
+  `docker-compose.yml`'s `environment:` block — a value in the Komodo stack env alone is just
+  compose interpolation input. It was missing there, so every booth on `55d6242` had Car Wash
+  on (unset = everything). Fixed: compose forwards it with a default of `parking,validation`;
+  a booth is never entitled to a module its stack env does not name. Check on the box:
+  `docker exec <stack>-server-1 env | grep MODULES_ENTITLED` and the boot log line
+  `venue modules (entitled = …; effective = …)`.
 - **Web:** `/wash` (the desk: ticket lookup → category/service/price → order, the site's
   booth|bay policy shown read-only;
   the queue oldest-first with Done / Paid cash / Paid card / Void) and `/setup/carwash`

wiki/log.md

@@ -3029,3 +3029,13 @@ every `jwtVerify` resolves the user's CURRENT role from the DB (cached per user,
 `bumpPermsCache()`, which the user update/delete routes now call); a deleted user's session
 ends with 401 on its next request; the WS cookie path uses the same. Test: moved user creates
 an order on the next request with the same cookie. Recorded on [[local-jwt-auth]].
+
+## [2026-09-06] ingest | MODULES_ENTITLED never reached the container
+
+User set park-2 to `MODULES_ENTITLED=parking`, re-synced, destroyed + redeployed the stack —
+Lavazh still there. Cause: the variable was in the Komodo stack env and `.env.example` but not
+in `docker-compose.yml`'s server `environment:` block, so the container never saw it; unset =
+every module → every booth on 55d6242 had Car Wash entitled. Fix: compose forwards it with
+default `parking,validation`. Troubleshoot on a booth with `docker exec … env | grep MODULES`
+and the boot log line `venue modules (entitled = …; effective = …)`. Recorded on
+[[venue-modules]] §As-built (deploy gotcha).