feat(carwash): Car Wash v1 + per-till shifts + site-level pay-at + till access by module permission

Car Wash — the pilot venue module (wiki/decisions/venue-modules.md):
- Master data (categories × services price matrix) at /setup/carwash; the desk at /wash
  (ticket lookup → order; open queue oldest-first: Done / Paid cash / Paid card / Void;
  Finished list). Orders freeze names + price; their life is signed (carwash_order,
  carwash_payment). Migration 0027.
- Where money is taken is a SITE setting (carwash_config.pay_at, migration 0028, signed
  config_change on a flip) — no per-order radio; a stale client is refused (409).
- Core seams: PayStation charge providers (a booth-paid wash rides the parking payment as
  chargeLines) + applyValidation() shared with the merchant route. A bay-paid, done wash
  signs the $0 parking payment so the exit reader releases the car.
- "Parking discount" modes for the wash: free while the wash runs (+ tolerance) and wash
  price off the fee (floored at 0), resolved at done and anchored at the order's intake
  (the entry-anchored version comped a 74-day stay); typed-amount and percent hidden for
  the wash. Long durations render y/d/h/m.

Tills — a shift belongs to a till, not the site (wiki/concepts/shift.md §Tills):
- TillId booth|carwash; every money event names its till (absent = booth, so the chain
  re-folds identically). ShiftService is per till: single-open, folds, X/Z-reports,
  vouchers, carry-forward. A bay payment needs the carwash shift.
- Working a till needs that till's module permission (manifest tillPermission; 403
  till_forbidden); /api/shift/tills lists only the role's tills.
- Web: ShiftButton per till (header = booth, wash desk = carwash); shift hub lists every
  open shift with till badges + filter; drawer hub switches tills.

Modules: landing per module (index route resolves booth → module landing → shifts →
profile); guards bounce to "/", /booth needs session:read.

Tests: carwash e2e suite (settings, intake, booth/bay paths, modes, void, gate, pay-at
policy, till permissions), 6 per-till shift tests; suite green (1 pre-existing flaky
backup test under the parallel run).

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

apps/web/src/modules/carwash/index.tsx

@@ -0,0 +1,49 @@
+import { createRoute, redirect, useRouteContext } from "@tanstack/react-router";
+import type { AnyRoute } from "@tanstack/react-router";
+import { can } from "../../api.js";
+import { moduleOn, type RootRoute, type WebModule } from "../../lib/modules.js";
+import type { RouterContext } from "../../router.js";
+import { CarWashSetup } from "./CarWashSetup.js";
+import { WashDesk } from "./WashDesk.js";
+
+// Car Wash — the pilot venue module, web side (wiki/decisions/venue-modules.md).
+// Two screens: the wash desk (/wash, carwash:read) and Setup → Car wash
+// (/setup/carwash, site:read; editing needs site:update). Both gate on the module
+// being effective at this site AND the permission; the server enforces the same.
+
+function gate(perm: string) {
+  return ({ context }: { context: unknown }) => {
+    const ctx = context as RouterContext;
+    // Bounce to the landing resolver, never straight to the booth (a wash-only role
+    // has no booth to land on).
+    if (!moduleOn(ctx.user, "carwash") || !can(ctx.user, perm)) throw redirect({ to: "/" });
+  };
+}
+
+export const carwashModule: WebModule = {
+  id: "carwash",
+  nav: [{ to: "/wash", labelKey: "nav.wash", perm: "carwash:read" }],
+  landing: { to: "/wash", labelKey: "nav.wash", perm: "carwash:read" },
+  routes(root: RootRoute) {
+    const washRoute = createRoute({
+      getParentRoute: () => root,
+      path: "/wash",
+      beforeLoad: gate("carwash:read"),
+      component: WashDesk,
+    });
+    return [washRoute];
+  },
+  setupNav: [{ to: "/setup/carwash", labelKey: "nav.carwash", perm: "site:read" }],
+  setupRoutes(setup: AnyRoute) {
+    const setupCarwashRoute = createRoute({
+      getParentRoute: () => setup,
+      path: "/carwash",
+      beforeLoad: gate("site:read"),
+      component: function CarWashSetupRoute() {
+        const { user } = useRouteContext({ strict: false }) as RouterContext;
+        return <CarWashSetup canEdit={can(user, "site:update")} />;
+      },
+    });
+    return [setupCarwashRoute];
+  },
+};