feat(subscription): RFID enrollment, any-credential exit, prepaid booth handling

Rounds out subscriptions across enrollment, the barrier flow, and the booth.

- RFID credentials enabled with a "Read card" enrollment flow: the operator
  arms ONE chosen reader (CredentialCapture, single-shot + ~30s TTL); that
  reader's next read is captured into the form and NOT dispatched to the access
  flow — the OTHER reader keeps serving live entry/exit. Routes:
  /api/subscriptions/readers + /capture/{arm,cancel} + poll.
- Enter with one credential, exit with another: sessions are keyed by a
  per-occurrence id (SUBSESS-<short>), not the credential value, with
  permitId in the payload. Direction is decided by the barrier the reader sits
  at (entry-lane→entry, exit-lane→exit; "both" infers); a fleet (maxConcurrent>1)
  admits several cars and exits any with any credential, FIFO (oldest first).
- Booth treats a subscription occurrence as PREPAID: never quoted/charged; the
  pay/exit modal shows a subscription mode (snapshots + a single audited
  Open-barrier action) to assist a faulty exit reader / missing card;
  reopenBarrier authorizes paidAt!=null OR subscription. Active Sessions badges
  "abonim" and labels by holder name (not the raw key).
- Plus a per-read diagnostic log in the QR-reader route (serial → device →
  verdict/dir), which surfaced the earlier duplicate-reader-IP misroute.

Verified via buildServer+inject + reader-scan/TCP-capture simulations
(enrollment isolation, cross-credential + FIFO fleet, prepaid-not-charged,
subscription reopen, unpaid-transient guard). Updated wiki (subscription,
booth-exit-flow). No migration.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/src/exit-flow.ts

@@ -30,6 +30,9 @@ interface SessionView {
   readonly enteredAt: string;
   readonly open: boolean; // no vehicle_exit yet
   readonly paidAt: string | null; // latest payment time, if any
+  /** A SUBSCRIPTION occurrence (prepaid; entry payload permit:true). Authorized to
+   *  exit / re-open without a `payment`. */
+  readonly subscription: boolean;
   readonly graceExitMin: number | null; // from the payment's tariff context, if known
   // Within the FREE entry-grace window (a quick in-and-out that the tariff prices at
   // 0). When true the exit opens without a pay-station visit — we mint a $0 payment so
@@ -188,10 +191,11 @@ export class ExitFlow {
 
     const view = this.#sessionFor(id);
     if (!view) return { ok: false, reason: "no session for ticket" };
-    // No payment → no re-open. The barrier-open action is only for sessions that
-    // have been paid (or paid-then-exited within grace). An unpaid car takes the
-    // pay/exit flow instead — enforced here, not just in the UI.
-    if (view.paidAt == null) {
+    // Authorization to re-open: a PAID transient (paid, or paid-then-exited within
+    // grace) OR a SUBSCRIPTION occurrence (prepaid — exactly the case the operator must
+    // assist when the exit reader / card fails). An unpaid TRANSIENT takes the pay/exit
+    // flow instead — enforced here, not just in the UI (the no-unpaid-bypass rule).
+    if (view.paidAt == null && !view.subscription) {
       return { ok: false, reason: "session not paid — no barrier open without payment" };
     }
 
@@ -431,11 +435,15 @@ export class ExitFlow {
       }
     }
 
+    const entryPl = (entry.payload ?? {}) as { permit?: boolean; permitId?: string };
+    const subscription = entryPl.permit === true || entryPl.permitId != null;
+
     return {
       identity,
       enteredAt: entry.occurredAt,
       open: !exited,
       paidAt,
+      subscription,
       graceExitMin,
       freeGrace,
     };