feat(subscription): RFID enrollment, any-credential exit, prepaid booth handling

Rounds out subscriptions across enrollment, the barrier flow, and the booth.

- RFID credentials enabled with a "Read card" enrollment flow: the operator
  arms ONE chosen reader (CredentialCapture, single-shot + ~30s TTL); that
  reader's next read is captured into the form and NOT dispatched to the access
  flow — the OTHER reader keeps serving live entry/exit. Routes:
  /api/subscriptions/readers + /capture/{arm,cancel} + poll.
- Enter with one credential, exit with another: sessions are keyed by a
  per-occurrence id (SUBSESS-<short>), not the credential value, with
  permitId in the payload. Direction is decided by the barrier the reader sits
  at (entry-lane→entry, exit-lane→exit; "both" infers); a fleet (maxConcurrent>1)
  admits several cars and exits any with any credential, FIFO (oldest first).
- Booth treats a subscription occurrence as PREPAID: never quoted/charged; the
  pay/exit modal shows a subscription mode (snapshots + a single audited
  Open-barrier action) to assist a faulty exit reader / missing card;
  reopenBarrier authorizes paidAt!=null OR subscription. Active Sessions badges
  "abonim" and labels by holder name (not the raw key).
- Plus a per-read diagnostic log in the QR-reader route (serial → device →
  verdict/dir), which surfaced the earlier duplicate-reader-IP misroute.

Verified via buildServer+inject + reader-scan/TCP-capture simulations
(enrollment isolation, cross-credential + FIFO fleet, prepaid-not-charged,
subscription reopen, unpaid-transient guard). Updated wiki (subscription,
booth-exit-flow). No migration.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/entities/subscription.md

@@ -104,10 +104,11 @@ LPR/ANPR plate identity** (the plate binding below):
     **`GS ( k`** (model-2, error-correction M) — added to the Rongta driver
     (`printSubscriptionCard`), no image/bitmap dependency (same approach as the Code128 ticket).
 - **RF tag / chip / card — selectable later, NOT live yet.** An RFID/proximity credential, read
-  **host-side** (reader → host → `pulseOpen`). The data model + backend **already accept `kind:'rf'`**
-  (no migration needed to enable it); only the UI constrains the operator to QR for now — the RFID
-  option is shown **disabled ("soon")** so the choice is visible. A Wiegand-out reader keeps a future
-  autonomous path open ([[entry-exit-readers]]); the [[dingtian-relay]] has no onboard card list.
+  **host-side** (reader → host → `pulseOpen`). **LIVE since 2026-06-18** — the operator selects RFID
+  and **reads the card off a physical reader** (see "Enrolling a card" below) rather than typing the
+  number. The GEE readers are combo QR + RFID (ID/IC/NFC), so the same device captures both. A
+  Wiegand-out reader keeps a future autonomous path open ([[entry-exit-readers]]); the
+  [[dingtian-relay]] has no onboard card list.
 - **Plate (LPR/ANPR) — NOT YET IMPLEMENTED.** When plate-bound (below), a matching plate read is an
   accepted identity too. The vision/ANPR service that produces plate reads is future work
   ([[opencv-anpr-service]] / [[lpr-camera]]); until it exists, plate binding has no live source.
@@ -115,6 +116,41 @@ LPR/ANPR plate identity** (the plate binding below):
 Both feed the host as a reader event whose `source` is `wiegand` / `qr` (the `IdentitySource`
 already in the model) and whose value is the credential id.
 
+### Enrolling a card — "Read card" capture (built 2026-06-18)
+
+RFID values are awkward to type, so the operator **presents the physical card to a chosen reader**
+and the system captures it into the credential. The catch is that the readers are also serving live
+traffic, so capture must **borrow one reader briefly without blocking the other**:
+
+- **`CredentialCapture`** (in-memory, single-site): the operator picks a reader and **arms** it
+  (`POST /api/subscriptions/capture/arm {deviceId}`). It is **single-shot + a ~30 s TTL**.
+- In the reader route (`qr-reader.ts`), each read first checks `tryConsume(deviceId, value)`: if
+  **this** reader is the armed one, the value is captured and the read is **NOT dispatched to the
+  access flow** (no barrier opens for a card being enrolled), then capture auto-disarms. A read on
+  **any other reader dispatches normally** — the live entry/exit flow on the other barrier is never
+  blocked. (Accepted trade: while armed, a real customer at the *armed* reader is captured instead of
+  admitted — kept tiny by single-shot + TTL.)
+- The booth form **polls** `GET /api/subscriptions/capture` (idle | armed | captured | expired);
+  on `captured` it drops the value into the RFID field. `POST …/capture/cancel` disarms.
+- Verified end-to-end (12/12): captured-not-dispatched (no ledger write), single-shot, the other
+  reader still drives a live `vehicle_exit` while armed, value retrievable, cancel/expiry.
+
+> The same mechanism would work to capture a **QR** too, but QR codes are server-generated + printed,
+> so capture is RFID-only in practice (QR has nothing to read off a card).
+
+### Multiple credentials, and entry decoupled from exit (2026-06-18)
+
+A subscription is a one-to-many aggregate: it may hold **several credentials at once** — e.g. a QR
+**and** an RFID card (and later NFC). Each is its own `subscription_credentials` row; any of them
+resolves the same subscription at the barrier. (NFC works today as an `rf` credential on the combo
+GEE reader; a distinct `nfc` `kind` is a small future labelling-only addition.)
+
+Crucially, **entry and exit are NOT bound to the same credential.** Originally the session was keyed
+by the exact credential value read, so you had to leave with whatever you arrived with — an
+*accidental* coupling. Now sessions are keyed by a **subscription occurrence** (`SUBSESS-<subId>-<uuid>`),
+so you can **enter with the QR and exit with the card**. The mechanics (barrier-decides-direction,
+FIFO close, fleet support) are in "As-built" below.
+
 ## Two optional, independent bindings — confirmed 2026-06-15
 
 A subscription has **two constraints the admin may or may not apply**, orthogonally. Either, both, or
@@ -196,11 +232,21 @@ Tables (mutable master data; every *use* still produces a signed `vehicle_entry`
 (`read-dispatch.ts`): a credential read routes to the subscription flow if it **matches a
 subscription** (card/QR credential, or a bound plate) — otherwise to the transient exit flow.
 
-- **Direction inferred from session state for that car** — no open session → ENTRY (check
-  `maxConcurrent`, sign `vehicle_entry`, open); an open session → EXIT (sign `vehicle_exit`, open,
-  close). A fleet has one session per car; anti-passback falls out.
-- **`maxConcurrent`** enforced as a fold over the signed ledger (the on-chain `permitId` payload is
-  the match key). Refusals (revoked / out-of-window / at-capacity) are signed `anomaly` events.
+- **Any credential opens/closes — sessions keyed by SUBSCRIPTION, not credential** (changed
+  2026-06-18). A subscriber can **enter with their QR and exit with their RFID card** (or any mix).
+  Entry mints a fresh **per-occurrence** session id (`SUBSESS-<subId>-<uuid>`, the ledger `identity`)
+  with `payload.permitId = subId`; the credential read is decoupled from the session key. See "Entry
+  decoupled from exit" below.
+- **Direction = the BARRIER the reader sits at.** An entry-lane read is an ENTRY, an exit-lane read
+  is an EXIT; a `"both"` barrier infers from open state (open occurrence → exit, else entry). This is
+  what lets a **fleet** (`maxConcurrent > 1`) admit several cars (each entry-lane read is an entry)
+  *and* exit any of them with any credential.
+- **Exit closes the OLDEST open occurrence (FIFO).** Per-car identity within a fleet isn't tracked
+  (it never was, once credentials are shared) — a read closes one occurrence, oldest first. An exit
+  read with nothing open is a no-op anti-passback signal (signed `anomaly`).
+- **`maxConcurrent`** enforced as a fold over the signed ledger by occurrence (`payload.permitId`
+  match). Refusals (revoked / out-of-window / at-capacity / exit-with-nothing-open) are signed
+  `anomaly` events.
 - **Admin CRUD** (`apps/server/src/routes/subscriptions.ts` + `apps/web/src/SubscriptionManager.tsx`):
   a subscription is an **aggregate** (row + credentials + bound plates + price). `GET
   /api/subscriptions` (any signed-in role — for lookup), `POST/PUT/DELETE /api/subscriptions[/:id]` +