Initial scaffold: Turborepo monorepo + design wiki

Turborepo (pnpm workspaces) with all dependencies pinned to latest
mutually-compatible versions: turbo 2.9, TypeScript 6, Fastify 5,
React 19, Vite 8, better-sqlite3 12 + Drizzle ORM 0.45.

Layout:
- apps/server   Fastify backend (local JWT auth + role guard, /health)
- apps/web      React 19 + Vite 8 operator SPA
- packages/db   Drizzle schema on SQLite/WAL; append-only events + users
- packages/devices  reader/printer/relay adapter interfaces (intent-only relay)
- packages/shared   shared domain types

Architecture constraints from the design wiki are encoded in the scaffold:
append-only hash-chained + signed event log, device-agnostic adapters,
"a barrier is not a door" (relay expresses intent only), fully-local
offline-first auth.

wiki/ is an LLM-maintained Obsidian knowledge base (28 pages) ingested
from the architecture & design notes, with its own maintenance schema.

Verified: pnpm install, full turbo build (5/5), server boots and serves
/health, drizzle-kit generates the initial migration.

apps/server/src/server.ts

@@ -0,0 +1,45 @@
+import jwt from "@fastify/jwt";
+import Fastify, { type FastifyInstance } from "fastify";
+import type { Role } from "@parking/shared";
+
+// The backend is Fastify (Node). Hardware drivers live as isolated Fastify
+// plugins emitting onto a shared internal event bus; auth is fully local
+// (offline-first). See wiki/entities/fastify.md and local-jwt-auth.md.
+
+declare module "@fastify/jwt" {
+  interface FastifyJWT {
+    payload: { sub: string; username: string; role: Role };
+    user: { sub: string; username: string; role: Role };
+  }
+}
+
+export async function buildServer(): Promise<FastifyInstance> {
+  const app = Fastify({
+    logger: { level: process.env.LOG_LEVEL ?? "info" },
+  });
+
+  // Local JWT signing with a local secret — no external identity provider.
+  await app.register(jwt, {
+    secret: process.env.JWT_SECRET ?? "dev-only-insecure-secret-change-me",
+  });
+
+  app.get("/health", async () => ({ status: "ok" }));
+
+  // TODO: register device-driver plugins (packages/devices adapters),
+  // the append-only event-log routes, and the role-guarded admin API.
+
+  return app;
+}
+
+/**
+ * preHandler role guard. Authorization is a simple per-route role check — no
+ * Casbin/RBAC engine needed at this scale. See wiki/entities/local-jwt-auth.md.
+ */
+export function requireRole(...allowed: Role[]) {
+  return async (req: { jwtVerify: () => Promise<void>; user?: { role: Role } }) => {
+    await req.jwtVerify();
+    if (!req.user || !allowed.includes(req.user.role)) {
+      throw Object.assign(new Error("forbidden"), { statusCode: 403 });
+    }
+  };
+}