Initial scaffold: Turborepo monorepo + design wiki

Turborepo (pnpm workspaces) with all dependencies pinned to latest
mutually-compatible versions: turbo 2.9, TypeScript 6, Fastify 5,
React 19, Vite 8, better-sqlite3 12 + Drizzle ORM 0.45.

Layout:
- apps/server   Fastify backend (local JWT auth + role guard, /health)
- apps/web      React 19 + Vite 8 operator SPA
- packages/db   Drizzle schema on SQLite/WAL; append-only events + users
- packages/devices  reader/printer/relay adapter interfaces (intent-only relay)
- packages/shared   shared domain types

Architecture constraints from the design wiki are encoded in the scaffold:
append-only hash-chained + signed event log, device-agnostic adapters,
"a barrier is not a door" (relay expresses intent only), fully-local
offline-first auth.

wiki/ is an LLM-maintained Obsidian knowledge base (28 pages) ingested
from the architecture & design notes, with its own maintenance schema.

Verified: pnpm install, full turbo build (5/5), server boots and serves
/health, drizzle-kit generates the initial migration.

wiki/index.md

@@ -0,0 +1,67 @@
+---
+type: overview
+tags: [parking, index]
+updated: 2026-06-14
+---
+
+# Index
+
+Content catalog for the wiki. Start at [[overview]]. Maintained on every ingest.
+Counts: 1 source · 14 entities · 10 concepts · 2 decision records.
+
+## Overview & navigation
+- [[overview]] — the top-level synthesis and entry point.
+- [[index]] — this catalog.
+- `log.md` — chronological record of ingests/queries/lints.
+
+## Sources
+- [[parking-system-architecture]] — design notes: stack, threat model, devices, UHPPOTE, ESP32, readers, BOM, open decisions.
+
+## Entities — technology stack
+- [[technology-stack]] — the full stack table; all MIT/Apache/BSD, chosen to avoid lock-in.
+- [[fastify]] — Node backend; hosts device-driver plugins + auth; serves the SPA.
+- [[sqlite]] — local single-writer DB (WAL); limits & why it fits.
+- [[drizzle-orm]] — ORM; schemas port to PostgreSQL for remote sync.
+- [[turborepo]] — monorepo tool.
+- [[react-vite-spa]] — React/Vite frontend served by Fastify.
+- [[local-jwt-auth]] — fully local auth (JWT + bcrypt + role guard); forced by offline-first.
+
+## Entities — rejected alternatives
+- [[payload-cms]] — strong, but rejected over BSL license shift (the rug-pull cautionary case).
+- [[refine]] — dropped for plain React; UI too simple to justify a framework.
+- [[logto-zitadel-oidc]] — OIDC providers ruled out by offline-first.
+
+## Entities — hardware & devices
+- [[uhppote-controller]] — current access controller; cheap, tamper-evident, open-UDP, fixed firmware.
+- [[esp32-custom-controller]] — prevention-grade upgrade; device-level auth.
+- [[atecc608]] — secure element; non-extractable signing key (host events + controller auth).
+- [[wiegand]] — reader standard feeding the controller directly (autonomous permit-holder path).
+- [[lpr-camera]] — edge-AI plate recognition; host-side casual-identity source.
+- [[bom]] — reference bill of materials (barrier, loops, controller, readers, payment, host, network).
+
+## Concepts — foundational forces
+- [[offline-first]] — no network dependency in core operation; what it forces (and doesn't).
+- [[threat-model]] — the operator-at-the-booth reframing; why encryption defends the wrong threat.
+
+## Concepts — integrity & anti-fraud
+- [[append-only-event-chain]] — append-only + hash chain + ATECC608 signing = unforgeable log.
+- [[reconciliation]] — the real anti-fraud control; what remote sync actually is.
+- [[disk-os-hardening]] — LUKS/GRUB/Secure Boot; worthwhile but not the main event.
+
+## Concepts — device architecture & safety
+- [[device-adapter-pattern]] — business logic talks to interfaces; swap hardware → new adapter.
+- [[barrier-not-a-door]] — never timed-close a barrier; safety lives in barrier firmware.
+- [[trust-boundary]] — the core fork: network vs. device; auditable vs. unforgeable.
+- [[fail-state-safety]] — entry fails closed, exit fails open; manual override; watchdog.
+
+## Concepts — access control
+- [[uhppote-udp-protocol]] — open UDP weakness + the unauthenticated commands that undermine the log.
+- [[network-isolation]] — mandatory VLAN isolation; the network as security boundary.
+- [[event-log-ingestion]] — host-side index tracking that makes the UHPPOTE log trustworthy.
+- [[challenge-response-auth]] — asymmetric nonce scheme for the ESP32 (auth + anti-replay).
+- [[entry-exit-readers]] — two populations, two integration paths; both can share a relay.
+- [[uhppote-vs-esp32]] — comparison: detection vs. prevention.
+
+## Decisions
+- [[standing-decisions]] — settled decisions (stack, platform, integrity, access control, readers).
+- [[open-questions]] — 6 unsettled items that drive procurement.