server: permit entry/exit branch + read dispatcher

A credential read now routes by what the credential IS: matches a permit
(card/QR credential or a bound plate) -> permit flow; else -> transient exit
flow. Lane resolved once (readerLaneWithAccess); ExitFlow.onRead -> handleAt so
the dispatcher owns lane resolution.

Permit direction is inferred from session state for that car (the read value is
the per-car session key): no open session -> ENTRY (enforce maxConcurrent, sign
vehicle_entry, open); open -> EXIT (sign vehicle_exit, open, close). Fleet
permit = one session per car; anti-passback falls out naturally.

maxConcurrent enforced as a fold over the signed ledger (null = unbound).
Validity window + status + plate-OR-card identity as designed. No ticket/fee;
every use is a signed event carrying permitId. Refusals (revoked / out-of-window
/ at-capacity) are signed anomalies, barrier stays closed.

Verified against stubs: card entry -> inferred exit; fleet cap 2 (F3 rejected
at 2/2, then admitted after F1 exits); plate-bound opens; revoked rejects;
unknown credential falls through to exit reject; verifyChain ok.

apps/server/src/lane-map.ts

@@ -1,4 +1,4 @@
-import { laneDevices, type Db } from "@parking/db";
+import { and, eq, laneDevices, type Db } from "@parking/db";
 
 // Resolves a device instance id (lane_devices.id) to its lane number.
 //
@@ -28,3 +28,21 @@ export class LaneMap {
     return this.#byDeviceId.get(deviceId) ?? null;
   }
 }
+
+/**
+ * The lane a reader/scanner belongs to, IF that lane has an access (barrier)
+ * device to open — shared by the read-driven flows (exit + permit). A read is an
+ * identity signal; it only drives a barrier where there's one to drive. Returns
+ * the lane number or null. (Distinguishing entry- vs. exit-readers per lane is a
+ * later lane-direction model.)
+ */
+export async function readerLaneWithAccess(db: Db, deviceId: string): Promise<number | null> {
+  const row = await db.select().from(laneDevices).where(eq(laneDevices.id, deviceId)).get();
+  if (!row || !row.enabled) return null;
+  const access = await db
+    .select()
+    .from(laneDevices)
+    .where(and(eq(laneDevices.category, "access"), eq(laneDevices.lane, row.lane)))
+    .get();
+  return access && access.enabled ? row.lane : null;
+}