feat: show recognized plate in live feed + active sessions

Surface the advisory ANPR plate (device_events kind="read", keyed by
session identity — unsigned, prunable, never an access decision) next to
entry/exit events in the live feed and on active-session rows.

Resolved at serialize time (new plate-lookup.ts; prefers an entry read;
one device_events scan per page) like subscriber-name enrichment — the
signed ledger is untouched. Adds plate? to the shared LedgerEvent and to
ActiveSession/SessionLookup; a small amber badge in the UI.

Caveat: a vehicle_entry is signed + pushed over WS before the async ANPR
read lands, so a fresh feed row may show no plate until reload; always
present on active sessions.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/src/routes/events.ts

@@ -2,7 +2,7 @@ import type { FastifyInstance } from "fastify";
 import { desc, gte, ledgerEvents, type Db } from "@parking/db";
 import type { LedgerEvent } from "@parking/shared";
 import { requirePermission } from "../auth.js";
-import { enrichEvent } from "../event-enrich.js";
+import { enrichEvents } from "../event-enrich.js";
 import type { EventLog } from "../event-log.js";
 
 // Read access to the append-only signed event log. NO write/update/delete routes
@@ -35,9 +35,10 @@ export async function eventRoutes(
         .orderBy(desc(ledgerEvents.index))
         .limit(limit)
         .all();
-      // Attach read-time display fields (e.g. subscriber name) without touching the
-      // signed record. The cast bridges the Drizzle row to the shared LedgerEvent.
-      const events = rows.map((r) => enrichEvent(db, r as unknown as LedgerEvent));
+      // Attach read-time display fields (subscriber name, advisory plate) without
+      // touching the signed record. One plate scan for the whole page (enrichEvents).
+      // The cast bridges the Drizzle row to the shared LedgerEvent.
+      const events = enrichEvents(db, rows as unknown as LedgerEvent[]);
       return { events };
     },
   );