feat(tills): per-till activity log, wash bucket on the booth Z-report, wash-desk printer role

Closes the three known follow-ups of the Tills decision (venue-modules.md):

- Activity log per till: `tillOfEvent(type, payload)` in @parking/shared (money events
  by payload till, other events by their owning module's till, everything else booth),
  applied by `/api/events?till=` in SQL and passed by the hub log, the Drawer "today"
  panel and the booth feed (history + live pushes). The events route admits a role that
  holds a module feed permission without event:read and returns only that module's
  event types — the live-socket rule.
- Booth Z-report: `chargesByModuleMinor` sums the chargeLines on the till's payments by
  module; the ticket bucket excludes them (Bileta = parking only); printed
  "Lavazh (në biletë)" only when any was taken. The wash till's slip prints "Lavazh:".
- Printer role `wash-desk`: the wash till's Z-report and vouchers print there, falling
  back to the booth printer; nothing falls back to the desk. `printerRoleOf()` is the
  one reading of the role field (the entry/booth loaders treated any non-booth role as
  an entry dispenser). Footer label "at wash desk".

Also: `GET /api/carwash/settings` opens to carwash:read OR site:read (new
requireAnyPermission) — the Wash operator job could not load the desk's category and
service pickers. Tests for all four; wiki (shift, printer-roles-failover, venue-modules,
log) updated.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

packages/devices/src/printer-routing.test.ts

@@ -27,6 +27,19 @@ describe("orderForRole", () => {
     expect(orderForRole(printers, "booth-receipt").map((p) => p.id)).toEqual(["booth"]);
   });
 
+  it("wash-desk job: the desk printer first, the booth printer as fallback, never the dispenser", () => {
+    const printers = [inst("disp", "entry-dispenser"), inst("booth", "booth-receipt"), inst("desk", "wash-desk")];
+    expect(orderForRole(printers, "wash-desk").map((p) => p.id)).toEqual(["desk", "booth"]);
+    // A site without a desk printer keeps printing wash slips in the booth.
+    expect(orderForRole(printers.slice(0, 2), "wash-desk").map((p) => p.id)).toEqual(["booth"]);
+  });
+
+  it("nothing ever falls back TO the wash desk (booth receipts and entry tickets stay off it)", () => {
+    const printers = [inst("desk", "wash-desk")];
+    expect(orderForRole(printers, "booth-receipt")).toEqual([]);
+    expect(orderForRole(printers, "entry-dispenser")).toEqual([]);
+  });
+
   it("breaks ties by failoverRank (higher first), then id", () => {
     const printers = [
       inst("b", "entry-dispenser", 1),