feat(anpr): poll snapshots until a confident plate, so auto-exit works

The ANPR bridge took ONE snapshot at the camera's vehicle-alarm instant — but the
alarm fires as the car APPROACHES, so that frame's plate is small/blurry/half-in-
frame and ANPR returns a low-confidence misread ('111'@0.20). The manual test reads
the SAME car at ~100% because by then it's STOPPED at the barrier, well-framed. So
subscriber auto-exit silently never fired (read below the 0.85 floor → ignored).

Fix (the car-stops-at-the-barrier insight): the bridge now PULLS A FRESH FRAME every
ANPR_POLL_MS (1000) and re-runs ANPR until one clears VISION_ENTRY_MIN_CONFIDENCE, or
ANPR_POLL_WINDOW_MS (8000) elapses (drove off / non-subscriber → give up cleanly).
- One loop per camera (#polling set) — the camera's ~1Hz alarm re-fires JOIN the
  running loop instead of spawning N concurrent loops.
- Fresh camera.captureSnapshot each tick, NOT captureSnapshotShared (its 1.5s TTL
  would re-serve the same bad approach frame).
- Camera-level debounce stamp moved to AFTER a successful emit (suppresses re-fires
  for ANPR_DEBOUNCE_MS once we've acted), not before the loop.

VERIFIED on hardware (DS-2CD1047G3H-LIU exit lane): 7 garbage approach frames →
AA890XX@0.999 at the barrier → signed vehicle_exit. Still advisory + fail-soft; a
barrier never opens on a low-confidence read. anpr-entry.test.ts +1 (poll
escalation low→low→high); 169 server tests green. Documented in
lane-presence-and-anpr-entry + the lpr-camera camera-fault writeup.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/lane-presence-and-anpr-entry.md

@@ -62,7 +62,23 @@ then does the gated entry/exit + barrier open. Constructed in `server.ts` (the f
 above the hik-alarm registration so the bridge can take `subscriptionFlow`). Fail-soft throughout —
 any snapshot/vision error degrades to the subscriber's card/QR, never throws into the push handler.
 Two new env knobs: `VISION_ENTRY_MIN_CONFIDENCE` (0.85), `ANPR_DEBOUNCE_MS` (12_000). Covered by
-`anpr-entry.test.ts` (7) + `hikvision-alarm.test.ts` wiring (3).
+`anpr-entry.test.ts` + `hikvision-alarm.test.ts` wiring.
+
+> **POLL-until-confident (2026-06-27).** The single-shot capture above was upgraded to a **poll
+> loop**. The camera fires its vehicle alarm the INSTANT motion starts — the car is still
+> APPROACHING, so the first frame's plate is small/blurry/half-in-frame and ANPR returns a
+> low-confidence misread (observed live on the exit lane: `'111'`@0.20, `'AE18671'`@0.19 …, while
+> the manual `test-anpr` on the SAME stopped car read `AA890XX`@1.00). The car then STOPS at the
+> barrier waiting for it to open — the stationary, well-framed moment the test reads at ~100%. So
+> the bridge now **pulls a FRESH frame every `ANPR_POLL_MS` (1000) and re-runs ANPR until one clears
+> the floor, or `ANPR_POLL_WINDOW_MS` (8000) elapses** (car drove off / non-subscriber → give up
+> cleanly). One loop per camera (`#polling` set) so the ~1Hz alarm re-fires JOIN it, not spawn N;
+> each tick is a fresh `camera.captureSnapshot` (NOT `captureSnapshotShared`, whose TTL would
+> re-serve the same bad frame). VERIFIED on hardware: 7 garbage approach frames → `AA890XX`@0.999
+> at the barrier → signed `vehicle_exit`. This is what made subscriber **auto-exit** actually work
+> on the DS-2CD1047G3H-LIU (whose alarm fires on approach, not at the readable moment — see
+> [[lpr-camera]] "auto-enter but don't auto-exit"). Still advisory + fail-soft; a barrier never
+> opens on a low-confidence read.
 
 The goal (narrowed deliberately — see Rejected below): **a subscriber's plate, read by the lane
 camera, admits them through the same gated flow a QR/card scan uses.** Scope was cut to subscribers