Door epic phases 4-5: inbound access-log ingest + universal API-call buttons

Phase 4 (migration 053): pull entry/denied events into door_access_log and
match each card to a member, via two transports sharing one ingest core.
Poll: a CRON_SECRET-guarded /api/cron/door-ingest reads each opted-in
native-HeatSync connection's ?z log through the existing hardened executor
and parses it (firmware-characterized, best-effort ring buffer). Webhook:
/api/door/inbound/[connection] accepts pushed event JSON authenticated by a
per-connection bearer secret from the vault. Both dedupe on
(connection_id, dedupe_key) so re-polls and retries are no-ops. Adds an
inbound config panel to /door/manage.

Phase 5 (migration 054): admins define api_buttons that fire a configured
HTTP call (full verbs + headers + body) when an authorized member presses
them, through the same hardened egress (now shared between callDoor and the
new callApi). Each button carries a required_permission (default the new
apicall.invoke code); members see only buttons they may press. Builder at
/door/buttons with a door-template preset; members press from /doors. Every
press is recorded in api_call_log with secrets redacted.

Both subsystems are inert until an admin enables inbound on a connection or
creates a button. 624 unit + 50 integration tests; migrations applied
top-to-bottom in schema.sql; types and docs updated.

proxy.ts

@@ -30,6 +30,15 @@ const PUBLIC_ROUTES = [
   // Scoped to the exact route so a future /api/cron/* without its own
   // secret is not exposed.
   '/api/cron/notifications',
+  // Door inbound-log poll, also crontab-driven; enforces its own CRON_SECRET.
+  // Scoped to the exact route.
+  '/api/cron/door-ingest',
+  // Per-connection inbound door-event webhook. Called by a controller/relay
+  // with no session; each request is authenticated by the connection's bearer
+  // secret in the route handler. The [connection] segment varies, so this is a
+  // prefix match (every /api/door/inbound/* path is session-exempt and must
+  // self-authenticate).
+  '/api/door/inbound',
   // Public form / waiver fill page. Only /f/[slug] lives here and must be
   // reachable anonymously (the page serves only published public forms and
   // submitForm enforces visibility). The /forms* management routes do NOT