Behavision: face recognition for retail, edge to head office

Five components that ship as one product:

- behavision/  the recognition engine. RTSP ingest, YuNet detection, IoU
               tracking, ArcFace embeddings, a FAISS/SQLite gallery, and a
               FastAPI dashboard. Identity is decided once per TRACK from an
               average of at least three embeddings, never per frame.
- agent/       the Go edge agent: supervises the engine, holds a durable
               spool, and drains it to MQTT. Nothing is acked before the
               broker confirms.
- desktop/     the shop PC application (Wails + React + tray).
- server/      the cloud API, MQTT consumer, reports and assistant.
- web/         platform.loyaly.ai, the head-office app, embedded in the
               server binary.

The gallery stores 512-float embeddings and timestamps - no images unless
`app.store_faces` is switched on. Those embeddings are biometric personal
data under GDPR and India's DPDP: template inversion reconstructs a
recognisable face from an ArcFace vector, so data/behavision.db is treated
as a biometric database and DELETE /api/visitors/{id} is a real erasure.

CLAUDE.md carries the reasoning behind every non-obvious decision here,
including the ones that were measured and the ones that were wrong first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HViLj9gYNRtSr7YVZmW5sn

.gitignore

@@ -0,0 +1,39 @@
+__pycache__/
+*.pyc
+.venv/
+venv/
+.env
+data/
+models/*.onnx
+models/*.caffemodel
+models/*.prototxt
+*.log
+.pytest_cache/
+
+# run-local.sh's working directory: the built binary, the encryption key and
+# the broker's password file. Nothing here belongs in a repository.
+.local/
+
+# The agent's local state when BEHAVISION_DATA_DIR points at a checkout.
+# agent.json holds this PC's broker password and its API token.
+agent.json
+spool/
+
+# Build output. The Windows package is ~400 MB unpacked and is rebuilt from
+# source by installer/build.ps1; the WebView2 bootstrapper is Microsoft's
+# redistributable, fetched at build time rather than vendored into history.
+/dist/
+/build/
+desktop/build/bin/
+installer/vendor/
+node_modules/
+
+# NOT ignored, deliberately: server/internal/web/dist and
+# desktop/frontend/dist. Both are `go:embed`ed at COMPILE time, so without
+# them in the tree `go build ./...` fails on a fresh checkout - on a machine
+# that may have no npm at all. They are ~200 KB and regenerating them is one
+# command; a repository that does not compile is the more expensive problem.
+
+# macOS finder metadata and rotated engine logs.
+.DS_Store
+*.log.[0-9]