Behavision: face recognition for retail, edge to head office

Five components that ship as one product:

- behavision/  the recognition engine. RTSP ingest, YuNet detection, IoU
               tracking, ArcFace embeddings, a FAISS/SQLite gallery, and a
               FastAPI dashboard. Identity is decided once per TRACK from an
               average of at least three embeddings, never per frame.
- agent/       the Go edge agent: supervises the engine, holds a durable
               spool, and drains it to MQTT. Nothing is acked before the
               broker confirms.
- desktop/     the shop PC application (Wails + React + tray).
- server/      the cloud API, MQTT consumer, reports and assistant.
- web/         platform.loyaly.ai, the head-office app, embedded in the
               server binary.

The gallery stores 512-float embeddings and timestamps - no images unless
`app.store_faces` is switched on. Those embeddings are biometric personal
data under GDPR and India's DPDP: template inversion reconstructs a
recognisable face from an ArcFace vector, so data/behavision.db is treated
as a biometric database and DELETE /api/visitors/{id} is a real erasure.

CLAUDE.md carries the reasoning behind every non-obvious decision here,
including the ones that were measured and the ones that were wrong first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HViLj9gYNRtSr7YVZmW5sn

web/vite.config.js

@@ -0,0 +1,25 @@
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+
+// The build lands inside the Go module, not in this directory.
+//
+// `go:embed` cannot reach outside its own module, and the server ships as ONE
+// binary on purpose - a second artefact to deploy is a second thing to forget
+// to deploy, the same argument that keeps `provision` a subcommand rather than
+// its own image.
+export default defineConfig({
+  plugins: [react()],
+  build: {
+    outDir: '../server/internal/web/dist',
+    emptyOutDir: true,
+  },
+  server: {
+    // shared/cameraMakes.js lives above this directory and is imported by both
+    // front ends; dev-server file serving is confined to the project root
+    // unless told otherwise, so `npm run dev` would 403 on it.
+    fs: { allow: ['..'] },
+    // `npm run dev` for styling work talks to a server run locally. The built
+    // bundle uses same-origin paths and needs no proxy.
+    proxy: { '/api': { target: 'http://127.0.0.1:8080', changeOrigin: true } },
+  },
+})