Give every terminal its own identity, and report fleet presence

Answers "which of my 100 tills are alive and healthy", and fixes three things
that were fine on one device and broken on a hundred.

Terminal identity (lib/data/local/terminal_identity.dart)
- Every device mints a UUID on first run, stored in its own database, plus a
  short code (T4A9) derived from it. Renaming keeps the device id, so history
  keeps pointing at the same physical till.
- Replaces the literal 'TERM-01', which was hardcoded in five places. The whole
  fleet reported as one terminal: shift reports merged, MQTT topics collided,
  and a second connection with the same client id evicts the first from the
  broker — so two tills would have knocked each other offline in a loop.

Invoice numbers now carry the terminal code
- INV-2608-T4A9-00042. The sequence counter lives in each till's own database
  and starts at 1, so without this every terminal in the fleet minted
  INV-2608-00001 for its first sale of the month. The order UUID kept the data
  distinct; the number a customer quotes on a receipt was not.

SQLite pragmas
- WAL, so the product grid refreshing does not block the sale being written,
  and the file is never left mid-rewrite by a power cut.
- busy_timeout 5s, so a contended lock waits instead of throwing "database is
  locked" — which at checkout is a failed sale with a customer standing there.
- synchronous NORMAL, the right trade under WAL for a till.

Fleet presence (lib/data/sync/presence_reporter.dart)
- Retained status record on connect and once a minute: device id, code, name,
  app version, pending bill count, last upload, catalogue revision, sync halt
  state. Retained so a dashboard connecting at noon gets all 100 terminals
  immediately rather than a blank board.
- The Last Will already said "reachable". A till can be connected and still be
  holding 200 unsent bills or running last month's prices; only pending_bills
  and catalogue_revision say so.

NATS
- The MQTT gateway maps / to . so the existing transport works unchanged.
  SyncConfig.asNatsSubject() exposes the translation, and the contract doc
  gives the JetStream subjects (pos.*.*.order, pos.*.*.status) plus the two
  server-side requirements: a file-backed stream, and the ack published by the
  consumer after commit rather than by the ingest handler.

Tests: 129 -> 140. New coverage for identity minting and stability, per-device
invoice uniqueness, topic and client-id separation, NATS subject mapping, and
the two pragmas. Suite run three times clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

lib/data/local/app_database.dart

@@ -60,7 +60,7 @@ class AppDatabase {
       path,
       options: OpenDatabaseOptions(
         version: _version,
-        onConfigure: (db) => db.execute('PRAGMA foreign_keys = ON'),
+        onConfigure: _configure,
         onCreate: (db, version) async => _createSchema(db),
         onUpgrade: (db, from, to) async {
           if (from < 2) await db.execute(_createDayArchive);
@@ -84,12 +84,35 @@ class AppDatabase {
       inMemoryDatabasePath,
       options: OpenDatabaseOptions(
         version: _version,
-        onConfigure: (db) => db.execute('PRAGMA foreign_keys = ON'),
+        onConfigure: _configure,
         onCreate: (db, version) async => _createSchema(db),
       ),
     );
   }
 
+  /// Pragmas applied on every connection, before any query runs.
+  ///
+  /// Defaults are wrong for a till:
+  ///
+  /// * **WAL** lets a read proceed while a write is in flight. On the rollback
+  ///   journal the product grid refreshing would block the sale being written.
+  ///   It also survives a power cut better: the database file is never left
+  ///   mid-rewrite.
+  /// * **busy_timeout** makes a contended lock wait instead of throwing
+  ///   `database is locked` — which, at checkout, is a failed sale.
+  /// * **synchronous = NORMAL** is the right trade under WAL: an fsync per
+  ///   transaction costs more than a POS can spare, and WAL still recovers a
+  ///   committed transaction after a crash. Only a host OS crash or power loss
+  ///   can lose the last commits, which is what the UPS is for.
+  static Future<void> _configure(Database db) async {
+    await db.execute('PRAGMA foreign_keys = ON');
+    await db.execute('PRAGMA busy_timeout = 5000');
+
+    // In-memory databases have no WAL; asking for it is harmless but pointless.
+    await db.execute('PRAGMA journal_mode = WAL');
+    await db.execute('PRAGMA synchronous = NORMAL');
+  }
+
   Future<void> close() async {
     await _db?.close();
     _db = null;
@@ -345,6 +368,19 @@ class MetaKeys {
   static const String catalogueRevision = 'catalogue_revision';
   static const String invoiceSequence = 'invoice_sequence';
 
+  /// Fleet identity. Minted once on first run and never changed — it is what
+  /// ties a bill, an MQTT topic and a presence record to one physical till.
+  static const String deviceId = 'terminal_device_id';
+
+  /// Short code stamped into invoice numbers, e.g. `T4A9`. Unique per device
+  /// so two tills in the same shop cannot mint the same invoice.
+  static const String terminalCode = 'terminal_code';
+
+  /// Human label shown in Settings and on the fleet board, e.g. "Counter 2".
+  static const String terminalName = 'terminal_name';
+
+  static const String storeId = 'store_id';
+
   /// Printer chosen in Settings. Stored as the printer's `url`, which is what
   /// `Printing.directPrintPdf` needs to target it without a dialog.
   static const String printerUrl = 'printer_url';

lib/data/local/terminal_identity.dart

@@ -0,0 +1,106 @@
+import 'package:uuid/uuid.dart';
+
+import 'app_database.dart';
+import 'catalogue_dao.dart';
+
+/// Who this till is, across a fleet.
+///
+/// Everything that has to be distinguishable between 100 installed terminals
+/// hangs off this: MQTT topics, presence records, invoice numbers, and which
+/// cashier's shift a bill belongs to. Before it existed every device called
+/// itself `TERM-01`, so their topics collided, the fleet board showed one
+/// terminal, and 100 tills minted the same invoice number.
+class TerminalIdentity {
+  const TerminalIdentity({
+    required this.deviceId,
+    required this.code,
+    required this.name,
+    required this.storeId,
+  });
+
+  /// Minted once, on first run, and never changed. The stable machine identity
+  /// — reinstalling the app on the same till keeps it, because it lives in the
+  /// database rather than in memory.
+  final String deviceId;
+
+  /// Short, unique, and safe inside an invoice number: `T4A9`.
+  final String code;
+
+  /// What a person calls it. Free text, and duplicates are the shop's problem,
+  /// not the system's — nothing keys on it.
+  final String name;
+
+  final String storeId;
+
+  /// Used as the MQTT client id and in every topic. Stable across restarts so
+  /// the broker can resume a session rather than treating each launch as a new
+  /// client.
+  String get clientId => 'pos-$storeId-$code';
+
+  @override
+  String toString() => '$name ($code)';
+}
+
+/// Reads the terminal's identity from the database, minting it on first run.
+class TerminalIdentityStore {
+  const TerminalIdentityStore(this._catalogue);
+
+  final CatalogueDao _catalogue;
+
+  static const _uuid = Uuid();
+
+  /// Loads the identity, creating one the first time this device is started.
+  ///
+  /// The mint is idempotent: an existing device id is never replaced, so a
+  /// terminal cannot silently change identity and orphan its own history.
+  Future<TerminalIdentity> load({String defaultStoreId = 'store-01'}) async {
+    var deviceId = await _catalogue.meta(MetaKeys.deviceId);
+    var code = await _catalogue.meta(MetaKeys.terminalCode);
+
+    if (deviceId == null || deviceId.isEmpty) {
+      deviceId = _uuid.v4();
+      await _catalogue.setMeta(MetaKeys.deviceId, deviceId);
+    }
+
+    if (code == null || code.isEmpty) {
+      code = codeFor(deviceId);
+      await _catalogue.setMeta(MetaKeys.terminalCode, code);
+    }
+
+    final name = await _catalogue.meta(MetaKeys.terminalName);
+    final storeId = await _catalogue.meta(MetaKeys.storeId);
+
+    return TerminalIdentity(
+      deviceId: deviceId,
+      code: code,
+      name: (name == null || name.isEmpty) ? 'Terminal $code' : name,
+      storeId: (storeId == null || storeId.isEmpty) ? defaultStoreId : storeId,
+    );
+  }
+
+  /// `T` plus four hex characters of the device id.
+  ///
+  /// Short enough to read off a screen and repeat over the phone, and with
+  /// 65,536 values a 100-terminal fleet has roughly a 7% chance of a collision
+  /// somewhere in it — which is why [rename] exists and why the back office
+  /// should reject a duplicate rather than assume uniqueness.
+  static String codeFor(String deviceId) {
+    final hex = deviceId.replaceAll('-', '');
+    return 'T${hex.substring(0, 4).toUpperCase()}';
+  }
+
+  /// Re-codes a terminal, for when head office wants readable numbers or two
+  /// devices in one shop happened to collide.
+  ///
+  /// The device id is deliberately untouched: history already written under the
+  /// old code keeps pointing at the same physical till.
+  Future<void> rename({String? code, String? name, String? storeId}) async {
+    if (code != null && code.isNotEmpty) {
+      await _catalogue.setMeta(MetaKeys.terminalCode, code.toUpperCase());
+    }
+    if (name != null) await _catalogue.setMeta(MetaKeys.terminalName, name);
+    if (storeId != null && storeId.isNotEmpty) {
+      await _catalogue.setMeta(MetaKeys.storeId, storeId);
+    }
+  }
+}