refactor: remove rest-api client, access PlaceOS directly

[stakach]

Summary

staff-api and rest-api share a database, so the HTTP calls made through get_placeos_client now run locally. The placeos crystal-client shard is gone.

Was (rest-api call)	Now
systems.fetch	find_system!: ControlSystem.find!. Guests are still limited to the systems in their JWT roles.
systems.with_emails	systems_with_emails: one ControlSystem.where(email: ...) query
systems.search (one request per zone, run in parallel)	systems_in_zones: a single SQL query (any zone, all features, capacity >=, bookable)
root.signal	signal: Redis PUBLISH to placeos/<channel> and placeos/<authority_id>/<channel>, same as rest-api
apikeys.inspect_jwt	ApiKey.find_key! → expired? → build_jwt
users.resource_token	User#resource_token from placeos-models (PlaceOS/models#333)

Behaviour changes

• Signal failures are logged and the request still succeeds. Before, a failed signal POST returned a 404 after the booking or event had already been saved.
• Systems are rendered as PlaceOS::Model::ControlSystem in event.system and availability.system. That is a superset of the old client struct, the same object rest-api returns.
• No resource token → 511 Network Authentication Required on the o365 photo endpoint, matching the delegated-tenant path. The id in the Graph URL is now path-escaped.
• A guest signal on a non-/guest/ channel no longer fails. rest-api blocked these for guest JWTs; staff-api chooses the channel itself, so that check doesn't apply here.

Config / deploy

• New: REDIS_URL, defaulting to redis://localhost:6379. staff-api deployments already have Redis access.
• Removed: PLACE_URI, PLACE_HOST_HEADER, SSL_VERIFY_NONE. PLACE_URI is no longer required at boot.
• docker-compose has a keydb service for specs.

Tidy-ups

• Removed the PlaceOS::Client::API::Error handler.
• Renamed the duplicate action_not_implemented handler to needs_authentication.
• Removed the system.zones || [] no-ops and the repeated placeos_client locals.
• Every system email is converted with .to_s before it's compared or sent, because Email == String is always false.

Dependencies

Uses User#resource_token from placeos-models 9.119.0 (PlaceOS/models#333).

Test plan

• Full ./test: 322 examples, 0 failures, 0 errors, 12 pending
• Specs no longer stub rest-api. About 160 signal/system/OAuth stubs are gone; systems are real DB rows, and signal assertions subscribe to Redis (SignalSpy).
• New spec/controllers/placeos_direct_spec.cr covers:
  • X-API-Key: valid, unknown and expired keys
  • signals on both channels
  • systems_in_zones filters
  • guest system access
  • delegated-tenant resource token, including the 511 case
  • o365 photo, including the 511 case
• Fix found by the specs: find_system! forced auth on the unauthenticated public-event attendee routes.
• crystal tool format --check, ./bin/ameba: clean

🤖 Generated with Claude Code