v0.6.3: hide the paid city lots from users without a ParkSmarter account

The green lots are the map's only paid category ("City lots - Paid hourly or
permit"); paying for them goes through ParkSmarter, so they are no use to
someone browsing without an account. Every other category is free street
parking with a posted time limit and needs nothing.

Gated by category rather than by an id list. Two lots were named (off Oak St
and off N 3rd Ave) and then the beach ones, which together is every green lot
on the map — and an id list would silently break the next time the map is
regenerated from a new PDF, since ids are positional.

- Paid lots are filtered out of the overlay when signed out, so they are
  neither drawn nor tappable.
- "Park here" still detects them, so standing in one explains that it needs an
  account instead of reporting no parking nearby.
- The area screen guards too, in case one is reached with a stale nav param.
- Server carries an optional per-area requiresAccount override for a lot that
  turns out to take payment another way. Null means "use the category
  default", so an unset value can't be confused with an explicit false.

The new column needs a real migration: CREATE TABLE IF NOT EXISTS does not add
a column to a table that already exists, so an already-deployed server would
have kept the old schema. Covered by a test that builds the pre-migration
table and then opens it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/src/app.ts

@@ -197,6 +197,9 @@ export async function buildApp(opts: BuildOptions) {
           color: String(raw.color ?? '#888888'),
           shape: g.type === 'Polygon' ? 'polygon' : 'line',
           geometry: g,
+          // Absent means "let the client decide by category"; only an explicit
+          // boolean overrides a specific lot.
+          requiresAccount: typeof raw.requiresAccount === 'boolean' ? raw.requiresAccount : null,
         });
       }
       return { replaced: db.replaceAreas(areas), total: db.areaCount() };