feat: extend Flux image automation, Gatus, and docs for VIN Decoder

Closes leeworks-agents/api-company#133
Closes leeworks-agents/api-company#134
Closes leeworks-agents/api-company#135
Closes leeworks-agents/api-company#136

- flux/image-automation/imagerepositories.yaml: add vin-decoder ImageRepository
  pointing at registry.leeworks.dev/vin-decoder/api (#133)
- flux/image-automation/imagepolicies.yaml: add vin-decoder ImagePolicy
  with semver range >=0.1.0 (#133)
- flux/monitoring/gatus-helmrelease.yaml: add VIN Decoder API endpoint check
  targeting https://vin.leeworks.dev/v1/health with Slack alert (#134)
- docs/pre-launch-checklist.md: add vin-decoder to Infrastructure, DNS & TLS,
  Functional Verification, and Legal sections; update status page line to
  reference all four APIs (#135)
- docs/secrets-checklist.md: add items #11-13 for vin-decoder GITEA_TOKEN,
  gitea-registry, and rapidapi-proxy-secret; add detail sections for each (#136)

kustomize build flux/ passes with zero errors.

docs/pre-launch-checklist.md

@@ -11,6 +11,7 @@ Use this checklist as the final go-live gate — run through every item the day
   - [ ] `zip-enrichment` pod `READY=1/1` (`kubectl get pods -n zip-enrichment`)
   - [ ] `holidays` pod `READY=1/1` (`kubectl get pods -n holidays`)
   - [ ] `air-quality` pod `READY=1/1` (`kubectl get pods -n air-quality`)
+  - [ ] `vin-decoder` pod `READY=1/1` (`kubectl get pods -n vin-decoder`)
 - [ ] `docs-site` pod Running and READY (`kubectl get pods -n docs-site`)
 - [ ] Prometheus scraping all three API services (check Prometheus Targets UI)
 - [ ] Grafana dashboard accessible at `grafana.leeworks.dev`
@@ -25,8 +26,9 @@ Use this checklist as the final go-live gate — run through every item the day
 - [ ] `docs.leeworks.dev` → cluster ingress IP
 - [ ] `status.leeworks.dev` → cluster ingress IP
 - [ ] `registry.leeworks.dev` → cluster ingress IP
+- [ ] `vin.leeworks.dev` → cluster ingress IP (`dig vin.leeworks.dev +short` + `curl -I https://vin.leeworks.dev`)
 - [ ] `grafana.leeworks.dev` → cluster ingress IP
-- [ ] TLS certificates issued for all 7 subdomains (`kubectl get certificates -A`)
+- [ ] TLS certificates issued for all 8 subdomains (`kubectl get certificates -A`)
 
 ---
 
@@ -38,9 +40,12 @@ Use this checklist as the final go-live gate — run through every item the day
 - [ ] `GET /zip/{zip}` returns correct data for a sample ZIP code (e.g. `curl https://zip.leeworks.dev/zip/10001`)
 - [ ] `GET /holidays/{year}` returns correct data (e.g. `curl https://holidays.leeworks.dev/holidays/2026`)
 - [ ] `GET /aqi/{city}` returns correct data (e.g. `curl https://aqi.leeworks.dev/aqi/New%20York`)
+- [ ] `GET /v1/health` returns HTTP 200 on **vin-decoder** (`curl https://vin.leeworks.dev/v1/health`)
+- [ ] `GET /v1/decode?vin=1HGCM82633A004352` returns correct make/model/year data
+- [ ] Request **without** `X-RapidAPI-Proxy-Secret` returns HTTP 403 on **vin-decoder** (`curl https://vin.leeworks.dev/v1/decode?vin=1HGCM82633A004352`)
 - [ ] Request **without** `X-RapidAPI-Proxy-Secret` returns HTTP 403 on all three APIs
 - [ ] `docs.leeworks.dev/pricing` loads correctly
-- [ ] `status.leeworks.dev` shows all three APIs as **UP**
+- [ ] `status.leeworks.dev` shows all **four** APIs as **UP**
 
 ---
 
@@ -50,6 +55,8 @@ Use this checklist as the final go-live gate — run through every item the day
 - [ ] `docs/legal/privacy-policy.md` committed and reachable at `docs.leeworks.dev/legal/privacy-policy`
 - [ ] `docs/legal/acceptable-use-policy.md` committed and reachable at `docs.leeworks.dev/legal/acceptable-use-policy`
 - [ ] All three APIs listed on RapidAPI with **Free + 3 paid tiers** (leeworks-agents/api-company#44)
+- [ ] VIN Decoder listed on RapidAPI with Free + 3 paid tiers (leeworks-agents/api-company#131)
+- [ ] `rapidapi-proxy-secret` updated with real RapidAPI value in `vin-decoder` namespace (leeworks-agents/api-company#128)
 - [ ] PayPal linked to RapidAPI (leeworks-agents/api-company#19)
 - [ ] `rapidapi-proxy-secret` updated with **real** RapidAPI values in all 3 namespaces (leeworks-agents/api-company#81)