feat: scaffold vin-decoder repo — server, data layer, Flux manifests, CI

Closes leeworks-agents/api-company#122

- openapi.yaml: copied from leeworks-agents/api-company apis/vin-decoder/openapi.yaml (canonical spec)
- src/db.js: SQLite database init with vin_cache schema and indexes
- src/nhtsa.js: NHTSA vPIC fetch + field mapping
- src/cache.js: cache read/write with 90-day TTL, validateVin, getCacheStats, evictExpired
- src/server.js: Fastify server implementing GET /v1/decode, POST /v1/batch, GET /v1/health
  - X-RapidAPI-Proxy-Secret middleware on /decode and /batch
  - X-Request-Id, X-Cache, X-Data-Source response headers
  - Returns 403 for missing/wrong proxy secret
- scripts/seed.js: pre-warm cache with known VINs, runs eviction sweep
- src/tests/cache.test.js: unit tests for validateVin + cache integration (Honda Accord VIN)
- Dockerfile: Node 20 alpine, non-root, healthcheck on /v1/health
- .gitea/workflows/ci.yaml: test → build → push to registry.leeworks.dev/vin-decoder/api:<sha>
- flux/vin-decoder/: Namespace, Deployment (with RAPIDAPI_PROXY_SECRET from secret), Service, Ingress (vin.leeworks.dev + TLS), Kustomization
- .gitignore: node_modules, data/, .env

.gitea/workflows/ci.yaml

@@ -0,0 +1,39 @@
+name: CI — Build, Test, Push
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm test
+
+  build-and-push:
+    runs-on: ubuntu-latest
+    needs: test
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set image tag
+        id: tag
+        run: echo "SHA=${GITHUB_SHA::8}" >> $GITHUB_OUTPUT
+      - name: Log in to Gitea registry
+        run: echo "${{ secrets.GITEA_TOKEN }}" | docker login registry.leeworks.dev -u leeworks-agents --password-stdin
+      - name: Build image
+        run: |
+          docker build -t registry.leeworks.dev/vin-decoder/api:${{ steps.tag.outputs.SHA }} \
+                       -t registry.leeworks.dev/vin-decoder/api:latest .
+      - name: Push image
+        run: |
+          docker push registry.leeworks.dev/vin-decoder/api:${{ steps.tag.outputs.SHA }}
+          docker push registry.leeworks.dev/vin-decoder/api:latest