feat: scaffold vin-decoder repo — server, data layer, Flux manifests, CI

Closes leeworks-agents/api-company#122

- openapi.yaml: copied from leeworks-agents/api-company apis/vin-decoder/openapi.yaml (canonical spec)
- src/db.js: SQLite database init with vin_cache schema and indexes
- src/nhtsa.js: NHTSA vPIC fetch + field mapping
- src/cache.js: cache read/write with 90-day TTL, validateVin, getCacheStats, evictExpired
- src/server.js: Fastify server implementing GET /v1/decode, POST /v1/batch, GET /v1/health
  - X-RapidAPI-Proxy-Secret middleware on /decode and /batch
  - X-Request-Id, X-Cache, X-Data-Source response headers
  - Returns 403 for missing/wrong proxy secret
- scripts/seed.js: pre-warm cache with known VINs, runs eviction sweep
- src/tests/cache.test.js: unit tests for validateVin + cache integration (Honda Accord VIN)
- Dockerfile: Node 20 alpine, non-root, healthcheck on /v1/health
- .gitea/workflows/ci.yaml: test → build → push to registry.leeworks.dev/vin-decoder/api:<sha>
- flux/vin-decoder/: Namespace, Deployment (with RAPIDAPI_PROXY_SECRET from secret), Service, Ingress (vin.leeworks.dev + TLS), Kustomization
- .gitignore: node_modules, data/, .env

README.md

@@ -1,3 +1,34 @@
 # vin-decoder
 
-VIN Decoder API — decode any 17-character VIN using NHTSA vPIC
+VIN Decoder API - decode any 17-character VIN using NHTSA vPIC
+
+**Live at:** https://vin.leeworks.dev (once deployed)
+**OpenAPI spec:** openapi.yaml
+
+## Endpoints
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | /v1/decode?vin={vin} | Required | Decode a single VIN |
+| POST | /v1/batch | Required | Decode up to 50 VINs |
+| GET | /v1/health | None | Service health and cache stats |
+
+Auth = X-RapidAPI-Proxy-Secret header.
+
+## Local development
+
+npm install
+node scripts/seed.js  # optional: seed known VINs
+npm run dev           # starts on localhost:3000
+
+## Tests
+
+npm test
+
+## Environment variables
+
+PORT (default 3000), DB_PATH (default ./data/vin_cache.db), RAPIDAPI_PROXY_SECRET (required in prod)
+
+## Deployment
+
+Flux manifests: flux/vin-decoder/. Requires gitea-registry imagePullSecret and rapidapi-proxy-secret in vin-decoder namespace.