feat: scaffold vin-decoder repo — server, data layer, Flux manifests, CI

Closes leeworks-agents/api-company#122

- openapi.yaml: copied from leeworks-agents/api-company apis/vin-decoder/openapi.yaml (canonical spec)
- src/db.js: SQLite database init with vin_cache schema and indexes
- src/nhtsa.js: NHTSA vPIC fetch + field mapping
- src/cache.js: cache read/write with 90-day TTL, validateVin, getCacheStats, evictExpired
- src/server.js: Fastify server implementing GET /v1/decode, POST /v1/batch, GET /v1/health
  - X-RapidAPI-Proxy-Secret middleware on /decode and /batch
  - X-Request-Id, X-Cache, X-Data-Source response headers
  - Returns 403 for missing/wrong proxy secret
- scripts/seed.js: pre-warm cache with known VINs, runs eviction sweep
- src/tests/cache.test.js: unit tests for validateVin + cache integration (Honda Accord VIN)
- Dockerfile: Node 20 alpine, non-root, healthcheck on /v1/health
- .gitea/workflows/ci.yaml: test → build → push to registry.leeworks.dev/vin-decoder/api:<sha>
- flux/vin-decoder/: Namespace, Deployment (with RAPIDAPI_PROXY_SECRET from secret), Service, Ingress (vin.leeworks.dev + TLS), Kustomization
- .gitignore: node_modules, data/, .env

src/nhtsa.js

@@ -0,0 +1,46 @@
+import fetch from 'node-fetch';
+
+const NHTSA_BASE = 'https://vpic.nhtsa.dot.gov/api/vehicles/DecodeVinValues';
+const TTL_SECONDS = 90 * 24 * 60 * 60; // 90 days
+
+/** Fetch decoded VIN data from NHTSA vPIC */
+export async function fetchFromNhtsa(vin) {
+  const url = `${NHTSA_BASE}/${encodeURIComponent(vin)}?format=json`;
+  const res = await fetch(url, { timeout: 10000 });
+  if (!res.ok) throw new Error(`NHTSA returned HTTP ${res.status}`);
+  const json = await res.json();
+  const results = json.Results?.[0];
+  if (!results) throw new Error('NHTSA returned empty Results array');
+  return results;
+}
+
+/** Map NHTSA flat key/value response to our schema */
+export function mapNhtsaToSchema(raw) {
+  const cc = raw.DisplacementCC ? parseFloat(raw.DisplacementCC) : null;
+  const litre = raw.DisplacementL ? parseFloat(raw.DisplacementL) : null;
+  const cylinders = raw.EngineCylinders ? parseInt(raw.EngineCylinders, 10) : null;
+  return {
+    make: raw.Make || null,
+    model: raw.Model || null,
+    model_year: raw.ModelYear || null,
+    trim: raw.Trim || null,
+    series: raw.Series || null,
+    body_class: raw.BodyClass || null,
+    drive_type: raw.DriveType || null,
+    engine_displacement_cc: isNaN(cc) ? null : cc,
+    engine_displacement_l: isNaN(litre) ? null : litre,
+    engine_cylinders: isNaN(cylinders) ? null : cylinders,
+    fuel_type_primary: raw.FuelTypePrimary || null,
+    transmission_style: raw.TransmissionStyle || null,
+    transmission_speeds: raw.TransmissionSpeeds || null,
+    plant_city: raw.PlantCity || null,
+    plant_state: raw.PlantState || null,
+    plant_country: raw.PlantCountry || null,
+    manufacturer_name: raw.Manufacturer || null,
+    vehicle_type: raw.VehicleType || null,
+    error_code: raw.ErrorCode || '0',
+    error_text: raw.ErrorText || null,
+  };
+}
+
+export { TTL_SECONDS };