feat: add car inquiries with resilience, ownership privacy, and retry visibility

Introduce plate, chassis, and third-party car endpoints, a wall-clock inquiry
deadline with transport-only retries, and ownership-safe no-match errors so
another person's identity never leaks.

Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -0,0 +1,39 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [Unreleased]
+
+### Added
+
+- Car inquiry endpoints:
+  - `POST /inquiry/carByPlate` — insurance inquiry by plate (provider passthrough)
+  - `POST /inquiry/carByChassis` — insurance inquiry by chassis/VIN
+  - `POST /inquiry/thirdPartyCar` — third-party car inquiry with provider-specific policy selection
+- New inquiry types: `CAR_BY_PLATE`, `CAR_BY_CHASSIS`, `THIRD_PARTY_CAR` (legacy `CAR_PLATE` remains, marked deprecated)
+- Shared CentInsur SOAP client and provider support for plate / chassis / national-code car policy lookups
+- Third-party car selection rules: passenger vehicle groups, current Jalali-year overlap, active-policy preference, and plate + national-code merge (including zero-km plates)
+- Provider resilience layer: wall-clock inquiry deadline (`INQUIRY_DEADLINE_MS`, default 90s), transport-only retries, per-attempt timeouts, and an attempt trail
+- `attemptSummary` on inquiry responses — always on failure; on success only when a retry occurred
+- `INQUIRY_DEADLINE_EXCEEDED` error (HTTP 504) with Persian translation
+- Car ownership safety helpers: ownership mismatch is returned as a generic no-match (no owner national code, no conflict map)
+- Generalized `inquiry_result_cache` collection and service (replaces person-only cached-inquiry-result)
+- Unit tests for car privacy, provider resilience, and timeout/deadline behavior
+
+### Changed
+
+- Retry helper honors an absolute deadline and records per-attempt outcomes
+- Orchestrator initializes a deadline and attempt trail, and does not fall through to another provider on business outcomes (`INQUIRY_NO_MATCH`, `RECORD_NOT_FOUND`, `SHEBA_MISMATCH`, validation)
+- Base provider, Amitis, Moallem, Parsian, and Tejarat No use the shared resilience runner
+- Tejarat No now covers person, Shahkar, real-estate, and the new car inquiry types (OAuth on accounts host, REST on inquiry gateway)
+- General token service supports more resilient auth login/refresh
+- Inquiry logs persist `attemptSummary`
+- Payload masking also covers `nationalId`, `ntnlid`, and `policyOwnerNationalCode`
+- Conflict payloads no longer include another person's national code or identity fields
+
+### Security
+
+- Car inquiry ownership mismatch is indistinguishable from "no result" so callers cannot discover who a plate or chassis belongs to
+- Public error payloads are checked so another party's national code cannot leak