fix inquiry integration and insurer case details

docs/external-api-curls.md

@@ -433,6 +433,23 @@ curl -X POST "$ESG_URL/inquiry/policyByPlate" \
   }'
 ```
 
+### Car By Chassis (Two-Factor VIN Inquiry)
+
+Use the two-factor chassis route when the backend must match both the VIN and
+the resolved third-party policyholder. Do not send `nationalCode` to the
+one-factor `policyByChassis` route.
+
+```sh
+curl -X POST "$ESG_URL/inquiry/carByChassis" \
+  -H "Authorization: Bearer $ESG_ACCESS_TOKEN" \
+  -H "Content-Type: application/json" \
+  -H "Accept: application/json" \
+  --data '{
+    "nationalCode": "0012345678",
+    "chassis": "NAAR03HFFRDE07024"
+  }'
+```
+
 ### Person Inquiry
 
 ESG expects Jalali birth date, normalized as `YYYY-MM-DD`.