feat: add car inquiries with resilience, ownership privacy, and retry visibility

Introduce plate, chassis, and third-party car endpoints, a wall-clock inquiry
deadline with transport-only retries, and ownership-safe no-match errors so
another person's identity never leaks.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/unit/car-inquiry-safety.spec.ts

@@ -0,0 +1,67 @@
+import {
+  assertCarPolicyOwnedBy,
+  createCarOwnershipMismatchError,
+  isCarOwnershipMatch,
+  publicErrorLeaksNationalCode,
+} from '../../src/common/helpers/car-inquiry-safety.helper';
+
+const REQUESTED = '6269944419';
+const OWNER = '4311402422';
+
+function formatError(
+  providerMessage?: string,
+  providerCode?: string,
+  fallbackMessage?: string,
+  extras?: Record<string, unknown>,
+): Error {
+  const error = new Error(fallbackMessage ?? providerMessage ?? 'failed');
+  (
+    error as Error & {
+      normalizedError: {
+        code?: string;
+        message: string;
+        providerMessage?: string;
+        conflict?: Record<string, string>;
+      };
+    }
+  ).normalizedError = {
+    code: providerCode,
+    message: fallbackMessage ?? 'failed',
+    providerMessage,
+    conflict: extras?.conflict as Record<string, string> | undefined,
+  };
+  return error;
+}
+
+describe('car inquiry privacy', () => {
+  it('treats a plate/chassis record as a match only when owner national code equals the requester', () => {
+    expect(isCarOwnershipMatch(REQUESTED, { NtnlId: OWNER })).toBe(false);
+    expect(isCarOwnershipMatch(OWNER, { NtnlId: OWNER })).toBe(true);
+    expect(isCarOwnershipMatch(REQUESTED, {})).toBe(false);
+  });
+
+  it('never puts the real owner national code on a mismatch error', () => {
+    const error = createCarOwnershipMismatchError(formatError);
+    const payload = (error as Error & { normalizedError: unknown }).normalizedError;
+
+    expect(publicErrorLeaksNationalCode(payload, OWNER)).toBe(false);
+    expect(payload).toMatchObject({
+      code: 'INQUIRY_NO_MATCH',
+      message: 'Inquiry returned no matching result',
+    });
+    expect((payload as { conflict?: unknown }).conflict).toBeUndefined();
+  });
+
+  it('throws the same generic no-match when plate belongs to someone else', () => {
+    expect(() =>
+      assertCarPolicyOwnedBy(REQUESTED, { NtnlId: OWNER, InsNam: 'سهيل حاجي زاده' }, formatError),
+    ).toThrow();
+
+    try {
+      assertCarPolicyOwnedBy(REQUESTED, { NtnlId: OWNER }, formatError);
+    } catch (error) {
+      expect(publicErrorLeaksNationalCode(error, OWNER)).toBe(false);
+      expect(JSON.stringify(error)).not.toContain('سهيل');
+    }
+  });
+});