[SECURITY][FLEET DOCUMENTS] Store vehicle uploads privately with authorized retrieval

[Obiajulu-gif]

Summary

Administrator vehicle uploads are written to publicly accessible blob URLs and the raw blob response is returned. Registration, insurance, inspection, or ownership images can therefore bypass application authorization.

Repository evidence

• app/api/upload/route.ts:180-187 writes vehicle files with access: "public" and returns the blob object.
• The KYC path in the same route uses an application-controlled document record, showing the missing boundary for fleet files.

Scope

• Use private storage references and a fleet-document download route with role/resource authorization.
• Persist ownership, purpose, checksum, retention, and access audit metadata.

Acceptance criteria

• Direct public URLs cannot retrieve fleet documents.
• Authorized reads are no-store and auditable.

Tests

• Cover admin upload/read, unauthorized access, expired/deleted records, and guessed storage keys.

Non-goals

• Changing vehicle image presentation for deliberately public marketing assets.

[JONAH-6]

I have experience with TypeScript and secure file storage. I’ll move fleet documents to private storage, add authorized retrieval with audit metadata, and test admin access, unauthorized requests, expired/deleted records, and guessed storage keys.