M1: implement operational core

Demo auth, seed import/reset, dashboard, vehicle/booking list+detail, audit trail. Backend: 19 tests passing, ruff clean. Frontend: React Router shell, typed API client, responsive pages. Verified end-to-end via curl and browser.

backend/tests/test_vehicles.py

@@ -0,0 +1,27 @@
+def test_list_vehicles_filters_by_status(ops_client):
+    response = ops_client.get("/api/v1/vehicles", params={"status": "maintenance"})
+    assert response.status_code == 200
+    vehicles = response.json()
+    assert len(vehicles) > 0
+    assert all(v["operational_status"] == "maintenance" for v in vehicles)
+
+
+def test_attention_only_filters_flagged_vehicles(ops_client):
+    response = ops_client.get("/api/v1/vehicles", params={"attention_only": True})
+    assert response.status_code == 200
+    vehicles = response.json()
+    assert len(vehicles) > 0
+    assert all(v["attention"] for v in vehicles)
+
+
+def test_vehicle_detail_includes_related_records(ops_client):
+    response = ops_client.get("/api/v1/vehicles/MO-016")
+    assert response.status_code == 200
+    body = response.json()
+    assert body["public_ref"] == "MO-016"
+    assert len(body["quality_issues"]) >= 1
+
+
+def test_vehicle_detail_404_for_unknown_ref(ops_client):
+    response = ops_client.get("/api/v1/vehicles/MO-999")
+    assert response.status_code == 404