Move KYC documents behind private Blob access

[BigDella]

What changed

• upload encrypted KYC documents only to a private Vercel Blob store
• retrieve private objects server-side through the authenticated document proxy
• retain an explicit compatibility path for inventoried legacy public objects
• add a dry-run/migration command that moves records, rewrites references, optionally revokes public blobs, and emits a JSONL audit inventory
• keep public vehicle imagery unchanged

Why

Encryption alone did not prevent anonymous ciphertext harvesting because KYC objects were written to public storage.

Validation

• KYC private-storage policy tests: 3 passed
• changed-file typecheck scan: no errors in this diff; the repository-wide baseline still has unrelated failures

Closes #175

[Obiajulu-gif]

Thanks for the contribution! Merging this now as part of a maintainer PR sweep.