fix(vehicles): make decoded vehicles readable by any authenticated user

Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877

repro.mjs

@@ -0,0 +1,31 @@
+import { chromium } from "playwright";
+
+const VEHICLE_ID = "ac846487-8bc9-484b-ad36-35e68bf5f955";
+const CATEGORY_ID = "f15c3c5f-f3b0-47bf-985d-cf9b9c0ff760";
+
+const browser = await chromium.launch({ headless: true });
+const ctx = await browser.newContext();
+const page = await ctx.newPage();
+
+await page.request.post("https://dev.sase.tr/api/auth/sign-in/email", {
+  data: { email: "admin@sase.tr", password: "Sase2026" },
+});
+
+page.on("response", async (r) => {
+  const u = r.url();
+  if (u.includes("/api/") && (u.includes("categories") || u.includes("vehicles"))) {
+    let body = "";
+    try { body = (await r.text()).slice(0, 400); } catch {}
+    console.log(`${r.status()} ${u.replace("https://dev.sase.tr","")}\n  → ${body}\n`);
+  }
+});
+
+await page.goto(`https://dev.sase.tr/dashboard/vehicles/${VEHICLE_ID}/categories/${CATEGORY_ID}`, { waitUntil: "networkidle" });
+await page.waitForTimeout(3000);
+
+console.log("--- final URL:", page.url());
+const body = await page.evaluate(() => document.body.innerText);
+console.log("error visible:", /hata|yuklenir|yüklenir/i.test(body));
+console.log("text excerpt:", body.split("\n").filter(l => l.trim()).slice(0, 10).join(" | "));
+
+await browser.close();