feat(07-02): InboxProvider interface + config/vehicle/history DTOs

- inbox-provider.interface.ts: InboxProvider contract with fetchPdfAttachments + testConnection; re-exports InboxConfig/InboxEmail/InboxAttachment with export type (isolatedModules)
- dkv-config.dto.ts: DkvConfigDto with @IsEmail() senderFilter/exportRecipient, @Min(5) pollIntervalMin, @IsIn() protocol/encryption (T-07-04)
- dkv-vehicle.dto.ts: CreateVehicleDto (all required @IsNotEmpty) + UpdateVehicleDto (all optional)
- dkv-history.dto.ts: DkvHistoryQueryDto with @IsInt @Min(1) page/limit pagination (T-07-06)
- Fix: export type re-exports required for isolatedModules TypeScript setting

apps/api/src/dkv/providers/inbox-provider.interface.ts

@@ -0,0 +1,32 @@
+import { InboxAttachment, InboxConfig, InboxEmail } from '../dkv.types';
+
+// Re-export types for downstream consumers that import from this module
+export type { InboxAttachment, InboxConfig, InboxEmail };
+
+/**
+ * Abstract inbox provider contract — implemented by ImapProvider and
+ * ExchangeInboxProvider. Consumers (DkvService, DkvSchedulerService) depend
+ * only on this interface, not on the concrete implementations.
+ *
+ * Security:
+ * - T-07-03: Implementations MUST NOT log credential values
+ * - InboxConfig carries decrypted credentials — never persist, never serialize
+ */
+export interface InboxProvider {
+  /**
+   * Connects to the configured inbox, searches for emails from the configured
+   * sender filter, downloads PDF attachments, and returns all matching emails.
+   *
+   * @param config  Decrypted inbox connection parameters
+   * @returns       Array of emails with their PDF attachments as Buffers
+   */
+  fetchPdfAttachments(config: InboxConfig): Promise<InboxEmail[]>;
+
+  /**
+   * Tests whether the inbox connection can be established.
+   *
+   * @param config  Decrypted inbox connection parameters
+   * @returns       true if connection succeeded, false on any auth/network error
+   */
+  testConnection(config: InboxConfig): Promise<boolean>;
+}