feat: [vehicle] 법인차량 사진 API 추가

- CorporateVehicle 모델 (photos 관계 포함)
- VehiclePhotoService (R2 저장, 최대 10장 제한)
- VehiclePhotoController (index/store/destroy)
- StoreVehiclePhotoRequest (동적 max 검증)
- finance.php 라우트 등록

app/Http/Controllers/Api/V1/VehiclePhotoController.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Helpers\ApiResponse;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Finance\StoreVehiclePhotoRequest;
+use App\Services\Finance\VehiclePhotoService;
+use Illuminate\Http\JsonResponse;
+
+class VehiclePhotoController extends Controller
+{
+    public function __construct(private readonly VehiclePhotoService $service) {}
+
+    public function index(int $id): JsonResponse
+    {
+        return ApiResponse::handle(
+            fn () => $this->service->index($id),
+            __('message.fetched')
+        );
+    }
+
+    public function store(StoreVehiclePhotoRequest $request, int $id): JsonResponse
+    {
+        return ApiResponse::handle(
+            fn () => $this->service->store($id, $request->file('files')),
+            __('message.created')
+        );
+    }
+
+    public function destroy(int $id, int $fileId): JsonResponse
+    {
+        return ApiResponse::handle(
+            fn () => $this->service->destroy($id, $fileId),
+            __('message.deleted')
+        );
+    }
+}

app/Http/Requests/Finance/StoreVehiclePhotoRequest.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Http\Requests\Finance;
+
+use App\Models\Commons\File;
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreVehiclePhotoRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        $vehicleId = $this->route('id');
+        $currentCount = File::where('document_id', $vehicleId)
+            ->where('document_type', 'corporate_vehicle')
+            ->whereNull('deleted_at')
+            ->count();
+
+        $maxFiles = 10 - $currentCount;
+
+        return [
+            'files' => ['required', 'array', 'min:1', "max:{$maxFiles}"],
+            'files.*' => [
+                'required',
+                'file',
+                'mimes:jpg,jpeg,png,gif,bmp,webp',
+                'max:10240', // 10MB
+            ],
+        ];
+    }
+
+    public function attributes(): array
+    {
+        return [
+            'files' => '사진 파일',
+            'files.*' => '사진 파일',
+        ];
+    }
+
+    public function messages(): array
+    {
+        return [
+            'files.required' => __('error.file.required'),
+            'files.max' => __('error.vehicle.photo_limit_exceeded'),
+            'files.*.mimes' => __('error.file.invalid_type'),
+            'files.*.max' => __('error.file.size_exceeded'),
+        ];
+    }
+}

app/Models/Finance/CorporateVehicle.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Models\Finance;
+
+use App\Models\Commons\File;
+use App\Traits\BelongsToTenant;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\SoftDeletes;
+
+class CorporateVehicle extends Model
+{
+    use BelongsToTenant, SoftDeletes;
+
+    protected $table = 'corporate_vehicles';
+
+    protected $fillable = [
+        'tenant_id',
+        'plate_number',
+        'model',
+        'vehicle_type',
+        'ownership_type',
+        'mileage',
+        'options',
+        'is_active',
+    ];
+
+    protected $casts = [
+        'mileage' => 'integer',
+        'options' => 'array',
+        'is_active' => 'boolean',
+    ];
+
+    public function photos(): HasMany
+    {
+        return $this->hasMany(File::class, 'document_id')
+            ->where('document_type', 'corporate_vehicle')
+            ->orderBy('id');
+    }
+}

app/Services/Finance/VehiclePhotoService.php

@@ -0,0 +1,124 @@
+<?php
+
+namespace App\Services\Finance;
+
+use App\Models\Commons\File;
+use App\Models\Finance\CorporateVehicle;
+use App\Services\Service;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Storage;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+class VehiclePhotoService extends Service
+{
+    private const MAX_PHOTOS = 10;
+
+    public function index(int $vehicleId): array
+    {
+        $vehicle = $this->getVehicle($vehicleId);
+
+        return $vehicle->photos->map(fn ($file) => $this->formatFileResponse($file))->values()->toArray();
+    }
+
+    /**
+     * @param  UploadedFile[]  $files
+     */
+    public function store(int $vehicleId, array $files): array
+    {
+        $vehicle = $this->getVehicle($vehicleId);
+        $tenantId = $this->tenantId();
+        $userId = $this->apiUserId();
+
+        $currentCount = File::where('document_id', $vehicleId)
+            ->where('document_type', 'corporate_vehicle')
+            ->whereNull('deleted_at')
+            ->count();
+
+        if ($currentCount + count($files) > self::MAX_PHOTOS) {
+            throw new \Exception(__('error.vehicle.photo_limit_exceeded'));
+        }
+
+        $uploaded = [];
+
+        foreach ($files as $uploadedFile) {
+            $extension = $uploadedFile->getClientOriginalExtension();
+            $storedName = bin2hex(random_bytes(8)).'.'.$extension;
+            $displayName = $uploadedFile->getClientOriginalName();
+
+            $year = date('Y');
+            $month = date('m');
+            $directory = sprintf('%d/corporate-vehicles/%s/%s', $tenantId, $year, $month);
+            $filePath = $directory.'/'.$storedName;
+
+            Storage::disk('r2')->putFileAs($directory, $uploadedFile, $storedName);
+
+            $mimeType = $uploadedFile->getMimeType();
+
+            $file = File::create([
+                'tenant_id' => $tenantId,
+                'display_name' => $displayName,
+                'stored_name' => $storedName,
+                'file_path' => $filePath,
+                'file_size' => $uploadedFile->getSize(),
+                'mime_type' => $mimeType,
+                'file_type' => 'image',
+                'document_id' => $vehicleId,
+                'document_type' => 'corporate_vehicle',
+                'is_temp' => false,
+                'uploaded_by' => $userId,
+                'created_by' => $userId,
+            ]);
+
+            $uploaded[] = $this->formatFileResponse($file);
+        }
+
+        return $uploaded;
+    }
+
+    public function destroy(int $vehicleId, int $fileId): array
+    {
+        $tenantId = $this->tenantId();
+        $userId = $this->apiUserId();
+
+        $file = File::where('tenant_id', $tenantId)
+            ->where('document_id', $vehicleId)
+            ->where('document_type', 'corporate_vehicle')
+            ->where('id', $fileId)
+            ->first();
+
+        if (! $file) {
+            throw new NotFoundHttpException(__('error.file.not_found'));
+        }
+
+        $file->softDeleteFile($userId);
+
+        return [
+            'file_id' => $fileId,
+            'deleted' => true,
+        ];
+    }
+
+    private function getVehicle(int $vehicleId): CorporateVehicle
+    {
+        $vehicle = CorporateVehicle::find($vehicleId);
+
+        if (! $vehicle) {
+            throw new NotFoundHttpException(__('error.vehicle.not_found'));
+        }
+
+        return $vehicle;
+    }
+
+    private function formatFileResponse(File $file): array
+    {
+        return [
+            'id' => $file->id,
+            'file_name' => $file->display_name,
+            'file_path' => $file->file_path,
+            'file_url' => url("/api/v1/files/{$file->id}/download"),
+            'file_size' => $file->file_size,
+            'mime_type' => $file->mime_type,
+            'created_at' => $file->created_at?->format('Y-m-d H:i:s'),
+        ];
+    }
+}

routes/api/v1/finance.php

@@ -42,6 +42,7 @@
 use App\Http\Controllers\Api\V1\TaxInvoiceController;
 use App\Http\Controllers\Api\V1\TodayIssueController;
 use App\Http\Controllers\Api\V1\VatController;
+use App\Http\Controllers\Api\V1\VehiclePhotoController;
 use App\Http\Controllers\Api\V1\VendorLedgerController;
 use App\Http\Controllers\Api\V1\WelfareController;
 use App\Http\Controllers\Api\V1\WithdrawalController;
@@ -396,6 +397,13 @@
     Route::delete('/{id}', [AccountSubjectController::class, 'destroy'])->whereNumber('id')->name('v1.account-subjects.destroy');
 });
 
+// Corporate Vehicle Photo API (법인차량 사진)
+Route::prefix('corporate-vehicles')->group(function () {
+    Route::get('/{id}/photos', [VehiclePhotoController::class, 'index'])->whereNumber('id')->name('v1.corporate-vehicles.photos.index');
+    Route::post('/{id}/photos', [VehiclePhotoController::class, 'store'])->whereNumber('id')->name('v1.corporate-vehicles.photos.store');
+    Route::delete('/{id}/photos/{fileId}', [VehiclePhotoController::class, 'destroy'])->whereNumber(['id', 'fileId'])->name('v1.corporate-vehicles.photos.destroy');
+});
+
 // Bill API (어음관리)
 Route::prefix('bills')->group(function () {
     Route::get('', [BillController::class, 'index'])->name('v1.bills.index');