Restrict RX-7 to allowlisted UserIds (owner + son demo lock)

- GameConfig: RX7AllowedUserIds allowlist + isRX7Allowed/starterCarFor helpers
- ProfileTemplate: no hard-coded starter; granted per-player by UserId
- DataManager: grants RX-7 to allowlisted players, public car to everyone else
- Economy.buyCar + CarManager.spawn: server-side refuse RX-7 for non-allowlisted
- Cars: RX-7 flagged Restricted; client dealership hides it from non-owners
- Gates: stylua clean, selene 0/0, rojo builds

src/server/CarManager.luau

@@ -19,6 +19,7 @@ local ReplicatedStorage = game:GetService("ReplicatedStorage")
 
 local Shared = ReplicatedStorage.Shared
 local Cars = require(Shared.Cars)
+local GameConfig = require(Shared.GameConfig)
 local ProfileTemplate = require(Shared.ProfileTemplate)
 local DataManager = require(script.Parent.DataManager)
 
@@ -125,6 +126,11 @@ function CarManager.spawn(player: Player, carId: string?)
 	if not car then
 		return
 	end
+	-- Defense in depth: never spawn the restricted RX-7 for a non-allowlisted user,
+	-- even if their save somehow contained it.
+	if car.Id == GameConfig.RestrictedStarterCarId and not GameConfig.isRX7Allowed(player.UserId) then
+		return
+	end
 	-- Only spawn cars the player owns (anti-cheat: no spawning unowned exotics).
 	local owned
 	for _, o in ipairs(data.OwnedCars) do