Restrict RX-7 to allowlisted UserIds (owner + son demo lock)

- GameConfig: RX7AllowedUserIds allowlist + isRX7Allowed/starterCarFor helpers
- ProfileTemplate: no hard-coded starter; granted per-player by UserId
- DataManager: grants RX-7 to allowlisted players, public car to everyone else
- Economy.buyCar + CarManager.spawn: server-side refuse RX-7 for non-allowlisted
- Cars: RX-7 flagged Restricted; client dealership hides it from non-owners
- Gates: stylua clean, selene 0/0, rojo builds

src/server/DataManager.luau

@@ -71,6 +71,22 @@ local function onPlayerAdded(player: Player)
 	profile:AddUserId(player.UserId) -- GDPR-friendly association
 	profile:Reconcile() -- fill missing template keys
 
+	-- Grant the correct starter car for THIS player (RX-7 only for allowlisted
+	-- UserIds; everyone else gets the public starter). Idempotent: only grants
+	-- if the player has no cars yet (i.e. genuinely first join).
+	local data = profile.Data
+	if #data.OwnedCars == 0 then
+		local starterId = GameConfig.starterCarFor(player.UserId)
+		table.insert(data.OwnedCars, {
+			Id = starterId,
+			Upgrades = { Engine = 0, Tires = 0, Nitro = 0 },
+		})
+		data.EquippedCarId = starterId
+	elseif data.EquippedCarId == "" then
+		-- Safety: if somehow they own cars but have nothing equipped, equip the first.
+		data.EquippedCarId = data.OwnedCars[1].Id
+	end
+
 	profile.OnSessionEnd:Connect(function()
 		-- The session was lost (another server stole it, or we released it).
 		profiles[player] = nil