feat(fulfillment): bundle/exclusion enforcement + REQUIRED_FIELDS + intake wiring (Phases 1/1.5/2)

- compliance-orders: hazmat-phmsa/state-emissions products, full REQUIRED_FIELDS
  table for all DOT/state/hazmat slugs, BUNDLE_COMPONENTS dedup + MUTUALLY_EXCLUSIVE
  enforcement on /batch (single source of truth, exported)
- checkout: empty ADMIN_ASSISTED_SLUGS (state/hazmat now get intake links)
- services/__init__: register HazmatPHMSAHandler + state-emissions handler
- state_trucking: _summarize_intake admin-todo enrichment
- Wizard: wire StateTruckingIntakeStep + step labels

api/src/routes/checkout.ts

@@ -2066,15 +2066,11 @@ async function sendComplianceIntakeEmail(
       </p>
     </div>` : "";
 
-  // Fully admin-assisted services — NO customer intake form (state-level filings
-  // collected by ops). Everything else (FCC + federal DOT: MCS-150, BOC-3, UCR,
-  // authority, D&A, audit, etc.) now has a customer intake page and gets a link.
-  const ADMIN_ASSISTED_SLUGS = new Set([
-    "irp-registration", "ifta-application", "ifta-quarterly",
-    "or-weight-mile-tax", "ny-hut-registration", "ky-kyu-registration",
-    "nm-weight-distance", "ct-highway-use-fee", "ca-mcp-carb",
-    "state-dot-registration", "intrastate-authority", "osow-permit",
-    "state-trucking-bundle",
+  // Fully admin-assisted services with NO customer intake form. State-level
+  // trucking + hazmat/emissions now have a dedicated intake step, so they are
+  // NO LONGER in this set — customers get an intake link like other services.
+  const ADMIN_ASSISTED_SLUGS = new Set<string>([
+    // (reserved for any future no-intake services)
   ]);
   const dotOrders = orders.filter(o => ADMIN_ASSISTED_SLUGS.has(o.service_slug as string));
   const fccOrders = orders.filter(o => !ADMIN_ASSISTED_SLUGS.has(o.service_slug as string));