feat: fill the delivery address from the CEP and quote freight as it is typed

A complete CEP now looks up its address on the server (ViaCEP, rate
limited, keeping the Site's CSP to its own origin) and fills street,
district, city and state, moving the cursor to the first field left, and
quotes the freight without pressing Calcular. The CEP keeps its mask when
the cart is restored. Freight and its delivery time appear in the order
summary instead of a line under the CEP, the delivery option says it ships
with Jadlog, and the address reminder is a hint rather than an error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/api/health.py

@@ -1,6 +1,8 @@
-"""Health, session bootstrap and freight quoting."""
+"""Health, session bootstrap, freight quoting and the address of a CEP."""
 import os
+import re
 
+import httpx
 from fastapi import APIRouter, HTTPException, Request, Response
 
 from ..core import db
@@ -48,3 +50,23 @@ def quote_freight(body: FreightEstimate):
         return freight.quote(body.service, body.postal_code, body.metres, body.declared_cents)
     except ValueError as exc:
         raise HTTPException(422, str(exc))
+
+# The address of a CEP, so the cart fills it in. Looked up here rather than in
+# the browser, which keeps the Site's CSP to its own origin.
+VIACEP = 'https://viacep.com.br/ws/{}/json/'
+CEP_LIMIT = 120
+
+@router.get('/api/cep/{cep}')
+def cep_address(cep: str, request: Request):
+    if not re.fullmatch(r'[0-9]{8}', cep):
+        raise HTTPException(422, 'CEP must have eight digits')
+    rate_limit('cep-lookup', client_ip(request), CEP_LIMIT, 900)
+    try:
+        response = httpx.get(VIACEP.format(cep), timeout=5)
+        data = response.json() if response.status_code == 200 else {}
+    except (httpx.HTTPError, ValueError):
+        raise HTTPException(503, 'Consulta de CEP indisponível')
+    if not data or data.get('erro'):
+        raise HTTPException(404, 'CEP não encontrado')
+    return {'street': data.get('logradouro') or '', 'district': data.get('bairro') or '',
+            'city': data.get('localidade') or '', 'state': data.get('uf') or ''}