feat: add begin repair workflow

backend/app/identity.py

@@ -674,6 +674,8 @@ def machine_agent_request(path: str) -> bool:
 def required_api_permission(method: str, path: str) -> str | None:
     if path.startswith("/api/admin/"):
         return "users.manage"
+    if method == "POST" and path == "/api/repairs":
+        return "repairs.create"
     if method == "GET":
         if path.startswith("/api/system/"):
             return "system_health.view"