Add ORDS v0.3 repair data export endpoint - #58

devices.problem is unsanitised free text with no Purify mutator, so it can
carry raw HTML, email addresses, phone numbers and URLs with tracking
parameters. Redaction is a standalone pass rather than logic inside the
mapper so it can be toggled, tested against fixtures and audited on its own,
and it reports per-run counts by type so an export can be checked before
handover.

Every pass fails closed: a regex error yields an empty string rather than
leaking the unredacted original. The phone heuristic uses a nine-digit floor
to keep hyphenated substance such as rpm ranges, part numbers and firmware
versions intact.

Emits the fourteen standard columns in spec order. Most map straight across
because the standard was derived from this schema, but three need work:
year_of_manufacture is not stored so it is derived from the event year minus
the item age, country needs alpha-3, and product_category_id needs a name
lookup because our idcategories do not match the published ones.

Vocabulary handling follows the Open Repair Alliance's published releases
rather than the table schema, which is stale in two places: the standard
collapses our screen-size and laptop-size splits into single categories,
repair_status carries Unknown as a real value, and the barrier wording drops
the "the" we seed.

Holds the instance identity and the vocabulary maps in config rather than a
database table so a change shows up in a diff and is versioned alongside the
standard it tracks.

id_prefix and data_provider are deliberately undefaulted. The identifier is
a stable key the consumer upserts on across releases, so serving under an
unassigned or borrowed namespace would overwrite another provider's records;
the endpoint refuses to serve while either is blank.

Adds GET /api/public/v2/repairs behind a new repairs:read scope, serving
JSON or CSV with filters for update time, event window, powered category and
pagination. The per-page ceiling is 1000 rather than the events endpoint's
100 because this is a bulk export rather than a display API.

Visibility mirrors PublicEventController: approved events on approved
groups, soft-deleted rows excluded, and allowed_network_ids honoured. The
network restriction is a subquery rather than a join so a group belonging to
several permitted networks does not multiply its devices.

The feature flag moves from the shared public/v2 group onto each scope so
the export can ship dark without taking the live events API down with it.

CSV output escapes cells opening with a formula character, which spreadsheet
software would otherwise execute on open, and carries the pagination and
sync metadata in headers since the format has no envelope for it.

Documented in docs/public-repairs-api.md alongside the events API.

repairs:read is the first scope beyond events:read, so the option help now
lists the valid values instead of only showing the default.

Covers the auth surface including an events:read token being refused on
repairs and the reverse, the feature flag in both directions, the config
guards, all fourteen columns against a fixture, CSV column order and
formula escaping, visibility exclusions, network restriction, filters,
pagination and the redaction passes.

Ships every value blank or off. The identity settings are per deployment
rather than defaulted in the chart, and the endpoint refuses to serve until
an instance sets them.

filter_var maps both "" and null to false rather than firing
FILTER_NULL_ON_FAILURE, so a request for ?powered= merged false, passed
the nullable|boolean rule, and narrowed the export to unpowered items.
The docs tell callers to omit the parameter for both datasets, and an
empty parameter is how plenty of clients spell an omitted one.

The CSV response carries its pagination metadata in X-Total-Count,
X-Page, X-Per-Page, X-Last-Page and X-Max-Updated-At, and the docs
advertise both those headers and CORS. Without an expose list a
cross-origin caller receives the body and none of the headers, so it
cannot tell when it has reached the last page.

This also applies to the events endpoint, which shares the middleware.

Enabling the export and publishing volunteer free text were a single
switch, so flipping FEATURE__PUBLIC_REPAIRS_API also published the
problem column. The scrubber removes contact details and identifiers but
cannot remove personal names, and the licensing question on that text is
still open, so it now takes a deliberate opt-in.

The config default moves with the chart, otherwise an instance that
never sets the variable still publishes the column.