Ship a repair command and a container

verify reports integrity problems and repair rebuilds derivatives from the
Originals, which is what makes the file layout trustworthy without a database.
The image runs TypeScript on Node 24 with no build step, writes only under
MENU_ROOT, and the provision script writes the untracked site.env using the
image's own hasher so the server needs no Node.

src/cli/repair.ts

@@ -0,0 +1,17 @@
+/**
+ * Regenerates derivatives that are missing while their Original is intact.
+ *
+ *   npm run repair
+ */
+
+import { repairSite } from '../storage/repair.ts';
+import { loadCliSite } from './site.ts';
+
+const { dataDir } = await loadCliSite();
+const report = await repairSite({ dataDir });
+
+for (const line of report.fixed) console.log(`fixed: ${line}`);
+for (const line of report.unresolved) console.error(`unresolved: ${line}`);
+console.log(`${report.fixed.length} file(s) repaired, ${report.unresolved.length} unresolved`);
+
+if (report.unresolved.length > 0) process.exitCode = 1;