Slice 11: jotsmith doctor --repair + --json

[MaxAnderson95]

What to build

Add the side-effectful and machine-readable variants of doctor per PRD §6.6:

• --repair: autofix every FAIL the tool knows how to fix in place
• --json: machine-readable output for agents

Reuses the upload paths from setup (#6).

Acceptance criteria

• --repair re-uploads the discovery doc and JWKS when they are missing, malformed, or don't match what would be computed now
• --repair re-enables static website hosting if it was disabled
• FAILs that require human action are printed but not fixed:
  • KV in legacy access-policy mode
  • SA PrimaryEndpoints.Web mismatch with config issuer — the user is told to use setup --force-issuer-rewrite (this is the flag introduced in Slice 6: jotsmith setup #6's AC)
• --json emits a single JSON object on stdout: {"checks":[{name, status, message, repaired?}], "summary":{"pass": N, "warn": N, "fail": N, "repaired": N}}; the pretty stderr report is suppressed in --json mode
• --json and --repair may be combined; the JSON shows which checks were repaired
• Exit codes: 0 if all checks are PASS or WARN after any repairs; 1 if any FAIL remains
• Integration test exercises a re-upload-after-deletion scenario behind //go:build integration

Blocked by

• Slice 6: jotsmith setup #6 — setup

Originally created in OpenCode session ID: ses_17ca8efd8ffexLcFSysAMDVNBQ

[MaxAnderson95]

Implemented and merged in #14.

Originally created in OpenCode session ID: ses_17c986ef9ffeHc0S3r1wQcmLDT