Validate material requests before creating work orders

Work order creation API now validates read permission and enforces Material Request type and status restrictions.