feat(cli): add mem doctor diagnostic command

[sun-970]

Summary

• Add mem doctor read-only CLI diagnostic command that checks server reachability, credential presence, workspace selection, and CLI/server version skew
• Support --format text|json output with mem.doctor/v1 schema version; always exits 0 per Approved Scope
• Each check result includes name, code, status, message, and hint fields (AC-001)
• All "not logged in" hints across 16 command files now name the deploy/compose/ path (REQ-002)
• Golden file validates JSON output shape (AC-003)
• Write-guard transport test proves no non-GET requests are issued (AC-002)
• All error paths fail closed without leaking URLs, tokens, or raw error values

Closes #112

Acceptance Criteria Coverage

AC	Status	Evidence
AC-001: Fixture per finding class	✅	TestDoctorServerUnreachable, TestDoctorNoCredentials, TestDoctorNoWorkspace, TestDoctorVersionSkew — each asserts named check, code, and hint
AC-002: No write requests	✅	TestDoctorPerformsNoWriteRequests — stub transport fails test on any non-GET call
AC-002: Never prints secrets	✅	TestDoctorNoSecretsInTextOutput, TestDoctorMalformedServerURL, TestDoctorServerReturnsNon200Healthz — assert no token/URL/error body leakage
AC-003: Golden file	✅	TestDoctorJSONMatchesGoldenFile validates against testdata/doctor-golden.json

Test plan

• go test ./cmd/mem/ -run TestDoctor — 16 doctor tests pass
• go test ./cmd/mem/ — full CLI suite passes (no regressions)
• go vet ./cmd/mem/ — clean
• go build ./cmd/mem/ — builds successfully
• CI passes

[waterbro-8]

Closing under the fork-workflow decision recorded on 2026-09-03: repository
automation is not being enabled for fork pull requests, so a fork head cannot
carry a CI result, and every acceptance gate in this repository is written
against checks that ran. Nothing in this comment is a judgment that the work is
wrong; where it is right, it is re-landed on an organization branch instead.

#112, with #131 as the organization-branch candidate.

Both branches add the same surface — server/cmd/mem/cmds_doctor.go plus a test
file of comparable size — so this is a duplicate of #131 rather than a complement
to it, and #131 is the one sitting on a branch that can be given a check result.

The state of that replacement, so nobody leaves here assuming #112 is covered:
#131 is still a draft, and its base 731a4680 (2026-08-31) is four commits
behind main@1332bf46. It needs a rebase and an independent review before #112
has anything implemented.

The commits are not lost. A closed fork PR keeps its head ref:

git fetch https://github.com/bytefolk/mem.git refs/pull/149/head:pr-149

Every file in this branch was therefore available to the re-doing work, whether
or not it was used.