feat(cli): add mem doctor diagnostic command

CHANGELOG.md

@@ -7,8 +7,19 @@ The project publishes 0.x prerelease versions; a stable release line is not yet
 
 ## [Unreleased]
 
+### Added
+
+- `mem doctor` read-only diagnostic command that checks server reachability,
+  credential presence, workspace selection, and CLI/server version skew. Supports
+  `--format text|json` output with `mem.doctor/v1` schema. Performs no writes and
+  installs no dependencies (`#112`).
+
 ### Changed
 
+- All CLI commands that require authentication now include the documented
+  `deploy/compose/` deployment path in their "not logged in" hint, directing
+  first-run users to the recommended container deployment (`#112` REQ-002).
+
 - Migrate GitHub repository, Release, issue, badge, and raw-content coordinates
   to the canonical `bytefolk` organization while retaining the published npm
   scope, MCP identity, and existing cache paths.

server/cmd/mem/client.go

@@ -24,6 +24,14 @@ func newCliError(code int, msg, hint string) *cliError {
 	return &cliError{code: code, msg: msg, hint: hint}
 }
 
+// errNotLoggedIn returns the standard auth error for unauthenticated CLI use.
+// The hint names the documented deploy/compose path so first-run users are
+// directed to the recommended container deployment (#112 REQ-002).
+func errNotLoggedIn() *cliError {
+	return newCliError(3, "not logged in",
+		"run `mem auth login`; see deploy/compose/ for the recommended deployment path")
+}
+
 // fromAPIError maps an *apiclient.APIError to a *cliError with the SPEC §7.1
 // exit code. Any other error is returned unchanged.
 func fromAPIError(err error) error {

server/cmd/mem/cmds_auth.go

@@ -132,7 +132,7 @@ func newAuthStatusCmd() *cobra.Command {
 				return err
 			}
 			if cfg.Token == "" {
-				return newCliError(3, "not logged in", "run `mem auth login` first")
+				return errNotLoggedIn()
 			}
 
 			var capabilities struct {
@@ -241,7 +241,7 @@ func newTokenCreateCmd() *cobra.Command {
 				return err
 			}
 			if cfg.Token == "" {
-				return newCliError(3, "not logged in", "run `mem auth login` first")
+				return errNotLoggedIn()
 			}
 			scopeList := splitCommas(scopes)
 			body := map[string]any{

server/cmd/mem/cmds_auth_test.go

@@ -162,7 +162,7 @@ func TestAuthStatusWithoutTokenReturnsAuthExitCode(t *testing.T) {
 	if !errors.As(err, &cliErr) {
 		t.Fatalf("error type = %T, want *cliError", err)
 	}
-	if cliErr.code != 3 || cliErr.hint != "run `mem auth login` first" {
+	if cliErr.code != 3 || cliErr.hint != "run `mem auth login`; see deploy/compose/ for the recommended deployment path" {
 		t.Fatalf("cli error = %#v", cliErr)
 	}
 }

server/cmd/mem/cmds_context.go

@@ -82,7 +82,7 @@ Examples:
 				return err
 			}
 			if cfg.Token == "" {
-				return newCliError(3, "not logged in", "run `mem auth login` first")
+				return errNotLoggedIn()
 			}
 			body := map[string]any{"query": strings.Join(args, " ")}
 			if scope != "" {