fix: give Doctor the host configuration the runtime receives

`pnpm doctor` and `startApi` each read their own subset of the same
environment variables, and the subsets had drifted. Doctor never read
`S3_*` or module secrets at all, so a correctly configured installation
was told its object storage was "not configured" and every module
requiring a bucket or a secret was reported blocked -- while the runtime,
from the identical environment, bound those buckets and ran the modules.

Both executables now map the environment through one
`loadHostConfiguration(env)` in Core, which takes the environment as an
argument and never reads `process.env` itself. Validation stays with the
existing per-domain validators, so each caller keeps its own failure
behaviour: startup refuses a rejected value, Doctor reports it as a
sanitized code.

Doctor's storage option becomes raw input like its mail option, so a
half-configured provider is reported as a blocking configuration failure
instead of throwing before a report exists. The outbound-email check --
computed, counted toward the result, but absent from every rendered
section -- is now printed, and the rendered set is asserted against a
real report so a future check cannot go missing the same way.

Co-Authored-By: Claude Opus 5 <[email protected]>

core/tests/doctor-report.test.ts

@@ -3,6 +3,7 @@ import {
   type DoctorDependencies,
   diagnoseEkklesia,
   formatDoctorReport,
+  RENDERED_DOCTOR_CHECK_IDS,
 } from "../src/diagnostics/index.js";
 import type { MigrationDatabase } from "../src/migrations/index.js";
 import type { ModuleMigrationAggregate, ModuleSchemaAggregate } from "../src/modules/index.js";
@@ -123,9 +124,37 @@ Object storage
   ✓ No module requires object storage
     0 modules declare a logical storage bucket.
 
+Outbound email
+  ○ Outbound email not configured
+    No EKKLESIA_SMTP_HOST is set. This is a complete deployment: nothing in the platform sends email yet.
+
 Result: READY WITH WARNINGS`);
   });
 
+  it("renders every check the report contains, so none can silently affect the result", async () => {
+    const report = await diagnoseEkklesia(
+      {
+        moduleDiscovery: {
+          moduleSdkVersion: "0.1.0",
+          modulesDirectory: "/not-rendered/modules",
+          platformVersion: "0.1.0",
+        },
+        runtimeRange: ">=24.11.0 <25",
+        runtimeVersion: "24.15.0",
+      },
+      noConfigurationDependencies(),
+    );
+
+    // `outbound-email.configuration` was computed, counted toward the overall result, and never
+    // printed — so a rejected SMTP setting turned an operator's report NOT READY with nothing on
+    // screen saying why. Asserting the two sets against each other is what keeps a future check
+    // from repeating it.
+    expect([...RENDERED_DOCTOR_CHECK_IDS].sort()).toEqual(
+      report.checks.map((entry) => entry.id).sort(),
+    );
+    expect(new Set(RENDERED_DOCTOR_CHECK_IDS).size).toBe(RENDERED_DOCTOR_CHECK_IDS.length);
+  });
+
   it("does not depend on NO_COLOR or terminal interactivity", async () => {
     const report = await diagnoseEkklesia(
       {