fix: give Doctor the host configuration the runtime receives

`pnpm doctor` and `startApi` each read their own subset of the same
environment variables, and the subsets had drifted. Doctor never read
`S3_*` or module secrets at all, so a correctly configured installation
was told its object storage was "not configured" and every module
requiring a bucket or a secret was reported blocked -- while the runtime,
from the identical environment, bound those buckets and ran the modules.

Both executables now map the environment through one
`loadHostConfiguration(env)` in Core, which takes the environment as an
argument and never reads `process.env` itself. Validation stays with the
existing per-domain validators, so each caller keeps its own failure
behaviour: startup refuses a rejected value, Doctor reports it as a
sanitized code.

Doctor's storage option becomes raw input like its mail option, so a
half-configured provider is reported as a blocking configuration failure
instead of throwing before a report exists. The outbound-email check --
computed, counted toward the result, but absent from every rendered
section -- is now printed, and the rendered set is asserted against a
real report so a future check cannot go missing the same way.

Co-Authored-By: Claude Opus 5 <[email protected]>

core/tests/doctor.test.ts

@@ -1378,7 +1378,7 @@ describe("Ekklesia Doctor — object storage", () => {
     });
 
     const report = await diagnoseEkklesia(
-      { ...options(databaseUrl), storage: storageConfig },
+      { ...options(databaseUrl), storageConfiguration: storageConfig },
       services,
     );
     const bindings = check(report, "object-storage.bindings");
@@ -1398,7 +1398,7 @@ describe("Ekklesia Doctor — object storage", () => {
     });
 
     const report = await diagnoseEkklesia(
-      { ...options(databaseUrl), storage: storageConfig },
+      { ...options(databaseUrl), storageConfiguration: storageConfig },
       services,
     );
     const integration = check(report, "object-storage.integration");
@@ -1420,7 +1420,7 @@ describe("Ekklesia Doctor — object storage", () => {
     });
 
     const report = await diagnoseEkklesia(
-      { ...options(databaseUrl), storage: storageConfig },
+      { ...options(databaseUrl), storageConfiguration: storageConfig },
       services,
     );
     const integration = check(report, "object-storage.integration");
@@ -1448,7 +1448,7 @@ describe("Ekklesia Doctor — object storage", () => {
     });
 
     const report = await diagnoseEkklesia(
-      { ...options(databaseUrl), storage: storageConfig },
+      { ...options(databaseUrl), storageConfiguration: storageConfig },
       services,
     );