fix: give Doctor the host configuration the runtime receives

`pnpm doctor` and `startApi` each read their own subset of the same
environment variables, and the subsets had drifted. Doctor never read
`S3_*` or module secrets at all, so a correctly configured installation
was told its object storage was "not configured" and every module
requiring a bucket or a secret was reported blocked -- while the runtime,
from the identical environment, bound those buckets and ran the modules.

Both executables now map the environment through one
`loadHostConfiguration(env)` in Core, which takes the environment as an
argument and never reads `process.env` itself. Validation stays with the
existing per-domain validators, so each caller keeps its own failure
behaviour: startup refuses a rejected value, Doctor reports it as a
sanitized code.

Doctor's storage option becomes raw input like its mail option, so a
half-configured provider is reported as a blocking configuration failure
instead of throwing before a report exists. The outbound-email check --
computed, counted toward the result, but absent from every rendered
section -- is now printed, and the rendered set is asserted against a
real report so a future check cannot go missing the same way.

Co-Authored-By: Claude Opus 5 <[email protected]>

docs/development/email.md

@@ -102,6 +102,10 @@ carries no value.
 A successful probe proves the relay accepts this deployment. It does **not** prove a message would
 reach an inbox — that depends on the relay's authorization policy and the domain's DNS records.
 
+Doctor reads the `EKKLESIA_SMTP_*` values through the same `loadHostConfiguration` the API
+executable uses, so the relay it reports on is the relay the runtime would use. The check is
+rendered in Doctor's own **Outbound email** section.
+
 ## Logging
 
 Transactional email carries verification links, reset links, and personal data. The transport logs