feat(cli): 'config check' subcommand (U10a tail, KTD16/17 minimal)

- server config check: load + validate + masked summary; exit 1 on issues
- no side effects: creates no DB, starts nothing, writes no business dirs
- Config.Check() (production secrets, port range, data dir) exported for
  reuse; MaskedSummary never prints credential values
- default no-arg invocation unchanged (serve); help added
- smoke-verified: pass exit 0, invalid port exit 1 with issue line
- layer-source attribution (config explain) deferred to U10b ConfigSnapshot

cmd/server/main.go

@@ -19,6 +19,22 @@ import (
 )
 
 func main() {
+	// KTD16：同一程序提供运维子命令；默认（无子命令）保持 serve 行为不变。
+	if len(os.Args) > 1 {
+		switch os.Args[1] {
+		case "config":
+			if len(os.Args) > 2 && os.Args[2] == "check" {
+				configCheck(os.Args[3:])
+				return
+			}
+			fmt.Fprintln(os.Stderr, "用法: server config check [--env path] [--port N] [--host H] [--backend name]")
+			os.Exit(2)
+		case "-h", "--help", "help":
+			fmt.Println("用法: server [serve flags]        启动服务（默认）\n      server config check [flags]  加载并校验配置（脱敏摘要，无副作用）")
+			return
+		}
+	}
+
 	envPath := flag.String("env", ".env", "环境配置文件路径")
 	port := flag.Int("port", 0, "HTTP 服务端口 (默认读取配置文件或 8080)")
 	host := flag.String("host", "", "HTTP 监听主机 (默认读取配置文件或 127.0.0.1)")
@@ -157,3 +173,40 @@ func shutdownDrainTimeout(cfg *config.Config) time.Duration {
 	}
 	return at + 30*time.Second
 }
+
+
+// configCheck 加载并校验配置：输出脱敏摘要与问题清单。
+// 不创建 DB、不启动服务、不写业务目录（KTD17 config check 约束）。
+func configCheck(args []string) {
+	fs := flag.NewFlagSet("config check", flag.ExitOnError)
+	envPath := fs.String("env", ".env", "环境配置文件路径")
+	port := fs.Int("port", 0, "HTTP 端口覆盖")
+	host := fs.String("host", "", "HTTP 主机覆盖")
+	backend := fs.String("backend", "", "智能体后端覆盖")
+	_ = fs.Parse(args)
+
+	cfg, err := config.Load(*envPath)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "config check: 加载失败: %v\n", err)
+		os.Exit(1)
+	}
+	if *port > 0 {
+		cfg.HTTPPort = *port
+	}
+	if *host != "" {
+		cfg.HTTPHost = *host
+	}
+	if *backend != "" {
+		cfg.AgentBackend = *backend
+	}
+
+	fmt.Println(cfg.MaskedSummary())
+	if issues := cfg.Check(); len(issues) > 0 {
+		fmt.Fprintln(os.Stderr, "config check: 未通过")
+		for _, it := range issues {
+			fmt.Fprintf(os.Stderr, "  - %s\n", it)
+		}
+		os.Exit(1)
+	}
+	fmt.Println("config check: 通过")
+}