- server config check: load + validate + masked summary; exit 1 on issues
- no side effects: creates no DB, starts nothing, writes no business dirs
- Config.Check() (production secrets, port range, data dir) exported for
reuse; MaskedSummary never prints credential values
- default no-arg invocation unchanged (serve); help added
- smoke-verified: pass exit 0, invalid port exit 1 with issue line
- layer-source attribution (config explain) deferred to U10b ConfigSnapshot