[DX] Add startup self-check / config validator

Goal

Operators should see how their config parsed before the first tool call fails.

What to ship

On server startup (after parsing CONNECTION_PROFILES and all env vars), log one summary line per profile:

[config] profile=dev tiers=[read] dbs=fleet collections=fleet:vehicles,maintenance auth=connection-string [config] profile=prod tiers=[read,write] readOnly=false dbs=* auth=entra [config] WARN: profile 'archive' has allowedDatabases=[] (explicit deny-all) — confirm this is intentional

Plus a --validate CLI flag that:

• Parses config, prints the summary, and exits 0/1 without starting the server.
• Useful in CI / pre-deploy hooks.

Acceptance criteria

• One log line per profile at startup, at INFO level.
• Empty-array allowlists ([]) trigger a WARN line (catches the footgun).
• --validate flag exits non-zero on any parse error.
• New tests cover both happy path and []-warn path.

Why

Operators currently learn how their config parsed only when a tool call fails. Print it at boot — catches typos cheaply.

Locate the TypeScript config parser, server startup entry point, CLI argument handling, and existing configuration tests. Trace how CONNECTION_PROFILES and environment variables are parsed, then verify that startup logs one summary per profile, [] allowlists warn, and --validate reports parse failures without starting the server.