Add mapbox doctor: a read-only snapshot of the environment

[mattpodwysocki]

Summary

Stacked on #39 (mapbox config list/unset), which is itself stacked on #35 (mapbox config get/set). Base branch is feat/177-config-list-unset, so this diff is just the incremental change — rebase onto main once #35 and #39 merge.

• mapbox doctor — a read-only snapshot of what the next command would see: which token wins and its state, which proxy variables are in effect, and where the update-check/telemetry switches currently stand.
• --verify additionally checks that api.mapbox.com is reachable, through the same http::client() (and therefore the same proxy handling) every other request in this crate uses. Nothing is sent otherwise — same precedent auth whoami --verify already sets.
• Reuses auth::resolve_source for the token report rather than re-deriving the precedence. token_expires_at/token_usage moved from private to pub(crate) for this; token_account/load_credentials were already public.
• MAPBOX_INTERNAL_DOCTOR_URL overrides the checked host — undocumented, for the same reason update_check.rs's MAPBOX_INTERNAL_UPDATE_URL exists: without a seam, --verify could only ever be tested against the real network.

Test plan

• cargo build, cargo fmt, cargo clippy --all-targets -- -D warnings, cargo test — all clean
• New tests/doctor.rs: bare state, a token in the environment, both switches (persisted + env), a proxy variable, and — through a loopback server — both the reachable and unreachable --verify outcomes, plus a timing assertion that no request happens at all without --verify
• docs/commands.md and CHANGELOG updated
• Manually verified against the real api.mapbox.com too (not just the loopback server)

[zmofei]

A few correctness bugs in doctor's diagnostics, plus one design question and one cleanup suggestion.

[mattpodwysocki]

Thanks for the thorough review. Addressed everything:

• Proxy vars: PROXY_VARS now lists both cases (HTTPS_PROXY/https_proxy, etc.) — reqwest reads both, curl's convention. On the design question: kept the env-var list rather than asking the client to expose "was a proxy applied" — reqwest has no public API for that, so closing the remaining gap (NO_PROXY exempting a specific host, a scheme-specific variable only applying to that scheme) would mean asking upstream, not something to build around here. Documented the gap explicitly in both the code comment and the docs page instead of implying more precision than this has.
• Update-check line: now depends on telemetry_allowed too. MAPBOX_CLI_NO_TELEMETRY=1 alone now correctly reports "Update check: off".
• --timeout: --verify now threads http::requested(matches) through, falling back to 5s only when neither --timeout nor MAPBOX_TIMEOUT was given.
• error field: now omitted entirely outside --debug via skip_serializing_if, not set to null.
• Structural fix: replaced the two independently-built Value trees with one Report struct (and four typed sub-structs) that both the text and JSON renderers read from — the same shape auth::Identity uses. This is exactly what let the telemetry bug happen: the JSON read three raw switches, the text line's own condition asked only two.

New tests for all four bugs in tests/doctor.rs: a lowercase proxy variable, telemetry alone flipping the reported update-check state, an explicit --timeout cutting a hung connection short (via a loopback server that accepts but never answers), and the error field's presence keyed to --debug.

[mattpodwysocki]

Closing and reopening to force a CI run — the base-branch retarget didn't trigger one and neither did two follow-up pushes.