[CLI] Add Doctor Support Artifact

[rasulkireev]

Summary

The CLI can now generate a self-contained support artifact with readwise doctor. The artifact reports local config/auth/cache state, validates credentials when present, checks MCP tool discovery by default, and stays useful when the user is logged out or auth itself is broken.

This also brings in the diagnostics surface the doctor command depends on: --debug / READWISE_CLI_DEBUG=1 now emits sanitized phase timings and correlated error details with a run_id, and the doctor artifact carries the same correlation ID for support handoff.

Details

• readwise doctor prints a JSON artifact with CLI/runtime metadata, config-file health, auth state, tool-cache state, and check results.
• readwise doctor --no-network skips authenticated network checks for offline or privacy-sensitive support flows.
• Artifacts redact token-shaped fields, authorization headers, and configured access/refresh/client-secret values even if an upstream error includes a raw secret substring.
• Static commands like doctor now bypass dynamic MCP tool discovery so diagnostic output is available before normal command registration succeeds.

Validation

• npm run build
• npm test
• Manual smoke: node --import tsx src/index.ts doctor --help
• Manual smoke: node --import tsx src/index.ts doctor --no-network with no config file emitted a warning-status JSON artifact instead of failing the auth gate.

Post-Deploy Monitoring & Validation

• Log/search terms: monitor support reports and GitHub issues for readwise doctor, READWISE_CLI_DEBUG, run_id, Token refresh failed, Could not fetch MCP tools, and Not logged in.
• Metrics/dashboards: no additional production dashboard is available for this local CLI path; validate through CI, npm release smoke, and support artifact quality.
• Healthy signals: users can run readwise doctor while logged out, artifacts parse as JSON, support can correlate artifacts with debug logs via run_id, and shared artifacts do not include raw access tokens, refresh tokens, client secrets, or authorization headers.
• Failure signals: doctor hangs, logged-out doctor exits nonzero, --no-network still attempts MCP/OAuth calls, artifacts fail JSON parsing, or any shared artifact contains raw credential material.
• Rollback/mitigation trigger: immediately ship a patch or revert the doctor/diagnostics command path if credential leakage or diagnostic hangs are reported. Until patched, stop requesting doctor artifacts in support guidance.
• Validation window and owner: first 48 hours after npm release, owned by the CLI maintainer/support rotation.

---