feat: easy proxy doctor — pre-flight config & network diagnostic (#22)

[montoyaedu]

Summary

Adds easy proxy doctor, a read-only diagnostic — the safety net the recent outage lacked. That outage was caused by a hand-written vhost using a static upstream {} block: nginx resolves such hosts at startup and aborts if one fails, taking down every site. Nothing surfaced the risk before recreating the container.

What doctor checks

• Static vhost scan (host-side, no Docker needed) — flags:
  • upstream {} blocks → resolved at nginx startup; one bad host blocks all sites. Advises the variable form.
  • deprecated listen ... http2 directive.
• nginx config test — nginx -t inside the container, when the proxy is running.
• Proxy networks — lists the Docker networks the container is joined to.
• Exit code — non-zero only when nginx -t fails (a definite startup blocker); warnings alone don't fail it.

Changes

• commands/proxy.sh — doctor subcommand + __easy_command_proxy_doctor + help entry.
• test/doctor.bats — 7 tests; test/test_helper.bash — mock_docker_nginx_invalid.
• CLAUDE.md, README.md — command tables; CHANGELOG.md — [Unreleased] entry.

Test plan

TDD — 7 tests written first, watched fail, then made green.

npm run lint   # exits 0
bats test/     # 29/29 (22 + 7 new)

Notes

• Scoped to the high-value checks. Per-vhost upstream resolvability (DNS-checking each backend from inside the container) is a natural follow-up, not included here.
• The network check lists the proxy's networks; flagging them against a configured edge network lands with EASY_PROXY_NETWORK — declarative edge network for the proxy #23 (EASY_PROXY_NETWORK).

Closes #22

🤖 Generated with Claude Code