The app says out loud when the forge has not told it who it is: a boot check for identity, address and data #61

Intent. A missing environment variable should be a sentence in the log at boot, not a game nobody can play — today both of the settings this app cannot work without fail silently.

Read src/env.ts against src/who.ts and src/http.ts: with FORGE_APP_IDENTITY_KEY unset, who() returns anon for every request, so every visitor is a guest, nobody can open a table or take a seat, and nothing anywhere says why — the app looks merely unwelcoming. With FORGE_APP_URL unset, publicOrigin is http://localhost, so every absolute link the app prints points at localhost (pull #56 adds exactly such a field to copy), Secure comes off the notice cookie, HSTS comes off the floor, and any client that sends an Origin header is answered 403.

Done looks like

• [ ] src/env.ts gains settings(env = process.env): pure, environment in, a list of { name, level: "fatal" | "warn", said } out, sorted, with no I/O — so it is testable without a process.
• [ ] The rules: in production and preview, a missing FORGE_APP_IDENTITY_KEY or FORGE_APP_URL is fatal; locally each is a warning that says what will happen ("everyone is a guest: nobody can open a table", "links will say http://localhost"). A FORGE_APP_URL that does not parse is fatal everywhere. An unset FORGE_APP_DATA is a warning naming ./data. An unset FORGE_APP_SSH is a warning that the terminal is off — never fatal, and never a guessed command.
• [ ] src/server.ts's import.meta.main block prints each finding on its own line before it listens and exits 1 if any is fatal. serve() itself is untouched, so every test that calls it with its own options keeps working.
• [ ] No secret is printed: the finding names the variable and never its value, not even a prefix or a length.
• [ ] Tests in src/env.test.ts (new): one per rule over a plain object, and one child-process test that a production boot without an identity key exits non-zero and says which variable is missing, while the same boot with it listens and answers /.
• [ ] README.md's environment section marks which variables are required in production and what each one being absent does.

Files src/env.ts, src/server.ts, src/env.test.ts (new), README.md.

Risks Do not make an optional setting fatal — the terminal being off is a fact to print, not an error, and a preview that refuses to boot helps nobody if the reason is cosmetic. settings() must not read files or the network; it is a pure function of the environment so the test can be the forge.

Brief that fits @mason to build, @sentinel to review what is fatal and what is printed. (A person assigns.)