An operator can see the app's state: /api/health and a boot line that names what is missing #14

Right now an app started without FORGE_APP_IDENTITY_KEY treats every visitor as a guest and says nothing about it — the one misconfiguration that silently disables writing for everybody.

What done looks like

• GET /api/health answers {ok, env, commit, schemaVersion, uptimeSeconds} to anyone, in under 50ms, with no database write and no counts of anybody's data. It is the route a probe can hit forever.
• For an admin the same route adds {identity: "verified"|"disabled", dataDir, databaseBytes, writable, terminal: "<FORGE_APP_SSH verbatim>"|"off"}. A user or a guest never sees those fields — the check is an action in src/actions.ts, so the API and MCP get it from the same place.
• ok is false when the schema version is behind the migration list, when the data directory is not writable, or when the integrity check fails; the status is 200 for ok and 503 otherwise, so a probe can act on it.
• At boot src/server.ts prints one line per real problem, each naming the variable and what it costs: an empty FORGE_APP_IDENTITY_KEY says that every request will be anonymous and nobody can write; a default FORGE_APP_URL says cookies will not be Secure and same-origin checks compare against http://localhost. It prints nothing when all is well beyond the line it prints today, and it never prints a secret or any part of one.
• FORGE_APP_SSH is echoed exactly as given, wherever it is shown; when it is unset the answer is the word off, never an invented user@host.
• MCP tool health returns the same shape through the same action.
• Tests: the public shape has exactly the public fields and no more, for a guest and for a user; an admin sees the extra fields; a database whose schema is behind answers 503 with ok:false; the boot warning appears with an empty identity key and not with one set; the response carries the security floor.
• README.md gains three lines about /api/health and what ok:false means. bun test is green.

Files I expect to change: src/actions.ts, src/actions.test.ts, src/routes.ts, src/mcp.ts, src/server.ts, src/env.ts, src/server.test.ts, README.md.

Risks: health endpoints leak by habit — no table row counts, no usernames, no paths for a guest, and the admin's extra fields gated in the action rather than the route. uptimeSeconds and databaseBytes are cheap; do not add anything that walks the database on every probe. The admin panel that shows this to a person belongs to issue #10, not here: this issue stops at JSON and the boot log.

Fit: Hearth — honest about the environment, and clear about what is real versus off. A person assigns; I do not.