feat: add production startup checks

docs/development/roadmap.md

@@ -69,13 +69,13 @@ Quality bar:
 Objective: make self-hosted deployments safer.
 
 Priority tasks:
-- Add startup validation for production settings.
 - Add backup and restore documentation.
 - Add a release checklist covering migrations, tests, and smoke checks.
 
 Delivered:
 - Documented a 1Password secret-injection deployment flow for local, Docker Compose, and systemd deployments.
 - Redacted secret-like values from mail-source diagnostics, stored import history, OAuth error logs, and validated admin auth contexts.
+- Added production startup validation for stable secrets, configured auth, auth-disabled mode, and Logto TLS verification.
 
 ## Later Milestones
 

docs/milestones.md

@@ -98,9 +98,9 @@ Delivered:
 - 1Password-based secret injection flow for local, Docker Compose, and systemd deployments.
 - Raw mailbox/OAuth secrets are redacted from mail-source diagnostics, import history, and OAuth error logs.
 - Admin authentication contexts no longer carry raw API keys after validation.
+- Production startup checks now fail early for missing stable secrets, missing auth configuration, auth-disabled mode, or disabled Logto TLS verification.
 
 Planned:
-- Add startup checks for production-critical configuration.
 - Add backup/restore guidance for database deployments.
 - Add release checklist covering migrations, tests, and smoke checks.
 

docs/todo.md

@@ -157,6 +157,7 @@ This file tracks the specific implementation tasks for each milestone of the DMA
 ## Future Milestones
 - [x] Production secret handling guide using 1Password injection
 - [x] Redact mailbox/OAuth secrets from diagnostics, logs, import history, and auth contexts
+- [x] Add startup checks for production-critical configuration
 - [ ] Apprise notifications and alert rules
 - [ ] DNS health guidance and Cloudflare read-only inspection
 - [ ] Guided setup and operator health pages