Config resolver: unified config.yaml < env < CLI merge with doctor provenance

[hurttlocker]

Problem

cortex doctor and cortex import resolve LLM provider config differently. doctor checks env vars only, while import reads config.yaml. This caused a 20-minute debugging session where enrichment appeared broken because the env var wasn't set despite config.yaml being correct.

Solution

Create a shared config resolver in internal/config/ with clear merge order:

1. ~/.cortex/config.yaml (lowest priority)
2. Environment variables (OPENROUTER_API_KEY, etc.)
3. CLI flags (highest priority)

Acceptance Criteria

• New internal/config/resolver.go package
• Single ResolveConfig() function used by all entry points: doctor, import, search, embed, classify
• cortex doctor prints resolved values with source annotations: llm_provider: openrouter (from: ~/.cortex/config.yaml)
• Tests covering all 3 merge layers + override precedence
• No breaking changes to existing CLI flags or config format (v1.0 stability contract)

Assignee

x7 — first PR in collaborative workflow