feat(doctor): sweep the linked sites, fold check into site:doctor

[prabowosd]

There are three health commands and none of them knows about the others, so anyone who wants to know whether something is wrong has to run all three, and the one people reach for first never looks at their sites. lerd doctor now ends with a [Sites] section: every linked site runs through the site-level checks and gets one line, the counts plus the first thing that is wrong, with the command to run for the detail. A machine where podman, DNS and the ports are all fine while three sites are failing no longer reports itself healthy.

The sweep has to stay quick, so it runs the cheap half of the site doctor and leaves the framework command checks, composer audit, npm audit and the response-time lookup to site:doctor on a named site. The one expensive check it keeps is whether the site's database exists, because that is what catches a site 500ing on every request, and it is no longer expensive: one engine's database list is reused for a few seconds rather than costing a container exec per site. On a fourteen site machine the sweep adds about two seconds to a doctor run.

lerd check was the third entry point and everything it validated is about the project rather than the environment, so .lerd.yaml validation moves into the site doctor as its own check. Every surface that runs the doctor validates it now, the dashboard and the MCP tool included, and check stays as a deprecated alias for site:doctor in the current directory. Folding it in also fixed a worker it was wrong about: one declared in the project's own custom_workers was only recognised on a custom-container site, so a plain site running one was told it had no definition to match.

The reclaim offer the issue asks for is already there, doctor lists it as an optional fix and --fix runs lerd cleanup after confirming.

Closes #1358