ELX-33: gctx config — print the resolved settings and where each came from

[cdevarenne]

Settings resolve from the environment, then a gitignored .env, then a default — and there is
currently no way to see what actually got resolved without running a command that uses them.

That matters most for ES_INFERENCE_ID, which is baked into the index mapping at creation
time. Get it wrong and you do not find out when you set it; you find out later, when
retrieval behaves oddly against an index that has to be rebuilt to fix it.

A config subcommand should print the resolved configuration, and — in the spirit of a project
about provenance — say where each value came from: the environment, the .env file, or the
built-in default.

gctx config

  ES_URL             https://…            (.env)
  ES_API_KEY         set                  (.env)
  ES_INDEX           grounded-context-corpus   (default)
  ES_INFERENCE_ID    .elser-2-elasticsearch    (default)

Done when

• every setting the code reads is listed, with its resolved value
• each line names its source: environment, .env, or default
• the API key is never printed — only whether one is present. An error message or a
  config dump must not leak a credential, which is why the key is package-private on the
  JVM side and never returned by the Python accessor
• it runs with no cluster and no credentials, reporting absence as a normal state rather
  than an error
• a test asserts the key's value cannot appear in the output

Useful for two audiences: an adopting team checking their own cluster is wired correctly, and a
pre-demo sanity check that takes one command instead of a rebuilt index.