doctor: add provider key and model cache readiness checks

[Senzo13]

Context

JoyBoy can run without provider keys, but Hugging Face and CivitAI imports need clear setup diagnostics. New users should understand when a key is optional, missing, or required for a gated/downloaded model.

Relevant files:

• core/infra/doctor.py
• core/infra/local_config.py
• docs/GETTING_STARTED.md
• tests/test_harness_audit.py

Suggested approach

Add Doctor checks that report local provider key status without printing the key value, plus basic cache/download directory readiness.

Acceptance criteria

• Doctor reports HF_TOKEN and CIVITAI_API_KEY as configured/missing without exposing secrets.
• Missing keys are warnings, not hard errors, unless the check is explicitly for provider downloads.
• The check mentions where users can configure keys.
• A small test covers the shape of the report.