feat: add diagnostics reporter for config and runtime state

[Gipzy8]

Closes #149
feat: add diagnostics reporter for config and runtime state

Add a redacted, allowlist-based diagnostics reporter so SDK users can
generate a safe support report covering config validity, RPC
reachability, declared role, signer presence, and compliance failure
classification — without ever risking exposure of private keys,
seeds, or Stellar addresses.

Changes:

• src/diagnostics/config.ts: diagnoseConfig() builds a ConfigDiagnostics
  report field-by-field from an allowlist; never throws on missing/
  invalid/malformed input, reports resolution failure as a status +
  ConfigErrorCode instead. RPC URL is reduced to origin+pathname only
  (query string/hash, where API keys live, is never read)
• src/diagnostics/runtime.ts: buildRuntimeDiagnostics() probes RPC
  reachability via rpcServer.getHealth(), reusing the existing
  NetworkFailure/buildNetworkFailureDiagnostic redaction boundary on
  failure; reports declared role and signer presence (never the
  signer itself)
• src/diagnostics/compliance.ts: classifyComplianceFailure() classifies
  PortfolioError/RoleError/ConfigValidationError by their closed code
  enum only — never .message/.cause, which interpolate raw values
  elsewhere in the SDK
• src/diagnostics/report.ts: buildDiagnosticsReport() combines the
  three sections; distinguishes a plain AegisClient from a role-aware
  client (both have a .role property with different, incompatible
  meanings) to read the declared role safely
• src/index.ts: export the new diagnostics types and functions
• tests/diagnostics.test.ts: 16 tests — a known secret/seed never
  appears in serialized output (whole or partial), an unlisted
  invented sensitive field never appears (proves the allowlist default
  rather than a remembered denylist), RPC URL credentials redacted,
  invalid/incomplete config reflected as a status without throwing,
  unsupported/unavailable network names distinguished from unset,
  compliance failure classification (133 total tests pass)
• docs/diagnostics.md: usage, what is/isn't included, and an explicit
  warning to review a report before sharing it