feat: add stable cursors and effective config rendering

internal/config/effective.go

@@ -0,0 +1,23 @@
+package config
+
+import "encoding/json"
+
+// RenderEffectiveServer returns deterministic, payload-free JSON suitable for
+// the one-time startup configuration log.
+func RenderEffectiveServer(config *Server) ([]byte, error) {
+	return renderEffective(config)
+}
+
+// RenderEffectiveClient returns deterministic, payload-free JSON. TLS file
+// paths are included, but file contents are never read or rendered.
+func RenderEffectiveClient(config *Client) ([]byte, error) {
+	return renderEffective(config)
+}
+
+func renderEffective(value any) ([]byte, error) {
+	encoded, err := json.MarshalIndent(value, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	return append(encoded, '\n'), nil
+}