feat(mcp): check_env struct-level granularity via composes selectors (#4)

Patch to v1.1.1. check_env could only reason at module granularity, so a var
that lives on one struct of a multi-struct module (e.g. EINHERJAR_SERVER_CORS_ORIGINS
on web.Config, not web/server.Config) couldn't be flagged dead when the app
composes the sibling struct. Adds struct-level selectors to close that gap.

internal/tools (check_env):
- New `composes` input: exact config structs as module/subpackage/Struct selectors
  (e.g. web/server/Config, db-postgres/Config, core/logz/Config), alongside or
  instead of the coarse `modules` list.
- not-composed now reasons over the union of composed vars (from modules AND
  struct selectors), so it surfaces struct-level dead vars. Coarse modules:["web"]
  keeps the prior behavior.
- parseStructSelector helper; errors on malformed or non-existent selectors.

Tests: struct-level dead-var catch (CORS flagged with web/server/Config but not
with module web), bad-selector errors; existing calls updated to the new arg.
Version bumped to v1.1.1 (badge + serverVersion). No dependency changes.

Reviewed-on: #4
Co-authored-by: Rene Nochebuena Guerrero <rene@nochebuena.dev>
Co-committed-by: Rene Nochebuena Guerrero <rene@nochebuena.dev>

CHANGELOG.md

@@ -6,6 +6,25 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.1.1] — 2026-08-07
+
+Patch. `check_env` gains struct-level granularity so it can catch dead vars that module
+granularity cannot.
+
+### Added
+
+- **`check_env` `composes` input** — declare the exact config structs an app composes as
+  `module/subpackage/Struct` selectors (e.g. `web/server/Config`, `db-postgres/Config`,
+  `core/logz/Config`), alongside or instead of the coarse `modules` list. A var counts as
+  composed when any listed module or struct declares it.
+
+### Changed
+
+- **`not-composed` now reasons over the composed var set, not just modules.** With struct
+  selectors, `check_env` flags struct-level dead vars — e.g. `EINHERJAR_SERVER_CORS_ORIGINS`
+  (which lives on `web.Config`) is now reported dead when the app composes `web/server/Config`
+  rather than `web.Config`. Passing coarse `modules: ["web"]` keeps the previous behavior.
+
 ## [1.1.0] — 2026-08-07
 
 Minor release. The env-var story is now **derived from the framework's real struct tags** end