feat: switch config to JSONC + split secrets.json

Load business config as JSONC (comments + trailing commas) via an
in-repo stripper then stdlib json — no new deps. Default path prefers
config.jsonc, falls back to legacy config.json. Auth write-back targets
only sibling secrets.json so JSONC comments are never wiped; secrets
overlay merges on load. Examples, compose, Docker, docs, favsort and
tools all share the same loader. Phase A only — no DB settings migration.

.dockerignore

@@ -1,7 +1,13 @@
 # 本地凭据与运行期数据
 config.json
+config.jsonc
 config.json.bak
+config.jsonc.bak
 config.json.tmp
+config.jsonc.tmp
+secrets.json
+secrets.json.bak
+secrets.json.tmp
 data/
 
 # 开发与测试