feat: switch config to JSONC + split secrets.json

Load business config as JSONC (comments + trailing commas) via an
in-repo stripper then stdlib json — no new deps. Default path prefers
config.jsonc, falls back to legacy config.json. Auth write-back targets
only sibling secrets.json so JSONC comments are never wiped; secrets
overlay merges on load. Examples, compose, Docker, docs, favsort and
tools all share the same loader. Phase A only — no DB settings migration.

.gitignore

@@ -1,7 +1,13 @@
-# 本地凭据，绝对不要提交
+# 本地凭据与业务配置，绝对不要提交
 config.json
+config.jsonc
 config.json.bak
+config.jsonc.bak
 config.json.tmp
+config.jsonc.tmp
+secrets.json
+secrets.json.bak
+secrets.json.tmp
 
 # 计划 / 日志 / 快照
 data/