feat: switch config to JSONC + split secrets.json

Load business config as JSONC (comments + trailing commas) via an
in-repo stripper then stdlib json — no new deps. Default path prefers
config.jsonc, falls back to legacy config.json. Auth write-back targets
only sibling secrets.json so JSONC comments are never wiped; secrets
overlay merges on load. Examples, compose, Docker, docs, favsort and
tools all share the same loader. Phase A only — no DB settings migration.

compose.example.yml

@@ -10,6 +10,7 @@ services:
     ports:
       - "8080:8080"
     volumes:
-      - ./config.json:/config/config.json
+      - ./config.jsonc:/config/config.jsonc
+      - ./secrets.json:/config/secrets.json
       - ./data:/data
-    command: ["python", "app.py", "--config", "/config/config.json"]
+    command: ["python", "app.py", "--config", "/config/config.jsonc"]