feat: switch config to JSONC + split secrets.json

Load business config as JSONC (comments + trailing commas) via an
in-repo stripper then stdlib json — no new deps. Default path prefers
config.jsonc, falls back to legacy config.json. Auth write-back targets
only sibling secrets.json so JSONC comments are never wiped; secrets
overlay merges on load. Examples, compose, Docker, docs, favsort and
tools all share the same loader. Phase A only — no DB settings migration.

secrets.example.json

@@ -0,0 +1,21 @@
+{
+  "bilibili": {
+    "read": {
+      "mid": 0,
+      "csrf": "",
+      "cookie": ""
+    },
+    "write": {
+      "mid": 0,
+      "csrf": "",
+      "cookie": ""
+    }
+  },
+  "telegram": {
+    "bot_token": "replace-with-telegram-bot-token",
+    "chat_id": 0
+  },
+  "web": {
+    "auth_token": "replace-with-a-long-random-token"
+  }
+}