feat: switch config to JSONC + split secrets.json

Load business config as JSONC (comments + trailing commas) via an
in-repo stripper then stdlib json — no new deps. Default path prefers
config.jsonc, falls back to legacy config.json. Auth write-back targets
only sibling secrets.json so JSONC comments are never wiped; secrets
overlay merges on load. Examples, compose, Docker, docs, favsort and
tools all share the same loader. Phase A only — no DB settings migration.

tests/test_jsonc.py

@@ -0,0 +1,46 @@
+# -*- coding: utf-8 -*-
+"""JSONC 剥离与解析测试: uv run python tests/test_jsonc.py"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+sys.stdout.reconfigure(encoding="utf-8")
+
+from reaction_board.jsonc import loads, strip_jsonc  # noqa: E402
+
+
+def test_comments_trailing_comma_and_strings():
+    text = '''
+    // head comment
+    {
+      "a": 1, // trail
+      "url": "https://ex.com//path", /* block */
+      "list": [1, 2, ],
+      "nested": { "x": true, },
+    }
+    '''
+    data = loads(text)
+    assert data == {
+        "a": 1,
+        "url": "https://ex.com//path",
+        "list": [1, 2],
+        "nested": {"x": True},
+    }
+    # 字符串内双斜杠不得被当成注释吃掉
+    assert "https://ex.com//path" in strip_jsonc(text)
+
+
+def test_block_comment_and_bom():
+    text = '\ufeff{"k": /* c */ "v",}'
+    assert loads(text) == {"k": "v"}
+
+
+def main():
+    test_comments_trailing_comma_and_strings()
+    test_block_comment_and_bom()
+    print("OK: JSONC 注释、尾逗号与字符串保护测试通过")
+
+
+if __name__ == "__main__":
+    main()