feat: switch config to JSONC + split secrets.json

Load business config as JSONC (comments + trailing commas) via an
in-repo stripper then stdlib json — no new deps. Default path prefers
config.jsonc, falls back to legacy config.json. Auth write-back targets
only sibling secrets.json so JSONC comments are never wiped; secrets
overlay merges on load. Examples, compose, Docker, docs, favsort and
tools all share the same loader. Phase A only — no DB settings migration.

tools/probe_anon.py

@@ -49,8 +49,9 @@ def get(url, cookie):
 
 
 def main():
-    cfg = json.load(open(os.path.join(ROOT, "config.json"), encoding="utf-8"))
-    full = cfg["cookie"]
+    from reaction_board.config import default_config_path, load_config
+    app = load_config(default_config_path(ROOT), require_auth=False)
+    full = app.bilibili.read.cookie or app.bilibili.write.cookie
     anon = strip_identity(full)
 
     variants = [("完整 cookie", full), ("去掉身份字段", anon), ("完全无 cookie", None)]