Refactor server config: single --config flag replaces --secrets/--mail-perms

- New server/config.mjs loads config.json, resolves secrets path relative
  to config dir, returns users/smtp/mail_perms_path/bind/port
- server/secrets.mjs removed (logic absorbed into config.mjs)
- smtp moves from secrets.json to config.json
- secrets.json now contains only users (pure credentials)
- config.example.json added as reference template
- .gitignore/.npmignore updated to cover config.json and mail-perms.json
- README updated with new setup and flags

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

secrets.example.json

@@ -1,11 +1,4 @@
 {
-	"smtp": {
-		"host": "smtp.example.com",
-		"port": 587,
-		"secure": false,
-		"auth": { "user": "relay@example.com", "pass": "<password>" },
-		"from": "agent@example.com"
-	},
 	"users": {
 		"<username>": { "secret": "<hex secret>", "canApprove": [] },
 		"<username>": { "secret": "<hex secret>", "canApprove": ["<username>"] }