Configuration, secrets & onboarding

[JSONbored]

Part of #975.

Context

Self-hosters need a clear, documented configuration surface and a smooth onboarding (GitHub App + webhook setup, AI-backend authentication).

Deliverables

• A documented per-project config surface (generic schema). Sensitive review heuristics/policy remain server-side defaults, not user-facing knobs.
• Secret/credential plumbing (a real secrets mechanism, not committed env): GitHub App credentials + the AI-backend credential.
• Startup validation — refuse to start when mis-configured, with clear, actionable errors (e.g., missing/expired AI credential, missing GitHub App key).
• Onboarding docs: create/install the GitHub App, point the webhook at the self-hosted instance, choose + authenticate an AI backend.

Acceptance criteria

• A new self-hoster can configure and authenticate without reading source.
• Invalid/missing config fails fast with guidance rather than failing silently at review time.

Notes

• Keep the public config schema minimal and non-gameable; do not expose internal review/policy parameters.