feat: first-run config.json auto-generation on blank PVC

- loadConfig(): if config.json missing, create data/ dir, write default config
  with random sessionSecret and empty passwordHash, log instructions
- loadData(): throw clear error if units.json missing instead of crashing opaquely
- deployment.yaml: remove envFrom secretRef (SESSION_SECRET/PASSWORD_HASH not
  read from env — config.json on PVC is the source of truth)

k8s/deployment.yaml

@@ -31,9 +31,6 @@ spec:
               value: "https://humorunits.com"
             - name: ALLOWED_ORIGINS
               value: "https://humorunits.com,https://www.humorunits.com,https://dickloads.com,https://www.dickloads.com"
-          envFrom:
-            - secretRef:
-                name: humor-units-secrets  # SESSION_SECRET, PASSWORD_HASH
           volumeMounts:
             - name: data
               mountPath: /app/data