Splits a merged config into non-secret settings and secret credentials.
Walks the whole config tree and relocates every SECRET_KEYS-named
string leaf into the secrets half, so config.json never receives a plaintext
credential. The loader's deep-merge recombines the two halves on load.
Splits a merged config into non-secret settings and secret credentials.
Walks the whole config tree and relocates every SECRET_KEYS-named string leaf into the secrets half, so config.json never receives a plaintext credential. The loader's deep-merge recombines the two halves on load.