Config-less start, and fix the config, cache and search docs !16

Stacked on !15; retarget to main once that merges.

• #21 config.json is optional when it is the default path; a file named with -c must exist. Validation, theme, API cache and rate limit setup run either way. Built-in nsfw default is now false, matching the example. Two tests.
• #22 SETUP.md: update-interval is seconds and a full directory scan, d is listed, y is 360 days, exceeding max-size empties the directory. The example's "lifetime": null is "1w".
• #23 API.md documents t as tag search. The "Folders" option on user pages was a favourites search; it is labelled favourites and the unused search.folders key is dropped from both catalogues.
• #26 SETUP.md is one config list with theme and language in place, then time units, robots.txt, and the reverse proxy section last.

Closes #21 Closes #22 Closes #23 Closes #26