fix: keep config operations on the selected file

[z116123123x]

Summary

• resolve the active Supermemory config once with the existing JSONC-first precedence
• use that selected path consistently for runtime loading, install defaults, and status
• stop install before mutation when the selected config is malformed instead of overwriting it or creating a shadow JSON file
• preserve an existing JSONC file byte-for-byte when no defaults are missing, and add missing defaults without rebuilding its comments, formatting, line endings, or trailing content
• reject non-object JSON and JSONC roots without rewriting the selected file
• parse JSONC when status identifies the API-key source, while keeping the key redacted
• add deterministic Bun tests for JSONC-only, JSON-only, neither, both, malformed and non-object configs, JSONC formatting variants, install failure, and status redaction

Why

Runtime loading checks supermemory.jsonc before supermemory.json, but install
and status previously used supermemory.json unconditionally. With only JSONC
present, install could therefore create a second JSON file with conflicting
defaults while the runtime continued reading JSONC.

This keeps the existing precedence and fresh-install JSON default. Existing
JSONC is updated without reserializing its existing content: missing top-level
defaults are inserted, the candidate is reparsed and checked against every
prior value before writing, and the original remainder of the file is preserved
byte-for-byte. No new runtime dependency is introduced.

Validation

• bun install --frozen-lockfile
• bun test (22 tests, 150 assertions)
• bun run typecheck
• bun run build
• git diff --check

All checks pass. The status test stubs fetch; no external provider call is
made.