Group whitelist settings under dedicated configuration

[Ovler-Young]

Summary

• Groups video filtering allowlists, recommendation admission, and minute-bootstrap eligibility under [whitelist.video], [whitelist.recommendation], and [whitelist.minute_bootstrap].
• Keeps processing.filtering.content_blacklist under [processing.filtering]; matching content still excludes a video after allowlist checks.
• Automatically moves legacy whitelist TOML keys to their new locations at startup. Migration preserves values and comments, validates the effective whitelist before replacing the file, and stops on conflicts or unsupported syntax. A same-directory lock prevents two app instances from migrating the file simultaneously. Run migration when no editor or other process writes config.toml; a concurrent external edit can still race with the replacement.
• Warns and falls back to environment variables when the original config.toml has invalid TOML syntax. Migration conflicts, validation failures, and file errors remain startup errors. A symlink remains readable when no migration is needed; a symlink requiring a rewrite needs manual migration.
• Preserves the existing environment variable names and comma-separated list parsing. TOML values take precedence over environment values, and --update-info --pid-v2-whitelist overrides configured recommendation IDs for that run.
• Documents the key migration and notes that pnpm init-schema is needed after changing minute-bootstrap values so stored SQL defaults receive the updated configuration.

Validation

• pnpm exec tsx --test src/config/migrate-whitelist.test.ts
• pnpm exec tsc --noEmit
• pnpm exec biome check src/config/migrate-whitelist.ts src/config/index.ts src/config/migrate-whitelist.test.ts
• Parsed config.toml.example with smol-toml.