fcom 1.0.x-dev

Development snapshot of the 1.0.x branch with the changes requested in the security advisory coverage review (#3579384). Everything is backwards compatible with 1.0.4; no configuration migration is required.

- API secret storage: the secret can now come from a Key module key, a $config['fastcomments.settings']['api_secret'] override in settings.php, or the existing configuration value. The settings form uses a password field, keeps the
stored secret when the field is left blank, and offers a checkbox to clear it.
- The status report shows where the API secret is stored and warns when it is kept in exportable configuration.
- The API secret is sent to FastComments as the x-api-key header instead of a query parameter, so it can no longer appear in logged request URLs.
- Standalone widgets (recent comments, recent discussions, top pages) load through a Drupal behavior with drupalSettings instead of an inline script in the Twig template.
- API client failures now throw FastCommentsApiException and are logged to the fastcomments channel instead of returning FALSE or NULL.
- Views and requirements hooks moved to the object-oriented hook class with legacy shims for Drupal 10.
- Webhook controller returns 500 when no API secret is configured, 403 on a missing or invalid signature, and 400 on an invalid payload.
- Added Unit, Kernel, and Functional test coverage (31 tests), passing on Drupal.org GitLab CI.
- README documents the API secret storage options and links the FastComments Agent Skill.