docs: settings pull-through after #207 - secrets file path on Windows and with XDG in the 1Password how-to; 1Password approval is per terminal session, not per value

Files changed:
- docs/explanation/configuration-tiers.md
- docs/how-to/use-1password-for-settings.md

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

docs/how-to/use-1password-for-settings.md

@@ -36,8 +36,10 @@ A reference by name works the same way without `op`:
 
 - set the reference: `tools/wikitool config set <section>.<field> --ref <name>`;
 - put the value into `WIKITOOL_SECRET_<NAME>` (the name upper-cased) in the environment, or into
-  the secrets file `~/.config/chemenu/<instance_id>/secrets.json` as `{"<name>": "<value>"}`,
-  readable by you only (`chmod 600`). The `instance_id` is in `wikitool.json`.
+  the secrets file as `{"<name>": "<value>"}`: `~/.config/chemenu/<instance_id>/secrets.json`
+  (`$XDG_CONFIG_HOME` instead of `~/.config` when it is set), readable by you only
+  (`chmod 600`) - on Windows `%APPDATA%\chemenu\<instance_id>\secrets.json`. The `instance_id`
+  is in `wikitool.json`.
 
 ## In CI