refactor(core): move the per-app profiles into config/per_app.rs

The per-application overlay was spread over three places in `config.rs`: five methods after the migrations, `has_app_override` 133 lines further down among the identity accessors, and the private `app_overlay` matcher at the foot of the file, below the `impl` that holds its only two callers. The distance hid the distinction the docs insist on, that editing addresses a profile by its exact key while matching falls back to an `exe:` key. All three blocks move verbatim, in their original order, into `config/per_app.rs`; `app_overlay` stays private because both callers move with it, and `config.rs` drops the `Path` import only the matcher used.