fix: move [secrets] after global keys in config examples

In TOML, all keys after a [section] header belong to that table.
The examples had api-bind-to after [secrets], causing it to be
parsed as secrets.api-bind-to and triggering "incorrect secret
format" errors.

Fixes #6

README.md

 
 ```toml
 bind-to = "0.0.0.0:443"
+api-bind-to = "127.0.0.1:9090"
 
+# [secrets] must be the last section in the global scope —
+# in TOML, all keys after a [section] become part of that table.
 [secrets]
 alice = "ee..."
 bob   = "ee..."
-
-api-bind-to = "127.0.0.1:9090"
 ```
 
 Run:
 
 ```toml
 bind-to = "0.0.0.0:443"
+api-bind-to = "127.0.0.1:9090"
 
+# [secrets] должен быть последней секцией в глобальном scope —
+# в TOML все ключи после [section] становятся частью этой таблицы.
 [secrets]
 alice = "ee..."
 bob   = "ee..."
-
-api-bind-to = "127.0.0.1:9090"
 ```
 
 Запуск:

example.config.toml

 # should either be base64-encoded or starts with ee.
 secret = "ee367a189aee18fa31c190054efd4a8e9573746f726167652e676f6f676c65617069732e636f6d"
 
-# For multi-user support, use the [secrets] section instead of "secret".
-# Each key is a user name, used for per-user stats tracking.
-# All secrets must use the same hostname.
-# [secrets]
-# alice = "ee367a189aee18fa31c190054efd4a8e9573746f726167652e676f6f676c65617069732e636f6d"
-# bob = "ee0123456789abcdef0123456789abcd9573746f726167652e676f6f676c65617069732e636f6d"
-
 # Host:port pair to bind the built-in stats HTTP API server.
 # GET /stats returns per-user connection counts and traffic.
 # If not set, the stats API is not started.
 # Otherwise, chose a new DC.
 allow-fallback-on-unknown-dc = false
 
+# For multi-user support, use the [secrets] section instead of "secret".
+# Each key is a user name, used for per-user stats tracking.
+# All secrets must use the same hostname.
+#
+# IMPORTANT: [secrets] must appear after all global keys (like bind-to,
+# api-bind-to) — in TOML, keys after a [section] belong to that table.
+# [secrets]
+# alice = "ee367a189aee18fa31c190054efd4a8e9573746f726167652e676f6f676c65617069732e636f6d"
+# bob = "ee0123456789abcdef0123456789abcd9573746f726167652e676f6f676c65617069732e636f6d"
+
 # This section is relevant to communication with fronting domain. Usually
 # you do not need to setup anything here but there are plenty of cases, especially
 # if you put mtg behind load balancer, when some specific configuration is