Config is layered: built-in defaults, then the YAML file, then BFD_* environment variables, then CLI flags. Global defaults live under a 'defaults' mapping; per-peer settings are file-only. Includes config.yaml.dist and ScriptHookSink::with_script_dir so the hooks directory is configurable.
