Load currently swallows every error it hits. Change it to return (Settings, error), propagating failures with enough context to tell a missing file from malformed JSON. Update every caller. The tests in conf_test.go describe the expected signature.
