security: Add secrets scanning to CI

[db-tycoon-stephen]

Summary

Implement automated secrets scanning in CI pipeline.

Motivation

From Technical Debt - Security Improvements:

• Implement secrets scanning
• Add vulnerability scanning
• Enhance audit logging

Proposed Implementation

1. GitHub Actions Integration

   • Add trufflesecurity/trufflehog or similar scanner
   • Scan on every PR and push
   • Block merges if secrets detected

2. Pre-commit Hook

   • Add detect-secrets to pre-commit config
   • Baseline for known false positives
   • Local scanning before push

3. Audit Trail

   • Log scanning results
   • Alert on new detections
   • Historical tracking

Acceptance Criteria

• Secrets scanner runs in CI
• Pre-commit hook configured
• No secrets in current codebase
• Documentation for handling alerts

[db-tycoon-stephen]

Completed in PR #26 (merged to v0.3)