chore(security): allowlist two historical false-positive gitleaks findings

The local pre-push hook runs full-history `gitleaks detect` (CI is
path-filtered, so these slipped past on unrelated pushes). Two findings live
only in old commit diffs; both current files are already clean:

- add-service-to-compose.mdx: a Meilisearch example MEILI_MASTER_KEY value
  before it became the `<set-from-your-secret-manager>` placeholder.
- Auth.session.mutations.utils.test.ts: fixture token `abcdef1234567890`,
  since changed to `test-challenge-token-stub`.

Pin both by fingerprint in .gitleaksignore — narrowly scoped to these exact
commits/lines; rules stay active everywhere else and for HEAD. Verified
`gitleaks detect` (v8.30.1, the CI-pinned version) now reports no leaks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: agjs

.gitleaksignore

@@ -0,0 +1,19 @@
+# gitleaks fingerprint allowlist for specific HISTORICAL findings.
+#
+# Format: <commit>:<file>:<rule>:<line>. Each entry ignores exactly one
+# finding at one commit — rules stay fully active for every other commit and
+# for the current working tree. Used for false positives that live only in old
+# commit diffs (the current files are already clean), where a line/value regex
+# in .gitleaks.toml can't match because the offending value no longer exists
+# in HEAD. The repo-wide allowlist for current placeholders lives in
+# .gitleaks.toml; this file is only for pinned past commits.
+
+# Meilisearch recipe: an intermediate commit had a non-empty MEILI_MASTER_KEY
+# example value before it was changed to the `<set-from-your-secret-manager>`
+# placeholder (now allowlisted in .gitleaks.toml). Docs example, never a real key.
+9262aa98aebe8b93d055b28a98fb44b72097935b:apps/docs/src/content/docs/recipes/add-service-to-compose.mdx:generic-api-key:100
+
+# Auth session test: the fixture token was `abcdef1234567890` at this commit
+# (looks hex-key-ish to generic-api-key) and has since been changed to the
+# clearer `test-challenge-token-stub`. Test stub, never a real secret.
+901fd55367183293112f393dbc4cb99127af3913:apps/ui/src/features/auth/Auth.session.mutations.utils.test.ts:generic-api-key:13