Add comprehensive secrets scanning capability:

secrets_scanner.py (1028 lines):
- 60+ regex patterns across 10 provider categories (AWS, Azure, GCP,
  DigitalOcean, Anthropic, OpenAI, Groq, HuggingFace, GitHub, GitLab,
  Stripe, Square, Braintree, Slack, Twilio, SendGrid, Mailgun, PKI
  keys, JWT, MongoDB, PostgreSQL, MySQL, Redis, generic credentials)
- Full git history scan via git-show diffs — catches deleted secrets
- Shannon entropy analysis (threshold 4.6 bpc) for generic secrets
- Blast radius assessment per finding type
- Secret redaction — only prefix shown, never full value stored
- Placeholder/test-fixture exclusion to reduce false positives
- SecretFinding and SecretScanResult dataclasses with to_dict()

ui/server.py:
- GET /api/secrets/patterns — pattern category list for UI
- start_secrets_scan Socket.IO event — streams progress, accepts
  GitHub URL or local path, auto-clones when URL supplied
- Integrated into main scan pipeline (runs after Semgrep, results
  included in report_data passed to report.html template)

ui/templates/index.html:
- Secrets Detection section with KPI strip (total/critical/high/
  history/files/commits)
- Scanner controls: repo input, git history toggle, entropy toggle
- Live progress bar streaming from Socket.IO
- Findings table with severity badges, provider, blast radius,
  redacted secret, source (working tree vs git history)
- Client-side filter buttons: All / Critical / High / Medium / History
- Category breakdown bar chart
- 5-step remediation guide panel

README.md:
- Version badge updated to v3.0.0
- Full Secrets Detection section with pattern table, git history
  explanation, blast radius explanation, remediation overview
- v3.0.0 added to releases table