v1.4.0 — Secret scanning

Secret scanning — memories can now be scanned for credentials before they are stored, so a refused write was never written rather than deleted afterwards.

It is off by default. Set POLYMNEMO_RSP_CONFIG to turn it on; the image ships a config at /app/plugins/rsp.toml using two scanners — one for polymnemo's own API tokens, and gitleaks for cloud and service credentials.

It covers the text of a memory: remember, save_session, update, and a media memory's description. The contents of uploaded files are not scanned — those bytes go straight to object storage and never pass through the server.

Full changelog: v1.3.0...v1.4.0