feat(security): add gitleaks for secret detection

[ryoppippi]

Summary

• Add gitleaks to detect and prevent secrets from being committed

What Changed

• Add .gitleaks.toml configuration with default rules
• Add gitleaks to pre-commit hook via git-hooks.nix
• Add gitleaks job to CI workflow using nix
• Add just gitleaks command
• Add gitleaks to nix flake for local development

---

Summary by cubic

Add Gitleaks for secret detection in commits and CI. This blocks accidental secret leaks and makes local scans easy.

• New Features
  • Pre-commit hook via Nix to prevent committing secrets.
  • CI job runs Gitleaks using Nix.
  • Devshell includes Gitleaks; run “just gitleaks” to scan the repo.
  • .gitleaks.toml with default rules and an allowlist for common lock files.

^{Written for commit 74f1176. Summary will update automatically on new commits.}

[cubic-dev-ai]

No issues found across 4 files

[Copilot]

Pull request overview

This PR adds gitleaks to the project for secret detection and prevention. It integrates gitleaks into multiple parts of the development workflow to catch secrets before they're committed and in CI.

• Adds gitleaks configuration with default rules and allowlist for lock files
• Integrates gitleaks into pre-commit hooks and CI pipeline
• Provides a Just command for manual secret scanning

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.gitleaks.toml	Configuration file with default rules and path allowlist for .lock and .snap files
justfile	Adds gitleaks command to run secret detection manually
flake.nix	Adds gitleaks package and configures pre-commit hook with protect --staged command
.github/workflows/ci.yaml	Adds dedicated gitleaks job that runs detect on full repository history

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[glebedel]

LGTM