Check for secrets before commit and push #94

Problem

A model committed a camera password in source code, as a default configuration, and lcode pushed it to a public GitHub repository. Nothing warned anyone. Cleaning up took a history rewrite, a force-push and a password change, and GitHub still serves the old commits.

Proposal

• Before git commit and git push: scan what's being committed or pushed for secrets: passwords and tokens in code, private keys, credentials in URLs (rtsp://user:pass@…), .env files.
• When something is found, stop the command and show where. In ask mode, the user decides. In auto-edit and yolo modes it stays blocked, and the model is told to move the secret into configuration or the environment.
• Pushing to a public repository gets a stricter check.
• Patterns: use lcode's existing secret patterns (memory already has some) and add common credential forms.

Acceptance criteria

• Commits and pushes that contain secrets are stopped, with the file and line
• False positives can be allowed explicitly
• Tests, docs