ci(security): add gitleaks scanning

[singhvishalkr]

Problem

Secrets such as JWT keys, API tokens, wallet private keys, and Stellar secret keys could be committed without an automated repository gate.

Solution

• Added .gitleaks.toml with default rules plus a Stellar secret-key rule.
• Added a Secret Scan CI job that runs the requested zricethezav/gitleaks-action@v1 full repository scan and a PR diff scan.
• Added a Husky pre-commit staged scan through gitleaks protect --staged --redact --config .gitleaks.toml when the local binary is installed.
• Documented local setup, CI behavior, and the narrow placeholder allowlist.

Closes #63

Verification

• Parsed .gitleaks.toml with Python tomllib
• npx.cmd --yes prettier --check .github/workflows/ci.yml docs/SECRET-SCANNING.md
• git diff --check

I could not execute Gitleaks locally because this Windows machine does not have the gitleaks binary or Docker installed. The new CI job should exercise the scanner on the branch.

[nanaf6203-bit]

Gitleaks + the Husky pre-commit hook is a great catch — exactly what we want before this thing lives anywhere real. Merged.