phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

01_Projects/Infrastructure/Services/vaultwarden.md

@@ -1,71 +0,0 @@
-
-
-```
-create database vaultwarden;
-```
-
-
-```
-CREATE USER vaultwarden WITH ENCRYPTED PASSWORD 'windysecurity';
-GRANT ALL PRIVILEGES ON DATABASE vaultwarden TO vaultwarden;
-```
-
-
-```bitwarden.load
-LOAD DATABASE
-     FROM sqlite:///opt/vaultwarden/vw-data/db.sqlite3
-     INTO postgresql://vaultwarden:windysecurity@localhost:5432/vaultwarden
-
-WITH include drop, create tables, create indexes, reset sequences
-EXCLUDING TABLE NAMES LIKE '__diesel_schema_migrations'
-ALTER SCHEMA 'main' RENAME TO 'public'
-;
-
-```
-
-
-```
-pgloader bitwarden.load
-```
-
-```
--- Grant usage and create permissions on the public schema
-GRANT USAGE ON SCHEMA public TO vaultwarden;
-GRANT CREATE ON SCHEMA public TO vaultwarden;
-
--- Optionally, grant all permissions on the public schema
-GRANT ALL ON SCHEMA public TO vaultwarden;
-
--- Transfer ownership of the public schema to vaultwarden (optional)
-ALTER SCHEMA public OWNER TO vaultwarden;
-
-```
-
-
-```.env
-DOMAIN="https://auth.wsvc.info/"
-DATABASE_URL=postgresql://vaultwarden:windysecurity@172.18.0.1:5432/vaultwarden
-SMTP_HOST=smtp.windy.me
-SMTP_FROM=<vnet@windy.me>
-SMTP_PORT=587
-SMTP_SECURITY=starttls
-SMTP_USERNAME=vnet@windy.me
-SMTP_PASSWORD=windyboy2006
-```
-
-```admin token
-i8aHqBZvgTjCoHKRqMqHxmbFs3JFwWnrzPuub09sUnYKTfwZ7m1VCKXABlSxRkJ6
-```
-
-
-```
-echo -n "VjoM4sndg4.8uCzPmodH" | argon2 "$(openssl rand -base64 32)" -e -id -k 19456 -t 2 -p 1
-```
-
-```
-$argon2id$v=19$m=19456,t=2,p=1$eXhRMTBiVXRjR2pFalpRYStCQys1SmtkaGVONTFJWm9HQmNMVDg2ZGlkVT0$ssdf1xrdTwXP7S7xoRiams1R3nGeSS3dkuKcPD/sO90
-```
-
-```
-ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$d3Pa5o/TrvEhaVvj/bypWSnBqIFjU/rqkRV+Th7KmHU$ZDwdhqyIrTTvnAsIAUURjN3t3bgNWJfEh8Mv2cY0gUs'
-```