security: scrub live credentials from tracked notes; point values at Vaultwarden

- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
  placeholders across 24 files (review-named 12 + noise-audit finds:
  WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
  credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)

.zcode/plans/plan-sess_0cc98e77-f1eb-421d-9514-7ef2591a7320.md

@@ -15,7 +15,7 @@
      "command": "uvx",
      "args": ["plane-mcp-server", "stdio"],
      "env": {
-       "PLANE_API_KEY": "plane_api_d3dd7b29c3d04f6190f7bcf9fda078f3",
+       "PLANE_API_KEY": "{{SECRET_PLANE_API}}",
        "PLANE_WORKSPACE_SLUG": "space",
        "PLANE_BASE_URL": "https://plane.chans.xyz"
      }