security: scrub live credentials from tracked notes; point values at Vaultwarden

- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
  placeholders across 24 files (review-named 12 + noise-audit finds:
  WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
  credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)

01_Projects/Home-Automation/Storage.md

@@ -11,7 +11,7 @@ GRANT ALL PRIVILEGES ON DATABASE hass TO hass;
 
 ```
 recorder:
-  db_url: postgresql://hass:hass@store.local/hass
+  db_url: postgresql://hass:{{SECRET_HA_DB_HASS}}@store.local/hass
 ```
 
 
@@ -113,7 +113,7 @@ Migrating your Home Assistant instance from SQLite to PostgreSQL involves a few
     ```lisp
 LOAD DATABASE
      FROM sqlite://./home-assistant_v2.db.bak
-     INTO postgresql://hass:hass@localhost/hass
+     INTO postgresql://hass:{{SECRET_HA_DB_HASS}}@localhost/hass
 
  WITH data only,
       drop indexes,
@@ -156,7 +156,7 @@ ALTER SCHEMA "main" RENAME TO "public";
     
     ```yaml
     recorder:
-      db_url: postgresql://hass:hass@192.168.55.53/hass
+      db_url: postgresql://hass:{{SECRET_HA_DB_HASS}}@192.168.55.53/hass
     ```
     
     Replace `yourpassword` and `localhost` as needed.
@@ -260,7 +260,7 @@ psql -h localhost -U hass -d hass -f ha_dump.sql -W > load.log 2>&1
 
 
 ```
-pgloader sqlite://./home-assistant_v2.db.bak postgresql://hass:hass@localhost/hass
+pgloader sqlite://./home-assistant_v2.db.bak postgresql://hass:{{SECRET_HA_DB_HASS}}@localhost/hass
 ```
 
 
@@ -298,7 +298,7 @@ SELECT setval('statistics_short_term_id_seq', MAX(id)) FROM statistics_short_ter
 
 ```
 recorder:
-  db_url: postgresql://hass:hass@192.168.55.53/hass
+  db_url: postgresql://hass:{{SECRET_HA_DB_HASS}}@192.168.55.53/hass
 ```
 
 
@@ -331,7 +331,7 @@ sqlite3mysql --sqlite-file home-assistant_v2.db --mysql-user hass --mysql-passwo
 
 ```
 recorder:
-  db_url: mysql://hass:hass@192.168.55.53/hass?charset=utf8mb4
+  db_url: mysql://hass:{{SECRET_HA_DB_HASS}}@192.168.55.53/hass?charset=utf8mb4
 
 ```
 

01_Projects/Home-Automation/WAQI.md

@@ -8,13 +8,13 @@ Congratulation, your registration already validated.
   
 Your token is
 
-761ba9c8b1745baed8d667f036d6ab46a843b962
+{{SECRET_WAQI_TOKEN}}
 
   
   
 
 You can now try, for instance, to get the beijing feed using:  
-[https://api.waqi.info/feed/here/?token=761ba9c8b1745baed8d667f036d6ab46a843b962](https://api.waqi.info/feed/here/?token=761ba9c8b1745baed8d667f036d6ab46a843b962)
+[https://api.waqi.info/feed/here/?token={{SECRET_WAQI_TOKEN}}](https://api.waqi.info/feed/here/?token={{SECRET_WAQI_TOKEN}})
 
 And you will get this result:
 

01_Projects/Home-Automation/data.md

@@ -46,7 +46,7 @@ Create a pgloader configuration file to handle the dump file import. Here's an e
 ```lisp
 LOAD DATABASE
     FROM FILE 'hass.sql'
-    INTO postgresql://hass:hass@localhost/hass
+    INTO postgresql://hass:{{SECRET_HA_DB_HASS}}@localhost/hass
 
 WITH include no drop, create tables, create indexes, reset sequences