security: scrub live credentials from tracked notes; point values at Vaultwarden

- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
  placeholders across 24 files (review-named 12 + noise-audit finds:
  WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
  credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)

01_Projects/Home-Automation/data.md

@@ -46,7 +46,7 @@ Create a pgloader configuration file to handle the dump file import. Here's an e
 ```lisp
 LOAD DATABASE
     FROM FILE 'hass.sql'
-    INTO postgresql://hass:hass@localhost/hass
+    INTO postgresql://hass:{{SECRET_HA_DB_HASS}}@localhost/hass
 
 WITH include no drop, create tables, create indexes, reset sequences