security: scrub live credentials from tracked notes; point values at Vaultwarden

- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
  placeholders across 24 files (review-named 12 + noise-audit finds:
  WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
  credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)

01_Projects/Infrastructure/Services/Dendrite.md

@@ -7,12 +7,12 @@ dendrite/windyboy2006
 
 reCAPTCHA
 key: 6LemvrUlAAAAAPqUuH_1V-lWdKAeEORzeAEhor46
-secret: 6LemvrUlAAAAAOzHkBnRH3Qxiw2q3YI0ZHdLf6Bh
+secret: {{SECRET_DENDRITE_RECAPTCHA_SECRET}}
 
 admin:
-windy/catalog@2006
+windy / {{SECRET_DENDRITE_ADMIN}}（实际值见 Vaultwarden）
 
-AccessToken: D0lJWbpHRSO4s3zfqxSvO9ZmdWJuV2iPTC5K9VijuuU
+AccessToken: {{SECRET_DENDRITE_ACCESS_TOKEN}}
 
 
 matrix media repo:

01_Projects/Infrastructure/Services/Matrix-windy-pc.md

@@ -173,10 +173,10 @@ database:
     cp_max: 10
 log_config: "/data/chans.xyz.log.config"
 media_store_path: /data/media_store
-registration_shared_secret: "lTjbS&oVJ7==Co+4YdbDxR,u7.:d+3qgofIR@9c#*1ULc;M2,*"
+registration_shared_secret: "{{SECRET_MATRIX_CHANS_REGISTRATION_SHARED_SECRET}}"
 report_stats: true
-macaroon_secret_key: "fe@vZvVnFFA3j:;hK;DI27;vZk@lHHk~w7foB*Q0D0nd.;tGho"
-form_secret: "G*bdHINrFR+@,A3^P=IpayYU3aluiAKcI5@L&E-f#Du:s@MgB6"
+macaroon_secret_key: "{{SECRET_MATRIX_CHANS_MACAROON}}"
+form_secret: "{{SECRET_MATRIX_CHANS_FORM_SECRET}}"
 signing_key_path: "/data/chans.xyz.signing.key"
 trusted_key_servers:
   - server_name: "matrix.org"
@@ -205,7 +205,7 @@ EsT1 s6mK hgBT 3Cnv iYbW SNBD Bf3C LwPs nPbq dXJ8 cbbg aiEs
 matrix:
   homeserver: https://chans.xyz
   username: "@zhiqiang:chans.xyz"
-  password: "vaz6PQV5vjg1aya-mvr"
+  password: "{{SECRET_MATRIX_USER_ZHIQIANG}}"
   rooms:
     - "#hass:chans.xyz"
   commands:
@@ -251,7 +251,7 @@ get token
 curl -X POST -H "Content-Type: application/json" -d '{
   "type": "m.login.password",
   "user": "hass",
-  "password": ".P.fPdJL6.wz77q*9VjD"
+  "password": "{{SECRET_MATRIX_USER_HASS}}"
 }' "https://chans.xyz/_matrix/client/r0/login"
 
 ```
@@ -272,26 +272,26 @@ curl -XPOST "https://synapse.chans.xyz/_matrix/client/v3/login" \
              "type": "m.id.user",
              "user": "zhiqiang"
          },
-         "password": "vaz6PQV5vjg1aya-mvr"
+         "password": "{{SECRET_MATRIX_USER_ZHIQIANG}}"
      }'
 
 ```
 
 ```
 
-{"access_token":"mct_yDGcVmMw2QyTiPPq4DVEHr5BPjQeqh_w1qQx1","device_id":"MryevHEy6k","user_id":"@zhiqiang:chans.xyz"}%
+{"access_token":"{{SECRET_MATRIX_MCT_ACCESS_TOKEN}}","device_id":"MryevHEy6k","user_id":"@zhiqiang:chans.xyz"}%
 
 ```
 
 ```
-mct_yDGcVmMw2QyTiPPq4DVEHr5BPjQeqh_w1qQx1
+{{SECRET_MATRIX_MCT_ACCESS_TOKEN}}
 ```
 
 
 ```
 matrix:
   homeserver: chans.xyz
-  secret: 'wqfJ1r4cyaQbRNzGUUxjOyFf1g2hvC8F'
+  secret: '{{SECRET_MATRIX_WINDY_PC}}'
   endpoint: https://synapse.chans.xyz/
 
 ```

01_Projects/Infrastructure/Services/Matrix.md

@@ -173,10 +173,10 @@ database:
     cp_max: 10
 log_config: "/data/chans.xyz.log.config"
 media_store_path: /data/media_store
-registration_shared_secret: "lTjbS&oVJ7==Co+4YdbDxR,u7.:d+3qgofIR@9c#*1ULc;M2,*"
+registration_shared_secret: "{{SECRET_MATRIX_CHANS_REGISTRATION_SHARED_SECRET}}"
 report_stats: true
-macaroon_secret_key: "fe@vZvVnFFA3j:;hK;DI27;vZk@lHHk~w7foB*Q0D0nd.;tGho"
-form_secret: "G*bdHINrFR+@,A3^P=IpayYU3aluiAKcI5@L&E-f#Du:s@MgB6"
+macaroon_secret_key: "{{SECRET_MATRIX_CHANS_MACAROON}}"
+form_secret: "{{SECRET_MATRIX_CHANS_FORM_SECRET}}"
 signing_key_path: "/data/chans.xyz.signing.key"
 trusted_key_servers:
   - server_name: "matrix.org"
@@ -205,7 +205,7 @@ EsT1 s6mK hgBT 3Cnv iYbW SNBD Bf3C LwPs nPbq dXJ8 cbbg aiEs
 matrix:
   homeserver: https://chans.xyz
   username: "@zhiqiang:chans.xyz"
-  password: "vaz6PQV5vjg1aya-mvr"
+  password: "{{SECRET_MATRIX_USER_ZHIQIANG}}"
   rooms:
     - "#hass:chans.xyz"
   commands:
@@ -251,7 +251,7 @@ get token
 curl -X POST -H "Content-Type: application/json" -d '{
   "type": "m.login.password",
   "user": "hass",
-  "password": ".P.fPdJL6.wz77q*9VjD"
+  "password": "{{SECRET_MATRIX_USER_HASS}}"
 }' "https://chans.xyz/_matrix/client/r0/login"
 
 ```
@@ -297,7 +297,7 @@ No email address provided, user will be prompted to add one
 matrix:
   homeserver: "https://chans.xyz"
   username: "@hass:chans.xyz"
-  password: "sgHoMmOWn8SkYJf#"
+  password: "{{SECRET_MATRIX_USER_HASS}}"
   rooms:
     - "#guangzhou:chans.xyz"