security: scrub live credentials from tracked notes; point values at Vaultwarden

- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
  placeholders across 24 files (review-named 12 + noise-audit finds:
  WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
  credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)

01_Projects/Infrastructure/Services/Matrix.md

@@ -173,10 +173,10 @@ database:
     cp_max: 10
 log_config: "/data/chans.xyz.log.config"
 media_store_path: /data/media_store
-registration_shared_secret: "lTjbS&oVJ7==Co+4YdbDxR,u7.:d+3qgofIR@9c#*1ULc;M2,*"
+registration_shared_secret: "{{SECRET_MATRIX_CHANS_REGISTRATION_SHARED_SECRET}}"
 report_stats: true
-macaroon_secret_key: "fe@vZvVnFFA3j:;hK;DI27;vZk@lHHk~w7foB*Q0D0nd.;tGho"
-form_secret: "G*bdHINrFR+@,A3^P=IpayYU3aluiAKcI5@L&E-f#Du:s@MgB6"
+macaroon_secret_key: "{{SECRET_MATRIX_CHANS_MACAROON}}"
+form_secret: "{{SECRET_MATRIX_CHANS_FORM_SECRET}}"
 signing_key_path: "/data/chans.xyz.signing.key"
 trusted_key_servers:
   - server_name: "matrix.org"
@@ -205,7 +205,7 @@ EsT1 s6mK hgBT 3Cnv iYbW SNBD Bf3C LwPs nPbq dXJ8 cbbg aiEs
 matrix:
   homeserver: https://chans.xyz
   username: "@zhiqiang:chans.xyz"
-  password: "vaz6PQV5vjg1aya-mvr"
+  password: "{{SECRET_MATRIX_USER_ZHIQIANG}}"
   rooms:
     - "#hass:chans.xyz"
   commands:
@@ -251,7 +251,7 @@ get token
 curl -X POST -H "Content-Type: application/json" -d '{
   "type": "m.login.password",
   "user": "hass",
-  "password": ".P.fPdJL6.wz77q*9VjD"
+  "password": "{{SECRET_MATRIX_USER_HASS}}"
 }' "https://chans.xyz/_matrix/client/r0/login"
 
 ```
@@ -297,7 +297,7 @@ No email address provided, user will be prompted to add one
 matrix:
   homeserver: "https://chans.xyz"
   username: "@hass:chans.xyz"
-  password: "sgHoMmOWn8SkYJf#"
+  password: "{{SECRET_MATRIX_USER_HASS}}"
   rooms:
     - "#guangzhou:chans.xyz"