security: scrub live credentials from tracked notes; point values at Vaultwarden

- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
  placeholders across 24 files (review-named 12 + noise-audit finds:
  WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
  credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)

01_Projects/Infrastructure/VPS/DNS.md

@@ -350,7 +350,7 @@ docker compose exec -T db psql \
 
 ```
 docker compose exec -T db psql -U pdns -d postgres -v ON_ERROR_STOP=1 
-  -c "ALTER ROLE pdnsadmin WITH PASSWORD 'windyboy2006';"
+  -c "ALTER ROLE pdnsadmin WITH PASSWORD '{{SECRET_PDNSADMIN_DB}}';"
 ```