security: scrub live credentials from tracked notes; point values at Vaultwarden

- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
  placeholders across 24 files (review-named 12 + noise-audit finds:
  WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
  credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)

03_Resources/Prompt-Library/baibot-system-prompts.md

@@ -108,7 +108,7 @@ text_generation:
 
 ```yaml
 base_url: https://zenmux.ai/api/v1
-api_key: sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03
+api_key: sk-ai-v1-{{SECRET_ZENMUX_BAIBOT}}（实际值见 Vaultwarden）
 
 text_generation:
   model_id: moonshotai/kimi-k2-thinking
@@ -219,7 +219,7 @@ text_generation:
 
 ```yaml
 base_url: https://zenmux.ai/api/v1
-api_key: sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03
+api_key: sk-ai-v1-{{SECRET_ZENMUX_BAIBOT}}（实际值见 Vaultwarden）
 
 text_generation:
   model_id: google/gemini-3-pro-preview-free
@@ -279,7 +279,7 @@ speech_to_text:
 
 ```yaml
 base_url: https://zenmux.ai/api/v1
-api_key: sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03
+api_key: sk-ai-v1-{{SECRET_ZENMUX_BAIBOT}}（实际值见 Vaultwarden）
 
 text_generation:
   model_id: deepseek/deepseek-v3.2-speciale