ci: add secret scanning for GitHub, Gitea, and local use

- .gitleaks.toml — extends gitleaks defaults with Pi-hole-specific rules
  for pwhash/totp_secret/app_pwhash; allowlists known-safe patterns
- .github/workflows/secret-scan.yml — GitHub Actions (full history scan)
- .gitea/workflows/secret-scan.yml — Gitea Actions (identical workflow)
- scripts/check-secrets.sh — shared runner used by both CI and local;
  supports --staged-only for pre-commit hook use; falls back to Docker
  if gitleaks isn't on PATH
- scripts/install-hooks.sh — installs pre-commit hook pointing at above
- pihole/sanitize-config.sh — redacts pwhash/totp_secret/app_pwhash
  in pihole.toml in-place before the file is committed
- pihole/pull-config.sh — updated to call sanitize-config.sh
  automatically after every pull so the repo stays clean by default

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s

pihole/sanitize-config.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Redact sensitive fields from a Pi-hole pihole.toml before committing.
+# Called automatically by pull-config.sh; can also be run manually.
+#
+# Usage: sanitize-config.sh <pihole.toml>
+#   Edits the file in-place, replacing sensitive field values with "".
+
+set -euo pipefail
+
+usage() {
+  echo "Usage: $(basename "$0") <pihole.toml>" >&2
+  exit 1
+}
+
+[[ $# -eq 1 ]] || usage
+FILE="$1"
+[[ -f "$FILE" ]] || { echo "Error: file not found: $FILE" >&2; exit 1; }
+
+REDACTED=0
+
+redact_field() {
+  local field="$1"
+  # Match lines like:  pwhash = "some-value"  and blank the value
+  if grep -qE "^\s+${field}\s*=\s*\"[^\"]{1,}\"" "$FILE"; then
+    sed -i -E "s|^(\s+${field}\s*=\s*)\"[^\"]*\"|\1\"\"|" "$FILE"
+    echo "  redacted: ${field}"
+    REDACTED=$((REDACTED + 1))
+  fi
+}
+
+echo "Sanitizing $(basename "$FILE")..."
+redact_field "pwhash"
+redact_field "app_pwhash"
+redact_field "totp_secret"
+
+if [[ $REDACTED -eq 0 ]]; then
+  echo "  (nothing to redact)"
+else
+  echo "  ${REDACTED} field(s) redacted."
+fi