ci: add secret scanning for GitHub, Gitea, and local use

- .gitleaks.toml — extends gitleaks defaults with Pi-hole-specific rules
  for pwhash/totp_secret/app_pwhash; allowlists known-safe patterns
- .github/workflows/secret-scan.yml — GitHub Actions (full history scan)
- .gitea/workflows/secret-scan.yml — Gitea Actions (identical workflow)
- scripts/check-secrets.sh — shared runner used by both CI and local;
  supports --staged-only for pre-commit hook use; falls back to Docker
  if gitleaks isn't on PATH
- scripts/install-hooks.sh — installs pre-commit hook pointing at above
- pihole/sanitize-config.sh — redacts pwhash/totp_secret/app_pwhash
  in pihole.toml in-place before the file is committed
- pihole/pull-config.sh — updated to call sanitize-config.sh
  automatically after every pull so the repo stays clean by default

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s

scripts/install-hooks.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Install git hooks that run the secret scan before every commit.
+# Run once after cloning: bash scripts/install-hooks.sh
+
+set -euo pipefail
+
+REPO_ROOT="$(git -C "$(dirname "$0")" rev-parse --show-toplevel)"
+HOOK="${REPO_ROOT}/.git/hooks/pre-commit"
+
+cat > "$HOOK" << 'HOOK'
+#!/usr/bin/env bash
+exec "$(git rev-parse --show-toplevel)/scripts/check-secrets.sh" --staged-only
+HOOK
+
+chmod +x "$HOOK"
+echo "Installed pre-commit hook → ${HOOK}"
+echo "The secret scan will run automatically before every commit."