feat: add gitleaks secret scanning to CI pipeline

Runs gitleaks detect with full history before the build job.
Both test and secrets jobs must pass to gate image push.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -16,8 +16,19 @@ jobs:
       - run: ruff check src/ tests/
       - run: PYTHONPATH=src pytest tests/ -v
 
+  secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks_8.24.0_linux_x64.tar.gz \
+            | tar xz -C /usr/local/bin gitleaks
+      - run: gitleaks detect --source . -v
+
   build:
-    needs: test
+    needs: [test, secrets]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4