Remove hardcoded secrets, read from env vars, and add gitleaks guards

[devin-ai-integration]

Summary

Weekly gitleaks sweep found live secrets committed in the working tree (all values redacted here):

• backend/src/config/production.js:7 — hardcoded JWT signing secret (secret: '****')
• backend/src/config/production.js:11 — Postgres connection string with embedded password (url: '****')
• backend/src/config/production.js:14 — SendGrid API key (apiKey: '****')
• .github/workflows/deploy.yml:15-16 — AWS access key ID (AKIA****) + secret access key
• .github/workflows/deploy.yml:23 — Slack bot token (xoxb-****)
• .github/workflows/deploy.yml:29 — GitHub PAT (ghp_****)
• .github/workflows/deploy.yml:35 — Stripe live secret key (sk_live_****)

History-only findings (rotate, cannot be fixed by this PR): the same values in prior commits, plus k8s/secret.yaml and curl basic-auth in .github/workflows/sonar-devin-fix.yml from since-removed files.

Changes:

• production.js now reads JWT_SECRET / DATABASE_URL / SENDGRID_API_KEY via requireEnv() getters that throw when the env var is missing — no hardcoded fallbacks.
• deploy.yml env values replaced with ${{ secrets.* }} references (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, SLACK_BOT_TOKEN, RELEASE_TAGGING_PAT, STRIPE_SECRET_KEY) — these repo secrets must be configured for deploy to keep working.
• Untracked frontend/.env (non-secret VITE_API_URL only; frontend/.env.example already documents it) and added root/frontend .gitignore rules ignoring all .env files while keeping !*.env.example.
• backend/.env.example gains placeholders for DATABASE_URL and SENDGRID_API_KEY (placeholders only).
• New guards: .pre-commit-config.yaml with the gitleaks/gitleaks hook (rev v8.30.0) and .github/workflows/gitleaks.yml running gitleaks/gitleaks-action@v2 on push and pull_request (fails the build on any leak).

Rotation required: every secret listed above must be treated as compromised and rotated — they remain in git history. This PR removes them going forward; purging history (e.g. git filter-repo) should be done separately after rotation.

Verified: gitleaks detect --no-git is clean on this branch; backend tests (161 passed) and frontend lint pass.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/55dbdf86091d49eeb3bfbb26cd9495ed

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud