Remove committed secrets; read config from env vars and add gitleaks guards

[devin-ai-integration]

Summary

Weekly gitleaks sweep (v8.30.1) found hardcoded secrets committed on main. This PR removes them from the working tree, wires the code to read from environment variables / GitHub Actions secrets with fail-fast behaviour, and adds pre-commit + CI gitleaks gates so they cannot be re-committed.

Findings (values redacted)

Working-tree scan (5 leaks):

File:line	Type
.github/workflows/deploy.yml:15-16	AWS access key id + secret access key (AKIA**** / ****)
.github/workflows/deploy.yml:23	Slack bot token (xoxb-****)
.github/workflows/deploy.yml:29	GitHub PAT (ghp_****)
.github/workflows/deploy.yml:35	Stripe live secret key (sk_live_****)
backend/src/config/production.js:14	JWT signing secret (****), plus Postgres URL with embedded password (line 19) and SendGrid API key (line 22)

History scan (10 leaks): the above, plus history-only leaks in k8s/secret.yaml and .github/workflows/sonar-devin-fix.yml (files no longer in the tree). backend/.env is not tracked (only backend/.env.example); frontend/.env was tracked but contained only the non-secret VITE_API_URL.

Changes

• .github/workflows/deploy.yml: literals -> ${{ secrets.AWS_ACCESS_KEY_ID }}, ${{ secrets.AWS_SECRET_ACCESS_KEY }}, ${{ secrets.SLACK_BOT_TOKEN }}, ${{ secrets.RELEASE_TAGGING_PAT }}, ${{ secrets.STRIPE_SECRET_KEY }} (these repo secrets must be created for the deploy workflow to keep working).
• backend/src/config/production.js: each secret becomes a lazy getter backed by requireEnv(name), which throws Missing required environment variable: <name> — no fallback literals.

  jwt: { get secret() { return requireEnv('JWT_SECRET'); }, expiresIn: '24h' }

• backend/.env.example: placeholders added for DATABASE_URL and SENDGRID_API_KEY (JWT_SECRET placeholder already present).
• .gitignore / frontend/.gitignore: ignore .env, .env.*, *.env, keep !*.env.example; frontend/.env untracked.
• .pre-commit-config.yaml: gitleaks/gitleaks hook pinned to v8.30.0.
• .github/workflows/gitleaks.yml: runs the gitleaks CLI (detect --no-git --redact --exit-code 1) on push and pull_request; fails the build on any leak. Uses the CLI rather than gitleaks-action (which requires a paid org license) and scans the working tree only because history still contains the leaks until it is purged.

Post-fix gitleaks detect --no-git is clean; backend tests (161) and frontend lint pass.

Rotation required

All leaked credentials must be treated as compromised and rotated — they remain in git history (e.g. commit f278c67). This PR only stops them being present going forward; history purging (git filter-repo/BFG + force push) should be done separately once rotation is complete.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/a68b5b502bce4757bfe29756aae98864
Open in Devin Desktop: https://partner-workshops.devinenterprise.com/desktop/session/a68b5b502bce4757bfe29756aae98864?variant=devin

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud