ci: add secret scanning for GitHub, Gitea, and local use

- .gitleaks.toml — extends gitleaks defaults with Pi-hole-specific rules
  for pwhash/totp_secret/app_pwhash; allowlists known-safe patterns
- .github/workflows/secret-scan.yml — GitHub Actions (full history scan)
- .gitea/workflows/secret-scan.yml — Gitea Actions (identical workflow)
- scripts/check-secrets.sh — shared runner used by both CI and local;
  supports --staged-only for pre-commit hook use; falls back to Docker
  if gitleaks isn't on PATH
- scripts/install-hooks.sh — installs pre-commit hook pointing at above
- pihole/sanitize-config.sh — redacts pwhash/totp_secret/app_pwhash
  in pihole.toml in-place before the file is committed
- pihole/pull-config.sh — updated to call sanitize-config.sh
  automatically after every pull so the repo stays clean by default

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s

pihole/pull-config.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Pull Pi-hole configuration from a running instance to a local directory.
+# Sensitive fields (password hashes, TOTP secrets) are redacted automatically.
 #
 # Usage: pull-config.sh <source-host> <dest-dir>
 #   source-host  SSH-reachable hostname or IP of the source Pi-hole
@@ -7,10 +8,12 @@
 #
 # Example:
 #   ./pull-config.sh root@pihole ./config
-#   ./pull-config.sh root@192.168.2.100 /backup/pihole-$(date +%Y%m%d)
+#   ./pull-config.sh root@192.168.2.253 /backup/pihole-$(date +%Y%m%d)
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
 usage() {
   echo "Usage: $(basename "$0") <source-host> <dest-dir>" >&2
   echo "  source-host  SSH target for the source Pi-hole (e.g. root@pihole)" >&2
@@ -30,6 +33,7 @@ mkdir -p "${DEST}/dnsmasq.d"
 # ── pihole.toml ────────────────────────────────────────────────────────────────
 echo "  pihole.toml"
 ssh "${SOURCE}" "cat /etc/pihole/pihole.toml" > "${DEST}/pihole.toml"
+"${SCRIPT_DIR}/sanitize-config.sh" "${DEST}/pihole.toml"
 
 # ── custom dnsmasq drop-ins ────────────────────────────────────────────────────
 # Pi-hole manages its own generated config; we only capture user-added files.