feat: add secret leak prevention barriers

- Install git-secrets with custom patterns for TPMJS, Neon, and AWS
- Add secrets scan to lefthook pre-commit hook (blocks commits with secrets)
- Create .gitsecrets file documenting secret patterns
- Enhance .gitignore with comprehensive env file patterns
- Add .env.example template for safe secret documentation

.env.example

@@ -0,0 +1,80 @@
+# =============================================================================
+# TPMJS Environment Variables
+# =============================================================================
+# Copy this file to .env.local and fill in the values.
+# NEVER commit .env files with real secrets!
+#
+# Required variables are marked with [REQUIRED]
+# Optional variables are marked with [OPTIONAL]
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# Database [REQUIRED]
+# -----------------------------------------------------------------------------
+# Neon PostgreSQL connection string (get from https://console.neon.tech)
+DATABASE_URL="postgresql://user:password@host/database?sslmode=require"
+DATABASE_URL_UNPOOLED="postgresql://user:password@host/database?sslmode=require"
+
+# -----------------------------------------------------------------------------
+# Authentication [REQUIRED for auth features]
+# -----------------------------------------------------------------------------
+# Better Auth secret - generate with: openssl rand -base64 32
+BETTER_AUTH_SECRET="your-32-char-minimum-secret-here"
+# Base URL for auth callbacks (optional, auto-detected in most cases)
+BETTER_AUTH_URL="http://localhost:3000"
+
+# -----------------------------------------------------------------------------
+# Cron Jobs [REQUIRED for sync endpoints]
+# -----------------------------------------------------------------------------
+# Secret for authenticating Vercel Cron requests - generate with: openssl rand -hex 32
+CRON_SECRET="your-64-char-hex-secret-here"
+
+# -----------------------------------------------------------------------------
+# API Key Encryption [REQUIRED for API key features]
+# -----------------------------------------------------------------------------
+# Secret for encrypting user API keys - generate with: openssl rand -base64 32
+API_KEY_ENCRYPTION_SECRET="your-encryption-secret-here"
+
+# -----------------------------------------------------------------------------
+# External Services [OPTIONAL]
+# -----------------------------------------------------------------------------
+# Resend - for sending emails (https://resend.com)
+RESEND_API_KEY="re_your_resend_api_key"
+
+# OpenAI - for AI features (https://platform.openai.com)
+OPENAI_API_KEY="sk-your-openai-api-key"
+
+# Vercel KV - for rate limiting (auto-configured on Vercel)
+KV_REST_API_URL="https://your-kv-instance.kv.vercel-storage.com"
+KV_REST_API_TOKEN="your-kv-token"
+
+# -----------------------------------------------------------------------------
+# Executor Services [OPTIONAL]
+# -----------------------------------------------------------------------------
+# Railway executor for tool execution
+RAILWAY_EXECUTOR_URL="https://your-railway-service.up.railway.app"
+
+# -----------------------------------------------------------------------------
+# Discord Integration [OPTIONAL]
+# -----------------------------------------------------------------------------
+DISCORD_SUMMARY_AGENT_ID="your-agent-id"
+DISCORD_GUILD_ID="your-guild-id"
+DISCORD_SUMMARY_CHANNEL_ID="your-channel-id"
+
+# -----------------------------------------------------------------------------
+# Public Variables (safe to expose to browser)
+# -----------------------------------------------------------------------------
+NEXT_PUBLIC_APP_URL="http://localhost:3000"
+NEXT_PUBLIC_API_URL="http://localhost:3000/api"
+
+# -----------------------------------------------------------------------------
+# Development/Testing [OPTIONAL]
+# -----------------------------------------------------------------------------
+NODE_ENV="development"
+
+# Integration test credentials (only for test environment)
+# INTEGRATION_TEST_SESSION_TOKEN="test-session-token"
+# INTEGRATION_TEST_API_KEY="test-api-key"
+# INTEGRATION_TEST_USER_ID="test-user-id"
+# INTEGRATION_TEST_USERNAME="test-username"
+# TEST_BASE_URL="http://localhost:3000"