Secrets Management: Secure secrets handling

[OneByJorah]

Secrets Management Gap

Current State: Secrets in .env.sample, docker-compose.yml, and code. Default passwords in code. No secret rotation, no external secret store.

Required:

1. Remove all hardcoded secrets from code
2. Remove default passwords from docker-compose.yml
3. Add .gitignore for .env files
4. Use Docker secrets or external secret store (HashiCorp Vault, AWS Secrets Manager, 1Password, Bitwarden)
5. Add secret rotation strategy
6. Add .env.example with placeholders only
7. Audit for hardcoded secrets in codebase
8. Add pre-commit hook for secret scanning (gitleaks)

Priority: CRITICAL