security: add gitleaks pre-commit hook and CI scan (#285)

Deploys org-wide secret-leak prevention following the 2026-04-17
Discord webhook URL incident (scraped from public karaoke-gen repo,
used to spam malware in #releases).

Layers:
  - .githooks/pre-commit — gitleaks protect --staged (fail fast)
  - .github/workflows/security.yml — reusable CI scanner
  - .gitleaks.toml — default rules + Discord-webhook rule + FP allowlist