Sprint B.7: secret scan before commit-push (TUI + CLI)

- src/secrets.rs: scans added lines of the staged diff for GitHub/GitLab
  token shapes, AWS access keys, Discord token assignments, private key
  blocks; prefix+tail-length matching (no regex dep), matched values never
  echoed
- a hit blocks the commit and unstages (git reset); CLI override
  --allow-secrets; TUI sync flow shares the same scan
- verified: block+unstage, override commits, prose mentions don't trigger

src/cli.rs

@@ -65,6 +65,8 @@ pub enum Commands {
         #[arg(long, default_value = "pull")] action: String,
         /// Commit message (required for commit-push)
         #[arg(short, long)] message: Option<String>,
+        /// Commit even when staged changes look like secrets
+        #[arg(long)] allow_secrets: bool,
     },
     /// Tag a release and publish it on the provider
     Release {