secrets-check

Scan staged changes for secrets before commit. Blocks the commit if any known pattern matches (AWS keys, Stripe live keys, JWTs, PEM blocks, GitHub tokens, Google API keys, generic high-entropy string