ci: add secrets scanning, staticcheck, gosec, coverage, env docs, compose/nginx validation, a11y

New jobs in pipeline:

secrets-scan: gitleaks detection
go-staticcheck: static analysis (complement to golangci-lint)
go-gosec: Go security linter
test: coverage profiling with 50% threshold gate
env-docs-check: verifies all env vars are documented in .env.example
docker-compose-check: validates compose.yml syntax
nginx-check: validates nginx config
frontend-a11y: Svelte a11y accessibility checks

Also: remove orphaned Makefile, update .env.example with 11 missing vars,
create .gitleaks.toml with allowlist, add check-env-docs.py script.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitleaks.toml

@@ -0,0 +1,21 @@
+# Gitleaks configuration for Crussell
+title = "Crussell secrets scanning"
+
+[extend]
+# Use the default gitleaks rules
+useDefault = true
+
+# Allowlist paths and regexes that are known safe
+[allowlist]
+description = "Known false positives"
+paths = [
+    # Test fixtures with mock data
+    "backend/testutils/",
+    "backend/handlers/.*_test.go",
+    # Example env file with placeholder values
+    ".env.example",
+    # SabreDAV dependency files
+    "sabredav/composer.json",
+    # Frontend env examples
+    "frontend/.env.production",
+]