ci: add secrets scanning, staticcheck, gosec, coverage, env docs, compose/nginx validation, a11y

New jobs in pipeline:

secrets-scan: gitleaks detection
go-staticcheck: static analysis (complement to golangci-lint)
go-gosec: Go security linter
test: coverage profiling with 50% threshold gate
env-docs-check: verifies all env vars are documented in .env.example
docker-compose-check: validates compose.yml syntax
nginx-check: validates nginx config
frontend-a11y: Svelte a11y accessibility checks

Also: remove orphaned Makefile, update .env.example with 11 missing vars,
create .gitleaks.toml with allowlist, add check-env-docs.py script.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

frontend/eslint.a11y.config.js

@@ -0,0 +1,38 @@
+import { fileURLToPath } from 'node:url';
+import { includeIgnoreFile } from '@eslint/compat';
+import js from '@eslint/js';
+import svelte from 'eslint-plugin-svelte';
+import { defineConfig } from 'eslint/config';
+import globals from 'globals';
+import ts from 'typescript-eslint';
+import svelteConfig from './svelte.config.js';
+
+const gitignorePath = fileURLToPath(new URL('./.gitignore', import.meta.url));
+
+export default defineConfig(
+	includeIgnoreFile(gitignorePath),
+	js.configs.recommended,
+	...ts.configs.recommended,
+	...svelte.configs.recommended,
+	{
+		languageOptions: {
+			globals: { ...globals.browser, ...globals.node }
+		}
+	},
+	{
+		files: ['**/*.svelte', '**/*.svelte.ts', '**/*.svelte.js'],
+		languageOptions: {
+			parserOptions: {
+				projectService: true,
+				extraFileExtensions: ['.svelte'],
+				parser: ts.parser,
+				svelteConfig
+			}
+		}
+	},
+	{
+		rules: {
+			'svelte/valid-compile': 'error'
+		}
+	}
+);

frontend/package.json

@@ -14,7 +14,8 @@
 		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
 		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
 		"format": "prettier --write .",
-		"lint": "prettier --check . && eslint ."
+		"lint": "prettier --check . && eslint .",
+		"lint:a11y": "eslint 'src/**/*.svelte' --config eslint.a11y.config.js"
 	},
 	"devDependencies": {
 		"@eslint/compat": "^1.2.5",