ci: fix gitleaks module path, compose env file, and nginx limit_req_zone scope

- secrets-scan: gitleaks module path was renamed from
  github.com/gitleaks/gitleaks/v8 to github.com/zricethezav/gitleaks/v8
- docker-compose-check: create backend/.env from .env.example before
  running docker compose config (env file required by compose.yml)
- nginx: move limit_req_zone directives outside server block to http
  level, where nginx requires them

.gitea/workflows/ci.yaml

@@ -37,7 +37,7 @@ jobs:
           cache: false
 
       - name: Install gitleaks
-        run: go install github.com/gitleaks/gitleaks/v8@latest
+        run: go install github.com/zricethezav/gitleaks/v8@latest
 
       - name: Detect secrets
         run: gitleaks detect --source . --verbose --no-banner
@@ -748,6 +748,9 @@ jobs:
       - name: Install docker CLI
         run: apk add --no-cache docker-cli docker-compose
 
+      - name: Create env file for compose validation
+        run: cp .env.example backend/.env
+
       - name: Validate compose.yml
         run: docker compose -f compose.yml config --quiet