ci: fix gitleaks module path, compose env file, and nginx limit_req_zone scope

- secrets-scan: gitleaks module path was renamed from
  github.com/gitleaks/gitleaks/v8 to github.com/zricethezav/gitleaks/v8
- docker-compose-check: create backend/.env from .env.example before
  running docker compose config (env file required by compose.yml)
- nginx: move limit_req_zone directives outside server block to http
  level, where nginx requires them

nginx/conf.d/default.conf

@@ -1,6 +1,10 @@
 # Define cache for API responses
 proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=api_cache:10m max_size=100m inactive=60m use_temp_path=off;
 
+# Rate limiting (per IP) — must be at http level, not inside server block
+limit_req_zone $binary_remote_addr zone=api_limit:10m rate=20r/m;
+limit_req_zone $binary_remote_addr zone=dav_limit:10m rate=100r/m;
+
 server {
     listen 80;
     listen 443 ssl http2;
@@ -17,10 +21,6 @@ server {
     add_header X-XSS-Protection "1; mode=block";
     add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none';" always;
 
-    # Rate limiting (per IP)
-    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=20r/m;
-    limit_req_zone $binary_remote_addr zone=dav_limit:10m rate=100r/m;
-
     # Serve static frontend
     root /usr/share/nginx/html;
     index index.html;