feat: establish production SaaS foundation

scripts/repo-security-scan.js

@@ -74,6 +74,9 @@ const ruleAllowlistedFiles = {
   'frontend-legacy-user-header': new Set([
     'scripts/repo-security-scan-test.js',
   ]),
+  'git-access-token': new Set([
+    'scripts/repo-security-scan-test.js',
+  ]),
 };
 
 const rules = [
@@ -113,6 +116,13 @@ const rules = [
     pattern: /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/,
     message: 'Provider secret keys must not be committed.',
   },
+  {
+    id: 'git-access-token',
+    severity: 'critical',
+    pattern: /\b(?:GITEA_TOKEN|GIT_TOKEN)\s*[:=]\s*["']?([A-Za-z0-9_-]{32,})/i,
+    message: 'Git access tokens must stay in server-side secret storage.',
+    validate: (match) => !/^(?:replace|example|your|rotated|placeholder)/i.test(String(match[1] || '')),
+  },
   {
     id: 'cloud-access-key',
     severity: 'critical',