security: enforce changelog and secret guard

.githooks/pre-commit

@@ -0,0 +1,19 @@
+#!/bin/sh
+# Red Valley: every commit needs a changelog and must not add obvious secrets.
+
+if git diff --cached --quiet; then
+  exit 0
+fi
+
+if git diff --cached --quiet -- CHANGELOG.md; then
+  echo "Commit blocat: actualizeaza si adauga CHANGELOG.md la fiecare commit." >&2
+  exit 1
+fi
+
+if git diff --cached --unified=0 -- . ':(exclude)CHANGELOG.md' |
+  grep -E '^\+[^+].*(rcon_password|sv_licenseKey|mysql_connection_string|webhook_url|discord_webhook|api[_-]?key|access[_-]?token)([[:space:]]*[:=][[:space:]]*|[[:space:]]+)[^[:space:]"]+' >/dev/null; then
+  echo "Commit blocat: posibil secret detectat in staged diff." >&2
+  exit 1
+fi
+
+exit 0