fix(security): add standalone secret-scan job to CI

Had a real dependency-audit gate (npm audit --audit-level=high) but no
secret scan. trufflehog's Action is Docker-based and cannot run on this
repo's existing windows-latest runner (needed for the Windows desktop
app's own browser/quality tests), so this adds it as a separate,
parallel ubuntu-latest job rather than inserting it into the Windows
job where it would break CI - the last gap for this repo to count as
fully-authored.

.gitea/workflows/quality.yml

@@ -6,6 +6,16 @@ on:
   pull_request:
 
 jobs:
+  secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Secret scan
+        uses: trufflesecurity/trufflehog@v3.79.0
+        with:
+          path: ./
+          extra_args: --only-verified
+
   quality:
     runs-on: windows-latest
     steps: