security: harden secret hygiene and pre-commit scanning

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build build-release clean test run version
+.PHONY: build build-release clean test run version install-hooks
 
 # Get version from git
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
@@ -72,6 +72,12 @@ deps:
 	go mod download
 	go mod tidy
 
+# Install local git hooks
+install-hooks:
+	git config core.hooksPath .githooks
+	chmod +x .githooks/pre-commit scripts/check-secrets.sh
+	@echo "Installed git hooks from .githooks/"
+
 # Help
 help:
 	@echo "QuoteForge Server (qfs) - Build Commands"
@@ -92,6 +98,7 @@ help:
 	@echo "  run            Run development server"
 	@echo "  watch          Run with auto-restart (requires entr)"
 	@echo "  deps           Install/update dependencies"
+	@echo "  install-hooks  Install local git hooks (secret scan on commit)"
 	@echo "  help           Show this help"
 	@echo ""
 	@echo "Current version: $(VERSION)"