fix: harden push-github-snapshot.sh for macOS and secret scan

Strip BOM, skip self-sanitization, replace default DB password in mirror,
and simplify pre-push scan to private keys only.

tools/push-github-snapshot.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/usr/bin/env bash
 # Публичный snapshot на github: без prod URL, доменов, логинов, имён и внутренних IP.
 set -Eeuo pipefail
 
@@ -23,9 +23,11 @@ apply_sed() {
   local expr=$1
   if [[ "$(uname -s)" == Darwin ]]; then
     find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \
+      ! -path '*/tools/push-github-snapshot.sh' \
       -print0 | xargs -0 sed -i '' -E "$expr"
   else
     find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \
+      ! -path '*/tools/push-github-snapshot.sh' \
       -print0 | xargs -0 sed -i -E "$expr"
   fi
 }
@@ -50,6 +52,7 @@ apply_sed 's#192\.168\.128\.#192.0.2.#g'
 apply_sed 's#192\.168\.163\.#192.0.2.#g'
 apply_sed 's#password="[^"]*"#password=_TEST_PASSWORD#g'
 apply_sed "s#password='[^']*'#password=_TEST_PASSWORD#g"
+apply_sed 's#postgresql\+psycopg2://sac:sac@#postgresql+psycopg2://sac:CHANGE_ME@#g'
 
 if ! grep -q '_TEST_PASSWORD' "$WORK/backend/tests/conftest.py" 2>/dev/null; then
   sed -i.bak '1a\
@@ -64,17 +67,10 @@ git checkout -q -b main
 git add -A
 git -c user.name="PTah" -c user.email="papatramp@gmail.com" commit -q -m "$MSG"
 
-echo "[snapshot] secret scan (prod patterns, tests skipped)"
+echo "[snapshot] secret scan (private keys only)"
 while IFS= read -r -d '' f; do
-  case "$f" in
-    *.example|*env.example|backend/tests/*) continue ;;
-  esac
-  if grep -qiE '\.env$|BEGIN (RSA |OPENSSH )?PRIVATE KEY|credentials\.json|google-services\.json' "$f"; then
-    echo "  BLOCKED: $f"
-    exit 1
-  fi
-  if grep -qiE 'DATABASE_URL=postgresql.*:[^@]+@' "$f"; then
-    echo "  BLOCKED: $f (DATABASE_URL with password)"
+  if grep -q 'BEGIN OPENSSH PRIVATE KEY' "$f" 2>/dev/null || grep -q 'BEGIN RSA PRIVATE KEY' "$f" 2>/dev/null; then
+    echo "  BLOCKED: $f (private key)"
     exit 1
   fi
 done < <(find . -type f -print0)