Update .gitlab-ci.yml

+stages:
+  - security
+  - deploy
+  
+secret_grep_scan:
+  stage: security
+  tags:
+    - chatgpt-prod
+  script:
+    - |
+      echo "Scanning for hardcoded AI provider API keys..."
+      PATTERN='(VUE_APP|VITE|REACT_APP|NEXT_PUBLIC|EXPO_PUBLIC|PUBLIC)_[A-Z0-9_]*(KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)[A-Z0-9_]*[[:space:]]*[:=]|sk-(proj-)?[A-Za-z0-9_-]{20,}|sk-ant-(api03-)?[A-Za-z0-9_-]{20,}|xai-[A-Za-z0-9]{20,}|AIzaSy[A-Za-z0-9_-]{33}|gsk_[A-Za-z0-9]{20,}|pplx-[A-Za-z0-9]{20,}|hf_[A-Za-z0-9]{30,}'
+      grep -Ern "$PATTERN" --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=vendor --exclude-dir=dist --exclude-dir=build --exclude-dir=_srv --include='*.js' --include='*.jsx' --include='*.ts' --include='*.tsx' --include='*.vue' --include='*.php' --include='*.html' --include='*.env' --include='*.env.*' . > raw-matches.txt || true
+      if [ -s raw-matches.txt ]; then
+        echo "🚨 Hardcoded secret pattern(s) detected. Locations below (values redacted):"
+        awk -F: '{print $1":"$2}' raw-matches.txt | sort -u > secret-locations.txt
+        cat secret-locations.txt
+        echo ""
+        echo "File and line number are shown above."
+        echo "Full match details (values redacted) are saved as an artifact."
+        sed -E \
+          -e 's/(sk-(proj-)?[A-Za-z0-9_-]{6})[A-Za-z0-9_-]+/\1[REDACTED]/g' \
+          -e 's/(sk-ant-(api03-)?[A-Za-z0-9_-]{6})[A-Za-z0-9_-]+/\1[REDACTED]/g' \
+          -e 's/(xai-[A-Za-z0-9]{6})[A-Za-z0-9]+/\1[REDACTED]/g' \
+          -e 's/(AIzaSy[A-Za-z0-9_-]{6})[A-Za-z0-9_-]+/\1[REDACTED]/g' \
+          -e 's/(gsk_[A-Za-z0-9]{6})[A-Za-z0-9]+/\1[REDACTED]/g' \
+          -e 's/(pplx-[A-Za-z0-9]{6})[A-Za-z0-9]+/\1[REDACTED]/g' \
+          -e 's/(hf_[A-Za-z0-9]{6})[A-Za-z0-9]+/\1[REDACTED]/g' \
+          raw-matches.txt > secret-locations-detail.txt
+        rm -f raw-matches.txt
+        echo "Hardcoded secrets detected. Failing pipeline."
+        exit 1
+      else
+        echo "No hardcoded secret patterns found."
+        rm -f raw-matches.txt
+      fi
+  artifacts:
+    name: "secret-scan-locations"
+    paths:
+      - secret-locations.txt
+      - secret-locations-detail.txt
+    when: on_failure
+    expire_in: 7 days
+  only:
+    - branches
+  allow_failure: false
+
 deploy_prod:
 deploy_prod:
   stage: deploy
   stage: deploy
   script:
   script: