fix(security): move plaintext API keys to gitignored secrets.fish

.config/fish/conf.d/secrets.fish.example

@@ -0,0 +1,7 @@
+# ~/.config/fish/conf.d/secrets.fish.example
+# Kopiere diese Datei nach secrets.fish und trage deine echten Keys ein:
+# cp secrets.fish.example secrets.fish
+#
+# set -gx GEMINI_API_KEY "dein-gemini-api-key"
+# set -gx JULES_API_KEY "dein-jules-api-key"
+# set -gx GCP_PROJECT_ID "dein-gcp-project-id"

.config/fish/config.fish

@@ -59,11 +59,7 @@ set --global fish_pager_color_prefix normal --bold --underline
 set --global fish_pager_color_progress brwhite --background=cyan
 set --global fish_pager_color_selected_background -r
 
-# API-Keys
+# Secrets and private API keys are loaded automatically from ~/.config/fish/conf.d/secrets.fish (gitignored)
-set -gx GEMINI_API_KEY "AIzaSyBu-u9JIHoPR_wIsjwjelo1lGUzzxKKofQ"
-set -gx JULES_API_KEY "AQ.Ab8RN6LXe33UjfpBGpityANYBO-pHUwZEG7wKoM4V7yWTAezoQ"
-set -gx GCP_PROJECT_ID "gen-lang-client-0990109275"
-# set -gx SSH_AUTH_SOCK "$HOME/Library/Group Containers/2BU85C4SUE.com.1password/t/agent.sock"
 
 
 # Added by Antigravity CLI installer

.gitignore

@@ -4,3 +4,5 @@ Brewfile.lock.json
 .config/nvim/lazy-lock.jsonr
 .gnupg/private-keys-v1.d/*
 todo.md
+.config/fish/conf.d/secrets.fish
+secrets.fish