sanitize: redact secrets from docs, add forefront-broadband-map, exclude backup dir

- Redact credentials/keys from README, key-inventory, model-chain, ops-portal docs, project-log, systems-networks-team, app3
- Add forefront-broadband-map.md with sanitized content
- Add .gitignore to permanently exclude .backup-before-sanitize-20260723/ and .env files
- No credentials rotated; no history rewritten

README.md

@@ -271,7 +271,7 @@ All SSL certificates issued via Let's Encrypt through Caddy. All certs auto-rene
 - **DNS trap:** `itpropartner.com` uses SiteGround nameservers. Cloudflare zone is NOT authoritative. Always verify with `dig NS domain.com` before creating records.
 - **SiteGround:** No API access. All DNS changes are manual through SiteGround panel.
 - **Provider diversity:** core-bu stays at Hetzner specifically so a netcup outage can't kill both Core and standby simultaneously.
-- **app3 MySQL:** Root password at `MOQMINFQIhklM0AF`, accessible via 127.0.0.1:3306.
+- **app3 MySQL:** Root password in Vaultwarden + `/root/.my.cnf` on app3, accessible via 127.0.0.1:3306.
 - **CloudPanel:** SQLite DB at `/home/clp/htdocs/app/data/db.sq3` — users live here, not in MySQL.
 - **AWS CLI PATH:** All backup scripts must use `/opt/awscli-venv/bin/aws` or `source /opt/awscli-venv/bin/activate` — `aws` bare fails in cron context (PATH doesn't include venv bin). Documented in server-provisioning-standard v1.3.0.
 - **Backup verification:** Always run at least one manual backup after provisioning a server and verify it landed in S3 — never trust cron entries alone. Silent failures (`aws: command not found`, wrong file paths, S3 permission issues) won't surface otherwise.