sanitize: redact secrets from docs, add forefront-broadband-map, exclude backup dir

- Redact credentials/keys from README, key-inventory, model-chain, ops-portal docs, project-log, systems-networks-team, app3
- Add forefront-broadband-map.md with sanitized content
- Add .gitignore to permanently exclude .backup-before-sanitize-20260723/ and .env files
- No credentials rotated; no history rewritten

docs/ops-portal/CHANGELOG.md

@@ -28,7 +28,7 @@
 - Server count: 7 → 5 clean entries
 
 ### Changed
-- Admin credentials: germaine/itpp2026! → ippadmin/LoveMyBoys.1520!
+- Admin credentials: germaine/itpp2026! → ippadmin (password → Vaultwarden)
 - JWT_SECRET made persistent in /root/.hermes/.env to survive restarts
 - Collector timeout: 20s → 90s to handle 94K-file S3 bucket scanning
 

docs/ops-portal/README.md

@@ -9,7 +9,7 @@
 - **Data:** `/var/www/ops/data/ops-status.json` (5-min collector refresh)
 - **Collector:** `/root/.hermes/scripts/ops-data-collector.py` — Wazuh, Bitdefender, S3, UISP, system health
 - **Systemd:** `ops-portal.service`, env from `/root/.hermes/.env`
-- **Credentials:** ippadmin / LoveMyBoys.1520!
+- **Credentials:** ippadmin (password → Vaultwarden / `~/.hermes/.env`)
 
 ## Pages (11 total)
 | Page | Path | Description |