sanitize: redact secrets from docs, add forefront-broadband-map, exclude backup dir

- Redact credentials/keys from README, key-inventory, model-chain, ops-portal docs, project-log, systems-networks-team, app3
- Add forefront-broadband-map.md with sanitized content
- Add .gitignore to permanently exclude .backup-before-sanitize-20260723/ and .env files
- No credentials rotated; no history rewritten

docs/ops-portal/README.md

@@ -9,7 +9,7 @@
 - **Data:** `/var/www/ops/data/ops-status.json` (5-min collector refresh)
 - **Collector:** `/root/.hermes/scripts/ops-data-collector.py` — Wazuh, Bitdefender, S3, UISP, system health
 - **Systemd:** `ops-portal.service`, env from `/root/.hermes/.env`
-- **Credentials:** ippadmin / LoveMyBoys.1520!
+- **Credentials:** ippadmin (password → Vaultwarden / `~/.hermes/.env`)
 
 ## Pages (11 total)
 | Page | Path | Description |