chore: stop tracking per-install secrets in config

- gitignore config/security-private.php (CSRF/nonce + rate-limit signing
  salt); it is a per-install secret Grav auto-generates and its own header
  says not to commit. Each environment now keeps its own uncommitted salt.
- drop the runtime-generated popularity.salt from api.yaml; Grav re-derives
  it per install.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU

.gitignore

@@ -9,5 +9,6 @@
 /config/plugins/git-sync.yaml
 /config/plugins/api-private.php
 /config/security.yaml
+/config/security-private.php
 /config/versions.yaml
 /themes/intotheeast/node_modules/