chore: stop tracking per-install secrets in config

- gitignore config/security-private.php (CSRF/nonce + rate-limit signing
  salt); it is a per-install secret Grav auto-generates and its own header
  says not to commit. Each environment now keeps its own uncommitted salt.
- drop the runtime-generated popularity.salt from api.yaml; Grav re-derives
  it per install.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU

.gitignore

@@ -9,5 +9,6 @@
 /config/plugins/git-sync.yaml
 /config/plugins/api-private.php
 /config/security.yaml
+/config/security-private.php
 /config/versions.yaml
 /themes/intotheeast/node_modules/

config/plugins/api.yaml

@@ -57,4 +57,3 @@ popularity:
   ignore:
     - '/test*'
     - /modular
-  salt: 37517ad926e4f900863af7f1b58718cdccc34f7265dedd09d33b6f820046c510

config/security-private.php

@@ -1,7 +0,0 @@
-<?php
-
-// Auto-generated private secret. Do NOT commit to version control.
-// Used for CSRF nonce signing and admin rate-limit hashing. Regenerate by
-// deleting this file; the next request will write a new value.
-
-return 'lsUHWFkCwvGZrL';