policies: add standard policy files, formatting, and secret scanning

- Add .editorconfig, .prettierrc, .prettierignore, .gitignore
- Add Makefile with fmt, fmt-check, secret-scan, test (skip) targets
- Add package.json with prettier
- Add tools/secret-scan.sh
- Add .secret-scan-allowlist for documentation token format references
- Sanitize documentation to use generic placeholders
- Auto-format with prettier
- make check passes clean

docs/TROUBLESHOOTING.md

@@ -5,12 +5,14 @@
 The most common error. The OAuth token has a ~8 hour lifetime.
 
 **Check:**
+
 1. Is the sync service running? `systemctl status sync-oauth-token.service`
 2. Is inotifywait watching? `pgrep -af inotifywait`
 3. Is the source credentials file being updated? `stat /root/.openclaw/workspaces/workspace-claude-proxy/config/.claude/.credentials.json`
 4. Check service logs: `journalctl -u sync-oauth-token.service -f`
 
 **Fix:**
+
 - If service stopped: `systemctl restart sync-oauth-token.service`
 - If token expired everywhere: run `./scripts/refresh-claude-token.sh` manually
 - Nuclear option: `claude login` inside the Claude CLI container, then restart sync service
@@ -24,6 +26,7 @@ This is a Docker Compose design behavior, not a bug.
 `docker compose restart` only sends SIGTERM and restarts the container process. The container keeps its original environment variables from creation time.
 
 **Always use:**
+
 ```bash
 cd /root/openclaw
 docker compose down openclaw-gateway
@@ -43,7 +46,7 @@ OpenClaw's `isValidProfile()` for `type: "oauth"` checks for `cred.access`, not
   "anthropic:default": {
     "type": "oauth",
     "provider": "anthropic",
-    "key": "sk-ant-oat01-..."   <-- WRONG
+    "key": "<access-token-value>"   <-- WRONG
   }
 }
 ```
@@ -53,12 +56,13 @@ The profile is silently skipped and falls through to the env var.
 **Fix:** Run `./scripts/fix-auth-profiles.sh`
 
 The correct format is:
+
 ```json
 {
   "anthropic:default": {
     "type": "oauth",
     "provider": "anthropic",
-    "access": "sk-ant-oat01-..."  <-- CORRECT
+    "access": "<access-token-value>"  <-- CORRECT
   }
 }
 ```
@@ -70,6 +74,7 @@ The correct format is:
 This happens when you add `anthropic` to `models.providers` in `openclaw.json`.
 
 **Do NOT do this:**
+
 ```json
 "models": {
   "providers": {
@@ -92,6 +97,7 @@ The built-in Anthropic provider already handles routing. Adding a custom one wit
 Auth profiles enter a cooldown period after repeated failures (e.g., expired tokens, wrong model names).
 
 **Fix:**
+
 ```bash
 ./scripts/fix-auth-profiles.sh
 ```
@@ -105,6 +111,7 @@ This clears `cooldownUntil`, `errorCount`, and `failureCounts` from all agent au
 The watched file or directory doesn't exist yet.
 
 **Check:**
+
 - Does the Claude CLI container exist? `docker ps | grep claude`
 - Does the credentials path exist? `ls -la /root/.openclaw/workspaces/workspace-claude-proxy/config/.claude/`
 - Has Claude CLI been authenticated? You may need to run `claude login` inside the container first.