security: remove plaintext dev/Postgres passwords from .cursorrules

These were committed in cleartext and pushed to remote history. Rotate the
dev server SSH password and Postgres 'ladmin' password separately; this
only stops the leak going forward and points at Infisical/vault instead.

.cursorrules

@@ -219,16 +219,18 @@ Types:
 
 ## Development Environment
 
+Credentials are NOT stored in this file (or anywhere in git). See Infisical
+(`LevkinOps` project) / ansible vault for dev server SSH and Postgres
+credentials — ask if you need the lookup path.
+
 ### Dev Server
 - **Host**: 10.0.10.121
 - **User**: appuser
-- **Password**: C0caC0la
 
 ### Dev PostgreSQL
 - **Host**: 10.0.10.181
 - **Port**: 5432
 - **User**: ladmin
-- **Password**: C0caC0la
 
 ## Deployment
 - Use deployment scripts in package.json