chore: Add Gitleaks configuration and enhance CI workflow for backend validation

This commit introduces a Gitleaks configuration file to manage known false positives and improve security by preventing the accidental exposure of sensitive information. Additionally, it enhances the CI workflow by adding a step to validate backend imports and application structure, ensuring that core modules and API routers can be imported successfully without starting the server or connecting to a database.

tests/test_api_auth.py

@@ -432,6 +432,7 @@ class TestAuthenticationMiddleware:
     def test_get_current_user_with_expired_token(self, test_client: TestClient):
         """Verify 401 with expired JWT."""
         # Create an obviously invalid/expired token
+        # Note: This is a test fixture, not a real secret. The token is intentionally invalid.
         expired_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZG1pbiIsImV4cCI6MTYwOTQ1NjgwMH0.invalid"
         
         response = test_client.get(