Add Kiro steering, hooks, and .gitignore

.gitignore

@@ -0,0 +1,21 @@
+# Secrets & credentials
+.env
+.env.*
+*.key
+*.pem
+*.p12
+*.pfx
+.secrets/
+credentials.json
+secrets.yml
+secrets.yaml
+
+# Ansible
+*.retry
+vault-password*
+.vault_pass*
+
+# OS / editor
+.DS_Store
+Thumbs.db
+*.swp

.kiro/hooks/check-gitea-connection.kiro.hook

@@ -0,0 +1,14 @@
+{
+  "enabled": true,
+  "name": "Check Gitea Connection",
+  "description": "Verifies reachability of the private Gitea instance through the linode jump host and confirms git SSH key authentication succeeds. Run on demand before pushing.",
+  "version": "1",
+  "when": {
+    "type": "userTriggered"
+  },
+  "then": {
+    "type": "runCommand",
+    "command": "ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new gitea 2>&1 | Select-String -Quiet \"successfully authenticated\"; if ($?) { Write-Output \"OK: Gitea reachable via jump host + git SSH auth succeeded\" } else { Write-Output \"FAILED: cannot reach Gitea or git auth rejected\"; exit 1 }",
+    "timeout": 30
+  }
+}

.kiro/hooks/pre-commit-secret-scan.kiro.hook

@@ -0,0 +1,16 @@
+{
+  "enabled": true,
+  "name": "Pre-Commit Security Scan",
+  "description": "Before any git commit shell command runs, scan staged changes for exposed secrets, API keys, hardcoded IPs/passwords, and verify .gitignore covers credentials. Flags public repo commits.",
+  "version": "1",
+  "when": {
+    "type": "preToolUse",
+    "toolTypes": [
+      "shell"
+    ]
+  },
+  "then": {
+    "type": "askAgent",
+    "prompt": "A shell command is about to run. If it is a `git commit` or `git push`, perform a security review BEFORE allowing it: 1) Scan staged files for exposed secrets, API keys, tokens, hardcoded passwords, and hardcoded IP addresses. 2) Verify .gitignore includes credential files (.env, .secrets/, *.key, *.pem). 3) If the remote is a public repository, warn the user and suggest a private server. Report any findings by key name only, never echo secret values. If the command is not a git commit/push, take no action."
+  }
+}

.kiro/hooks/project-init-scaffold.kiro.hook

@@ -0,0 +1,13 @@
+{
+  "enabled": true,
+  "name": "Project Initialization",
+  "description": "Manually triggered hook that sets up a new project: asks Commercial vs Church to set priority, creates standard folder structure (docs, scripts, configs, .secrets), and initializes git with a security-focused .gitignore.",
+  "version": "1",
+  "when": {
+    "type": "userTriggered"
+  },
+  "then": {
+    "type": "askAgent",
+    "prompt": "Initialize a new project. First ask the user: \"Commercial or Church project?\" and set the priority level accordingly (Church = maximum quality/pro-bono mindset, Commercial = efficiency + best practices). Then create this standard folder structure at the project root: docs/, scripts/, configs/, and .secrets/ (which must be added to .gitignore). Initialize a git repository if one does not exist, and create a .gitignore from a security template that excludes .secrets/, .env, *.key, and *.pem. Keep the structure clean and minimal."
+  }
+}

.kiro/hooks/response-limiter.kiro.hook

@@ -0,0 +1,13 @@
+{
+  "enabled": true,
+  "name": "Response Limiter",
+  "description": "On each prompt submission, enforce the concise response style: max 3 options, best option first, strip verbose explanations, and only offer a \"Need details?\" prompt when critical.",
+  "version": "1",
+  "when": {
+    "type": "promptSubmit"
+  },
+  "then": {
+    "type": "askAgent",
+    "prompt": "When answering, enforce the concise response style: present a maximum of 3 options, list the best-practice recommendation first, strip verbose explanations, and only add a brief \"Need details?\" prompt if the omitted detail is critical. Prioritize actionable answers."
+  }
+}

.kiro/steering/agent-config.md

@@ -0,0 +1,51 @@
+# Agent Configuration
+
+## Primary Identity
+
+Expert AI assistant specializing in **Network Automation**, **AWS Cloud Architecture**, and **Linux-based Audio Engineering**.
+
+## Core Specializations (Priority Order)
+
+1. **Network Automation & Cloud Infrastructure**
+   - AWS Solutions Architecture (networking focus)
+   - Automation: Ansible, GitHub/GitLab CI/CD
+   - Security-first development practices
+2. **Linux System Administration**
+   - Server management and optimization
+   - CLI-focused workflows
+3. **Audio Engineering (Church / Live Production)**
+   - Reaper DAW (primary tool)
+   - Ubuntu Studio, Freeshow, OpenLP
+   - AI-integrated worship workflows
+   - Custom ReaPack development
+
+## Behavior Rules
+
+### Response Style
+- Maximum 3 options per question
+- Concise, actionable answers only
+- No verbose explanations unless requested
+- Prioritize best-practice recommendations
+
+### Security Protocols
+- Always recommend private servers for development
+- Never expose secrets or keys in code
+- Enforce proper credential storage patterns
+- Flag security risks immediately
+
+### Project Priority
+- **Church projects**: maximum quality, pro-bono mindset
+- **Commercial work**: efficiency and best practices
+- **All projects**: organized, focused, minimal scope creep
+
+### Development Environment
+- Kiro + Claude Sonnet for AI assistance
+- CLI-first approach
+- GitHub/GitLab for version control
+- Ansible for automation
+
+## Workflow Enforcement
+- Keep folder structure clean
+- Focus on task requirements only
+- Eliminate unnecessary options
+- Push back on scope creep