fix: redact Gemini key; exclude audit/log tables from seed exporter

- Redact AIzaSy Gemini key from clinical_audit_trail entries in seed JSON
- Add default never-export denylist to exportMasterSeedData() so that
  clinical_audit_trail, lab_log, bridge_sync_queue and session tables are
  always skipped when setup.seed.export_tables is not configured.
  This prevents API keys set via the admin UI from leaking into git via
  the audit trail even after being deleted from hospital_setting.

app/Controllers/Setup.php

@@ -259,6 +259,26 @@ class Setup extends BaseController
             $tables = $this->db->listTables();
             $exportedAllTables = true;
         }
+        // Tables that must never be exported in all-tables mode:
+        // audit trails, session logs, queue tables, and CI framework internals
+        // can contain secret values (API keys set via admin UI) or sensitive data.
+        $neverExport = [
+            'clinical_audit_trail',
+            'lab_log',
+            'bridge_sync_queue',
+            'ci_sessions',
+            'sessions',
+            'auth_token_logins',
+            'auth_logins',
+            'auth_remember_tokens',
+            'patient_duplicate_log',
+        ];
+
+        if ($exportedAllTables) {
+            $tables = array_values(array_filter($tables, static function ($t) use ($neverExport): bool {
+                return ! in_array(strtolower((string) $t), $neverExport, true);
+            }));
+        }
 
         $seedPayload = [
             'generated_at' => date('Y-m-d H:i:s'),

app/Database/master_seed_data.json

@@ -1575,7 +1575,7 @@
                 "record_id": "GEMINI_API_KEY",
                 "field_name": "GEMINI_API_KEY",
                 "old_value": "\"\"",
-                "new_value": "\"AIzaSyBSHpC1N7drS721o7KRZiMWygPK4CopNQI\"",
+                "new_value": "\"REDACTED_GEMINI_API_KEY\"",
                 "user_id": "1",
                 "action_at": "2026-02-21 19:34:24",
                 "hash": "dfc6370231d5fec4c562914546b5aea6fa79e1a8fe86d84ba9ba31c121cdcfcb",