Bump Fly.io proxy VM to 512MB, fix TruffleHog scanning (#152)

## Summary
- Bump Fly.io proxy VM memory from 256MB to 512MB — Alloy was OOM-killed, causing the Grafana Fly.io dashboard to lose metrics
- Fix TruffleHog pre-commit hook to scan only staged changes (`--since-commit HEAD`) instead of full repo history
- Sanitize example credential URL in Reolink camera plan doc

## Deployment and Testing
- [ ] Fly.io deploy triggers automatically on merge (workflow watches `fly/**`)
- [ ] After deploy, verify Alloy is running: `fly ssh console -a blumeops-proxy -C "ps aux"` should show alloy process
- [ ] Grafana Fly.io dashboard should start populating within ~1 minute

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/152

docs/changelog.d/fix-flyio-proxy-oom.bugfix.md

@@ -0,0 +1 @@
+Bump Fly.io proxy VM memory from 256MB to 512MB to prevent Alloy OOM kills.

docs/how-to/plans/operationalize-reolink-camera.md

@@ -172,9 +172,9 @@ ReoLink cameras need go2rtc as an intermediary (direct RTSP from Frigate can dro
 go2rtc:
   streams:
     front_floodlight:
-      - "ffmpeg:http://admin:password@192.168.3.X/flv?port=1935&app=bcs&stream=channel0_main.bcs#video=copy#audio=copy#audio=opus"
+      - "ffmpeg:http://admin:<your-password>@192.168.3.X/flv?port=1935&app=bcs&stream=channel0_main.bcs#video=copy#audio=copy#audio=opus"
     front_floodlight_sub:
-      - "ffmpeg:http://admin:password@192.168.3.X/flv?port=1935&app=bcs&stream=channel0_sub.bcs"
+      - "ffmpeg:http://admin:<your-password>@192.168.3.X/flv?port=1935&app=bcs&stream=channel0_sub.bcs"
 
 cameras:
   front_floodlight: