feat: sanitized agent config — Nexus no longer reads secrets from openclaw.json

- Mount agents-sanitized.json (agents key only, no secrets) instead of full openclaw.json
- Update AgentService default path from /home/node/.openclaw/openclaw.json to /etc/nexus/agents-sanitized.json
- Add AgentConfigPath env var to compose for explicit path configuration
- Generate sanitized file in deploy-nexus.sh before each deploy using Python extraction
- Add agents-sanitized.json to .gitignore

Eliminates the fragile ACL on openclaw.json (uid 1654) that causes 500 errors
on the Board endpoint when lost.

compose.yaml

@@ -64,6 +64,7 @@ services:
       Integrations__OpenClaw__Password: ${OPENCLAW_GATEWAY_PASSWORD:-}
       Admin__ResetToken: ${Admin__ResetToken:-}
       NexusApiKey: ${NEXUS_API_KEY:-}
+      AgentConfigPath: /etc/nexus/agents-sanitized.json
     extra_hosts:
       - host.docker.internal:host-gateway
     depends_on:
@@ -77,7 +78,7 @@ services:
       retries: 3
       start_period: 15s
     volumes:
-      - /home/projekte_bao/openclaw/data/openclaw/openclaw.json:/home/node/.openclaw/openclaw.json:ro
+      - /home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json:/etc/nexus/agents-sanitized.json:ro
       - /home/projekte_bao/openclaw/data/openclaw/workspace-iris:/mnt/workspace-iris
       - /home/projekte_bao/openclaw/data/openclaw/workspace-programmer:/mnt/workspace-programmer
       - /home/projekte_bao/openclaw/data/openclaw/workspace-reviewer:/mnt/workspace-reviewer