docs(tooling): match the hook description to the hook's real scope

Two post-merge review findings on PR #11, both in prose the same PR added.

`make hooks` advertised "prettier + next lint under frontend/", which
overstates the linter: prettier does run across the workspace, but
`next lint` only reaches `frontend/apps/web`, the one package with a
`lint` script. CONTRIBUTING called the block above it a
"lint / typecheck / test / secret-scan" pass while listing three
commands and no secret scan — there is no `make` target for it, and
saying so is more useful than implying a missing command.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: cemililik

.github/CONTRIBUTING.md

@@ -103,9 +103,10 @@ The pre-commit hook (activated by `make install`) runs, on staged files only:
 `frontend/`**; `next lint --fix` on JS / TS under `frontend/apps/web` — the one
 workspace with a `lint` script, so this is exactly what `pnpm -r lint` covers in
 CI; and, when the binary is on PATH, `leakwatch scan fs <staged-file>`. So the
-lint / typecheck / test / secret-scan pass above is mostly a sanity check. CI
-re-runs every check as a hard gate, so a bypassed local commit will fail the PR
-build.
+three commands above are mostly a sanity check. There is deliberately no
+`make secret-scan` to pair with them — the hook and CI are the scanner's only
+runners, and CI re-runs every check as a hard gate, so a bypassed local commit
+will fail the PR build.
 
 Prettier stops at the `frontend/` boundary, and the root `.prettierignore`
 is what enforces it in your editor — `.vscode/settings.json` maps `[markdown]`

Makefile

@@ -149,7 +149,7 @@ install: .env hooks ## Restore backend NuGet + frontend pnpm deps + activate git
 .PHONY: hooks
 hooks: ## Activate the repo's pre-commit hook (.githooks/pre-commit).
 	@git config core.hooksPath .githooks
-	@printf "$(CYAN)git hooks → .githooks/ (pre-commit: dotnet format on *.cs, prettier + next lint under frontend/, leakwatch if available)$(RESET)\n"
+	@printf "$(CYAN)git hooks → .githooks/ (pre-commit: dotnet format *.cs | prettier frontend/ | next lint frontend/apps/web | leakwatch if present)$(RESET)\n"
 
 # ─── Env scaffolding ──────────────────────────────────────────────────────
 # `.env` is gitignored; this rule copies `.env.example` on first run so the