scan-for-secrets goes from finder to fixer

Finding secrets hiding in your code is only half the battle; the other half is actually removing them without mangling the escaping. @simonw's scan-for-secrets v0.2 and v0.3 (released within hours of each other on April 5–6) solved the harder problem: streaming results as they're found, then redacting matches in place while respecting escape sequences like JSON, shell, and repr. The CLI now accepts multiple directories and individual files, and exposes a Python API for both iterator and non-iterator workflows. The real win: you can now run scan-for-secrets -r, eyeball the matches it found, confirm them, and have it replace every one with REDACTED — all in one pass. No manual find-and-replace, no risk of leaving a credential half-escaped.

v0.2 flips the plugin architecture: datasette-ports still works as a Datasette plugin (giving you datasette ports), but now you can also run it naked via uvx datasette-ports without any Datasette dependency at all. Useful if you're just trying to audit what's running on a box and don't want to drag in the whole framework. Tiny but elegant unbundling.

Compressing a text/event-stream response is a footgun: the client expects Server-Sent Events to arrive as discrete frames, but gzip buffers data for compression efficiency, delaying or coalescing events. @simonw's v0.3 adds a content-type check to skip compression on text/event-stream entirely. datasette-gzip v0.3 follows immediately with a dependency bump to pick up the fix. It's a small exemption with outsized importance for real-time applications.