docs(coderabbit): add optional external tools note and IaC review paths

- Recommend enabling gitleaks, semgrep, checkov in CodeRabbit UI
- Add IaC/container/K8s review instructions under path_instructions
- Keep path fields as strings to satisfy linter

Author: AlmostBald-TRADING

.coderabbit.yaml

@@ -6,6 +6,9 @@ tone_instructions: "Professional tone focusing on security, performance, code qu
 
 # Review configuration
 reviews:
+  # Optional: Consider enabling additional external review tools in CodeRabbit UI
+  # such as gitleaks (secrets scanning), semgrep (SAST), and checkov (IaC scanning)
+  # for broader security coverage. These are configured in the CodeRabbit UI, not here.
   # Path filters for excluding files and directories
   path_filters:
     - "!**/*.pyc"
@@ -58,6 +61,79 @@ reviews:
         - Dependabot configuration
         - Security scanning setup
 
+    # Infrastructure as Code and containerization
+    - path: "**/*.tf"
+      instructions: |
+        Focus on:
+        - IaC security and misconfigurations (least privilege, restricted policies)
+        - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
+        - Container best practices (non-root user, slim base images, healthchecks)
+        - Network exposure and port/security group rules
+        - Kubernetes/Helm best practices (resource limits, probes, RBAC)
+
+    - path: "**/Dockerfile"
+      instructions: |
+        Focus on:
+        - IaC security and misconfigurations (least privilege, restricted policies)
+        - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
+        - Container best practices (non-root user, slim base images, healthchecks)
+        - Network exposure and port/security group rules
+        - Kubernetes/Helm best practices (resource limits, probes, RBAC)
+
+    - path: "**/Dockerfile.*"
+      instructions: |
+        Focus on:
+        - IaC security and misconfigurations (least privilege, restricted policies)
+        - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
+        - Container best practices (non-root user, slim base images, healthchecks)
+        - Network exposure and port/security group rules
+        - Kubernetes/Helm best practices (resource limits, probes, RBAC)
+
+    - path: "**/docker-compose.yml"
+      instructions: |
+        Focus on:
+        - IaC security and misconfigurations (least privilege, restricted policies)
+        - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
+        - Container best practices (non-root user, slim base images, healthchecks)
+        - Network exposure and port/security group rules
+        - Kubernetes/Helm best practices (resource limits, probes, RBAC)
+
+    - path: "**/docker-compose.*.yml"
+      instructions: |
+        Focus on:
+        - IaC security and misconfigurations (least privilege, restricted policies)
+        - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
+        - Container best practices (non-root user, slim base images, healthchecks)
+        - Network exposure and port/security group rules
+        - Kubernetes/Helm best practices (resource limits, probes, RBAC)
+
+    - path: "helm/**/*"
+      instructions: |
+        Focus on:
+        - IaC security and misconfigurations (least privilege, restricted policies)
+        - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
+        - Container best practices (non-root user, slim base images, healthchecks)
+        - Network exposure and port/security group rules
+        - Kubernetes/Helm best practices (resource limits, probes, RBAC)
+
+    - path: "k8s/**/*"
+      instructions: |
+        Focus on:
+        - IaC security and misconfigurations (least privilege, restricted policies)
+        - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
+        - Container best practices (non-root user, slim base images, healthchecks)
+        - Network exposure and port/security group rules
+        - Kubernetes/Helm best practices (resource limits, probes, RBAC)
+
+    - path: "kubernetes/**/*"
+      instructions: |
+        Focus on:
+        - IaC security and misconfigurations (least privilege, restricted policies)
+        - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
+        - Container best practices (non-root user, slim base images, healthchecks)
+        - Network exposure and port/security group rules
+        - Kubernetes/Helm best practices (resource limits, probes, RBAC)
+
     # Documentation (markdown files in root and docs directory)
     - path: "**/*.md"
       instructions: |