Chore: gate credentials and private addresses in the check script

[SandObserver]

Summary

• Add a secrets check to scripts/check-dist.mjs over src/ and
  public/api/, the files this repository authors. Covers GitHub, OpenAI-shaped,
  AWS, Google and Slack token patterns, private key blocks, JWTs, and RFC 1918
  addresses. Private addresses stay allowed in Markdown prose, where they are
  documented examples.
• Skip binary files in the hygiene scan. Image bytes were matching the word list.

public/js/ and public/widgets/ are excluded: they are verbatim copies of the
application and carry its own placeholder values.

Testing
npm run build and npm run check pass. Verified the gate by planting a fake
GitHub token and a 192.168.1.42 address in a stub payload: both were reported
and the run failed. Removing them restored a pass.

Checklist

• npm run build and npm run check both pass.
• Product UI is shown by running or capturing it, never recreated in CSS.
• Any new preview or screenshot carries no private hostnames or real data.
• Visual changes verified in both colour schemes and both docs themes.
• Links to the app repo still resolve.