ci(gitleaks): allowlist API doc placeholders

首次 CI run (27015391748) 在 secret-scan 阶段失败，4 个 finding 全是 docs/
里 curl 示例的占位符：
- docs/api.md:454      "api_key": "ap_a1b2c3d4e5f6..."  (响应样例)
- docs/usage-guide.md  Authorization: Bearer ap_your_key (3 处)

扩 .github/gitleaks.toml allowlist:
- paths: 加 docs/api.md, docs/usage-guide.md, docs/*-guide.md
- regexes: 加 ap_your_key, ap_[a-z0-9]+\.\.\., Bearer ap_your, Bearer YOUR_,
  your_(key|token|api_key|secret), YOUR_TOKEN
- 加 regexTarget = "match" 让 regex 匹配命中字符串本身而非整行

下一次 push 后这 4 个 finding 应该不再触发 fail。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/gitleaks.toml

@@ -59,13 +59,24 @@ paths = [
   '''.*tests/.*''',
   '''.*fixtures?/.*''',
   '''.*/MEMORY\.md$''',  # session memory may include token-shaped strings as docs
+  # API doc files — full of curl examples with "ap_your_key" / "ap_xxx..." placeholders
+  '''docs/api\.md$''',
+  '''docs/usage-guide\.md$''',
+  '''docs/.*-guide\.md$''',  # 任何 *-guide.md 文档（同样多 curl 示例）
 ]
+regexTarget = "match"
 regexes = [
   '''<your-key>''',
   '''<set-via-[A-Z_]+-env-var>''',
   '''\$\{[A-Z_]+_API_KEY\}''',
   '''YOUR_API_KEY''',
+  '''YOUR_TOKEN''',
+  '''your_(key|token|api_key|secret)''',
   '''dummy[_-]?key''',
   '''fake[_-]?key''',
   '''sk-xxxx+''',
+  '''ap_your_key''',                 # agentpaas 文档占位符
+  '''ap_[a-z0-9]+\.\.\.''',          # 截断式样例 (ap_a1b2c3d4e5f6...)
+  '''Bearer ap_your''',              # 出现在 curl Authorization 头
+  '''Bearer YOUR_''',                 # 通用 README 写法
 ]