fix(ci): allowlist dummy test key in gitleaks scan

The dummy value `sk-secret-key-1234567890` in test/tools.test.ts trips
gitleaks' default `generic-api-key` rule (entropy 4.02) and fails the
Secret Scan job on PR #1. It is a test-only fixture explicitly endorsed
by AGENTS.md ("Tests use dummy values ... sk-secret-key-…"), and the
literal value is asserted by the redaction test at line 183, so it
cannot be changed.

An inline `// gitleaks:allow` comment suppresses file-level scans but
NOT gitleaks' PR-range scan: gitleaks inspects each commit patch
separately, and the secret was introduced in 17822e7 before any allow
comment existed, so that patch is still flagged. A per-line comment
cannot retroactively suppress a finding in an earlier commit's patch.

Fix: add .gitleaks.toml that extends the built-in default config
(`extend = { useDefault = true }`, keeping every default rule) and
allowlists only the exact dummy string via a global [allowlist] regex.
Real Bailian keys (sk-ws-…) are never allowlisted. Verified locally with
gitleaks 8.24.3 (matching CI): the PR commit range scans clean.

Author: sommio

.gitleaks.toml

@@ -0,0 +1,15 @@
+title = "qwen-omni-mcp"
+
+# Keep all built-in gitleaks rules (generic-api-key, etc.) and only add a
+# narrow allowlist on top. Do not drop the default config.
+extend = { useDefault = true }
+
+[allowlist]
+description = "Test-only dummy values endorsed by AGENTS.md. Real Bailian (DashScope) keys use the sk-ws-... prefix and are NEVER allowlisted here."
+# tools.test.ts line 11 — dummy fixture asserted by the redaction test at
+# line 183, so the literal value cannot change. Trips generic-api-key
+# (entropy 4.02) in every commit patch that touches the file, including the
+# original introduction commit where no inline gitleaks:allow comment existed.
+regexes = [
+  '''sk-secret-key-1234567890''',
+]

test/tools.test.ts

@@ -8,7 +8,7 @@ import { type AppConfig } from "../src/config.js";
 import { DEFAULT_COMPARE_PROMPT } from "../src/prompts.js";
 import { createServer } from "../src/server.js";
 
-const SECRET_KEY = "sk-secret-key-1234567890";
+const SECRET_KEY = "sk-secret-key-1234567890"; // gitleaks:allow — dummy test fixture, not a real key
 const cfg: AppConfig = {
   apiKey: SECRET_KEY,
   model: "qwen3.7-plus",