fix: skip constants with secret-like names

[0xUXDesign]

Summary

• Constants whose names end with KEY, SECRET, TOKEN, PASSWORD, or CREDENTIAL (as underscore-delimited word segments) are now skipped during extraction
• Defense-in-depth: prevents accidental credential storage in the knowledge graph
• Non-secret constants with partial matches (KEYBOARD_SHORTCUT, TOKEN_LIMIT, SECRET_SAUCE_RECIPE) are correctly preserved — pattern only matches suffix positions

Test plan

• 6 secret-named constants verified as skipped (DATABASE_PASSWORD, STRIPE_SECRET_KEY, AWS_ACCESS_KEY, AUTH_TOKEN, API_KEY, JWT_CREDENTIAL)
• 3 non-secret constants with partial matches verified as kept (KEYBOARD_SHORTCUT, TOKEN_LIMIT, SECRET_SAUCE_RECIPE)
• Existing INTERNAL_KEY test updated (now skipped instead of extracted)
• Full suite: 170 tests pass, no regressions

🤖 Generated with Claude Code