fix: clear sast-scan and secrets-scan false positives

Both pre-existing pre-issue-#18 findings, surfaced for the first time by
the pr-checks workflow. Fixed at source rather than suppressed so future
scanner additions cannot reintroduce them.

semgrep (4 INFO findings, src/logger.ts:61-64):
  Rule: javascript.lang.security.audit.unsafe-formatstring
  pennyLog passed the prefix as a separate first argument to console.log,
  which the rule treats as a potential format-string injection sink. The
  prefix is built from a closed LogLevel enum (debug|info|warn|error|off)
  and never sees user input, so the finding is a false positive. Refactored
  to concatenate prefix + message into a single line argument up front --
  identical console output, no separate-argument format-string surface.

gitleaks (2 generic-api-key findings, test/providers/google.test.ts):
  Test placeholder values "AIzaSy-test-key-123" / "AIzaSy-valid" / etc.
  matched the pattern used by real Google API keys. Renamed all six
  occurrences to mock-google-* placeholders that no real-key heuristic
  matches. Tests still verify the same path (key forwarded into the
  request URL); only the literal value changed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/logger.ts

@@ -56,12 +56,19 @@ const LOG_LEVELS: Record<LogLevel, number> = { debug: 0, info: 1, warn: 2, error
  */
 export function pennyLog(level: LogLevel, settingLevel: LogLevel, message: string, ...data: unknown[]): void {
   if (LOG_LEVELS[level] >= LOG_LEVELS[settingLevel]) {
-    const prefix = `[PENNY ${level.toUpperCase()}]`;
+    // Build the full prefixed message as a single literal-concatenated string
+    // so it can't be split as a console.log format-string argument. The prefix
+    // is built from a closed LogLevel enum (no user-controlled input), but
+    // passing it as a separate first argument to console.log causes static
+    // analyzers (semgrep) to flag a non-issue. Concatenating up front sidesteps
+    // the false positive and is functionally identical -- console prints
+    // "[PENNY DEBUG] <message>" either way.
+    const line = `[PENNY ${level.toUpperCase()}] ${message}`;
     switch (level) {
-      case "debug": console.log(prefix, message, ...data); break;
-      case "info":  console.info(prefix, message, ...data); break;
-      case "warn":  console.warn(prefix, message, ...data); break;
-      case "error": console.error(prefix, message, ...data); break;
+      case "debug": console.log(line, ...data); break;
+      case "info":  console.info(line, ...data); break;
+      case "warn":  console.warn(line, ...data); break;
+      case "error": console.error(line, ...data); break;
     }
   }
 }

test/providers/google.test.ts

@@ -52,7 +52,7 @@ function makeRequest(overrides: Partial<CompletionRequest> = {}): CompletionRequ
     userPrompt: "Rewrite this passage with more tension.",
     model: "gemini-2.5-flash",
     maxTokens: 4096,
-    apiKey: "AIzaSy-test-key-123",
+    apiKey: "mock-google-test-key-123",
     ...overrides,
   };
 }
@@ -124,7 +124,7 @@ describe("GoogleProvider", () => {
       await provider.complete(makeRequest());
 
       expect(calls[0].url).toBe(
-        "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=AIzaSy-test-key-123"
+        "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=mock-google-test-key-123"
       );
     });
 
@@ -344,7 +344,7 @@ describe("GoogleProvider", () => {
       const { fn } = mockHttp({ status: 200, text: responseText });
       const provider = new GoogleProvider(fn);
 
-      const result = await provider.testConnection({ apiKey: "AIzaSy-valid" });
+      const result = await provider.testConnection({ apiKey: "mock-google-valid" });
       expect(result).toBeNull();
     });
 
@@ -360,7 +360,7 @@ describe("GoogleProvider", () => {
       const { fn } = mockHttp({ status: 401, text: '{"error":{"message":"invalid key"}}' });
       const provider = new GoogleProvider(fn);
 
-      const result = await provider.testConnection({ apiKey: "AIzaSy-bad" });
+      const result = await provider.testConnection({ apiKey: "mock-google-bad" });
       expect(result).toContain("401");
     });
 
@@ -370,7 +370,7 @@ describe("GoogleProvider", () => {
       };
       const provider = new GoogleProvider(fn);
 
-      const result = await provider.testConnection({ apiKey: "AIzaSy-key" });
+      const result = await provider.testConnection({ apiKey: "mock-google-key" });
       expect(result).toContain("Network error");
     });
 
@@ -379,10 +379,10 @@ describe("GoogleProvider", () => {
       const { fn, calls } = mockHttp({ status: 200, text: responseText });
       const provider = new GoogleProvider(fn);
 
-      await provider.testConnection({ apiKey: "AIzaSy-test" });
+      await provider.testConnection({ apiKey: "mock-google-test" });
 
       expect(calls).toHaveLength(1);
-      expect(calls[0].url).toContain("key=AIzaSy-test");
+      expect(calls[0].url).toContain("key=mock-google-test");
       expect(calls[0].url).toContain("gemini-2.0-flash:generateContent");
       const body = JSON.parse(calls[0].body!);
       expect(body.generationConfig.maxOutputTokens).toBe(16);