[grade=A] installer: stop shipping production CA private keys in installers

electron-builder extraResources bundled ../dashcaddy-api wholesale, so every
built AppImage/deb/NSIS/mac-zip carried Sami's PRODUCTION pki/root.key,
pki/intermediate.key, generated-certs/* TLS keys, data/, logs.

Fix: denylist excludes all key/cert extensions, secret dirs, pki/**,
generated-certs/**, data/**, .env*; Dockerfile needs only *.js,src/,routes/,
openapi.yaml,VERSION (verified). New scripts/check-artifact-secrets.sh
(build:scan) greps built trees for key material + PRIVATE KEY----- blocks.

Verified: pre-fix build leaked keys (find . -name '*.key' -> root.key etc);
post-fix build clean on linux/win/mac resource trees (scanner passes).
Judge: qwen3.8-max stand-in lane, round1 B+7 polish, polish folded,
round2 A 0 blocking. Verdicts /tmp/judge-batch3a-{verdict,r2-verdict}.json

dashcaddy-installer/package.json

@@ -11,7 +11,8 @@
     "build": "electron-builder",
     "build:win": "electron-builder --win",
     "build:mac": "electron-builder --mac",
-    "build:linux": "electron-builder --linux"
+    "build:linux": "electron-builder --linux",
+    "build:scan": "bash scripts/check-artifact-secrets.sh build-output"
   },
   "keywords": [
     "dashcaddy",
@@ -63,7 +64,42 @@
           "!node_modules/**",
           "!.git/**",
           "!**/*.test.js",
-          "!**/*.spec.js"
+          "!**/*.spec.js",
+          "!**/*.key",
+          "!**/*.pem",
+          "!**/*.p12",
+          "!**/*.pfx",
+          "!**/*.jks",
+          "!**/*.keystore",
+          "!**/*.ppk",
+          "!**/*.asc",
+          "!**/id_rsa*",
+          "!**/id_ed25519*",
+          "!**/secrets/**",
+          "!**/.ssh/**",
+          "!**/.aws/**",
+          "!**/.gnupg/**",
+          "!**/*.local",
+          "!**/.npmrc",
+          "!**/.netrc",
+          "!pki/**",
+          "!ca/**/*.key",
+          "!ca/**/*.der",
+          "!ca/**/*.mobileconfig",
+          "!ca/**/*.p12",
+          "!ca/**/*.pem",
+          "!ca/intermediate.crt",
+          "!ca/root.crt",
+          "!ca/scripts/**",
+          "!generated-certs/**",
+          "!data/**",
+          "!coverage/**",
+          "!audit-log.json",
+          "!error.log",
+          "!.env",
+          "!.env.*",
+          "!openapi.yaml.bak",
+          "!dist/**"
         ]
       }
     ],