[grade=A] installer: stop shipping production CA private keys in installers

electron-builder extraResources bundled ../dashcaddy-api wholesale, so every
built AppImage/deb/NSIS/mac-zip carried Sami's PRODUCTION pki/root.key,
pki/intermediate.key, generated-certs/* TLS keys, data/, logs.

Fix: denylist excludes all key/cert extensions, secret dirs, pki/**,
generated-certs/**, data/**, .env*; Dockerfile needs only *.js,src/,routes/,
openapi.yaml,VERSION (verified). New scripts/check-artifact-secrets.sh
(build:scan) greps built trees for key material + PRIVATE KEY----- blocks.

Verified: pre-fix build leaked keys (find . -name '*.key' -> root.key etc);
post-fix build clean on linux/win/mac resource trees (scanner passes).
Judge: qwen3.8-max stand-in lane, round1 B+7 polish, polish folded,
round2 A 0 blocking. Verdicts /tmp/judge-batch3a-{verdict,r2-verdict}.json

dashcaddy-installer/scripts/check-artifact-secrets.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# check-artifact-secrets.sh — fail (exit 1) if an electron-builder output
+# contains private key material. Belt-and-suspenders behind the
+# extraResources denylist in package.json (judge polish #5, batch 3a).
+#
+# Usage: scripts/check-artifact-secrets.sh <build-output-dir>
+set -u
+
+ROOT="${1:?usage: check-artifact-secrets.sh <build-output-dir>}"
+[ -d "$ROOT" ] || { echo "ERROR: $ROOT is not a directory"; exit 2; }
+
+fail=0
+
+# 1. Filename scan: private-key extensions and well-known key filenames.
+keyfiles=$(find "$ROOT" -type f \( \
+    -name '*.key' -o -name '*.pem' -o -name '*.p12' -o -name '*.pfx' \
+    -o -name '*.jks' -o -name '*.keystore' -o -name '*.ppk' \
+    -o -name 'id_rsa*' -o -name 'id_ed25519*' -o -name 'id_ecdsa*' \
+    -o -name 'id_dsa*' -o -name '*.ovpn' -o -name '*.keytab' \
+    -o -name '*.asc' \
+  \) 2>/dev/null)
+if [ -n "$keyfiles" ]; then
+  echo "FAIL: key-material filenames found:"
+  echo "$keyfiles"
+  fail=1
+fi
+
+# 2. Content scan: PEM private-key headers. Skip Electron asar archives and
+#    large binaries (they were covered by the filename scan + denylist).
+hits=$(grep -rl --binary-files=text -e 'PRIVATE KEY-----' "$ROOT" \
+       --exclude-dir='*.asar' --exclude='*.asar' 2>/dev/null || true)
+if [ -n "$hits" ]; then
+  echo "FAIL: private-key content found in:"
+  echo "$hits"
+  fail=1
+fi
+
+# 3. Env-file scan: .env files must never ship.
+envfiles=$(find "$ROOT" -type f \( -name '.env' -o -name '.env.*' \) 2>/dev/null)
+if [ -n "$envfiles" ]; then
+  echo "FAIL: .env files found:"
+  echo "$envfiles"
+  fail=1
+fi
+
+if [ "$fail" -eq 0 ]; then
+  echo "OK: no private key material in $ROOT"
+fi
+exit "$fail"