feat: expand secure-by-default credential detection

[megamen32]

What changed

Expands the always-on guard patterns so a fresh install protects more provider credentials without requiring a custom .gitpublic/scan.

Added built-in detection for:

• Anthropic
• AWS temporary credentials (ASIA)
• Telegram bot tokens
• npm and PyPI tokens
• Stripe secret/restricted keys
• SendGrid
• Discord bot tokens
• Twilio
• Mailgun
• DigitalOcean

Safe-by-default design

The new patterns are limited to recognizable provider-specific prefixes and structures. Broad assignment-based heuristics such as accessToken = ... were intentionally excluded because they caused noisy false positives on normal source code.

Tests

• Positive coverage for every new provider pattern
• Negative coverage for common variable declarations, hashes and placeholders
• 46 passed
• python -m py_compile passes
• git diff --check passes

Test credentials are assembled from string fragments so GitHub push protection does not mistake fixtures for leaked live secrets.