ci: exclude TypeDoc _media/ from secret scan

api/**/_media/ holds TypeDoc-copied example source (.ts/.md) with placeholder
keys like 0x1234567890abcdef… — published examples, not real secrets. Exclude
_media like other generated output so the scan stops failing on the 0.20.8 API
docs. Real-source coverage (hand-authored docs/config, contextual private-key
assignments everywhere) is unchanged.

Author: jhfnetboy

.github/workflows/check-secrets.yml

@@ -29,7 +29,10 @@ jobs:
           NC='\033[0m'
           
           # 排除的目录
-          EXCLUDED_DIRS="node_modules|\.git|\.netlify|\.svelte-kit|build|dist|\.next|contracts/broadcast|contracts/cache|contracts/lib|test-results|playwright-report|\.auth|vendor|cache|out"
+          # _media/ holds TypeDoc-generated example source (.ts/.md) copied into the
+          # API docs; these are published examples with placeholder keys (e.g.
+          # 0x1234…), not real source — exclude them like other generated output.
+          EXCLUDED_DIRS="node_modules|\.git|\.netlify|\.svelte-kit|build|dist|\.next|contracts/broadcast|contracts/cache|contracts/lib|test-results|playwright-report|\.auth|vendor|cache|out|_media"
           
           # 扫描的文件扩展名
           SCAN_EXTENSIONS="\.(ts|tsx|js|jsx|svelte|sol|md|json|env|example|toml|yaml|yml)$"