ci: allowlist server-only lib/scan-gemini.js in LLM key gate

The scan pipeline helper lives under lib/ but is imported exclusively
from pages/api/scan/identify — exclude it from the client-side URL scan.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/ci.yml

@@ -174,9 +174,23 @@ jobs:
             done
             exit 1
           fi
+          # lib/ may hold server-only helpers (e.g. scan-gemini.js) imported only from pages/api/.
+          SERVER_ONLY=(
+            lib/scan-gemini.js
+          )
           LLM_PATTERN='generativelanguage\.googleapis\.com|api\.openai\.com'
           FOUND=()
           while IFS= read -r file; do
+            skip=false
+            for so in "${SERVER_ONLY[@]}"; do
+              if [ "$file" = "$so" ]; then
+                skip=true
+                break
+              fi
+            done
+            if [ "$skip" = true ]; then
+              continue
+            fi
             if grep -qE "$LLM_PATTERN" "$file" 2>/dev/null; then
               FOUND+=("$file")
             fi