6e47d01c32
Bundle budget was warning-only: initial warning 700 kB, error 1.8 MB. Measured today the initial bundle is 1.55 MB raw / 324.58 kB transfer - up from the 1.15 MB measured on 11 August, so it had been growing with nothing to stop it. Lowers maximumError to 1.6 MB. That is a ratchet, not a target: just above today's size so the bundle cannot grow, with the 700 kB warning left in place as the goal. Lower it each time the number comes down. Adds scripts/ci/scan-bundle.sh (npm run scan:bundle), run in CI after the build. Seven patterns: both provider auth headers, the partner ID shape, client_secret, private key blocks, AWS keys, Telegram bot tokens. The legacy payment code that put credentials in the browser is already deleted; this is what stops it coming back. Verified in both directions - clean against the real dist, exit 1 against a planted credential. Measurement also corrected two assumptions recorded in the harvest TODO: admin and editor code is already lazy-loaded, so the initial bundle is main alone rather than a deployable-split problem; and mock gateway fixtures do reach production chunks, which is now filed as FH-E.6 with the cause identified. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>