fix: Exclude known NVS key names from secret detection

The strings check was matching 'auth_secret' (NVS key) and
'secret=%s' (printf format) as false positives. Filter out
known firmware patterns.

.gitea/workflows/lint.yml

@@ -73,7 +73,8 @@ jobs:
           CFG="get-started/csi_recv_router/sdkconfig"
 
           echo "=== Checking for hardcoded secrets ==="
-          if strings "$BIN" | grep -iqE '(password|secret|api_key|apikey)=[^$]'; then
+          if strings "$BIN" | grep -iE '(password|secret|api_key|apikey)=' \
+             | grep -ivE '(auth_secret|secret=%s|secret=\$)'; then
             echo "::error::Potential hardcoded secret found in binary"
             exit 1
           fi