[SizzleUnrlsd]

Summary

Two more recommendations of the manual audit under tests-project/: secrets in configuration files, and a coverage metric that tells "no findings" from "nothing analysed".

• Tests first (test: define configuration-file secrets and analysis coverage), implementation follows.
• config-secrets, a project plugin: the key-value pairs of .env, YAML, TOML, JSON, INI and properties files under the project root are judged with the same provider patterns, credential names and entropy rule as Python literals, one finding per value with a redacted preview. Virtual environments and tooling directories are skipped, files are decoded by their byte order mark, and Python files stay with the module detector. The provider patterns and credential names move to the SecretDetector base as defaults so both plugins share them. This is what finds the Bearer tokens in MiniBookApiServer's Insomnia export, a UTF-16 YAML file.
• Coverage: per file, analysed, syntax-error or unreadable, with the functions found and the functions lowered. ProjectAnalysis and the new engine.analyze_file carry it, Report renders it, as a last line in text (coverage: 2/4 files, 3/4 functions) and as a block with per-file detail in JSON. Existing expectations on the text output gain that line.
• source.decode_text honours UTF-8 and UTF-16 byte order marks for every file the engine reads, Python sources and manifests included; the manifest-only helper goes away.
• ProjectContext.root and interprocedural.discover_files give project plugins the same file discovery the engine uses.

Left from the audit: plaintext password storage and private data served from static.