Fix 4 false positive sources + restore AI engine connectivity

- HF API URL: api-inference → router.huggingface.co (HTTP 410 fix)
- _UNIT_TEST_FILE_RE: now catches *.test.api.ts multi-extension patterns
- PHP SQL rule: exclude JS template literals ${} (was flagging TS log messages)
- Debug Enabled rule: remove bare 'key' keyword (was matching 'foreign key')

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app.py

@@ -83,7 +83,7 @@ RULES = [
      "HIGH"),
 
     ("SQL Injection","CRITICAL",
-     r'(?i)["\'].*(SELECT|INSERT|UPDATE|DELETE|WHERE|FROM)\s+.*["\']\s*\.\s*\$(?!_SESSION)',
+     r'(?i)["\'].*(SELECT|INSERT|UPDATE|DELETE|WHERE|FROM)\s+.*["\']\s*\.\s*\$(?!_SESSION)(?!\{)',
      "PHP SQL query with direct variable concat (not session)",
      "Replace with PDO prepared statements: $stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?'); $stmt->execute([$id]);",
      "HIGH"),
@@ -536,7 +536,7 @@ RULES = [
      "HIGH"),
 
     ("Debug Enabled","MEDIUM",
-     r'(?i)(console\.log|print|var_dump|debug)\s*\([^)]*\b(password|token|secret|key|api_key)\b',
+     r'(?i)(console\.log|print|var_dump|debug)\s*\([^)]*\b(password|token|secret|api_key|apikey|auth_key|private_key|secretkey)\b',
      "Sensitive value logged to console/output",
      "Remove sensitive data from logs. Use structured logging with field filtering.",
      "HIGH"),
@@ -1600,7 +1600,7 @@ def scan_file_content(content, filename):
 # ══════════════════════════════════════════════════════════
 #  ZEROCYBER-SLM AI ENGINE  (Mistral-7B · HF Inference API)
 # ══════════════════════════════════════════════════════════
-HF_MODEL_URL = "https://api-inference.huggingface.co/models/mistralai/Mistral-7B-Instruct-v0.3"
+HF_MODEL_URL = "https://router.huggingface.co/hf-inference/models/mistralai/Mistral-7B-Instruct-v0.3"
 
 def zerocyber_ai_analyze(findings, repo_name, hf_token):
     """AI-powered deep analysis of top findings using ZeroCyber-SLM AI Engine."""
@@ -1800,7 +1800,12 @@ def parse_repo_url(url):
     return None, None, "Invalid URL. Use: owner/repo or https://github.com/owner/repo"
 
 
-_UNIT_TEST_FILE_RE = re.compile(r'(spec|test)\.[a-z]+$', re.IGNORECASE)
+# Matches: 2faSpec.ts  *.spec.ts  *.test.js  *.test.api.ts  (any multi-extension pattern)
+_UNIT_TEST_FILE_RE = re.compile(
+    r'(spec|test)\.[a-z]'   # *Spec.ts  *Test.js  *spec.ts
+    r'|\.(spec|test)\.',     # *.spec.ts  *.test.api.ts  (embedded between dots)
+    re.IGNORECASE
+)
 
 def _should_skip(path):
     p     = path.lower()