fix: storetest + sampledata false positives

- Added storetest/testdata/testutil/mockstore to SKIP_TEST_INFRA_DIRS
- Hardcoded Secret in sample*/fixture*/seed*/fake* files → INFO
(sampledata_util.go passwords are intentional test data)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app.py

@@ -996,7 +996,8 @@ SKIP_FILE_SUFFIXES = frozenset({
 # Directories that are pure test infrastructure (no real code)
 SKIP_TEST_INFRA_DIRS = frozenset({
     "cypress", "__tests__", "__mocks__", "mocks", "stubs",
-    "e2e", "jest", "jasmine",
+    "e2e", "jest", "jasmine", "storetest", "testdata", "testutil",
+    "fakestore", "mockstore", "teststore",
 })
 
 def _is_test_context(path):
@@ -2247,10 +2248,14 @@ def scan_file_content(content, filename):
 
                 # ── Test-context: secrets → INFO ─────────────────────────
                 test_note = ""
-                if test_ctx and actual_vuln == "Hardcoded Secret":
+                _is_sample = re.search(
+                    r'(?i)(sample|fixture|seed|fake|mock|dummy|stub|sampledata)',
+                    filename
+                )
+                if (test_ctx or _is_sample) and actual_vuln == "Hardcoded Secret":
                     actual_sev = "INFO"
                     conf       = "LOW"
-                    test_note  = "Test context — credential is likely mock/fixture data."
+                    test_note  = "Test/sample context — credential is likely mock/fixture data."
 
                 # ── Nearby mitigation check ──────────────────────────────
                 ctx_conf   = _context_confidence(lines, lineno, actual_vuln)