fix(scanner): skip STOR-004 on ERC-20 contract addresses

[Markeljan]

Summary

The storage rule's STOR-004 "Hardcoded token detected" pattern was matching any variable named *token* paired with a 16+ char quoted value. That collides with the standard Web3 pattern of fromToken="0x..." / toToken="0x..." / SELL_TOKEN="0x..." carrying ERC-20 contract addresses — those are public on-chain identifiers, not credentials.

What changed

• packages/scanner/src/rules/storage.ts — added isEvmAddressContext(content, index) and wired it into the scan loop alongside the existing isInComment / isExampleValue skips. Skip when the value is "0x" + 40 hex chars and the identifier portion (before = or :) contains token, addr, address, or contract. Splitting on the assignment operator means a trailing comment can't spoof the hint check.
• packages/scanner/src/tests/storage.test.ts — two new tests:
  • does not flag ERC-20 contract addresses as auth tokens — covers fromToken=, toToken=, SELL_TOKEN=, BUY_TOKEN=, tokenAddress:
  • still flags JWT-style tokens even when var name contains 'token' — guards against over-broad exclusion (eyJ... JWT still detected)

Impact

Re-running bun run compare:web3:

• Odos: 51 D → 88 B (past the original ~70+ target)
• "Hardcoded token detected" findings: 0 across all 11 router fixtures (was producing two false positives per router with fromToken=/toToken= examples)
• Full storage rule suite: 60/60 tests pass, 100% line coverage on storage.ts

Reviewer notes

• The exclusion is intentionally narrow: it requires the value to match exactly "0x" + 40 hex (the EVM address shape) and an identifier hint. Auth tokens that happen to start with 0x but aren't 40-hex-char addresses still trigger.
• Other STOR-* patterns (api_key, client_secret, password, AWS/GitHub/OpenAI/Slack value-pattern detectors) are unaffected — their identifier or value patterns don't collide with EVM addresses.
• The two pre-existing failures in e2e/web3.test.ts (WEB3_RULES registry rule-count expectations) are present on the clean tree and unrelated to this change.

Test plan

• bun test packages/scanner/src/__tests__/storage.test.ts — 60 pass, including 2 new
• bun run compare:web3 — Odos 88 B, zero Hardcoded token detected across all 11 routers
• Sanity-check that the regenerated comparison artifacts still render correctly in the landing page (not bundled here — pre-existing unrelated changes in this tree)

🤖 Generated with Claude Code