fix: deduplicate JS findings and fix S3 scan phase path

- Add js-secrets.txt to rawToJSON and shouldSkipArtifact so raw TXT
  findings are skipped when the structured JSON equivalent exists
- Fix domain workflow S3 scan phase reading buckets from wrong path
  (was checking domainDir/s3/, scanner writes to resultsDir/s3/domain/)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: h0tak88r

internal/api/api.go

@@ -1823,6 +1823,7 @@ func shouldSkipArtifact(path string) bool {
 		"kxss-results.txt",
 		"exposure-findings.txt",
 		"wp-confusion-results.txt",
+		"js-secrets.txt",
 		"nuclei-summary.txt",
 		"all-subs.txt",
 		"live-subs.txt",

internal/api/scan_results_api.go

@@ -1839,6 +1839,8 @@ func apiScanParsedResults(c *gin.Context) {
 		"ffuf-webhook-messages.txt":  "ffuf-results.json",
 		"kxss-results.txt":           "xss-reflection-vulnerabilities.json",
 		"exposure-findings.txt":      "exposure-vulnerabilities.json",
+		// js-secrets.txt is superseded by js-secrets-vulnerabilities.json
+		"js-secrets.txt":             "js-secrets-vulnerabilities.json",
 		"wp-confusion-results.txt":   "wp-confusion-vulnerabilities.json",
 		// URL corpus files — never findings; these are pipeline inputs (lists of URLs/JS files to feed into later scanners)
 		"js-urls.json": "__pipeline_input__",

internal/scanner/domain/domain.go

@@ -158,7 +158,7 @@ func RunDomain(opts ScanOptions) (*Result, error) {
 				return err
 			}
 			// After enumeration, scan each found bucket for permissions/public access.
-			bucketsFile := filepath.Join(domainDir, "s3", "buckets.txt")
+			bucketsFile := filepath.Join(resultsDir, "s3", domain, "buckets.txt")
 			if info, err := os.Stat(bucketsFile); err == nil && info.Size() > 0 {
 				data, _ := os.ReadFile(bucketsFile)
 				for _, bn := range strings.Split(strings.TrimSpace(string(data)), "\n") {