chore: allowlist tonymenu.app/astro.build URLs and website lockfile

git-shield flagged the new public domains and Astro's doc links as
"private_url" PII, plus funding/sponsor URLs in website/package-lock.json.
None of these are secrets.

Author: vekexasia

.pii-allowlist

@@ -172,3 +172,8 @@ registry[.]npmjs[.]org
 ^https?://x/chat$
 # Fixed system-clock dates used in vitest rate-limit/daily-cap window tests.
 ^2026-02-01T
+
+# ── TonyMenu marketing site (website/) public domains and doc links ──
+^https?://([a-z0-9-]+\.)*tonymenu\.app(/.*)?$
+^https?://([a-z0-9-]+\.)*astro\.build(/.*)?$
+^https?://astro\.badg\.es(/.*)?$

git-shield.toml

@@ -5,5 +5,9 @@
 # they're public UI strings shipped with the frontend.
 ignore_globs = [
   "web/messages/vec.json",
+  # Generated lockfile: full of public npm package funding/sponsor URLs
+  # (opencollective.com, github.com/sponsors/*) that the PII scanner
+  # mistakes for sensitive data. Not secrets, regenerated on every bump.
+  "website/package-lock.json",
 ]
 allowlist_paths = [".pii-allowlist"]