scanner: text inside code, kbd, pre and samp is code, not prose

ApiKeys.tsx documents the header to send as <code>Authorization: Bearer …</code>.
That is an identifier crossing a boundary on the doc's never-translate list, and
translating it would break the thing it documents. Those four elements exist to mark
content as code, so the scanner now honours them.

Verified the delta across both remaining areas is exactly that one string.

scripts/i18n/scan-hardcoded.ts

@@ -104,6 +104,15 @@ function isHuman(value: string | undefined): value is string {
 const stripComments = (source: string): string =>
   source.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^[ \t]*\/\/.*$/gm, '');
 
+/**
+ * `<code>`, `<kbd>`, `<pre>` and `<samp>` mark content as code rather than prose — that is what the
+ * elements are for. `<code>Authorization: Bearer …</code>` is an HTTP header, which the doc's
+ * never-translate list covers as an identifier crossing a boundary, and translating it would break the
+ * thing it documents.
+ */
+const stripCodeElements = (source: string): string =>
+  source.replace(/<(code|kbd|pre|samp)\b[^>]*>[\s\S]*?<\/\1>/g, '<$1/>');
+
 function* walk(dir: string): Generator<string> {
   let entries: string[];
   try {
@@ -135,7 +144,7 @@ function scan(root: string): { files: number; hits: Hit[] } {
     files++;
     let source: string;
     try {
-      source = stripComments(readFileSync(file, 'utf8'));
+      source = stripCodeElements(stripComments(readFileSync(file, 'utf8')));
     } catch {
       continue;
     }