feat(01-04): add shared Chunk type, Finding struct, Shannon entropy, and MaskKey

- pkg/types/chunk.go: shared Chunk struct breaking engine<->sources circular import
- pkg/engine/finding.go: Finding struct with MaskKey for pipeline output
- pkg/engine/entropy.go: Shannon entropy function using math.Log2
- pkg/engine/entropy_test.go: TDD tests for Shannon and MaskKey

pkg/engine/entropy.go

@@ -0,0 +1,23 @@
+package engine
+
+import "math"
+
+// Shannon computes the Shannon entropy of a string in bits per character.
+// Returns 0.0 for empty strings.
+// A value >= 3.5 indicates high randomness, consistent with real API keys.
+func Shannon(s string) float64 {
+	if len(s) == 0 {
+		return 0.0
+	}
+	freq := make(map[rune]float64)
+	for _, c := range s {
+		freq[c]++
+	}
+	n := float64(len([]rune(s)))
+	var entropy float64
+	for _, count := range freq {
+		p := count / n
+		entropy -= p * math.Log2(p)
+	}
+	return entropy
+}