Perplexity API keys

• gitleaks 8.30.1

Graduated arrival contract (registry detector since redact-secret#730). Lexical separability decided before authoring (#212): the provider-documented pplx- prefix plus a fixed 48-character alphanumeric body separates a key from every recorded confusable (pplx- model ids such as pplx-embed-v1-0.6b, package/host names, docs placeholders, masked values), none of which carries a 48-character alphanumeric run after the dash. The prefix is provider-documented (docs.perplexity.ai admin api-key-management); the body width and alphabet are tool-corroborated only (gitleaks 8.30.1 perplexity-api-key, osv-scalibr perplexityapikey, likely one lineage), and flare-redact's 40-60 range contradicts the exact 48. The contract is therefore T2: the weakest frozen field its positives and length twins depend on is a peer rule. The gitleaks false-positive convention (pplx- followed by 48 repeated "x") satisfies this pattern and is not authored as a control. The org Analytics API key and MCP OAuth tokens are other Perplexity credentials of undocumented shape; neither is claimed, and neither is a control. An OpenRouter sk-or-v1- key stored in PERPLEXITY_API_KEY is a real secret of another family and is not a control either.