feat(npm): enhance .npmignore and add prepublish check script

Updated .npmignore to include sensitive files such as .env and key files, ensuring they are excluded from npm packages. Introduced a new script, check-pack.ts, to validate that no sensitive files are included in the npm tarball before publishing. Updated package.json to include the new script in the prepublish process and expanded the files whitelist for packaging.

.npmignore

@@ -1,3 +1,11 @@
 docs/
 .claude/
 .cursor/
+
+# 密钥文件：package.json 的 files 白名单之外的第二道防线。
+# 注意 .npmignore 一旦存在就会完全接管 .gitignore，.gitignore 里的规则不再生效。
+.env
+.env.*
+!.env.example
+*.pem
+*.key