fix: stop tracking .env files with committed secrets

.env.development had a real Postgres/Redis password and JWT secret
committed in plain text; .env.test and .env.prod were tracked too.
Untrack all .env* files going forward and add .env.example as the
onboarding template instead.

Note: the exposed dev credentials are still in git history and must
be rotated separately.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitignore

@@ -38,3 +38,8 @@ Thumbs.db
 docker/postgres/data/
 docker/redis/data/
 docker/minio/data/
+
+# Environment files (secrets) — never commit real credentials
+.env
+.env.*
+!.env.example