fix: stop tracking .env files with committed secrets

.env.development had a real Postgres/Redis password and JWT secret
committed in plain text; .env.test and .env.prod were tracked too.
Untrack all .env* files going forward and add .env.example as the
onboarding template instead.

Note: the exposed dev credentials are still in git history and must
be rotated separately.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.development

@@ -1,21 +0,0 @@
-NODE_ENV=development
-PORT=4501
-
-# Nest build
-BUILD_COMMAND=npm run build:development
-
-# Database
-POSTGRES_HOST=postgres
-POSTGRES_DB=support_dev
-POSTGRES_USER=support_user
-POSTGRES_PASSWORD=z1F3tKF1JNDBQmMq95Up
-DATABASE_URL=postgresql://support_user:z1F3tKF1JNDBQmMq95Up@postgres:5432/support_dev
-
-# Redis
-REDIS_HOST=redis
-REDIS_PORT=6379
-REDIS_PASSWORD=D7FJ7QDKo5gF9KQAO1GL
-
-# Security & CORS
-JWT_SECRET=super-secret-development-jwt-key-32-chars-long
-CORS_ORIGINS=https://support-dev.maskantech.in

.env.example

@@ -0,0 +1,29 @@
+NODE_ENV=development
+PORT=4501
+
+# Build
+BUILD_COMMAND=npm run build:development
+
+# Database
+POSTGRES_HOST=postgres
+POSTGRES_DB=support_dev
+POSTGRES_USER=support_user
+POSTGRES_PASSWORD=CHANGE_ME
+DATABASE_URL=postgresql://support_user:CHANGE_ME@postgres:5432/support_dev
+
+# Redis
+REDIS_HOST=redis
+REDIS_PORT=6379
+REDIS_PASSWORD=CHANGE_ME
+
+# Security & CORS
+JWT_SECRET=CHANGE_ME_32_CHAR_MINIMUM_SECRET
+JWT_ACCESS_EXPIRES=15m
+JWT_REFRESH_EXPIRES=7d
+CORS_ORIGINS=http://localhost:3000
+
+# AWS S3 / storage
+AWS_REGION=us-east-1
+AWS_S3_BUCKET=supporthub-attachments
+AWS_ACCESS_KEY_ID=CHANGE_ME
+AWS_SECRET_ACCESS_KEY=CHANGE_ME

.env.prod

@@ -1,20 +0,0 @@
-NODE_ENV=production
-PORT=4503
-
-# Nest build
-BUILD_COMMAND=npm run build:prod
-
-# Database
-POSTGRES_HOST=postgres
-POSTGRES_DB=myapp_prod
-POSTGRES_USER=myapp_prod
-POSTGRES_PASSWORD=CHANGE_ME
-DATABASE_URL=postgresql://myapp_prod:CHANGE_ME@postgres:5432/myapp_prod
-
-REDIS_HOST=redis
-REDIS_PORT=6379
-REDIS_PASSWORD=CHANGE_ME
-
-# Security & CORS
-JWT_SECRET=CHANGE_ME_PRODUCTION_JWT_SECRET_32_CHARS
-CORS_ORIGINS=https://app.supporthub.com,https://admin.supporthub.com

.env.test

@@ -1,20 +0,0 @@
-NODE_ENV=test
-PORT=4502
-
-# Nest build
-BUILD_COMMAND=npm run build:test
-
-# Database
-POSTGRES_HOST=postgres
-POSTGRES_DB=myapp_test
-POSTGRES_USER=myapp_test
-POSTGRES_PASSWORD=test_password
-DATABASE_URL=postgresql://myapp_test:test_password@postgres:5432/myapp_test
-
-REDIS_HOST=redis
-REDIS_PORT=6379
-REDIS_PASSWORD=test_redis_password
-
-# Security & CORS
-JWT_SECRET=super-secret-testing-jwt-key-32-chars-long
-CORS_ORIGINS=http://localhost:3000

.gitignore

@@ -38,3 +38,8 @@ Thumbs.db
 docker/postgres/data/
 docker/redis/data/
 docker/minio/data/
+
+# Environment files (secrets) — never commit real credentials
+.env
+.env.*
+!.env.example