chore: add .env.example template and expand .gitignore for secrets

- Add .env.example with all config vars (no real secrets)
- Exclude .env, .env.*, docker-compose.override.yml
- Exclude wg/ (WireGuard configs with private keys)
- Exclude dump/, dump.zip, *.csv (sensitive exports)
- Keep .env.example tracked (!.env.example exception)

.env.example

@@ -0,0 +1,42 @@
+# ============================================================
+# Telegram Shop - Environment Configuration (TEMPLATE)
+# ============================================================
+# Копируй этот файл в .env и заполни реальными значениями.
+# ВНИМАНИЕ: .env файлы НЕ коммитятся — они в .gitignore.
+# ============================================================
+
+# --- Telegram Bot ---
+BOT_TOKEN=your_bot_token_here
+ADMIN_IDS=123456789,987654321
+SUPPORT_LINK=https://t.me/your_support
+
+# --- Catalog ---
+CATALOG_PATH=./catalog
+
+# --- Encryption (ОБЯЗАТЕЛЬНО! Без этого приложение упадёт) ---
+# Сгенерируй надёжный ключ: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+ENCRYPTION_KEY=
+
+# --- Commission ---
+COMMISSION_ENABLED=true
+COMMISSION_PERCENT=5
+
+# --- Commission Wallets ---
+COMMISSION_WALLET_BTC=
+COMMISSION_WALLET_LTC=
+COMMISSION_WALLET_USDT=
+COMMISSION_WALLET_USDC=
+COMMISSION_WALLET_ETH=
+
+# --- WireGuard ---
+WG_ENABLED=false
+WG_PRIVATE_KEY=
+WG_PUBLIC_KEY=
+WG_PRESHARED_KEY=
+WG_ENDPOINT=
+WG_ADDRESS=
+WG_DNS=
+
+# --- Gitea API (для CI/CD и пайплайна) ---
+GITEA_API_URL=https://git.softuniq.eu/api/v1
+GITEA_TOKEN=

.gitignore

@@ -1 +1,41 @@
-db
+# Dependencies
+node_modules/
+
+# Environment
+.env
+.env.*
+!.env.example
+
+# Secrets & sensitive data
+docker-compose.override.yml
+wg/
+dump/
+dump.zip
+*.csv
+
+# Database
+db/
+*.db
+
+# Logs
+*.log
+
+# OS
+.DS_Store
+
+# Kilo generated files (auto-created, not tracked)
+.kilo/logs/
+.kilo/reports/
+.kilo/EVOLUTION_LOG.md
+.kilo/WORKFLOW_AUDIT.md
+
+# Local workspace / worktrees
+.work/
+
+# Architect generated maps
+.architect/maps/.work/
+
+# Python cache
+__pycache__/
+*.pyc
+*.pyo