chore: add .env.example template and expand .gitignore for secrets

- Add .env.example with all config vars (no real secrets)
- Exclude .env, .env.*, docker-compose.override.yml
- Exclude wg/ (WireGuard configs with private keys)
- Exclude dump/, dump.zip, *.csv (sensitive exports)
- Keep .env.example tracked (!.env.example exception)

.env.example

@@ -0,0 +1,42 @@
+# ============================================================
+# Telegram Shop - Environment Configuration (TEMPLATE)
+# ============================================================
+# Копируй этот файл в .env и заполни реальными значениями.
+# ВНИМАНИЕ: .env файлы НЕ коммитятся — они в .gitignore.
+# ============================================================
+
+# --- Telegram Bot ---
+BOT_TOKEN=your_bot_token_here
+ADMIN_IDS=123456789,987654321
+SUPPORT_LINK=https://t.me/your_support
+
+# --- Catalog ---
+CATALOG_PATH=./catalog
+
+# --- Encryption (ОБЯЗАТЕЛЬНО! Без этого приложение упадёт) ---
+# Сгенерируй надёжный ключ: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+ENCRYPTION_KEY=
+
+# --- Commission ---
+COMMISSION_ENABLED=true
+COMMISSION_PERCENT=5
+
+# --- Commission Wallets ---
+COMMISSION_WALLET_BTC=
+COMMISSION_WALLET_LTC=
+COMMISSION_WALLET_USDT=
+COMMISSION_WALLET_USDC=
+COMMISSION_WALLET_ETH=
+
+# --- WireGuard ---
+WG_ENABLED=false
+WG_PRIVATE_KEY=
+WG_PUBLIC_KEY=
+WG_PRESHARED_KEY=
+WG_ENDPOINT=
+WG_ADDRESS=
+WG_DNS=
+
+# --- Gitea API (для CI/CD и пайплайна) ---
+GITEA_API_URL=https://git.softuniq.eu/api/v1
+GITEA_TOKEN=