chore: add .env.example template and expand .gitignore for secrets

- Add .env.example with all config vars (no real secrets)
- Exclude .env, .env.*, docker-compose.override.yml
- Exclude wg/ (WireGuard configs with private keys)
- Exclude dump/, dump.zip, *.csv (sensitive exports)
- Keep .env.example tracked (!.env.example exception)

.gitignore

@@ -1 +1,41 @@
-db
+# Dependencies
+node_modules/
+
+# Environment
+.env
+.env.*
+!.env.example
+
+# Secrets & sensitive data
+docker-compose.override.yml
+wg/
+dump/
+dump.zip
+*.csv
+
+# Database
+db/
+*.db
+
+# Logs
+*.log
+
+# OS
+.DS_Store
+
+# Kilo generated files (auto-created, not tracked)
+.kilo/logs/
+.kilo/reports/
+.kilo/EVOLUTION_LOG.md
+.kilo/WORKFLOW_AUDIT.md
+
+# Local workspace / worktrees
+.work/
+
+# Architect generated maps
+.architect/maps/.work/
+
+# Python cache
+__pycache__/
+*.pyc
+*.pyo