Merge pull request #678 from GGPOShadows/pr/gitignore-env-variants

fix(security): ignore the whole dotenv ladder, not just .env

.gitignore

@@ -1,6 +1,13 @@
 node_modules
 dist
+# Credential files. `.env` alone is not enough: Vite's loadEnv (see
+# server/standalone/vite.config.js) and scripts/setup-doctor.mjs both read the
+# full dotenv ladder — .env, .env.local, .env.<mode> and .env.<mode>.local —
+# so a key placed in any of them is live for the app. Only .env was ignored,
+# leaving the other three committable. .env.example is the tracked template.
 .env
+.env.*
+!.env.example
 *.log
 screenshots/
 qa-shots/