Harden .gitignore before making repo public

Add exclusions for secrets (.env, key/cert files, tokens),
user config with real credentials, and OS artifacts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sionsmith

.gitignore

@@ -1 +1,19 @@
 /target
+
+# Secrets and credentials
+.env
+.env.*
+*.pem
+*.key
+*.p12
+*.pfx
+*.cert
+*.der
+tokens.enc
+
+# User config (may contain real client IDs/tenant IDs)
+config.toml
+
+# OS artifacts
+.DS_Store
+Thumbs.db