fix: ignore all .env.* secret variants, not just bare .env

Bare `.env` only matched the exact filename, leaving .env.spike / .env.local
and other secret variants untracked-but-committable. Ignore .env.* and re-include
.env.example so the template stays tracked.

.gitignore

@@ -5,8 +5,11 @@ node_modules/
 dist/
 .dist/
 
-# Environment — NEVER commit .env (secrets at rest: DB passwords, OIDC secrets, encryption key)
+# Environment — NEVER commit secrets at rest (DB passwords, OIDC secrets, encryption key,
+# Fastmail app passwords). Ignore .env and every .env.* variant, but keep the example template.
 .env
+.env.*
+!.env.example
 
 # Editor
 .vscode/