Ignore .env files at every depth, and their variants

A pattern with no leading slash already matched at any depth, but the intent
was not obvious from the rules. State it explicitly and widen to `.env.*` so
variants like .env.local or .env.unraid-api cannot slip through, while keeping
.env.example and .env.<name>.example tracked.

Verified with git check-ignore at the repo root, one level down, and three
levels down.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,7 +1,11 @@
-# Secrets — every collection keeps its own .env beside its .env.example
+# Secrets — every collection keeps its own .env beside its .env.example.
+# A pattern with no leading slash matches at EVERY depth, so these cover any
+# .env anywhere in the repo, present or future. `.env.*` catches variants like
+# .env.local / .env.unraid-api; the negation keeps the committed examples.
 .env
-**/.env
-!**/.env.example
+.env.*
+!.env.example
+!.env.*.example
 
 # MemPalace per-project files (issue #185).
 # `mempalace init` ignores both by default. We deliberately track mempalace.yaml —