Initial commit: gitignore and env example

Establishes the secrets-handling contract for this repo: real env values
live in a local .env (gitignored from the first commit), and only the
sanitized .env.example with placeholder values is tracked.

.env.example documents the env surface for the v1 deployment: PUBLIC_URL,
Authentik OIDC clients (web + MCP resource server), Postgres connection,
embedder sidecar, NextAuth secret, and log level.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,44 @@
+# Environment files — never commit real secrets
+.env
+.env.*
+!.env.example
+!.env.*.example
+
+# Node / Next.js
+node_modules/
+.next/
+out/
+dist/
+build/
+*.tsbuildinfo
+next-env.d.ts
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+
+# Package manager state
+.pnpm-store/
+.yarn/
+
+# IDE / OS
+.vscode/
+.idea/
+.DS_Store
+Thumbs.db
+
+# Test / coverage
+coverage/
+.nyc_output/
+
+# Docker / runtime
+*.pid
+*.seed
+*.pid.lock
+
+# Local data volumes (if anyone bind-mounts under repo)
+data/
+postgres-data/