[P0.1] Gitignore .env.production and check history for committed secrets

[frankbria]

Filed by the SaaS launch review. Priority P0.1 — severity critical, category security.

Problem

.gitignore covers .env, .env.local and .env.staging but not .env.production, while .env.production.example instructs operators to copy it and fill in ANTHROPIC_API_KEY + AUTH_SECRET, and deploy.yml writes the real file inside the production git checkout. Any git add -A publishes live keys and the JWT signing secret to a public AGPL repo; git clean -fd on the server deletes the live env file.

Evidence

• .gitignore:62
• .env.production.example:2
• .github/workflows/deploy.yml:412
• verified: git check-ignore .env.production exits 1 (no match)

Acceptance criteria

• git check-ignore .env.production matches, preferably via .env* with !.env*.example
• All real env files stay ignored; .example files stay tracked
• History checked for a previously committed .env.production; any exposed AUTH_SECRET/API keys rotated

---

Atomic by construction: one developer, one focused session.