security: stop tracking the per-host env/ secret tree

git-sync auto-commit stages everything not gitignored (git add -A over
user/), NOT just the pages/config/themes folders. Because /env/ was not
gitignored, prod's git-sync pushed the per-host env tree — including
api-private.php (JWT), security-private.php (CSRF salt), and the
git-sync token — to Gitea in commit 9337003. Gitignore /env/ and untrack
it so it can never round-trip again. (Working-tree files kept via
--cached; prod still needs them to run.) Leaked secrets rotated
separately; history purge TBD.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU

.gitignore

@@ -11,4 +11,8 @@
 /config/security.yaml
 /config/security-private.php
 /config/versions.yaml
+# Per-host env override tree — holds LIVE secrets (JWT, CSRF salt, git-sync
+# token) + per-host overrides. Never commit/sync: git-sync stages anything
+# not gitignored, so an untracked /env/ would boomerang to Gitea.
+/env/
 /themes/intotheeast/node_modules/