chore: gitignore api plugin private-key file (api-private.php)

The API plugin (>=1.0.7) relocates jwt_secret from config/plugins/api.yaml
into a generated config/plugins/api-private.php. Ignore it like the other
per-instance secrets (git-sync.yaml, security.yaml) so it is never committed
or pushed by git-sync.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU

.gitignore

@@ -6,5 +6,6 @@
 /pages/01.trips/italy-2026-demo/
 /pages/02.post/*ui-test*/
 /config/plugins/git-sync.yaml
+/config/plugins/api-private.php
 /config/security.yaml
 /themes/intotheeast/node_modules/

config/system.yaml

@@ -210,7 +210,7 @@ session:
   domain: null
   path: null
 gpm:
-  releases: testing
+  releases: stable
   official_gpm_only: true
 http:
   method: curl