env cleanup round 2

.gitignore

@@ -5,8 +5,22 @@ __pycache__/
 *.pyc
 *.log
 
-# Env files (store secrets locally)
+# =============================
+# 🔐 Environment files (NEVER commit secrets!)
+# =============================
+# Ignore all .env files
 .env
+.env.local
+.env.*.local
+**/.env
+**/.env.local
+
+# BUT track .env.example templates (safe to commit)
+!.env.example
+!**/.env.example
+
+# Ignore backup directory
+.env-backups/
 
 # =============================
 # 🐳 Docker volumes (HUGE)