chore: scaffold ignore rules and environment templates

Keep secrets and build artifacts out of the tree so the repo is safe to publish.

.env.example

@@ -0,0 +1,36 @@
+# Copy to .env for local Traefik compose (dev).
+#   cp .env.example .env && ./scripts/compose-dev.sh up -d --build
+
+POSTGRES_USER=pargar
+POSTGRES_DB=pargar
+POSTGRES_PASSWORD=replace-with-a-local-password
+REDIS_PASSWORD=replace-with-a-redis-password
+RUSTFS_ACCESS_KEY=replace-with-a-rustfs-user
+RUSTFS_SECRET_KEY=replace-with-a-long-rustfs-password
+STORAGE_REGION=us-east-1
+STORAGE_BUCKET=pargar
+JWT_SECRET=replace-with-at-least-32-random-characters
+ADMIN_PASSWORD=replace-with-a-strong-admin-password
+ADMIN_NAME=Admin
+ADMIN_USERNAME=admin
+ADMIN_EMAIL=admin@example.com
+
+# Traefik Host() + TLS (dev uses Traefik default cert — browser warning OK)
+DOMAIN=localhost
+PUBLIC_URL=https://localhost
+FRONTEND_ORIGINS=https://localhost,https://127.0.0.1
+
+# Keep false unless you intentionally want fail-open rate limits / captcha.
+DEV_MODE=false
+SEED_CURRICULUM=false
+# METRICS_TOKEN=
+# TRUSTED_PROXY_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,::1/128
+
+DONATION_ENABLED=true
+DONATION_NOTE="If you want to support the program, sign in and coordinate privately with the team."
+# Offline payment only — enable after ops process is ready (also toggled in admin settings).
+PHYSICAL_CERT_ENABLED=false
+PHYSICAL_CERT_PRICE_IRR=2500000
+PHYSICAL_CERT_WINDOW_DAYS=30
+OTEL_EXPORTER_OTLP_ENDPOINT=
+OTEL_SERVICE_NAME=pargar-api

.env.prod.example

@@ -0,0 +1,33 @@
+# Production compose secrets — copy to .env.prod (never commit).
+#   ./scripts/compose-prod.sh up -d --build
+
+POSTGRES_USER=pargar
+POSTGRES_DB=pargar
+POSTGRES_PASSWORD=replace-with-strong-postgres-password
+REDIS_PASSWORD=replace-with-strong-redis-password
+RUSTFS_ACCESS_KEY=replace-with-rustfs-access-key
+RUSTFS_SECRET_KEY=replace-with-long-rustfs-secret
+STORAGE_REGION=us-east-1
+STORAGE_BUCKET=pargar
+JWT_SECRET=replace-with-at-least-32-random-characters
+ADMIN_PASSWORD=replace-with-strong-admin-password
+ADMIN_NAME=Admin
+ADMIN_USERNAME=admin
+ADMIN_EMAIL=admin@example.com
+
+# Public DNS hostname (Let's Encrypt HTTP-01 must reach this host on :80)
+DOMAIN=app.example.com
+ACME_EMAIL=ops@example.com
+PUBLIC_URL=https://app.example.com
+FRONTEND_ORIGINS=https://app.example.com
+
+DEV_MODE=false
+SEED_CURRICULUM=false
+METRICS_TOKEN=replace-with-metrics-scrape-token
+# TRUSTED_PROXY_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+
+DONATION_ENABLED=true
+# Enable only when offline payment ops are ready.
+PHYSICAL_CERT_ENABLED=false
+PHYSICAL_CERT_PRICE_IRR=2500000
+PHYSICAL_CERT_WINDOW_DAYS=30

.gitignore

@@ -0,0 +1,48 @@
+# Secrets — never commit (public repo)
+.env
+.env.*
+!.env.example
+!.env.prod.example
+
+# Local caches / tool scratch
+.tmp/
+.cache/
+.gotmp/
+.gocache/
+.gomodcache/
+
+# OS / editor
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+*.swp
+*~
+
+# Logs & coverage
+*.log
+*.test
+coverage.out
+coverage.html
+
+# Nested VCS (monorepo root only)
+backend/.git/
+frontend/.git/
+
+# Backend (root binaries only — do not ignore cmd/server/)
+backend/bin/
+backend/server
+backend/pargar
+!backend/cmd/server/
+backend/media/*
+!backend/media/sample.mp4
+!backend/media/.gitkeep
+
+# Frontend
+frontend/node_modules/
+frontend/.next/
+frontend/out/
+frontend/tsconfig.tsbuildinfo
+frontend/.env*.local
+# Vendored at build from emoji-datasource-apple (~27MB)
+frontend/public/emoji/