gitignore: broaden secret patterns (env/keys/certs/credentials/kubeconfig)

.gitignore

@@ -13,9 +13,25 @@ yarn-error.log*
 pnpm-debug.log*
 
 
-# environment variables
+# secrets — never commit (belt-and-suspenders; real creds live outside the repo)
-.env
+.env*
-.env.production
+!.env.example
+*.pem
+*.key
+*.crt
+*.p12
+*.pfx
+*.token
+*.tfvars
+*credentials*
+.git-credentials
+.netrc
+id_rsa*
+id_ed25519*
+*.kubeconfig
+kubeconfig
+*.secret
+secrets.*
 
 # macOS-specific files
 .DS_Store