chore(07-01): update .gitignore to protect actual YAML configs

- Ignored config/*.yaml (secrets protection)
- Ensured examples/schemas are tracked via !config/*.yaml.example
- Added specific rules for secrets.yaml and its example

.gitignore

@@ -52,6 +52,15 @@ backend/.env.*
 docker-compose.override.yml
 .env.docker
 
+# ── Configuration consolidation (Phase 7) ────────────────────
+# Ignore actual YAML config files which contain real values/secrets
+config/*.yaml
+# But ensure example/schema files are ALWAYS tracked
+!config/*.yaml.example
+# Specifically ignore secrets.yaml
+config/secrets.yaml
+!config/secrets.yaml.example
+
 # ── Application logs ─────────────────────────────────────────
 # (also covered by /logs/* above, these catch any other locations)
 frontend/logs/