security: harden gitignore and add config example files [v1.3.7]

- Expanded .gitignore: root venv, npx_cache, AI metadata (.remember, .claude),
  data/ (SQLite DB), frontend/config/, frontend/public/icons/, certificates,
  docker-compose.override.yml
- Removed backend/config/ldap_config.json from git tracking (contains real IPs/credentials)
- Added backend/config/ldap_config.json.example with placeholder template
- Updated backend/.env.example: added JWT_SECRET_KEY, ALLOWED_ORIGINS, DATA_DIR, LOGS_DIR

backend/.env.example

@@ -1,5 +1,25 @@
-# Google Gemini API Key
-GEMINI_API_KEY=your_gemini_key_here
+# ============================================================
+# TFM aInventory — Backend Environment Variables
+# Copy this file to .env and fill in real values.
+# NEVER commit the real .env file to Git!
+# ============================================================
 
-# Anthropic Claude API Key
-CLAUDE_API_KEY=your_claude_key_here
+# --- AI API Keys ---
+# Google Gemini API Key (required for AI label OCR onboarding)
+GEMINI_API_KEY=your_gemini_api_key_here
+
+# --- Security ---
+# JWT secret key — generate a strong random value for production:
+#   python3 -c "import secrets; print(secrets.token_urlsafe(64))"
+# If not set, an ephemeral key is generated per-run (tokens invalidated on restart).
+JWT_SECRET_KEY=change-me-generate-a-secure-random-value
+
+# --- CORS ---
+# Comma-separated list of allowed frontend origins
+# Example for LAN deployment:
+#   ALLOWED_ORIGINS=http://192.168.1.100:3000,https://192.168.1.100:3003
+ALLOWED_ORIGINS=http://localhost:3000,https://localhost:3003
+
+# --- Data Paths (overridden by start_server.sh / docker-compose) ---
+# DATA_DIR=/absolute/path/to/data
+# LOGS_DIR=/absolute/path/to/logs