chore: ignore .env copies, allow docker commands in Claude Code settings

.gitignore matched .env and .env.*.local but not the copies people and tools
actually leave behind — .env.bak-20260911, .env.save, .env.orig. Those carry
the identical secrets and showed up as untracked, one `git add .` away from
being committed. Patterns verified with git check-ignore.

The .claude/settings.json entry stops Claude Code prompting for confirmation
on every docker/docker compose invocation during local debugging.

Co-Authored-By: claude-flow <ruv@ruv.net>

.claude/settings.json

@@ -166,7 +166,9 @@
       "Bash(npx @claude-flow*)",
       "Bash(npx claude-flow*)",
       "Bash(node .claude/*)",
-      "mcp__claude-flow__:*"
+      "mcp__claude-flow__:*",
+      "Bash(docker *)",
+      "Bash(docker compose *)"
     ],
     "deny": ["Read(./.env)", "Read(./.env.*)"]
   },

.gitignore

@@ -24,6 +24,12 @@ apps/web/e2e/.playwright-runtime.json
 .env.test.local
 .env.production.local
 .env.*.local
+# Hand-made or tool-made copies of .env — these carry the same secrets as the
+# original but match none of the patterns above (.env.bak-20260911, .env.save).
+.env.bak*
+.env.backup*
+.env.orig
+.env.save
 *.e2e-backup
 
 # Logs