chore: ignore .env copies, allow docker commands in Claude Code settings

.gitignore matched .env and .env.*.local but not the copies people and tools
actually leave behind — .env.bak-20260911, .env.save, .env.orig. Those carry
the identical secrets and showed up as untracked, one `git add .` away from
being committed. Patterns verified with git check-ignore.

The .claude/settings.json entry stops Claude Code prompting for confirmation
on every docker/docker compose invocation during local debugging.

Co-Authored-By: claude-flow <ruv@ruv.net>

.gitignore

@@ -24,6 +24,12 @@ apps/web/e2e/.playwright-runtime.json
 .env.test.local
 .env.production.local
 .env.*.local
+# Hand-made or tool-made copies of .env — these carry the same secrets as the
+# original but match none of the patterns above (.env.bak-20260911, .env.save).
+.env.bak*
+.env.backup*
+.env.orig
+.env.save
 *.e2e-backup
 
 # Logs