security: untrack dev.env, add template dev.env.example

Real secrets now live in untracked dev.env (gitignored). dev.env.example
holds placeholders and is the canonical template — copy it to dev.env on
fresh checkout and fill in real keys.

.gitignore

@@ -185,4 +185,9 @@ fabric.properties
 .idea/caches/build_file_checksums.ser
 
 # idea folder, uncomment if you don't need it
-# .idea
+# .idea
+# Local secrets (real keys go here, not in dev.env.example)
+dev.env
+
+# Misc artifacts
+.git-filter-redactions.txt