security: untrack dev.env, add template dev.env.example

Real secrets now live in untracked dev.env (gitignored). dev.env.example
holds placeholders and is the canonical template — copy it to dev.env on
fresh checkout and fill in real keys.

.gitignore

@@ -186,3 +186,8 @@ fabric.properties
 
 # idea folder, uncomment if you don't need it
 # .idea
+# Local secrets (real keys go here, not in dev.env.example)
+dev.env
+
+# Misc artifacts
+.git-filter-redactions.txt