gitignore: exclude machine-generated noise and agap-mcp/.env

Logs, __pycache__/*.pyc and timestamped *.bak-* snapshots had accumulated
untracked for weeks. They churn on every run, so tracking them would only
produce noisy diffs; ignore them instead.

Also adds agap-mcp/.env (holds the kb#180 AGAP_MCP_AGENT_TOKENS map and
BW_PASSWORD) and a bare .env alongside the existing per-service entries.

Untracks family/__pycache__/migrate.cpython-312.pyc, the one already-tracked
file matching the new rules, so ignored and tracked state don't disagree.
Left on disk.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -1,3 +1,18 @@
+# Secrets — per-service env files. Never commit; real values live in
+# Vaultwarden and are injected via docker-compose ${VAR} substitution.
 adolf/.env
 seafile/.env
 openai/.env
+agap-mcp/.env
+.env
+
+# Machine-generated noise (added 2026-07-30). These had accumulated untracked
+# for weeks; they churn on every run and only produce noisy diffs.
+__pycache__/
+*.pyc
+*.log
+
+# Timestamped backup snapshots left behind by edit scripts
+# (e.g. docker-compose.yml.bak-20260704-141509, CLAUDE.md.bak-kb).
+*.bak
+*.bak-*