chore: align secrets env ignore patterns

Align git and Docker ignore patterns for secrets.env artifacts while preserving the intended encrypted-file workflow.

.dockerignore

@@ -10,6 +10,12 @@ dist/
 build/
 .env
 .env.bak.*
+# Secrets: keep plaintext and every transient secrets.env variant out of
+# the build context. If an encrypted secrets.env is used, it is mounted
+# at runtime — never baked into the image. Mirrored in .gitignore.
+secrets.env
+secrets.env.*
+!secrets.env.example
 /data/
 /logs/
 .git/

.gitignore

@@ -15,6 +15,13 @@ venv/
 .env.bak.*
 !.env.example
 
+# SOPS workflow — encrypted `secrets.env` is intentionally committable,
+# but every variant (plaintext, manual decrypt copy, editor backup)
+# must stay out of git. Mirrored in .dockerignore so the same artifacts
+# also cannot enter image build layers.
+secrets.env.*
+!secrets.env.example
+
 # Data — all user data stays local
 data/
 !services/hwfit/data/