chore: add a .gitignore, so .env cannot be committed

The release job sources FORGEJO_TOKEN from a .env beside the flake, and
nothing was holding that file out of a commit. target/ and .devbox/ were
only excluded by .git/info/exclude, which is local to one clone and never
travels, so a fresh checkout had no protection for either.

Also covers what the daemon and the test rigs write into a checkout:
master.key, mail.db, state.json and an operator's own smolboid.toml. No
tracked file becomes ignored.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,17 @@
+# Build output
+/target
+.devbox/
+result
+result-*
+
+# The release job sources FORGEJO_TOKEN from here. Never commit it.
+.env
+
+# Identity and feed state the daemon writes at runtime, and whatever the
+# test rigs leave in a checkout.
+*.key
+*.db
+*.db-wal
+*.db-shm
+state.json
+smolboid.toml