Add `.env*.local` and `*.log` entries so accidental secrets and debug logs never land in the tree. Matches the pattern used by showcase/shell. Leave the generated /src/data/*.json files tracked, as they are today.