Stop tracking .env files so secrets are never pushed.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitignore

@@ -34,13 +34,13 @@ __pycache__/
 venv/
 env/
 
-# Environment / secrets — app secrets only in backend/.env (never commit it).
-# Root .env is a Compose pointer (COMPOSE_ENV_FILES) with no secrets; keep it.
-backend/.env
+# Environment / secrets — NEVER commit real .env files
+.env
+**/.env
 .env.*
-!.env
+**/.env.*
 !.env.example
-!backend/.env.example
+!**/.env.example
 !frontend/.env.development
 !frontend/.env.production
 
@@ -66,4 +66,3 @@ Utopia-ai-hr-ats-portal 1.pem
 # Local-only Compose overrides (never deployed)
 docker.local.env
 tests/**
-**/.env**