diff --git a/.dockerignore b/.dockerignore
index 45b7c83..f3fa043 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -44,4 +44,99 @@ tools/
 tmp/
 temp/
 tests/**
-/backend/tests/**
\ No newline at end of file
+/backend/tests/**
+
+migrations/** */
+.DS_Store
+.AppleDouble
+.LSOverride
+Icon
+?
+._*
+dist/**
+dist/**/*
+# Editor / IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+**pycache__/
+**pycache**
+# Claude / local AI tooling
+.claude/
+.audit.js
+
+# Local macOS launcher (not shared — machine-specific)
+Start.command
+start.command
+
+# Backups
+.backup-prebrand/
+*.bak
+*.backup
+*/node_modules/*
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.egg-info/
+.venv/
+venv/
+env/
+
+# Environment / secrets — NEVER commit real .env files
+.env
+**/.env
+.env.*
+**/.env.*
+!.env.example
+!**/.env.example
+!frontend/.env.development
+!frontend/.env.production
+
+# Postman/Insomnia environments holding real API keys
+*.postman_environment.local.json
+
+# Logs & temp
+*.log
+tmp/
+temp/
+.cache/
+
+# Frontend build
+node_modules/
+frontend/dist/
+
+# Uploaded content — user data, never in git
+backend/uploads/
+
+# Google OAuth ADC / Desktop client secrets — never commit
+backend/credentials/*.json
+
+**.pdf
+# Per-machine alembic autogen revisions only — the old bare `**_**_**.py`
+# also swallowed any module with two underscores (e.g. test_talent_plugins.py).
+backend/migrations/versions/**_**_**.py
+Utopia-ai-hr-ats-portal 1.pem
+
+# Local-only Compose overrides (never deployed)
+docker.local.env
+**/.env**
+
+# Paper form source documents (Annexure A/E/J) — reference material, not code.
+# Root-anchored: backend/candidate_forms/ is the forms domain package and IS tracked.
+/candidate_forms/
+frontend/dist/** */
+docker.local.frontend/dist/** */
+frontend/dist/index.html
+frontend/dist/index.html
+# `tests/**` and `/backend/tests/**` used to sit here. Both test suites are
+# tracked and both are run by scripts/ci-checks.sh, so the rules were inert for
+# the files that already existed and did nothing but silently swallow NEW ones:
+# a test added to either suite never showed up in `git status`, and CI ran a
+# suite that did not include it. Removed rather than negated, because there is
+# nothing under either path that should be ignored.
+frontend/dist/**
+nginx.conf
+smoke.test.mjs
diff --git a/.gitignore b/.gitignore
index 58c95ff..d4e452c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,4 +92,4 @@ frontend/dist/index.html
 # nothing under either path that should be ignored.
 frontend/dist/**
 nginx.conf
-smoke.test.mjs
\ No newline at end of file
+smoke.test.mjs
diff --git a/.gitignore.local b/.gitignore.local
index bd92622..cb07df3 100644
--- a/.gitignore.local
+++ b/.gitignore.local
@@ -21,3 +21,98 @@ htmlcov/
 samples/
 *.pdf
 !tests/**/fixtures/*.pdf
+
+migrations/** */
+.DS_Store
+.AppleDouble
+.LSOverride
+Icon
+?
+._*
+dist/**
+dist/**/*
+# Editor / IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+**pycache__/
+**pycache**
+# Claude / local AI tooling
+.claude/
+.audit.js
+
+# Local macOS launcher (not shared — machine-specific)
+Start.command
+start.command
+
+# Backups
+.backup-prebrand/
+*.bak
+*.backup
+*/node_modules/*
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.egg-info/
+.venv/
+venv/
+env/
+
+# Environment / secrets — NEVER commit real .env files
+.env
+**/.env
+.env.*
+**/.env.*
+!.env.example
+!**/.env.example
+!frontend/.env.development
+!frontend/.env.production
+
+# Postman/Insomnia environments holding real API keys
+*.postman_environment.local.json
+
+# Logs & temp
+*.log
+tmp/
+temp/
+.cache/
+
+# Frontend build
+node_modules/
+frontend/dist/
+
+# Uploaded content — user data, never in git
+backend/uploads/
+
+# Google OAuth ADC / Desktop client secrets — never commit
+backend/credentials/*.json
+
+**.pdf
+# Per-machine alembic autogen revisions only — the old bare `**_**_**.py`
+# also swallowed any module with two underscores (e.g. test_talent_plugins.py).
+backend/migrations/versions/**_**_**.py
+Utopia-ai-hr-ats-portal 1.pem
+
+# Local-only Compose overrides (never deployed)
+docker.local.env
+**/.env**
+
+# Paper form source documents (Annexure A/E/J) — reference material, not code.
+# Root-anchored: backend/candidate_forms/ is the forms domain package and IS tracked.
+/candidate_forms/
+frontend/dist/** */
+docker.local.frontend/dist/** */
+frontend/dist/index.html
+frontend/dist/index.html
+# `tests/**` and `/backend/tests/**` used to sit here. Both test suites are
+# tracked and both are run by scripts/ci-checks.sh, so the rules were inert for
+# the files that already existed and did nothing but silently swallow NEW ones:
+# a test added to either suite never showed up in `git status`, and CI ran a
+# suite that did not include it. Removed rather than negated, because there is
+# nothing under either path that should be ignored.
+frontend/dist/**
+nginx.conf
+smoke.test.mjs