Stop tracking .env files and sanitize docker/.env.dist

.env, .env.dev, .env.prod, .env.test, and docker/.env contained real
production secrets and were tracked in git despite the Symfony
convention of keeping them local-only. Untrack them and ignore them
going forward; docker/.env.dist stays as a template but now uses
placeholder values instead of live credentials.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitignore

@@ -1,5 +1,9 @@
 
 ###> symfony/framework-bundle ###
+/.env
+/.env.dev
+/.env.prod
+/.env.test
 /.env.local
 /.env.local.php
 /.env.*.local
@@ -30,3 +34,7 @@ yarn-error.log
 ###< symfony/webpack-encore-bundle ###
 
 /.idea
+
+###> docker env ###
+/docker/.env
+###< docker env ###

docker/.env.dist

@@ -7,23 +7,23 @@ APP_ENV=prod
 SITE_BASE_URL=https://escapepage.com
 
 # Mailer
-MAILER_DSN=sendgrid://REDACTED_SENDGRID_KEY@default
+MAILER_DSN=sendgrid://CHANGEME_SENDGRID_API_KEY@default
 MAILER_FROM=mailer@escapepage.nl
 
 # Database
-DATABASE_URL=mysql://escapepage:REDACTED_DB_PASSWORD@database:3306/escapepage?serverVersion=8.0.32&charset=utf8mb4
+DATABASE_URL=mysql://escapepage:CHANGEME_DB_PASSWORD@database:3306/escapepage?serverVersion=8.0.32&charset=utf8mb4
 DB_NAME=escapepage
 DB_USER=escapepage
-DB_PASSWORD=REDACTED_DB_PASSWORD
+DB_PASSWORD=CHANGEME_DB_PASSWORD
-MYSQL_ROOT_PASSWORD=root
+MYSQL_ROOT_PASSWORD=CHANGEME_MYSQL_ROOT_PASSWORD
 
 # Mercure
 MERCURE_URL=http://mercure/.well-known/mercure
 MERCURE_PUBLIC_URL=https://escapepage.com/.well-known/mercure
-MERCURE_JWT_SECRET=REDACTED_MERCURE_JWT_SECRET
+MERCURE_JWT_SECRET=CHANGEME_MERCURE_JWT_SECRET
 MERCURE_CORS_ALLOWED_ORIGINS=https://escapepage.com
 MERCURE_TOPIC_BASE=https://escapepage.com
 
 # Recaptcha
-RECAPTCHA3_KEY=REDACTED_RECAPTCHA_KEY
+RECAPTCHA3_KEY=CHANGEME_RECAPTCHA3_KEY
-RECAPTCHA3_SECRET=REDACTED_RECAPTCHA_SECRET
+RECAPTCHA3_SECRET=CHANGEME_RECAPTCHA3_SECRET