Stop versioning the real secret.yaml

k8s/secret.yaml held the actual PostgreSQL password, Keycloak admin
password and OIDC client secrets, and .gitignore only covered .DS_Store
and *.tmp. Untrack it and ignore it, matching what infra-librechat already
does, and extend the ignore list to TLS key material.

kustomization.yaml still references the file, so the README now documents
creating it from secret.example.yaml — whose key set is identical — before
the first apply.

This only stops future leaks. The values remain in commit 6d3431c and on
the remote, so they must still be treated as compromised and rotated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -1,2 +1,12 @@
 .DS_Store
 *.tmp
+
+# Real secrets: only secret.example.yaml is versioned.
+# k8s/kustomization.yaml still references secret.yaml, so a fresh clone must
+# create it first — see README.
+k8s/secret.yaml
+
+# TLS material
+*.crt
+*.key
+*.pem