chore: gitignore private keys and credential files

Ignore *.pem / *.key / *.p12 / *.pfx so GitHub App private keys (e.g. the
codeboarding-review PEM downloaded for CI setup) can't be committed by
accident. No key is tracked in history.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Svilen-Stefanov

.gitignore

@@ -20,6 +20,13 @@ docs/development/architecture.md
 # Environment files
 .env
 
+# Secrets / credentials — never commit GitHub App private keys or similar.
+# (e.g. codeboarding-review.<date>.private-key.pem downloaded for CI setup.)
+*.pem
+*.key
+*.p12
+*.pfx
+
 # Logs
 *.log