M0: add .env.local.example

Exempts .env*.example from the .env* gitignore rule so the template
is trackable while real .env.local stays ignored.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FcktbLXSSXzx23GCue813e

.env.local.example

@@ -0,0 +1,14 @@
+# Copy this file to .env.local and fill in real values.
+# .env.local is gitignored — never commit real keys.
+
+# Project Settings -> API -> Project URL
+NEXT_PUBLIC_SUPABASE_URL=
+
+# Project Settings -> API -> anon public key. Safe to expose to the
+# browser: every query it makes is filtered by RLS.
+NEXT_PUBLIC_SUPABASE_ANON_KEY=
+
+# Project Settings -> API -> service_role key. NEVER exposed to the
+# browser. Only imported in server-only files (src/lib/supabase/service.ts),
+# used only inside /app/api/* route handlers. Bypasses RLS entirely.
+SUPABASE_SERVICE_ROLE_KEY=

.gitignore

@@ -32,6 +32,7 @@ yarn-error.log*
 
 # env files (can opt-in for committing if needed)
 .env*
+!.env*.example
 
 # vercel
 .vercel