infra: commit git.mana.how cloudflared route + ignore secrets/.bak

Two long-uncommitted Mac Mini drifts cleaned up:

1. cloudflared-config.yml — git.mana.how → :3030 (Forgejo). The
   route has been live for weeks (HTTP 200), just never committed.
2. .gitignore — exclude secrets/ (private keys: mana-ai mission-grant
   RSA keypair lives there; must NEVER be committed) and *.bak-*
   files (operator backup workflow on the Mac Mini).

services/mana-auth/drizzle/ on the Mac Mini was Mac-Mini-side
generated state for the (now deleted) mana-monorepo mana-auth
service; cleanup fell out with the Phase 7 deletion.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -25,6 +25,14 @@ ios/
 docs/*_CREDENTIALS.md
 docs/CREDENTIALS_*.md
 
+# Service secrets (private keys, never commit)
+secrets/
+
+# Local backup files (Mac Mini operator workflow)
+*.bak-*
+.env.macmini.bak-*
+cloudflared-config.yml.bak-*
+
 # Environment files
 .env
 .env.local

cloudflared-config.yml

@@ -130,6 +130,8 @@ ingress:
   # ============================================
   # Forgejo (Git + CI/CD)
   # ============================================
+  - hostname: git.mana.how
+    service: http://localhost:3030
 
   # ============================================
   # Standalone microservices