/target
**/node_modules
frontend/.next
frontend/out
frontend/coverage
frontend/playwright-report
frontend/test-results
.env
.env.local
*.log
.DS_Store
data/
token.key

# Hosted node-agent binaries (built + baked into the frontend image, not committed)
frontend/public/dl/

# Local env backups. `.env` is already ignored above, but a timestamped or
# suffixed copy of it is not — and these hold real credentials (subscription
# OAuth token, forge PAT, DB password). Ignore every variant, not just the
# exact name.
.env.bak*
*.env.bak*
deploy/compose/.env.*

# Local-only compose override. NOT for prod or the air-gapped install: it
# rebinds published ports to loopback, enables the login bypass, and points the
# runtime at MacBook-specific paths. docker-compose picks this file up
# automatically, so committing it would silently reconfigure anyone who runs
# deploy/compose.
deploy/compose/docker-compose.override.yml