fix(security): remove credential files from git tracking

- Untrack .admin-credentials.local (contained plaintext password)
- Untrack .env.backup-* files (contained environment configs)
- Add patterns to .gitignore to prevent future tracking

Files remain locally but are no longer in repository.
Password rotation required as credential was exposed in git history.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitignore

@@ -90,3 +90,7 @@ uploads/
 .claude/hooks/pre-deployment-check.js
 .claude/hooks/pre-deployment-verify.js
 docs/research/
+
+# Credential files (must never be tracked)
+.admin-credentials.local
+.env.backup*