fix: stop gitignore from matching lib/secrets/ application code

The .gitignore rule `secrets/` matched any directory named secrets/
anywhere in the tree, including the new lib/secrets/ application code
that holds the AES-GCM helpers. Production build failed with
"Module not found: Can't resolve '@/lib/secrets/crypto'". Anchor the
ignore to the repo root with `/secrets/` so only the top-level
credentials directory is excluded.

.gitignore

@@ -27,6 +27,7 @@ playwright-report/
 supabase/.branches/
 supabase/.temp/
 
-# Production deployment secrets (never commit)
-secrets/
+# Production deployment secrets (never commit). Anchored to repo root so it
+# doesn't also match lib/secrets/ (which is application code, not credentials).
+/secrets/
 *.pem