chore(repo): untrack internal docs + CLAUDE.md (keep local-only)

Per Matt: internal planning/audit/deployment docs + CLAUDE.md don't belong in the shared Gitea repo. git rm --cached (files kept in the working tree) + gitignored docs/ and CLAUDE.md. Tests kept. No history rewrite - what was exposed is infra topology (IP/SSH), not credentials (actual secrets were always in gitignored private/). Fresh repo-appropriate docs to follow.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitignore

@@ -61,3 +61,7 @@ docker-compose.override.yml
 
 # Scratch / audit artefacts
 tmp/
+
+# Internal docs + Claude instructions: kept local-only, not in the shared repo
+docs/
+/CLAUDE.md