security: strip creds from cloudflare.md, add .env.cloudflare, gitignore secrets

.gitignore

@@ -2,9 +2,11 @@
 .obsidian/workspace.json
 .obsidian/workspace.json.bak
 
-# Plugin cache/state (per-device)
-.obsidian/plugins/*/data.json
+# Plugin binaries (don't sync)
 .obsidian/plugins/*/main.js
+.obsidian/plugins/*/data.json
+
+# Theme cache (don't sync)
 .obsidian/themes/*/data.json
 
 # OS junk
@@ -14,3 +16,17 @@ Thumbs.db
 # Editor temp
 *~
 *.swp
+
+# Env files (any .env* — keep secrets server-only)
+.env
+.env.*
+*.env.local
+
+# Admin cloudflare creds (server-only, lives in /home/user/.env.cloudflare)
+000-shit_admin/cloudflare.md
+
+# Any other secret/cred files in admin folder
+000-shit_admin/*.key
+000-shit_admin/*.pem
+000-shit_admin/credentials.md
+000-shit_admin/credentials/