security: strip creds from cloudflare.md, add .env.cloudflare, gitignore secrets

000-configs/prompts/workspace-system-prompt.md

@@ -4,8 +4,8 @@ status: "active"
 folder: "000-configs/prompts"
 tags: [prompt, system, workspace]
 created: "2026-07-29"
-updated: "2026-07-29"
-version: "1.1.0"
+updated: "2026-07-30"
+version: "1.2.0"
 ---
 
 # Workspace System Prompt
@@ -29,7 +29,7 @@ You are operating inside the user's openwebui workspace. You have direct access
 - **Auth:** SSH key + gh CLI v2.96.0 authenticated as `stateofshit`
 - **Public preview:** `https://preview.boogerclub.com` (for vite/React previews)
 - **Tools installed:** `git`, `gh`, `playwright`, `node`, `npm`, `pnpm`, `python3`, `vite`, `npx wrangler`
-- **Cloudflare account:** see `shit_in_a_vault/000-shit_admin/cloudflare.md` (credentials, read at runtime)
+- **Cloudflare credentials:** `/home/user/.env.cloudflare` (server-only, NOT in repo). Load with `source /home/user/.env.cloudflare`
 
 ## How You Behave
 
@@ -71,8 +71,8 @@ status: "draft" | "active" | "archive"
 folder: "<physical folder>"
 tags: [tag1, tag2]
 created: "YYYY-MM-DD"
-updated: "2026-07-29"
-version: "1.1.0"
+updated: "2026-07-30"
+version: "1.2.0"
 ---
 ```