The linter config, .gitignore and .dockerignore from the current templates (closes #40)

.golangci.yml is now a byte-identical copy of the sneak/prompts next
copy: depguard is on with the test-support rule, and the gomodguard_v2
block list is in. keyfunc has no test-support packages of its own, so
the deny list is left as it is.

.gitignore and .dockerignore are the sneak/prompts next copies with this
repo's own entries added at the end: /keyfunc in both, and .gitea in
.dockerignore. .git stays in the Docker build context without
.git/config, for the version stamp.

The README TODO line for this issue is removed.

Model: opus-5-5

.gitignore

@@ -1,6 +1,3 @@
-# The built binary
-/keyfunc
-
 # OS
 .DS_Store
 Thumbs.db
@@ -14,8 +11,38 @@ Thumbs.db
 .vscode/
 *.sublime-*
 
-# Environment / secrets
-.env
-.env.*
-*.pem
-*.key
+# Agent scratch (worktrees of this repo, created and destroyed by
+# in-flight tooling). Unanchored: .gitignore patterns already match at
+# every depth, so no prefix is wanted here. This is not a .dockerignore
+# entry and must not be given a `**/` prefix on the way into one.
+.claude/
+
+# Node
+node_modules/
+
+# Secrets. Unanchored like every entry above, so each matches at every
+# depth. Matching is case-sensitive on Linux, so names use character
+# ranges rather than a lowercase form that misses `Server.Key`.
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Only the templates `example.env` and `sample.env` are
+# re-included below. A repository that commits any other template adds
+# its own negation after these lines, for example `!.env.example`.
+*.[eE][nN][vV]
+.[eE][nN][vV].*
+.[eE][nN][vV][rR][cC]
+!example.env
+!sample.env
+
+# Private keys and the bundles carrying them.
+*.[pP][eE][mM]
+*.[kK][eE][yY]
+*.[pP]12
+*.[pP][fF][xX]
+[iI][dD]_[rR][sS][aA]
+[iI][dD]_[dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]
+[iI][dD]_[eE][dD]25519
+
+# The binary `make build` writes.
+/keyfunc