Add security and git policies, make repo a model example

- Never commit secrets; comprehensive .gitignore with fetch URL
- Never force-push to main
- go mod tidy before committing
- make hooks target with Go repo detection
- Add .editorconfig, .prettierrc, .prettierignore
- Template files URL for new repo setup

REPO_POLICIES.md

@@ -12,8 +12,10 @@ Version: 2026-02-22
 
 - Every repo with software must have a root `Makefile` with these targets:
   `make test`, `make lint`, `make fmt` (writes), `make fmt-check`
-  (read-only), `make check` (prereqs: `test`, `lint`, `fmt-check`), and
-  `make docker`.
+  (read-only), `make check` (prereqs: `test`, `lint`, `fmt-check`),
+  `make docker`, and `make hooks` (installs pre-commit hook). A model
+  Makefile is at
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
 
 - Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
   instead of invoking the underlying tools directly. The Makefile is the
@@ -43,9 +45,20 @@ Version: 2026-02-22
 
 - `main` must always pass `make check`, no exceptions.
 
+- Never commit secrets. `.env` files, credentials, API keys, and
+  private keys must be in `.gitignore`. No exceptions.
+
+- `.gitignore` should be comprehensive from the start: OS files
+  (`.DS_Store`), editor files (`.swp`, `*~`), language build artifacts,
+  and `node_modules/`. Fetch the standard `.gitignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore`
+  when setting up a new repo.
+
 - Never use `git add -A` or `git add .`. Always stage files explicitly
   by name.
 
+- Never force-push to `main`.
+
 - Make all changes on a feature branch. You can do whatever you want on
   a feature branch.
 
@@ -84,7 +97,8 @@ Version: 2026-02-22
 
 - First commit of a new repo should contain only `README.md`.
 
-- Go module root: `sneak.berlin/go/<name>`.
+- Go module root: `sneak.berlin/go/<name>`. Always run `go mod tidy`
+  before committing.
 
 - Use SemVer.
 
@@ -112,6 +126,10 @@ Version: 2026-02-22
     - `static/` — static assets (images, fonts, etc.)
     - `web/` — web frontend source
 
+- When setting up a new repo, files from the `prompts` repo may be used
+  as templates. Fetch them from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/<filename>`.
+
 - New repos must contain at minimum:
     - `README.md`, `.git`, `.gitignore`, `.editorconfig`
     - `REPO_POLICIES.md` (copy from the `prompts` repo)