Layout, secret hygiene and workflow per the engagement's version control
plan. Nothing functional yet — this establishes the shape before code
lands, so the conventions are enforced from the first real commit.
- .gitignore + .env.example: no secret can reach a commit object
- lefthook + gitleaks pre-commit gate; blocks new files >10MB
- templates/ holds config files, never per-template scripts
- deploy/nginx/ version controlled rather than hand-edited on the server
Refs ADR-007
