security: remove .env from repo, add .env.example

CRITICAL: .env contained API keys that were publicly visible.
- Removed .env from git tracking and all history
- Added .env to .gitignore
- Created .env.example with placeholder values
- Deploy .env via HF Space Secrets instead

.env.example

@@ -0,0 +1,9 @@
+OPENROUTER_API_KEY=sk-or-v1-your-key-here
+OPENAI_API_KEY=sk-or-v1-your-key-here
+OPENAI_BASE_URL=https://openrouter.ai/api/v1
+FEISHU_APP_ID=your-app-id
+FEISHU_APP_SECRET=your-app-secret
+GATEWAY_ALLOW_ALL_USERS=true
+HERMES_ACCEPT_HOOKS=1
+MEMPALACE_PALACE_PATH=/data/hermes/palace
+FIRECRAWL_API_KEY=your-key-here

.gitignore

@@ -28,3 +28,6 @@ Thumbs.db
 
 # Environment
 .env.local
+
+# Secret files
+.env