docs: Go is production — rewrite README, update CLAUDE.md, gitignore .env

- README: Go-backend architecture, build/run via the compose override stack,
  WS/payload/auth/DB contracts, the branch layout (master = Go, python-legacy).
- CLAUDE.md: Project Overview + Components reflect the Go services; a "Go services
  — build, deploy, gotchas" section (string coercion, typeless telemetry, the
  trinket dedup, rollback); Deploying + Suitbuilder point at the Go paths. The
  behavioral contracts (WS/auth/DB/routes) are kept — Go honors them; file refs to
  main.py/inventory-service mark the legacy source.
- .gitignore: ignore .env / .env.bak-* (public repo; .env.example stays tracked).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -3,6 +3,12 @@ __pycache__
 static/v2/
 frontend/node_modules/
 
+# Secrets — the server-side env files hold SHARED_SECRET, SECRET_KEY, DB
+# passwords, and the Discord token. This repo is PUBLIC — never commit them.
+# .env.example stays tracked as the template.
+.env
+.env.bak-*
+
 # Claude Code config — never commit. The production agent's strict
 # permissions live server-side at /var/lib/overlord-agent/.claude/
 # (and via CLI flags in agent/claude_wrapper.py). The repo stays