Harden smoke callback discovery and env ignore rules

Author: gamblecodezcom

.env.example

@@ -3,7 +3,7 @@ ANNOUNCE_CHANNEL="-1002648883359"
 DEVICE=vps
 ADMIN_IDS=YOUR_TELEGRAM_USER_ID
 BOT_TOKEN=
-WEBAPP_HMAC_KEY=
+WEBAPP_HMAC_KEY=  # 32-byte secret for HMAC-signing webapp payloads/CSRF tokens; generate with: openssl rand -hex 32 (or openssl rand -base64 32); keep secret and never commit real values
 TELEGRAM_BOT_TOKEN=
 DISCORD_CODE_GENERATION_IMAGE_URL=https://raw.githubusercontent.com/gamblecodezcom/Runewager/main/images/discord_code_generation.png
 DISCORD_VERIFY_IMAGE_URL=https://raw.githubusercontent.com/gamblecodezcom/Runewager/main/images/discord_verify.png

.gitignore

@@ -2,6 +2,9 @@
 .env
 .env.*
 *.env
+!.env.example
+!.env.sample
+!.env.template
 
 # Logs
 logs/
@@ -32,3 +35,7 @@ data/helpful_messages.json
 data/promo-history.json
 data/runtime-state.json
 data/sshv-sessions.json
+
+# Runtime generated data + backups
+data/*.json
+data/backups/**