.env now gitignored; .env.example is the committed template

Per standard Docker convention. The active `.env` is per-host
(contains the actual TSIG secret + any host-specific port/hostname
overrides). The `.env.example` template documents the expected
variables with stub values so a fresh checkout knows what to copy.

Also: docker-compose.yml now passes ACME_TSIG_SECRET to the coredns
container via plain `environment:` directive -- compose auto-reads
`.env` for substitution. No --env-file gymnastics needed at the
invocation level.

docker-compose.yml

@@ -54,6 +54,10 @@ services:
     container_name: coredns
     restart: unless-stopped
     command: ["-conf", "/etc/coredns/Corefile"]
+    # The Corefile uses {$ACME_TSIG_SECRET} expansion to read the
+    # TSIG secret. Passed in from compose's env (which auto-reads .env).
+    environment:
+      - ACME_TSIG_SECRET=${ACME_TSIG_SECRET}
     depends_on:
       caddy:
         condition: service_healthy