Security: Add .gitignore, remove sensitive files from tracking

- Added comprehensive .gitignore for secrets, tokens, session data
- Untracked openclaw.json (contains API tokens)
- Untracked device-auth.json, paired.json
- Untracked session .jsonl files (conversation history)
- Untracked cron run logs

Note: Files still exist locally, just no longer version controlled

.gitignore

@@ -1,22 +1,29 @@
-# Sensitive OpenClaw files
-credentials/
-*.key
-*.pem
-*.env
-.env*
+# OpenClaw Security - Never commit secrets
+openclaw.json
+openclaw.json.bak*
+openclaw.json.tmp
+.env
+.env.*
+secrets/
 
-# Private session logs that might contain sensitive info
-session-logs/
-logs/
+# Session data (contains conversation history)
+agents/*/sessions/*.jsonl
+agents/*/sessions/*.jsonl.lock
 
-# Budget tracking (contains spending info)
-budget-tracker.json
+# Device auth and tokens
+identity/device-auth.json
+devices/paired.json
 
-# Any files with secrets or tokens
-*secret*
-*token*
-*password*
+# Cron run logs (may contain sensitive output)
+cron/runs/*.jsonl
 
-# Backup files
-*.bak
-*~
+# Media files
+media/
+
+# Temp files
+*.tmp
+*.lock
+
+# OS files
+.DS_Store
+Thumbs.db