Add automated check that no `.env*` files are accidentally committed

[Marvell69]

Description
.gitignore correctly excludes .env* (with an explicit exception for .env.local.example), but there's no CI-level enforcement catching a contributor who force-adds a real .env file despite the ignore rule (git add -f bypasses .gitignore entirely).

Requirements and context

• Add a CI step (or pre-commit hook via lint-staged) scanning staged/changed files for .env patterns other than the allowed example file, failing loudly if found
• Consider adding gitleaks or a similar secret-scanning tool as a more general safety net covering this and other credential-leak patterns

Suggested execution

git checkout -b ci/add-env-file-commit-guard

• Add CI/pre-commit guard against accidental .env commits
• Consider broader secret-scanning tool integration

Example commit message
ci: add guard against accidentally committed .env files