security: `.env` file with actual environment values is committed to the repository root — any secrets it contains are publicly visible to all GitHub visitors and in git history permanently

## 🚨 Critical Security Problem

The `.env` file is committed directly to the OpSo repository root. The `.gitignore` file exists but does not exclude `.env`. This means every secret in `.env` — API keys, OAuth credentials, database connection strings — is publicly visible to anyone who visits the repository on GitHub, forever (including in git history even after removal).

**Why this is critical:**

OpSo is a Flutter app that likely requires some configuration (Firebase project IDs, API endpoints, OAuth credentials for program data). Any value in `.env` is:
1. Visible to 109 GitHub forks — all forks inherit the commit history
2. Permanently in git history — even if deleted in a new commit, `git log --all` reveals it
3. Indexed by search engines in some cases

## Immediate Fix Required

**Step 1 — Rotate any credentials that were in `.env` immediately** (even before pushing the fix)

**Step 2 — Remove from git tracking:**

```bash
git rm --cached .env
git commit -m "security: remove .env from version control"
```

**Step 3 — Add to `.gitignore`:**

```gitignore
# Environment files — NEVER commit these
.env
.env.local
.env.production
.env.*.local

# Flutter/Dart generated
.dart_tool/
build/
```

**Step 4 — Create `.env.example` with placeholder values only:**

```bash
# .env.example — copy this to .env and fill in your own values
# NEVER commit .env with real values

# Firebase configuration
FIREBASE_API_KEY=your_firebase_api_key_here
FIREBASE_PROJECT_ID=your_project_id_here
```

**Step 5 — Remove from git history** (required since this is public):

```bash
git filter-repo --path .env --invert-paths
# Force push — coordinate with all contributors
```

## Files to Modify

| File | Change |
|---|---|
| `.env` | Remove from git tracking and history |
| `.gitignore` | Add `.env` and Flutter-specific patterns |
| `.env.example` | Create with placeholder values only |
| `README.md` | Add "Environment Setup" section explaining `.env.example` |

**Suggested labels:** `security`, `critical`, `good first issue`

I would like to work on this. Could you please assign it to me?