security: `.env` file with actual environment values is committed to the repository root — any secrets it contains are publicly visible to all GitHub visitors and in git history permanently

## 🚨 Critical Security Problem

The `.env` file is committed directly to the OpSo repository root. The `.gitignore` file exists but does not exclude `.env`. This means every secret in `.env` — API keys, OAuth credentials, database connection strings — is publicly visible to anyone who visits the repository on GitHub, forever (including in git history even after removal).

**Why this is critical:**

OpSo is a Flutter app that likely requires some configuration (Firebase project IDs, API endpoints, OAuth credentials for program data). Any value in `.env` is:
1. Visible to 109 GitHub forks — all forks inherit the commit history
2. Permanently in git history — even if deleted in a new commit, `git log --all` reveals it
3. Indexed by search engines in some cases

## Immediate Fix Required

**Step 1 — Rotate any credentials that were in `.env` immediately** (even before pushing the fix)

**Step 2 — Remove from git tracking:**

```bash
git rm --cached .env
git commit -m "security: remove .env from version control"
```

**Step 3 — Add to `.gitignore`:**

```gitignore
# Environment files — NEVER commit these
.env
.env.local
.env.production
.env.*.local

# Flutter/Dart generated
.dart_tool/
build/
```

**Step 4 — Create `.env.example` with placeholder values only:**

```bash
# .env.example — copy this to .env and fill in your own values
# NEVER commit .env with real values

# Firebase configuration
FIREBASE_API_KEY=your_firebase_api_key_here
FIREBASE_PROJECT_ID=your_project_id_here
```

**Step 5 — Remove from git history** (required since this is public):

```bash
git filter-repo --path .env --invert-paths
# Force push — coordinate with all contributors
```

## Files to Modify

| File | Change |
|---|---|
| `.env` | Remove from git tracking and history |
| `.gitignore` | Add `.env` and Flutter-specific patterns |
| `.env.example` | Create with placeholder values only |
| `README.md` | Add "Environment Setup" section explaining `.env.example` |

**Suggested labels:** `security`, `critical`, `good first issue`

I would like to work on this. Could you please assign it to me?

Start by inspecting the repository root, `.gitignore`, `.env`, `.env.example`, and README.md, then review the `.env` history without exposing its values. Coordinate credential rotation and the history rewrite before changing tracked files. Done means secrets are rotated, `.env` is no longer tracked or present in history, ignore rules and placeholders are added, and README.md documents setup.

由索引模型根据 Issue 内容生成。