[Bug / Security]: .env file is committed to the public repository — API keys and sensitive configuration are exposed

## Summary

The `.env` file is present and tracked in the root of the OpSo repository. This means any API keys, tokens, or configuration values stored in it are publicly visible to anyone browsing GitHub, scraped by bots, or indexed by secret-scanning tools.

## What I Found

The file `.env` appears at the root of `main` and is not excluded by the existing `.gitignore`. For a Flutter app that integrates with open-source program APIs, this is a critical exposure risk — particularly if the `.env` contains any Firebase credentials, API keys, or backend URLs.

## Impact

- Any secrets committed here are permanently in git history even if the file is later deleted.
- Public repositories are actively scanned by credential harvesting bots within minutes of a push.
- Contributors forking the repo will inherit the compromised file.

## Proposed Solution

1. Add `.env` to `.gitignore` immediately.
2. Run `git rm --cached .env` to stop tracking the file without deleting it locally.
3. Create a `.env.example` file with all the required keys listed but with empty or placeholder values — this serves as documentation for new contributors.
4. Update `CONTRIBUTING.md` to include a "Setup Environment" section explaining how to populate `.env` from `.env.example`.
5. If any real secrets were committed at any point, rotate them immediately.

I am ready to implement items 1–4 right away and raise a PR. Could you please assign this to me?

**Labels:** `security`, `bug`, `good first issue`, `GSSoC 2026`