untrack sample .env files, add .env.example placeholders

Live .env files (with real OAuth secrets) were tracked. Replaced with .env.example
templates. Existing .env files kept on disk so the sample still runs.

NOTE: prior history (8c5deb7, 88c2860) on gitea/main still contains the leaked
GOOGLE_CLIENT_SECRET. Rotate the credential in Google Cloud Console and decide
whether to rewrite history.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cfg/.gitignore

@@ -1,6 +1,5 @@
 # Environment files with credentials (use .env.example as template)
 **/.env
-!sample/**/.env
 
 # Database dumps (sensitive data)
 **/dumps/*.sql

cfg/sample/soleprint/.env

@@ -1,32 +0,0 @@
-# =============================================================================
-# Sample Soleprint Configuration
-# =============================================================================
-
-# =============================================================================
-# DEPLOYMENT
-# =============================================================================
-DEPLOYMENT_NAME=sample_spr
-
-# =============================================================================
-# NETWORK
-# =============================================================================
-NETWORK_NAME=sample_network
-
-# =============================================================================
-# PORTS (unique per room)
-# =============================================================================
-SOLEPRINT_PORT=12030
-NGINX_PORT=8130
-
-# =============================================================================
-# GOOGLE OAUTH
-# =============================================================================
-GOOGLE_CLIENT_ID=1076380473867-k6gvdg8etujj2e51bqejve78ft99hnqd.apps.googleusercontent.com
-GOOGLE_CLIENT_SECRET=***REMOVED***
-GOOGLE_REDIRECT_URI=http://sample.spr.local.ar/artery/google/oauth/callback
-
-# =============================================================================
-# AUTH
-# =============================================================================
-AUTH_BYPASS=true
-AUTH_SESSION_SECRET=sample-dev-secret-change-in-production

cfg/sample/soleprint/.env.example

@@ -1,21 +1,23 @@
 # =============================================================================
-# sample room — Managed App (Fixture Invoicing)
+# Sample Soleprint Configuration — copy to .env and fill in
 # =============================================================================
-# This room wraps examples/fixture-invoicing/ — a deliberate fixture, not a real app.
 
-DEPLOYMENT_NAME=sample
+DEPLOYMENT_NAME=sample_spr
 NETWORK_NAME=sample_network
 
+# Ports (unique per room)
+SOLEPRINT_PORT=12030
+NGINX_PORT=8130
+
 # =============================================================================
-# PORTS (host-exposed)
+# Google OAuth — get values from console.cloud.google.com
 # =============================================================================
-BACKEND_PORT=8120
-FRONTEND_PORT=3120
-DB_PORT=5532
+GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
+GOOGLE_CLIENT_SECRET=your-client-secret
+GOOGLE_REDIRECT_URI=http://sample.spr.local.ar/artery/google/oauth/callback
 
 # =============================================================================
-# DATABASE (Postgres)
+# Auth
 # =============================================================================
-POSTGRES_DB=fixture
-POSTGRES_USER=postgres
-POSTGRES_PASSWORD=localdev123
+AUTH_BYPASS=true
+AUTH_SESSION_SECRET=change-me-to-a-long-random-string