security: exclude .env.bak files from git and deployment

- Add .env.bak* patterns to .gitignore
- Explicitly exclude .env.bak* files from Firebase deployment
- Prevents accidental exposure of backup files containing secrets

.gitignore

@@ -15,6 +15,10 @@ build/
 .env.development.local
 .env.test.local
 .env.production.local
+.env.bak
+.env.bak*
+*.env.bak
+*.env.bak*
 
 # Logs
 logs/
@@ -103,6 +107,8 @@ Thumbs.db
 
 # Uploads
 uploads/
+# Exception: Test PDF file for development (must come before *.pdf)
+!/Creed CIM.pdf
 *.pdf
 *.doc
 *.docx

backend/firebase.json

@@ -16,7 +16,11 @@
       "cloud-run.yaml",
       ".env",
       ".env.*",
-      "*.env"
+      "*.env",
+      ".env.bak",
+      ".env.bak*",
+      "*.env.bak",
+      "*.env.bak*"
     ],
     "predeploy": [
       "npm run build"