security: remove hardcoded credentials, untrack .env

- config/system_config.py: defaults are localhost with empty credentials;
  real hosts/secrets must come from env (.env or docker-compose)
- main.py: help text lists env var names instead of real NATS host/user
- doormile_test.py: reads infra config from env instead of literals
- untrack .env, ignore .env/.env.*, add .env.example with keys only
- pytest.ini: testpaths=tests so doormile_test.py isn't collected

Credentials remain in git history and must be rotated.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AJLYcbTHCe45fyFnMfEin

main.py

@@ -204,11 +204,12 @@ Usage:
     python main.py --portal         Launch Streamlit customer portal
     python main.py --help           Show this help
 
-Infrastructure (set in .env):
-    NATS   nats://doormile@66.116.226.161:4223
-    Redis  66.116.226.255:6380
+Infrastructure (set in .env — see .env.example):
+    NATS   NATS_URL / NATS_USER / NATS_PASSWORD
+    Redis  REDIS_HOST / REDIS_PORT / REDIS_PASSWORD
     PG     DB_HOST / DB_PORT / DB_NAME / DB_USER / DB_PASSWORD
-    API    GO_API_BASE_URL
+    API    GO_API_BASE_URL / INTERNAL_API_KEY
+    LLM    ANTHROPIC_API_KEY / LLM_MODEL
     """)