feat: quick wins - dockerignore, env secrets, gzip, cache-control

- Add .dockerignore to exclude .git, __pycache__, docs, etc. from Docker context
- Create .env.example template with documented env vars
- Move OBSIGATE_ADMIN_PASSWORD from docker-compose.yml to env_file: .env
- Add .env.* to .gitignore (excluding .env.example)
- Enable GZipMiddleware for ~70% bandwidth reduction on text responses
- Add Cache-Control: immutable for /static/ assets
- Update ROADMAP: mark all 4 quick wins as done, add audit findings
- Add comprehensive technical audit report (AUDIT_TECHNIQUE_2026-05-27.md)

.env.example

@@ -0,0 +1,34 @@
+# ObsiGate — Environment variables
+# Copiez ce fichier en .env et modifiez les valeurs
+# Le fichier .env n'est JAMAIS commité (présent dans .gitignore)
+
+# Auth (décommenter pour activer)
+# OBSIGATE_AUTH_ENABLED=true
+# OBSIGATE_ADMIN_USER=admin
+# OBSIGATE_ADMIN_PASSWORD=change-me
+
+# Sécurité des cookies (activer si derrière HTTPS)
+# OBSIGATE_SECURE_COOKIES=false
+
+# Tokens TTL en secondes
+# OBSIGATE_ACCESS_TOKEN_TTL=900
+# OBSIGATE_REFRESH_TOKEN_TTL=604800
+
+# Rate limiting
+# OBSIGATE_LOGIN_MAX_ATTEMPTS=10
+# OBSIGATE_LOGIN_WINDOW_SECONDS=900
+
+# Watcher
+# OBSIGATE_WATCHER_ENABLED=true
+# OBSIGATE_WATCHER_USE_POLLING=false
+# OBSIGATE_WATCHER_POLLING_INTERVAL=5.0
+# OBSIGATE_WATCHER_DEBOUNCE=2.0
+
+# Ignored directories (séparés par des virgules)
+# OBSIGATE_IGNORED_DIRS=.obsidian,.trash,.git,__pycache__,node_modules,.obsigate-backup
+
+# Audit
+# OBSIGATE_AUDIT_MAX_SIZE=10485760
+
+# Backup
+# OBSIGATE_BACKUP_DIR=.obsigate-backup