gitignore: cover the key files the node actually writes (#43)

.gitignore ignores *.dat and wallet.dat, but the node also writes three files
in its data directory that are not .dat and are just as sensitive:

  btf_enc.key      this node's .btf service key -- its network identity
  nostr.key        the Nostr key its descriptors are signed with
  walletrpc.token  bearer token authorising spends over the wallet API

A node run with its data directory inside a working tree -- which is the
obvious thing to do while developing -- leaves all three untracked but
committable, and `git add -A` takes them. Losing btf_enc.key means losing your
address; publishing walletrpc.token hands over the wallet to anyone who can
reach the port.

Also ignore key backup archives and stray .patch/.rej/.orig files.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 22 insertions, 0 deletions

diff --git a/.gitignore b/.gitignore
index b997d34..9f7153b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,3 +36,25 @@ dist/
 .DS_Store
 Thumbs.db
 src/bitflash
+
+# Key material and secrets the node creates in its data directory.
+# *.dat above already covers wallet.dat, but these are not .dat files and are
+# every bit as sensitive: btf_enc.key and nostr.key are this node's .btf
+# identity, and walletrpc.token is bearer authority to spend from the wallet.
+*.key
+btf_enc.key
+nostr.key
+walletrpc.token
+
+# Wallet/key backups
+*.tgz
+*.tar.gz
+bitflash-keys-*
+
+# Mempool dump, if a node is configured to write one
+mempool.txt
+
+# Patches and scratch files kept alongside a working tree
+*.patch
+*.rej
+*.orig