add .env generation from bws, handle build services in deploy

- configure.sh generates .env files from .env.keys + bws
- deploy.sh detects build: services and runs docker compose build
- new-service.sh prints .env.keys instructions
- clean up .gitignore

tools/new-service.sh

@@ -64,3 +64,9 @@ OUTER
 sed -i "s/APP_PLACEHOLDER/$APP/g" "$REPO_ROOT/.gitea/workflows/deploy-$APP.yml"
 
 echo "Done. Edit docker/$APP/compose.yml, then commit and push."
+echo ""
+echo "If this service needs secrets:"
+echo "  1. Add secrets to Bitwarden Secrets Manager"
+echo "  2. Map them in docker/$APP/.env.keys (format: ENV_VAR=bws-secret-name)"
+echo "  3. Add env_file: .env to compose.yml"
+echo "  configure.sh will generate the .env file on the server automatically."