gitignore: cover the key files the node actually writes

[ericscalibur]

.gitignore ignores *.dat and wallet.dat, but the node also writes three files in its data directory that are not .dat and are just as sensitive:

btf_enc.key this node's .btf service key -- its network identity
nostr.key the Nostr key its descriptors are signed with
walletrpc.token bearer token authorising spends over the wallet API

A node run with its data directory inside a working tree -- which is the obvious thing to do while developing -- leaves all three untracked but committable, and git add -A takes them. Losing btf_enc.key means losing your address; publishing walletrpc.token hands over the wallet to anyone who can reach the port.

Also ignore key backup archives and stray .patch/.rej/.orig files.

[Bitflash-sh]

Right on the substance — those three files are the node's actual secrets and none of them end in .dat, so the existing rules never covered them. walletrpc.token is the one that would hurt most: it is bearer authority to spend, with no second factor behind it.

Checked that nothing currently tracked would start being ignored:

$ git ls-files | grep -Ei '\.key$|\.patch$|\.rej$|\.orig$|\.tgz$|\.tar\.gz$|^bitflash-keys-|mempool\.txt$|walletrpc\.token$'
(empty)

Clean, so this is purely additive.

One thing worth knowing rather than changing: *.key is broad enough to also swallow a public key file, should the project ever want one committed — an update-verification pubkey shipped in-tree, say. That is not the case today (the update pubkey lives as a repo variable, not a file), and git add -f covers the exception, so I would rather have the broad rule protecting private keys than a narrow one that misses the next filename we invent. Noting it only so it is not a surprise later.

The explicit entries alongside the glob are the right belt-and-braces: they document which files matter, which the glob alone does not.

Reviewed clean.