Play Framework

refactor: PF-71 — drop alpha back-compat, move .env.example to certs/, fix gitignore (release 1.12.22)

Three follow-up simplifications on top of 12bde9ccc:

1. Drop the loadDotEnv legacy fallback. Alpha release with no existing
   apps to maintain — there is no migration story to support. loadDotEnv
   reads certs/.env only, no WARNed fallback to project-root .env.

2. Move .env.example to certs/.env.example. Onboarding becomes a single-
   directory operation (cp certs/.env.example certs/.env) and the template
   doubles as the "this directory matters" marker, so no .gitkeep needed.

3. Drop the legacy-cleanup nudge from play secret. play secret only ever
   writes to certs/.env, never reads or warns about anything else.

Also fixes a latent bug surfaced during e2e testing: copy_directory
deliberately skips dot-files (legacy commit dc9b54104, to avoid picking up
.DS_Store / .idea), which meant the skel's .gitignore was never landing in
fresh apps. Without a .gitignore in the new app, the entire PF-71 secret-
protection invariant collapsed — operators running `git add .` would
accidentally commit certs/.env. Fixed by an explicit shutil.copyfile of
.gitignore in base.py right after the skel tree copy. The dot-file skip
stays in place for everything else (the change is surgical to .gitignore).

The skel .gitignore pattern is now `/certs/*` + `!/certs/.env.example`,
which ignores all runtime security material (TLS cert, TLS key, populated
.env) but keeps the committed template tracked. Verified with
`git check-ignore -v` against a fresh app — secret blocked, template
shows up as untracked-and-ready-to-add.

Tests: TestPlaySecret class grows to 5 tests (added a gitignore-pattern
test that initializes a real git repo and asserts the right files are
ignored vs tracked). All 5 pass.

End-to-end on /tmp/pf71test:
- play new produces certs/.env (mode 0600), certs/.env.example (mode 0644),
  and a project-root .gitignore.
- play start boots cleanly, GET / returns 200, no PLAY_SECRET errors.
- git check-ignore -v confirms patterns fire as designed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>