docs: add foundation docs and cluster configuration templates

- README: cluster architecture, quick start, use cases
- USAGE: stack topology, custom CLI reference
- TROUBLESHOOTING: operational safety rules
- .env.example: configuration template
- Makefile: build shortcuts

.gitignore

@@ -0,0 +1,40 @@
+# Environment files — real values must never be committed
+.env
+
+# Private CA key and generated TLS certs — ca.key must never enter the cluster or git.
+# Only ca.crt is safe to share, but we exclude the whole dir to avoid accidents.
+forge/pki/
+
+# Talos machine configs — contain WireGuard private keys, bootstrap tokens, PKI
+cluster-config/controlplane.yaml
+cluster-config/worker*.yaml
+cluster-config/secrets.yaml
+cluster-config/talosconfig
+talos-forge-trust.yaml
+# Kubeconfig — contains admin client certificate + private key
+cluster-config/kubeconfig
+
+*.html
+LOG.md
+project_context.md
+.claude/*
+
+ca.crt
+ca.key
+ca.srl
+
+forgejo.crt
+forgejo.key
+forgejo.csr
+
+# Compiled test binary — Go produces a native binary named after the directory.
+# Source is k8s/storage/test/main.go; the binary has no place in version control.
+k8s/storage/test/test
+
+*.key
+*.conf
+
+# Allowed markdown: CLAUDE.example.md, README.md, TROUBLESHOOTING.md
+CLAUDE.md
+
+skills-lock.json