chore(audit-fixes): fix .gitignore gaps + apply gofmt to all example files

[shing1211]

Summary

Two fixes from the 2026-10-01 audit of :

1. .gitignore credential-backup gap (security fix)

only blocked , not . A backup file made during the session
(, 485 bytes, RSA key + trade password + WS secret) would be
picked up by a plain and committed as a new file to this public repo.

Fix: Added patterns to block all common env-backup naming conventions:

.env.bak
.env.bak.*
.env.local
.env.*.local
.env.*.bak

Confirmed: dry-run now ignores the backup file. History is clean — the
credential file was never committed.

2. gofmt applied to 118 example files

118 of 126 example files failed , causing the CI "Check example numbering"
step to fail on every push. Applied across all files (119 files changed,
+365/−352 lines).

Build / vet / test / race results (all pass)

Check	Result
go build -p 1 ./...	✅
go vet -p 1 ./...	✅
go test -p 1 ./...	✅
go test -p 1 -race ./...	✅
go list -m -u all	✅ no outdated direct deps

Not fixed in this PR (requires owner action)

• Secret scanning not enabled — GitHub repo Settings → Security → Secret scanning → Enable
• CI "Check example numbering" logic — the gofmt fix makes the step pass; the step itself
  is in which I was not authorized to modify