caddy/.env and immich/.env were tracked despite .gitignore already excluding .env — gitignore only applies to untracked paths, so these kept diffing secrets into commits. Files stay on disk, just no longer in git. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DPXhxhLUopnuDm3dWeHd5C