security: remove committed private key, harden gitignore

git rm src/lexecon_keys/{private,public}_key.pem — keys were still
tracked in HEAD despite earlier attempt. Add src/lexecon_keys/ to
.gitignore so the path is explicitly covered. History rewrite follows.

https://claude.ai/code/session_01Svo578jk8PhSMqz5Xi2tad

Author: claude

.gitignore

@@ -72,15 +72,14 @@ data/
 *.bak
 coverage.json
 
-# Secrets management (Phase 1D)
+# Secrets / keys — never commit
 secrets/
 .env
 *.env.local
 *.pem
 *.pem.backup
 lexecon_keys/
-# .env.encrypted can be committed (encrypted with master key)
-# but exclude for extra safety unless you want to version it
+src/lexecon_keys/
 
 # Sphinx documentation
 docs/_build/