Harden secrets handling: env-var DB password + defensive .gitignore

Move hardcoded 'rootpassword' default in parser/{config,backfill_changeover,
clmparser,udcparser}.py behind os.environ.get('SHOPDB_DB_PASSWORD',
'rootpassword'). Add defensive patterns (.env, *.key, *.pem, id_rsa*,
secrets.*, etc.) to .gitignore across all project repos.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

parser/clmparser.py

@@ -35,13 +35,14 @@ from mysql.connector import Error
 try:
     from config import DB_CONFIG, CLM_DATA_PATH, BATCH_SIZE
 except ImportError:
+    import os
     import platform
     IS_WINDOWS = platform.system() == 'Windows'
     DB_CONFIG = {
         'host': '127.0.0.1',
         'port': 3306,
         'user': 'root',
-        'password': 'rootpassword',
+        'password': os.environ.get('SHOPDB_DB_PASSWORD', 'rootpassword'),
         'database': 'shopdb'
     }
     CLM_DATA_PATH = r'S:\SPC\UDC\CLM_Data' if IS_WINDOWS else '/home/camp/projects/UDC/CLM_Data'