Harden secrets handling: env-var DB password + defensive .gitignore

Move hardcoded 'rootpassword' default in parser/{config,backfill_changeover,
clmparser,udcparser}.py behind os.environ.get('SHOPDB_DB_PASSWORD',
'rootpassword'). Add defensive patterns (.env, *.key, *.pem, id_rsa*,
secrets.*, etc.) to .gitignore across all project repos.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

parser/udcparser.py

@@ -23,13 +23,14 @@ from mysql.connector.pooling import MySQLConnectionPool
 try:
     from config import DB_CONFIG, UDC_LOG_PATH as LOG_DIRECTORY, BATCH_SIZE
 except ImportError:
+    import os
     import platform
     IS_WINDOWS = platform.system() == 'Windows'
     DB_CONFIG = {
         'host': '127.0.0.1',
         'port': 3306,
         'user': 'root',
-        'password': 'rootpassword',
+        'password': os.environ.get('SHOPDB_DB_PASSWORD', 'rootpassword'),
         'database': 'shopdb'
     }
     LOG_DIRECTORY = r'S:\SPC\UDC\LogFiles' if IS_WINDOWS else '/home/camp/projects/UDC/LogFiles'