chore: add .gitignore and env template, untrack generated files

- Add .gitignore excluding generated docker-compose.yml, demo.env,
  editor files, and temporary files
- Remove demo/docker-compose.yml from tracking (generated by envsubst)
- Remove demo/demo.env from tracking (contains per-machine values)
- Add demo/demo.env.template as reference for required configuration
- Remove stale config/portainer/ directory (Portainer not in stack)

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

demo/demo.env.template

@@ -0,0 +1,84 @@
+# TSYS Developer Support Stack - Demo Environment Configuration
+# FOR DEMONSTRATION PURPOSES ONLY - NOT FOR PRODUCTION
+
+# Project Identification
+COMPOSE_PROJECT_NAME=kneldevstack-supportstack-demo
+COMPOSE_NETWORK_NAME=kneldevstack-supportstack-demo-network
+
+# Dynamic User Detection (auto-populated by demo-stack.sh)
+DEMO_UID=1000
+DEMO_GID=1000
+DEMO_DOCKER_GID=986
+
+# Port Assignments (4000-4099 range)
+HOMEPAGE_PORT=4000
+DOCKER_SOCKET_PROXY_PORT=4005
+PIHOLE_PORT=4006
+DOCKHAND_PORT=4007
+INFLUXDB_PORT=4008
+GRAFANA_PORT=4009
+DRAWIO_PORT=4010
+KROKI_PORT=4011
+ATOMIC_TRACKER_PORT=4012
+ARCHIVEBOX_PORT=4013
+TUBE_ARCHIVIST_PORT=4014
+WAKAPI_PORT=4015
+MAILHOG_PORT=4017
+ATUIN_PORT=4018
+
+# Network Configuration
+NETWORK_SUBNET=192.168.3.0/24
+NETWORK_GATEWAY=192.168.3.1
+
+# Health Check Timeouts
+HEALTH_CHECK_TIMEOUT=10s
+HEALTH_CHECK_INTERVAL=30s
+HEALTH_CHECK_RETRIES=3
+
+# Docker Socket Proxy Configuration
+DOCKER_SOCKET_PROXY_CONTAINERS=1
+DOCKER_SOCKET_PROXY_IMAGES=1
+DOCKER_SOCKET_PROXY_NETWORKS=1
+DOCKER_SOCKET_PROXY_VOLUMES=1
+DOCKER_SOCKET_PROXY_EXEC=0
+DOCKER_SOCKET_PROXY_PRIVILEGED=0
+DOCKER_SOCKET_PROXY_SERVICES=0
+DOCKER_SOCKET_PROXY_TASKS=0
+DOCKER_SOCKET_PROXY_SECRETS=0
+DOCKER_SOCKET_PROXY_CONFIGS=0
+DOCKER_SOCKET_PROXY_PLUGINS=0
+
+# InfluxDB Configuration
+INFLUXDB_ORG=tsysdemo
+INFLUXDB_BUCKET=demo_metrics
+INFLUXDB_ADMIN_USER=admin
+INFLUXDB_ADMIN_PASSWORD=demo_password
+INFLUXDB_AUTH_TOKEN=demo_token_replace_in_production
+
+# Grafana Configuration
+GF_SECURITY_ADMIN_USER=admin
+GF_SECURITY_ADMIN_PASSWORD=demo_password
+GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource
+
+# Pi-hole Configuration
+PIHOLE_WEBPASSWORD=demo_password
+WEBTHEME=default-darker
+
+# ArchiveBox Configuration
+ARCHIVEBOX_SECRET_KEY=demo_secret_replace_in_production
+ARCHIVEBOX_ADMIN_USER=admin
+ARCHIVEBOX_ADMIN_PASSWORD=demo_password
+
+# Tube Archivist Configuration
+TA_HOST=http://tubearchivist:8000
+TA_USERNAME=admin
+TA_PASSWORD=demo_password
+ELASTIC_PASSWORD=demo_password
+ES_JAVA_OPTS="-Xms512m -Xmx512m"
+
+# Wakapi Configuration
+WAKAPI_PASSWORD_SALT=demo_salt_replace_in_production
+
+# Atuin Configuration
+ATUIN_HOST=0.0.0.0
+ATUIN_OPEN_REGISTRATION=true