Add authenticated designlang extract path for coulomb.social

Interactive Playwright session capture (XDG storageState, mode 0600)
plus a designlang pack wrapper that never prints secrets. Document the
intended OpenBao lane tenants/binky/coulomb-social/bubble-member for
later password custody; interactive capture is the default for Bubble.

.gitignore

@@ -3,3 +3,15 @@
 .claude/*
 !.claude/rules/
 !.claude/rules/*.md
+
+# Auth / secrets — never commit (see docs/design-extract-auth.md)
+.auth/
+**/storage-state.json
+**/*cookie*.txt
+scripts/node_modules/
+scripts/package-lock.json
+
+# Local env overrides
+.env
+.env.*
+!.env.example