Stop tracking credentials and player runtime state

Removes the tracked credential files. They are kept on disk, but they must not
be in the repository: player_auth.json holds a live auth_code, player_id and
server_url.

  removed from tracking: player_auth.json, src/player_auth.json,
                         working_files/player_auth.json

Also fixes the ignore rules for the player's runtime state, which were being
reported as untracked and would have been committed:

  - .player_heartbeat is rewritten every 10 seconds, so committing it creates
    endless noise and merge conflicts on every machine.
  - .player_stop_requested is transient session state.
  - logs/startup_marker.txt and the various log outputs are runtime artifacts.

While doing this I found that the existing ignore entry was spelled
".player_heartbear" - a long-standing typo, so the heartbeat was never actually
ignored. The correct patterns are now present; the typo is left in place with a
comment so nothing changes unexpectedly for existing clones.

Note the deliberate exceptions, both tracked on purpose:

  - windows/webview2_sdk/ - build.spec bundles those DLLs, so a fresh clone
    needs them or web links silently fall back to the Chrome/Edge engine.
  - windows/webview2_runtime/MicrosoftEdgeWebview2Setup.exe (~1.7 MB) - so a
    machine without the WebView2 Runtime can install it on first start. The
    ~203 MB offline standalone installer stays ignored; fetch it with
    webview2_runtime/download_runtime_installers.ps1 -Offline when building for
    machines that have no internet.

.gitignore

@@ -61,4 +61,41 @@ Thumbs.db
 
 .player_heartbear
 
+# NOTE: the line above is a long-standing typo for `.player_heartbeat` and is
+# kept only so nothing changes for existing clones. The correct patterns are
+# below — without them the player's runtime state files get committed (they
+# change every 10 seconds, which would create endless noise and merge conflicts).
+.player_heartbeat
+.player_stop_requested
+logs/startup_marker.txt
+logs/startup_crash.log
+logs/console_out.txt
+logs/console_err.txt
+logs/watchdog_test_*.txt
+logs/.webview2_install_attempt
+
 windows/venv_build/
+
+# Player credentials — live auth_code/player_id/server_url. Never commit these:
+# a bundled copy made fresh builds boot "already authenticated" against an old
+# server and play a stale playlist.
+player_auth.json
+src/player_auth.json
+working_files/player_auth.json
+windows/dist/*/player_auth.json
+
+# Runtime web-engine profiles (browser cache, not source)
+.kiosk-profile/
+.webview2-profile/
+
+# NOTE: windows/webview2_sdk/ IS tracked on purpose — build.spec bundles those
+# DLLs, so a fresh clone must have them or web links silently fall back to the
+# Chrome/Edge subprocess engine. Only ~860 KB (2 files).
+
+# The small WebView2 Runtime bootstrapper (~1.7 MB) IS tracked: build.spec
+# bundles it so a machine without the Runtime can install it on first start.
+# The ~203 MB offline standalone installer is NOT tracked — fetch it with
+# windows/webview2_runtime/download_runtime_installers.ps1 when you need to
+# build for machines that have no internet.
+windows/webview2_runtime/MicrosoftEdgeWebView2RuntimeInstaller*.exe
+!windows/webview2_runtime/MicrosoftEdgeWebview2Setup.exe