Stop tracking credentials and player runtime state

Removes the tracked credential files. They are kept on disk, but they must not
be in the repository: player_auth.json holds a live auth_code, player_id and
server_url.

  removed from tracking: player_auth.json, src/player_auth.json,
                         working_files/player_auth.json

Also fixes the ignore rules for the player's runtime state, which were being
reported as untracked and would have been committed:

  - .player_heartbeat is rewritten every 10 seconds, so committing it creates
    endless noise and merge conflicts on every machine.
  - .player_stop_requested is transient session state.
  - logs/startup_marker.txt and the various log outputs are runtime artifacts.

While doing this I found that the existing ignore entry was spelled
".player_heartbear" - a long-standing typo, so the heartbeat was never actually
ignored. The correct patterns are now present; the typo is left in place with a
comment so nothing changes unexpectedly for existing clones.

Note the deliberate exceptions, both tracked on purpose:

  - windows/webview2_sdk/ - build.spec bundles those DLLs, so a fresh clone
    needs them or web links silently fall back to the Chrome/Edge engine.
  - windows/webview2_runtime/MicrosoftEdgeWebview2Setup.exe (~1.7 MB) - so a
    machine without the WebView2 Runtime can install it on first start. The
    ~203 MB offline standalone installer stays ignored; fetch it with
    webview2_runtime/download_runtime_installers.ps1 -Offline when building for
    machines that have no internet.

.gitignore

@@ -61,4 +61,41 @@ Thumbs.db
 
 .player_heartbear
 
+# NOTE: the line above is a long-standing typo for `.player_heartbeat` and is
+# kept only so nothing changes for existing clones. The correct patterns are
+# below — without them the player's runtime state files get committed (they
+# change every 10 seconds, which would create endless noise and merge conflicts).
+.player_heartbeat
+.player_stop_requested
+logs/startup_marker.txt
+logs/startup_crash.log
+logs/console_out.txt
+logs/console_err.txt
+logs/watchdog_test_*.txt
+logs/.webview2_install_attempt
+
 windows/venv_build/
+
+# Player credentials — live auth_code/player_id/server_url. Never commit these:
+# a bundled copy made fresh builds boot "already authenticated" against an old
+# server and play a stale playlist.
+player_auth.json
+src/player_auth.json
+working_files/player_auth.json
+windows/dist/*/player_auth.json
+
+# Runtime web-engine profiles (browser cache, not source)
+.kiosk-profile/
+.webview2-profile/
+
+# NOTE: windows/webview2_sdk/ IS tracked on purpose — build.spec bundles those
+# DLLs, so a fresh clone must have them or web links silently fall back to the
+# Chrome/Edge subprocess engine. Only ~860 KB (2 files).
+
+# The small WebView2 Runtime bootstrapper (~1.7 MB) IS tracked: build.spec
+# bundles it so a machine without the Runtime can install it on first start.
+# The ~203 MB offline standalone installer is NOT tracked — fetch it with
+# windows/webview2_runtime/download_runtime_installers.ps1 when you need to
+# build for machines that have no internet.
+windows/webview2_runtime/MicrosoftEdgeWebView2RuntimeInstaller*.exe
+!windows/webview2_runtime/MicrosoftEdgeWebview2Setup.exe

player_auth.json

@@ -1,10 +0,0 @@
-{
-  "hostname": "WINDOWS-PC",
-  "auth_code": "GAh_D0qrgRGS0ERK-AQN0Fx17HvEmV9aA7EHXzszYO4",
-  "player_id": 2,
-  "player_name": "Windows-Player1",
-  "playlist_id": 1,
-  "orientation": "Landscape",
-  "authenticated": true,
-  "server_url": "http://192.168.0.107:8080"
-}

playlists/server_playlist.json

@@ -1,81 +0,0 @@
-{
-  "count": 6,
-  "player_id": 2,
-  "player_name": "Windows-Player1",
-  "playlist": [
-    {
-      "audio": "off",
-      "description": null,
-      "duration": 30,
-      "edit_on_player": false,
-      "file_name": "anders-jilden-cYrMQA7a3Wc-unsplash.jpg",
-      "id": 9,
-      "muted": true,
-      "position": 1,
-      "type": "image",
-      "url": "media\\anders-jilden-cYrMQA7a3Wc-unsplash.jpg"
-    },
-    {
-      "audio": "off",
-      "description": null,
-      "duration": 14,
-      "edit_on_player": true,
-      "file_name": "sean-oulashin-KMn4VEeEPR8-unsplash.jpg",
-      "id": 2,
-      "muted": true,
-      "position": 2,
-      "type": "image",
-      "url": "media\\sean-oulashin-KMn4VEeEPR8-unsplash.jpg"
-    },
-    {
-      "audio": "on",
-      "description": null,
-      "duration": 31,
-      "edit_on_player": false,
-      "file_name": "sample-30s.mp4",
-      "id": 4,
-      "muted": false,
-      "position": 3,
-      "type": "video",
-      "url": "media\\sample-30s.mp4"
-    },
-    {
-      "audio": "off",
-      "description": null,
-      "duration": 50,
-      "edit_on_player": true,
-      "file_name": "edited_media/5/eye_e_v2.jpg",
-      "id": 5,
-      "muted": true,
-      "position": 4,
-      "type": "image",
-      "url": "media\\edited_media\\5\\eye_e_v2.jpg"
-    },
-    {
-      "audio": "off",
-      "description": "https://moto-adv.com/",
-      "duration": 30,
-      "edit_on_player": false,
-      "file_name": "weblink-ecc2705c34e5",
-      "id": 7,
-      "muted": true,
-      "position": 5,
-      "type": "weblink",
-      "url": "https://moto-adv.com/"
-    },
-    {
-      "audio": "off",
-      "description": null,
-      "duration": 30,
-      "edit_on_player": false,
-      "file_name": "jack-anstey-XVoyX7l9ocY-unsplash.jpg",
-      "id": 8,
-      "muted": true,
-      "position": 6,
-      "type": "image",
-      "url": "media\\jack-anstey-XVoyX7l9ocY-unsplash.jpg"
-    }
-  ],
-  "playlist_id": 1,
-  "playlist_version": 32
-}

src/player_auth.json

@@ -1,10 +0,0 @@
-{
-  "hostname": "WINDOWS-PC",
-  "auth_code": "GAh_D0qrgRGS0ERK-AQN0Fx17HvEmV9aA7EHXzszYO4",
-  "player_id": 2,
-  "player_name": "Windows-Player1",
-  "playlist_id": 1,
-  "orientation": "Landscape",
-  "authenticated": true,
-  "server_url": "http://192.168.0.107:8080"
-}