Sanitize codebase, reorganize docs, and add missing deploy files

Remove dead code identified in docs/SANITIZATION-REVIEW.md:
- app/blueprints/content_old.py and app/blueprints/playlist.py
- app/models/group.py, app/utils/nginx_config_reader.py
- orphaned templates (content_list, edit_content, upload_content,
  player_page) and the related group/Template references

Result: 6 blueprints, 82 routes, no dead modules or orphan templates.

Add files that deploy.sh and docker-entrypoint.sh already require but
which were never tracked:
- https_manager.py       (referenced by deploy.sh, migrate_network.sh,
                          docker-entrypoint.sh)
- Caddyfile.example      (seeded by deploy.sh; its absence aborts deploy)

Relocate generated Graphify artifacts from graphify-out/ to
docs/graphify-out/ (110 files, no content change) and archive the
superseded docs under docs/.

Ignore hygiene:
- ignore ad-hoc .env backups (.env.bak*) — they contain live secrets
- keep the pre-sanitization snapshots (docs/legacy code/,
  docs/old_code_documentation/) on disk but out of the repo

Fix .env.example: drop a duplicated config block, genericize the
hardcoded host IP, and document HOSTNAME_INTERNAL.

.gitignore

@@ -26,6 +26,23 @@ data/
 # Environment
 .env
 .env.local
+.env.*.local
+
+# Ad-hoc backups of .env (they contain real secrets — must never be committed)
+.env.bak
+.env.bak.*
+.env.*.bak
+*.env.bak
+
+# Deployment artefacts that contain secrets
+.deployment-credentials
+caddy-root.crt
+
+# Certificates / keys (generated by Caddy or the host)
+*.pem
+*.key
+!data/caddy-data/**
+!Caddyfile.example
 
 # Database
 *.db
@@ -59,3 +76,10 @@ build/
 #data
 data/
 
+# Local archive / restore-point snapshots.
+# Kept on disk for reference (see docs/SANITIZATION-REVIEW.md) but deliberately
+# NOT tracked: docs/legacy code/ is a full pre-sanitization repo snapshot and
+# docs/old_code_documentation/ is a byte-identical copy of the tree inside it.
+docs/legacy code/
+docs/old_code_documentation/
+