Untrack config.yaml, ignore it, and add config.example.yaml

config.yaml is meant to hold real, deployment-specific secrets (bcrypt
password hashes) and the public base_url, so it shouldn't be committed.
Add it to .gitignore, remove it from version control (kept locally on
disk), and check in config.example.yaml as the template to copy from.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.gitignore

@@ -1 +1,2 @@
 data/
+config.yaml

README.md

@@ -33,7 +33,14 @@ go run ./tools/hashpwd mysecretpassword
 # Outputs: $2b$12$...
 ```
 
-### 3. Edit `config.yaml`
+### 3. Create your `config.yaml`
+
+Copy the example config and edit it — `config.yaml` is git-ignored so your
+real credentials/domain never get committed:
+
+```bash
+cp config.example.yaml config.yaml
+```
 
 Replace the placeholder hashes with your real bcrypt hashes:
 
@@ -205,7 +212,7 @@ caldav-server/
 │   ├── store/           # filesystem storage layer
 │   └── webdav/          # WebDAV file handler
 ├── tools/hashpwd/       # bcrypt password hasher CLI
-├── config.yaml          # sample configuration
+├── config.example.yaml  # sample configuration (copy to config.yaml)
 ├── Dockerfile
 ├── docker-compose.yaml
 └── Makefile