config.yaml is meant to hold real, deployment-specific secrets (bcrypt
password hashes) and the public base_url, so it shouldn't be committed.
Add it to .gitignore, remove it from version control (kept locally on
disk), and check in config.example.yaml as the template to copy from.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
