docs: architecture guide + full .env.example + gitattributes + Makefile note (TASK-687) (#222)

Grouped nice-to-haves called out in the pre-launch audit.

1. docs/architecture.md — new contributor-focused architecture doc.
   CLAUDE.md covers the same ground but is agent-oriented; this is the
   human companion. Covers backend layout, request flow, frontend /
   data model / CLI↔daemon model / agent integration / testing.

2. .env.example — extended to document every PAD_* variable in
   docs/deployment.md (core, database, real-time events, security,
   email). Existing Postgres/Redis + encryption secrets kept at the
   top; new variables grouped by concern with inline comments and
   safe defaults commented out.

3. .gitattributes — normalize LF line endings repo-wide, mark binary
   assets, and flag web/build + web/.svelte-kit as generated so they
   don't pollute GitHub linguist stats or PR diffs.

4. Makefile — CAUTION comment on `make install` noting that the
   `killall -9 pad` step is system-wide; anyone else's pad daemon on
   the same machine gets killed too. Designed for single-developer
   local setups; not for shared hosts.

Parent: PLAN-644.

.gitattributes

@@ -0,0 +1,49 @@
+# Normalize line endings across platforms.
+# Without this, Windows contributors can commit CRLF into otherwise-LF files
+# and break diffs / hooks / linters. See `man gitattributes`.
+
+# Default: auto-detect text and normalize to LF on commit.
+* text=auto eol=lf
+
+# Explicit text — safer than relying on auto-detect.
+*.go         text eol=lf diff=golang
+*.ts         text eol=lf
+*.tsx        text eol=lf
+*.js         text eol=lf
+*.jsx        text eol=lf
+*.svelte     text eol=lf
+*.html       text eol=lf
+*.css        text eol=lf
+*.scss       text eol=lf
+*.md         text eol=lf
+*.json       text eol=lf
+*.yml        text eol=lf
+*.yaml       text eol=lf
+*.toml       text eol=lf
+*.sh         text eol=lf
+*.py         text eol=lf
+Makefile     text eol=lf
+Dockerfile*  text eol=lf
+
+# Vendored / minified — don't rewrite, don't diff as text.
+*.min.js     binary
+*.min.css    binary
+package-lock.json   -diff
+
+# Binary assets — never touch.
+*.png  binary
+*.jpg  binary
+*.jpeg binary
+*.gif  binary
+*.ico  binary
+*.woff  binary
+*.woff2 binary
+*.ttf   binary
+*.eot   binary
+*.pdf   binary
+*.zip   binary
+*.tar.gz binary
+
+# Keep generated output out of PR diffs / GitHub linguist stats.
+web/build/**         linguist-generated=true
+web/.svelte-kit/**   linguist-generated=true