.env encrypted to .env.sops using shared Unraid age key. .gitignore updated to allow .env.sops while still blocking plain .env.