chore: add .gitignore, CrowdSec acquis config, update architecture docs

- .gitignore: exclude crowdsec/.crowdsec.env (bouncer API key), .env.local,
  and compiled Go binaries (backend/bin/, backend/healthcheck)
- crowdsec/acquis.yaml: log acquisition config for CrowdSec agent
- docs: update d2 and mermaid diagrams to reflect MinIO bucket renames
  (libnovel-chapters→chapters, libnovel-audio→audio, libnovel-browse→catalogue),
  remove /api/browse, update presigned URL paths

v3/docs/d2/api-routing.d2

@@ -171,7 +171,7 @@ client -> caddy: HTTPS :443
 
 caddy -> sk: "/* (catch-all)\n→ SvelteKit handles auth"
 caddy -> be: "/health  /scrape*\n/api/browse  /api/book-preview/*\n/api/chapter-text/*  /api/chapter-markdown/*\n/api/reindex/*  /api/cover/*\n/api/audio-proxy/*  /api/catalogue  /api/ranking"
-caddy -> storage.mn: "/avatars/*\n(presigned GETs)"
+caddy -> storage.mn: "/avatars/*\n/audio/*\n/chapters/*\n(presigned MinIO GETs)"
 
 # ─── SvelteKit → Backend (server-side proxy) ──────────────────────────────────