chore: add .gitignore, CrowdSec acquis config, update architecture docs

- .gitignore: exclude crowdsec/.crowdsec.env (bouncer API key), .env.local,
  and compiled Go binaries (backend/bin/, backend/healthcheck)
- crowdsec/acquis.yaml: log acquisition config for CrowdSec agent
- docs: update d2 and mermaid diagrams to reflect MinIO bucket renames
  (libnovel-chapters→chapters, libnovel-audio→audio, libnovel-browse→catalogue),
  remove /api/browse, update presigned URL paths

v3/docs/d2/architecture.d2

@@ -46,7 +46,7 @@ storage: Storage {
 
   minio: MinIO {
     shape: cylinder
-    label: "MinIO :9000\n\nbuckets:\n  libnovel-chapters\n  libnovel-audio\n  avatars\n  libnovel-browse"
+    label: "MinIO :9000\n\nbuckets:\n  chapters\n  audio\n  avatars\n  catalogue"
   }
 
   pocketbase: PocketBase {
@@ -135,7 +135,7 @@ app.ui -> app.backend: REST API calls (server-side)\n/api/catalogue /api/book-pr
 
 app.caddy -> app.ui: "/* (catch-all)\n/api/scrape/*\n/api/chapter-text-preview/*\n→ SvelteKit (auth enforced)"
 app.caddy -> app.backend: "/health  /scrape*\n/api/browse  /api/book-preview/*\n/api/chapter-text/*\n/api/reindex/*  /api/cover/*\n/api/audio-proxy/*"
-app.caddy -> storage.minio: "/avatars/*\n(presigned avatar GETs)"
+app.caddy -> storage.minio: "/avatars/*\n/audio/*\n/chapters/*\n(presigned MinIO GETs)"
 
 # ─── External → App ───────────────────────────────────────────────────────────