chore: root directory cleanup and .gitignore hardening

WHAT WAS DONE:
- Moved 33 accumulated root-level .md files to docs/archive/root-cleanup-2026-03-28/
- Moved 5 Pokerole root files to docs/external/holly-project/
- Updated .gitignore to cover *.pem, *.key, .env, .DS_Store etc.
- Added explanatory README to the archive folder
- Root now contains only 7 essential files

WHY:
Full repository audit (first full clone) revealed root had accumulated
40 .md files from early Chroniclers (#1-#33) — old session handoffs,
competing start prompt variants, status snapshots. None deleted, all
preserved in archive. Root clutter makes navigation harder and creates
confusion about which files are current.

ROOT FILES KEPT:
- README.md, CHANGELOG.md, DOCUMENT-INDEX.md
- SESSION-HANDOFF-NEXT.md, SESSION-HANDOFF-PREVIOUS.md
- SESSION-HANDOFF-PROTOCOL.md, SESSION-HANDOFF-TEMPLATE.md

.GITIGNORE ADDITIONS:
- *.pem, *.key, *.p12, *.pfx (intentionally NOT *.ppk yet)
- .env, .env.*, *.secret
- .DS_Store, Thumbs.db

NOTE: SSH key intentionally left per Michael's decision.

FILES MOVED: 38 files reorganized, 0 deleted

Signed-off-by: Chronicler #45 <claude@firefrostgaming.com>

.gitignore

@@ -4,3 +4,20 @@ management/app.ini
 # Backup files
 *.backup
 *.bak
+
+# SSH keys and certificates (never commit private keys)
+# NOTE: Firefrost_key.ppk is intentionally tracked temporarily - remove when no longer needed
+*.pem
+*.key
+*.p12
+*.pfx
+# *.ppk  <- intentionally commented out until Firefrost_key.ppk is no longer needed
+
+# Environment and secrets
+.env
+.env.*
+*.secret
+
+# OS clutter
+.DS_Store
+Thumbs.db

docs/archive/root-cleanup-2026-03-28/README.md

@@ -0,0 +1,66 @@
+# Root Cleanup — March 28, 2026
+
+**Performed by:** Chronicler #45  
+**Reason:** Full repository audit revealed 40 markdown files accumulated in the root directory over many sessions. Root should only contain essential navigation files.
+
+## What Was Here
+
+These files were created by early Chroniclers (roughly #1–#33) as session handoffs, status snapshots, and start prompts. Over time they were superseded by the structured `docs/` hierarchy but never cleaned up.
+
+**None of these files are deleted — they are archived here for historical reference.**
+
+## Files Archived
+
+### Old Session Handoffs
+- `NEXT-SESSION-HANDOFF.md`
+- `NEXT-SESSION-PRIORITY.md`
+- `NEXT-SESSION-PROMPT.md`
+- `NEXT-SESSION-START-PROMPT.md`
+- `NEXT-SESSION-START.md`
+- `NEXT-SESSION-STARTUP-PROMPT.md`
+- `SESSION-20-HANDOFF-CODEX.md`
+- `SESSION-21-HANDOFF.md`
+- `SESSION-HANDOFF-AUDITOR.md`
+- `SESSION-HANDOFF-CHRONICLER-33.md`
+- `SESSION-END-CHECKLIST.md`
+
+### Old Start Prompt Variants
+- `SESSION-START-PROMPT.md`
+- `SESSION-START-PROMPT-CORRECTED.md`
+- `SESSION-START-PROMPT-FOR-23.md`
+- `SESSION-START-PROMPT-MINIMAL.md`
+- `SESSION-START-PROMPT-TEMPLATE.md`
+- `SESSION-START-MINIMAL.md`
+- `CUSTOM-PROMPT-FOR-SESSIONS.md`
+- `EMERGENCY-STARTER-PROMPT.md`
+- `MANDATORY-READING-ORDER.md`
+- `SUCCESSOR-PROMPT-DEPLOYER.md`
+
+### Status Snapshots
+- `CURRENT-CONTEXT.md`
+- `CURRENT-STATUS.md`
+- `DEPLOYMENT-AUDIT-CHECKLIST.md`
+- `DEPLOYMENT-STATUS-AUDIT.md`
+- `CODEX-DOCUMENTATION-SUMMARY.md`
+- `RESTRUCTURING-SUMMARY-2026-02-19.md`
+- `README-INDEX.md`
+
+## What Stayed at Root
+
+The root now contains only:
+- `README.md` — Repo introduction
+- `CHANGELOG.md` — Change log
+- `DOCUMENT-INDEX.md` — Master document map
+- `SESSION-HANDOFF-NEXT.md` — Current handoff (always current)
+- `SESSION-HANDOFF-PREVIOUS.md` — Previous handoff (one back)
+- `SESSION-HANDOFF-PROTOCOL.md` — How sessions work
+- `SESSION-HANDOFF-TEMPLATE.md` — Template for new handoffs
+
+## Pokerole Files
+
+Five Pokerole root files were moved to `docs/external/holly-project/` where they belong:
+- `POKEROLE-API-STATUS-FINAL.md`
+- `POKEROLE-GRAPHQL-API-ENABLED.md`
+- `POKEROLE-WIKI-DEPLOYMENT-COMPLETE.md`
+- `POKEROLE-WIKI-MISSION-SUCCESS.md`
+- `POKEROLE-WIKI-QUICK-REF.md`