chore: initial dotfiles skeleton

.gitignore

@@ -0,0 +1,41 @@
+# macOS
+.DS_Store
+.DS_Store?
+._*
+
+# Backup artifacts
+*.bak
+*.orig
+
+# SSH private keys — never commit unencrypted private keys
+# Remove a line below only if you store GPG-encrypted versions
+.ssh/id_rsa
+.ssh/id_ed25519
+.ssh/id_ecdsa
+.ssh/id_dsa
+.ssh/keys/*_rsa
+.ssh/keys/*_ed25519
+.ssh/keys/*_ecdsa
+.ssh/keys/*.pem
+# Public keys and config are fine
+!.ssh/*.pub
+!.ssh/keys/*.pub
+!.ssh/config
+!.ssh/known_hosts
+
+# GPG-encrypted private key backups are safe to commit
+!.ssh/keys/*.gpg
+
+# Secrets / tokens — never commit
+.env
+.env.*
+*.token
+*.secrets
+vault/
+
+# Machine-local overrides — never commit (written by setup_enterprise_ai_bash.sh)
+.bashrc.local
+.bash_profile.local
+
+# Credential store — never commit
+.config/dotfiles/credentials

README.md

@@ -0,0 +1,35 @@
+# dotfiles
+
+Centralized configuration management for kenjim@zet.
+
+## Remote
+`http://172.27.0.35:3000/kenjim/dotfiles`
+
+## Structure
+```
+dotfiles/
+├── .bashrc              → ~/.bashrc
+├── .bash_profile        → ~/.bash_profile
+├── .bash_aliases        → ~/.bash_aliases
+├── .gitconfig           → ~/.gitconfig
+├── .ssh/
+│   ├── config           → ~/.ssh/config
+│   └── keys/            (public keys + GPG-encrypted private keys)
+├── scripts/
+│   ├── dotfiles_manager.sh        → ~/scripts/dotfiles_manager.sh
+│   ├── setup_enterprise_ai_bash.sh → ~/scripts/setup_enterprise_ai_bash.sh
+│   └── bootstrap.sh               → ~/scripts/bootstrap.sh
+├── .vimrc               → ~/.vimrc
+├── .dotfiles_manifest   (list of managed HOME paths)
+├── install.sh           (new-machine restore script)
+└── README.md
+```
+
+## Quick start — restore on a new machine
+```bash
+git clone http://172.27.0.35:3000/kenjim/dotfiles ~/dotfiles
+bash ~/dotfiles/install.sh
+```
+
+## Managed files
+<!-- auto-updated by dotfiles_manager.sh status -->