feat: add hosts/ convention for centrally managed server .bashrc.local

- hosts/etqc-kenjim-11.bashrc.local: per-host local config for work server,
  managed from kenjim-mbp and deployed via 'dotfiles deploy-to'.
  Credentials replaced with CHANGEME placeholders — set real values on
  server after first deploy, never commit actual secrets.
- dotfiles_manager.sh: deploy-to step 5 auto-detects hosts/<hostname>.bashrc.local
  and SCPs it to ~/.bashrc.local on the remote (with backup of existing file)
- .gitignore: clarify that hosts/*.bashrc.local is intentionally tracked
  (existing .bashrc.local rule only matches the exact filename)
- README.md: document hosts/ layout, workflow, and credential placeholder strategy

README.md

@@ -75,6 +75,8 @@ Three scripts drive the system:
 │   │   ├── setup_enterprise_ai_bash.sh → symlinked from ~/scripts/setup_enterprise_ai_bash.sh
 │   │   └── bootstrap.sh               → symlinked from ~/scripts/bootstrap.sh
 │   ├── .dotfiles_manifest     # internal list of tracked HOME-relative paths
+│   ├── hosts/
+│   │   └── <hostname>.bashrc.local  # per-server local configs (deployed via deploy-to)
 │   ├── install.sh             # portable restore script (auto-generated)
 │   └── README.md              # this file
 │
@@ -249,6 +251,34 @@ Files are copied directly (not symlinked). Re-run `deploy-to` any time you
 want to push updates. `~/.ssh/` is skipped by default to avoid accidentally
 pushing private keys or your personal known_hosts to a shared server.
 
+### Centrally managing `~/.bashrc.local` for servers
+
+Work servers can't reach the Gitea repo, so their `~/.bashrc.local` is managed
+centrally from `kenjim-mbp` using per-host files in `dotfiles/hosts/`:
+
+```
+dotfiles/hosts/
+└── <hostname>.bashrc.local    # deployed as ~/.bashrc.local on that server
+```
+
+`deploy-to` automatically detects and deploys the matching file:
+
+```bash
+# Edit the server's local config on kenjim-mbp:
+$EDITOR ~/dotfiles/hosts/etqc-kenjim-11.bashrc.local
+
+# Commit and push from kenjim-mbp:
+dotfiles push "fix: update etqc-kenjim-11 local config"
+
+# Deploy to the server (no git access needed on the server):
+dotfiles deploy-to kenjim@etqc-kenjim-11
+```
+
+The `hosts/` files are committed to git. They may contain non-secret
+machine-specific variables (`MACHINE_PROFILE`, `MACHINE_HOST`, `AWS_PROFILE`,
+etc.). **Do not commit real passwords or tokens** — use `CHANGEME` placeholders
+and set real values manually on the server after first deploy.
+
 ---
 
 ## Dotfiles Management — How Symlinks Work