feat: add hosts/ convention for centrally managed server .bashrc.local

- hosts/etqc-kenjim-11.bashrc.local: per-host local config for work server,
  managed from kenjim-mbp and deployed via 'dotfiles deploy-to'.
  Credentials replaced with CHANGEME placeholders — set real values on
  server after first deploy, never commit actual secrets.
- dotfiles_manager.sh: deploy-to step 5 auto-detects hosts/<hostname>.bashrc.local
  and SCPs it to ~/.bashrc.local on the remote (with backup of existing file)
- .gitignore: clarify that hosts/*.bashrc.local is intentionally tracked
  (existing .bashrc.local rule only matches the exact filename)
- README.md: document hosts/ layout, workflow, and credential placeholder strategy

hosts/etqc-kenjim-11.bashrc.local

@@ -0,0 +1,39 @@
+### MACHINE_LOCAL — managed centrally in dotfiles/hosts/ on kenjim-mbp
+### Deployed via: dotfiles deploy-to kenjim@etqc-kenjim-11
+### DO NOT edit directly on the server — edit in ~/dotfiles/hosts/ and re-deploy
+# Host     : etqc-kenjim-11
+# Profile  : work (server)
+# =============================================================================
+
+export MACHINE_PROFILE="work"
+export MACHINE_HOST="etqc-kenjim-11"
+
+# Prevent shell auto-logout on idle
+unset TMOUT
+
+# =============================================================================
+# ServiceNow API credentials
+# =============================================================================
+export SN_USERNAME='_integ-soap-read'
+export SN_PASSWORD='CHANGEME'          # set real value — never commit
+
+# =============================================================================
+# LDAP bind credentials
+# Referenced by ldaps() and ldaps2() in ~/.bashrc.d/30_work.sh
+# =============================================================================
+export JNPR_LDAP_BIND_PW='CHANGEME'   # was: xqYzhL%lLe!FIr!67LJX%7a^PWOWY0
+export JNPR_LDAP_BIND_PW2='CHANGEME'  # was: tF#w3St@nGqq36XZDym#857U)v4xKw
+
+# =============================================================================
+# Unified Hub (Artifactory) credentials
+# Referenced by unified-hub-login() and unified-hub-engtech-bin-upload()
+# in ~/.bashrc.d/30_work.sh
+# =============================================================================
+export UNIFIED_HUB_USERNAME='kenjim@juniper.net'
+export UNIFIED_HUB_TOKEN='CHANGEME'   # base64 API token from Artifactory
+
+# =============================================================================
+# AWS — server uses named profiles from ~/.aws/config loaded by k8configs env
+# =============================================================================
+export AWS_PROFILE=pgdb-qnc
+export AWS_SDK_LOAD_CONFIG=1