Use python-dotenv for secrets management

config.py now loads .env via load_dotenv() at import time.
All secrets default to empty strings in code.
Locally: .env provides credentials (in .gitignore, never pushed).
HF Spaces: set via Secrets panel (env vars).

.gitattributes

@@ -0,0 +1 @@
+*.png filter=lfs diff=lfs merge=lfs -text

app/config.py

@@ -1,8 +1,11 @@
 """
 Centralised settings for the arxiv recommender app.
-All credentials live here; override with environment variables in production.
+All credentials live in .env locally; override with env vars in production.
 """
 import os
+from dotenv import load_dotenv
+
+load_dotenv()  # reads .env file if present (won't override existing env vars)
 
 # ── Qdrant (BGE-M3 dense, 1 024-dim) ─────────────────────────────────────────
 QDRANT_URL = os.getenv("QDRANT_URL", "")