chore(freemius): gitignored secrets slot for automated deploys

Adds .freemius.env.example (tracked template) and ignores .freemius.env,
where the real Freemius API Bearer token lives locally and never enters git
(the main repo is public). Bumps the pro submodule for the deploy script's
auto-load.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.freemius.env.example

@@ -0,0 +1,13 @@
+# Freemius Developer API — deploy credentials.
+#
+# Copy this to `.freemius.env` (which is gitignored) and paste your real token.
+#   cp .freemius.env.example .freemius.env
+#
+# The token is the "API Bearer Authorization Token" from
+#   Freemius -> your product (EMCP Tools) -> API & Keys.
+# It is a SECRET. It lives ONLY in .freemius.env, which is never committed.
+# If it ever leaks, click Regenerate in that same Freemius screen.
+#
+# pro/tools/freemius-deploy.sh auto-loads .freemius.env when present.
+
+FREEMIUS_API_TOKEN=paste-your-bearer-token-here

.gitignore

@@ -110,3 +110,10 @@ docs/
 .playwright-mcp/
 /services-final.png
 /services-page.png
+
+# Freemius deploy secrets — NEVER commit. The API Bearer token / secret key go
+# in .freemius.env (gitignored); pro/tools/freemius-deploy.sh auto-loads it.
+# Only .freemius.env.example (no real values) is tracked.
+.freemius.env
+.freemius.env.local
+freemius.env