chore: initial baseline before refactoring

Initial snapshot of Home Assistant config (HAOS 2026.4.4)
prior to dashboard restructuring and helper YAML migration.

Pre-commit cleanup applied:
- Removed blueprints/switch_manager/ (9.4 MB stale, component already gone)
- Removed .storage/switch_manager
- Removed home-assistant.log.{1,old,fault}
- Removed zigbee2mqtt/configuration_backup_v{1..4}.yaml
- Removed zigbee2mqtt/database.db.tmp.2024-09-27 (1.5y old)
- Created empty themes/ to satisfy configuration.yaml include

.gitignore uses allowlist strategy for .storage/ to keep
all tokens, keys, and PINs out of version control.

.gitignore

@@ -0,0 +1,149 @@
+# ============================================================
+# Home Assistant Config Repository – .gitignore
+# ============================================================
+# Strategy: Default-deny for sensitive areas.
+# .storage/* uses an explicit allowlist for files we DO want versioned.
+# ============================================================
+
+# === Secrets (Top-Level) ===
+secrets.yaml
+*.key
+*.pem
+*.crt
+known_devices.yaml
+.uuid
+*credentials.json
+ps5-mqtt/credentials.json
+
+# === Datenbanken & Logs ===
+home-assistant_v2.db*
+home-assistant.log*
+*.log
+*.log.*
+.ha_run.lock
+
+# === Caches & Runtime ===
+tts/
+image/
+deps/
+.cloud/
+.cache/
+__pycache__/
+*.pyc
+OZW_Log.txt
+
+# === HACS / Frontend Community Cards ===
+www/community/
+
+# === Custom Components – haben eigene Repos ===
+custom_components/
+
+# === Z2M-Runtime (enthält Network Keys → SECRETS!) ===
+zigbee2mqtt/log/
+zigbee2mqtt/database.db
+zigbee2mqtt/database.db.tmp.*
+zigbee2mqtt/state.json
+zigbee2mqtt/coordinator_backup.json
+zigbee2mqtt/device_icons/
+
+# === ESPHome Build Artefakte ===
+esphome/.esphome/
+esphome/.pioenvs/
+esphome/.piolibdeps/
+esphome/secrets.yaml
+
+# === AppDaemon Runtime ===
+appdaemon/logs/
+appdaemon/.cache/
+
+# === Backups (HAOS Backups, manuelle Snapshots) ===
+backup/
+backups/
+*.tar
+*.tar.gz
+
+# === Editor / OS ===
+.DS_Store
+Thumbs.db
+*.swp
+*.swo
+*~
+.vscode/
+.idea/
+
+# === Claude Code projekt-lokale Settings ===
+.claude/settings.local.json
+.claude/file-history/
+.claude/sessions/
+
+# ============================================================
+# .storage/ – ALLOWLIST-STRATEGIE
+# Default: alles ignorieren. Dann gezielt whitelisten.
+# ============================================================
+.storage/*
+.storage/**
+
+# --- Verzeichnis selbst zulassen (sonst wirken die Whitelists nicht) ---
+!.storage/
+
+# --- Whitelist: Dashboards & Lovelace (für Refactoring) ---
+!.storage/lovelace
+!.storage/lovelace.*
+!.storage/lovelace_dashboards
+!.storage/lovelace_resources
+!.storage/map
+
+# --- Whitelist: Helper (für YAML-Migration) ---
+!.storage/input_boolean
+!.storage/input_button
+!.storage/input_datetime
+!.storage/input_number
+!.storage/input_select
+!.storage/input_text
+!.storage/timer
+!.storage/counter
+!.storage/schedule
+!.storage/scheduler.storage
+
+# --- Whitelist: Registries (Areas/Floors/Labels — sicher, keine Tokens) ---
+!.storage/core.area_registry
+!.storage/core.floor_registry
+!.storage/core.label_registry
+!.storage/core.category_registry
+
+# --- Whitelist: Energy-Dashboard-Konfig ---
+!.storage/energy
+
+# --- Whitelist: Frontend-Panels & exposed_entities (UI-Struktur) ---
+!.storage/frontend_panels
+!.storage/homeassistant.exposed_entities
+
+# --- Whitelist: Powercalc Group-Definitionen (Konfig, kein Secret) ---
+!.storage/powercalc_group
+
+# ============================================================
+# WICHTIG – diese .storage-Files NIEMALS tracken (Tokens/Keys!):
+#   core.config_entries  → 28 OAuth-Tokens und API-Keys
+#   core.device_registry → MACs, Seriennummern (Privacy)
+#   core.entity_registry → groß, ändert sich ständig (Noise)
+#   core.restore_state   → Runtime-State, ändert sich sekündlich
+#   core.config          → Längengrad/Breitengrad (Privacy)
+#   alarmo.storage       → Alarm-PINs
+#   androidtv_adbkey*    → RSA Private Keys
+#   esphome.*            → ESPHome Verschlüsselungs-Keys
+#   mobile_app           → Push-Tokens
+#   tapo_control_*       → Tapo Auth
+#   unifi_data           → Unifi Auth
+#   roborock/            → Roborock Auth
+#   home_agent.*         → AI-Memories (Privacy)
+#   waste_collection_schedule.device_keys → API-Keys
+#   nibe_energy_conversion_data_* → Werte (Daten, kein Config)
+#   bluetooth.*          → Bluetooth-Geräte-Liste
+#   homekit_controller*  → HomeKit-Pairing-Daten
+#   hassio               → Supervisor-Daten
+#   trace.saved_traces   → Trace-Logs
+#   hacs.*               → HACS-Cache
+#   zone                 → Heim-Adresse/Koordinaten
+#   assist_pipeline.pipelines → Cloud-API-Konfig
+# Bewusst NICHT in der Whitelist oben.
+# ============================================================