Vendor backend and frontend into the monorepo

The submodule collapse was only half applied: .gitmodules was deleted but
backend/ and frontend/ were still recorded as gitlinks, so none of their
files were tracked. Replace the gitlinks with the real trees.

Also untrack .env (it carried placeholder secrets) in favour of a tracked
.env.example, drop the committed __pycache__, and narrow the blanket *.png
ignore that would have swallowed design assets.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,4 +1,3 @@
-*.png
 .vscode/*
 !.vscode/extensions.json
 node_modules/
@@ -6,3 +5,13 @@ node_modules/
 /playwright-report/
 /blob-report/
 /playwright/.cache/
+
+# Generated locally by the workspace root's scripts/setup.sh; never committed.
+.env
+secrets/
+
+__pycache__/
+*.py[cod]
+
+# Rendered pipeline graphs (matplotlib output from backend/app/flow).
+pipeline.png