[4.0.0-beta desktop] node_modules, .coverage, .DS_Store, and app/config.json are committed #259

PROBLEM

On release-4.0.0-beta, git tracks files .gitignore says to exclude:

• node_modules/ (thousands of files — the branch tree is ~7093 paths)
• .coverage
• .DS_Store (repo root and under app/)
• app/config.json — gitignored as "contains credentials", but tracked. It includes a default cluster username / password.

This bloats clones, can confuse PyInstaller if it is ever run from the repo root, and ships a credential-shaped JSON in a public repo.

Suggested RCA

Files were added before (or with -f despite) .gitignore. app/config.json was used as the developer config and committed so CI's --add-data "config.json;." would succeed.

Suggested FIX

git rm -r --cached node_modules .coverage .DS_Store app/.DS_Store app/config.json
# keep app/config.default.json (no secrets) as the shipped default

Confirm .gitignore already has those patterns (it does). Change PyInstaller datas to config.default.json (sibling issue).

Rotate any password that ever lived in the tracked config.json if it was more than the stock Administrator / password pair.

Unit tests

# tests/python/test_git_hygiene.py
import subprocess
from pathlib import Path

def _tracked() -> set[str]:
    out = subprocess.check_output(["git", "ls-files"], text=True)
    return set(out.splitlines())

def test_node_modules_not_tracked():
    tracked = _tracked()
    assert not any(p.startswith("node_modules/") for p in tracked)

def test_coverage_and_ds_store_not_tracked():
    tracked = _tracked()
    assert ".coverage" not in tracked
    assert not any(Path(p).name == ".DS_Store" for p in tracked)

def test_user_config_json_not_tracked():
    tracked = _tracked()
    assert "app/config.json" not in tracked
    assert "app/config.default.json" in tracked

Context: found on branch release-4.0.0-beta while reviewing standalone macOS .app / Windows .exe packaging. Issues in this batch share the title prefix [4.0.0-beta desktop].