chore: production-safe settings, development values only in DDEV

settings.php now holds production values (no debug, no devIPmask,
displayErrors off, warnings logged instead of thrown, deprecation log
off, sendmail, trustedHostsPattern for the production domains,
FE.compressionLevel 0 as the CDN compresses). The development values
moved into the DDEV block of additional.php. secrets.example.php gets
the production database connection.

Composer platform: PHP 8.5.12 (the version Hetzner rolls out).
Deployer 8 as dev dependency for the deployment.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

config/system/secrets.example.php

@@ -3,6 +3,17 @@
 // Template for config/system/secrets.php (not in Git). Values come from the TYPO3 10
 // production LocalConfiguration.php; empty values are ignored.
 return [
+    // Production only (DDEV brings its own database settings)
+    'DB' => [
+        'Connections' => [
+            'Default' => [
+                'dbname' => '',
+                'host' => '',
+                'password' => '',
+                'user' => '',
+            ],
+        ],
+    ],
     'SYS' => [
         // Must be the production key of TYPO3 10: static pages link to cHash URLs served by TYPO3 13
         'encryptionKey' => '',