chore(deploy): rewrite ansible for motief on motief.sgeboers.nl, remove drone

- Replace gtfs/bokeh deploy with motief/streamlit (port 8501)
- Update inventory to motief.sgeboers.nl
- Remove stale .drone.yml
- Add CI guard to forbid .env in repo
- Add env removal report and secrets rotation checklist

.github/workflows/forbid-env.yml

@@ -0,0 +1,20 @@
+name: Forbid .env in repo
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  check-no-env:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Fail if .env exists
+        run: |
+          if [ -f .env ]; then
+            echo ".env exists in repository root — failing build to avoid accidental secret exposure" >&2
+            exit 1
+          fi
+        shell: bash