Fix FX endpoint and harden gitignore

- frankfurter.app now redirects to frankfurter.dev/v1/ and blocks the
  default Python urllib UA with 403. Hit the new endpoint directly and
  send a named User-Agent.
- Extend .gitignore to block common service-account and credential file
  patterns (asset/, *-sa.json, *-service-account*.json, *credentials*.json,
  *-key.json) so keys can't be committed by accident.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -2,3 +2,10 @@ config.json
 *.pyc
 __pycache__/
 .DS_Store
+
+# Never commit service-account keys or credentials
+asset/
+*-sa.json
+*-service-account*.json
+*credentials*.json
+*-key.json

scripts/fx_convert.py

@@ -22,8 +22,9 @@ def fetch_rate(currency: str, on_date: str) -> tuple[float, str]:
     currency = currency.upper()
     if currency == "HKD":
         return 1.0, on_date
-    url = f"https://api.frankfurter.app/{on_date}?from={currency}&to=HKD"
-    with urllib.request.urlopen(url, timeout=10) as resp:
+    url = f"https://api.frankfurter.dev/v1/{on_date}?from={currency}&to=HKD"
+    req = urllib.request.Request(url, headers={"User-Agent": "AutoACCT/1.0"})
+    with urllib.request.urlopen(req, timeout=10) as resp:
         data = json.loads(resp.read())
     rate = data["rates"]["HKD"]
     return float(rate), data["date"]