Fix FX endpoint and harden gitignore

- frankfurter.app now redirects to frankfurter.dev/v1/ and blocks the
  default Python urllib UA with 403. Hit the new endpoint directly and
  send a named User-Agent.
- Extend .gitignore to block common service-account and credential file
  patterns (asset/, *-sa.json, *-service-account*.json, *credentials*.json,
  *-key.json) so keys can't be committed by accident.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -2,3 +2,10 @@ config.json
 *.pyc
 __pycache__/
 .DS_Store
+
+# Never commit service-account keys or credentials
+asset/
+*-sa.json
+*-service-account*.json
+*credentials*.json
+*-key.json