harden devshell: anchor pgdata to repo root, broaden gitignore

shellHook now derives PGDATA from $(git rev-parse --show-toplevel)
instead of $PWD. nix develop / direnv from a subdir (e.g.
backend/) used to seed a duplicate cluster at backend/.postgres
that leaked into git tracking. .gitignore loses its leading slash
on .postgres/ + .direnv/ + .pc.* so any nested cluster also gets
ignored. fallback to pwd preserves behavior outside a git repo.

968 stray backend/.postgres/* blobs already pruned from history
via git-filter-repo before this commit.

.gitignore

@@ -1,9 +1,9 @@
 # Nix devshell artefacts
-/.postgres/
-/.direnv/
+.postgres/
+.direnv/
 result
 result-*
 
 # Process-compose state
-/.pc.*
+.pc.*
 process-compose-*.log

flake.nix

@@ -27,7 +27,11 @@
           ];
 
           shellHook = ''
-            export PGDATA="$PWD/.postgres"
+            # Anchor PGDATA to the repo root so subshells in subdirs
+            # (e.g. backend/) reuse the same cluster instead of seeding
+            # a stray .postgres there.
+            REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+            export PGDATA="$REPO_ROOT/.postgres"
             export PGHOST="$PGDATA"
             export PGUSER="postgres"
             export PGDATABASE="postgres"