merge harden-devshell

hot-fix: pgdata anchored to repo root, .postgres/.direnv ignored
at any nesting. resolves stray backend/.postgres tracking caught
during phase 1 merge.

.gitignore

@@ -1,9 +1,9 @@
 # Nix devshell artefacts
-/.postgres/
-/.direnv/
+.postgres/
+.direnv/
 result
 result-*
 
 # Process-compose state
-/.pc.*
+.pc.*
 process-compose-*.log

flake.nix

@@ -27,7 +27,11 @@
           ];
 
           shellHook = ''
-            export PGDATA="$PWD/.postgres"
+            # Anchor PGDATA to the repo root so subshells in subdirs
+            # (e.g. backend/) reuse the same cluster instead of seeding
+            # a stray .postgres there.
+            REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+            export PGDATA="$REPO_ROOT/.postgres"
             export PGHOST="$PGDATA"
             export PGUSER="postgres"
             export PGDATABASE="postgres"