chore(backend): gitignore serviceAccount.json

FCM push is now verified end to end against the real konfi-castle-app
project: service-account JWT -> OAuth token (200), FCM messages:send
reached and processed (a bogus token gets a 400 INVALID_ARGUMENT and is
pruned from device_token). Real config lives only in the gitignored
backend/.env + backend/serviceAccount.json.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/.gitignore

@@ -3,3 +3,7 @@ dist
 coverage
 .env
 *.log
+
+# Firebase service account (secret)
+serviceAccount.json
+*.serviceAccount.json