Security/privacy audit: fix broken gitignore, exclude debug logs

Audited the full repo and git history for credentials, command history,
game transcripts, and any other private data:
- No passwords/auto-login fields ever committed in the world file.
- mushclient_prefs.sqlite (the only DB ever committed) contains only
  window-position/UI settings, nothing credential-related.
- No state/*.xml plugin state files, log files, or transcripts were
  ever committed - confirmed via full git history scan, not just the
  current working tree.
- Full-history grep for password/token/secret/key patterns turned up
  nothing but LuaSocket's own bundled example code.

Found and fixed a real bug while auditing: .gitignore's state/ rule was
missing a newline, joining two patterns into one that matched nothing,
so state/*.xml files were untracked by luck (never staged) rather than
actually ignored. Also excluded *.log and SQLite -shm/-wal temp files
going forward, since debug logs can contain snippets of typed game
text. Cleaned up stray gitignore-pattern text that had been pasted into
state/.gitkeep by mistake.

.gitignore

@@ -1,2 +1,11 @@
-cosmic rage/worlds/plugins/state/*.xmlcosmic rage/worlds/plugins/state/*
+cosmic rage/worlds/plugins/state/*.xml
-!cosmic rage/worlds/plugins/state/.gitkeep
+cosmic rage/worlds/plugins/state/*
+!cosmic rage/worlds/plugins/state/.gitkeep
+
+# Debug logs and local logging output - can contain snippets of typed game text
+*.log
+cosmic rage/logs/
+
+# SQLite temp files
+*.sqlite-shm
+*.sqlite-wal

cosmic rage/worlds/plugins/state/.gitkeep

@@ -1,3 +0,0 @@
-cosmic rage/worlds/plugins/state/*.xmlcosmic rage/worlds/plugins/state/*
-
-!cosmic rage/worlds/plugins/state/.gitkeep