added gluetun with qBittorrent and pyload-ng

VPN kill switch via shared network namespace, TorGuard WireGuard through
gluetun's custom provider. compose.yaml is the maintained version;
compose.personal.yaml is the variant actually running, kept as-is.

Verified against gluetun's own settings summary: SOCKSPROXY/SOCKSPROXY_PORT
are not real variables and the SOCKS5 server never starts; HTTPPROXY_PORT is
deprecated; pyload-ng listens on 8000, not 8880.

.gitignore: ignore wg*.conf and *.ovpn everywhere, because add gluetun/compose.yaml gluetun/compose.personal.yaml gluetun/.env.example gluetun/README.md .gitignore/init/** would
otherwise commit a WireGuard private key dropped in a service's init/ dir.
Un-ignore compose.personal.yaml narrowly, so compose.override.yaml stays out.

.gitignore

@@ -7,6 +7,10 @@
 # ─── …except the files that define a stack ──────────────────────────
 !*/compose.yaml
 !*/docker-compose.yaml
+# A service's alternative compose file, published as documentation. Narrow on
+# purpose: `!*/compose.*.yaml` would also un-ignore compose.override.yaml,
+# which is exactly where people keep local secrets.
+!*/compose.personal.yaml
 !*/.env.example
 !*/README.md
 
@@ -26,3 +30,10 @@
 *.crt
 secrets/
 TODO
+
+# VPN configs carry private keys. Named explicitly because the `!*/init/**`
+# rule above would otherwise happily commit one dropped in a service's
+# init/ directory -- which is exactly where this repo's own conventions
+# tell you to put runtime config fragments.
+wg*.conf
+*.ovpn