chore: ignore cmd/_* dev binaries + Tailwind rebuild

cmd/_fake_alert and similar one-shot dev tools live under cmd/_*
where Go's build tooling skips them. Add an explicit gitignore line
so an accidental 'git add cmd/.' can't drag them into a release.

styles.css is the regenerated Tailwind output — picks up the new
ntfy basic-auth fields and the right-rail preview ids.

.gitignore

@@ -30,3 +30,8 @@ coverage.html
 # skips paths beginning with _ or ., but ignore explicitly so nothing
 # checked in here can leak into a release tarball.
 /_diag/
+
+# Dev-only one-shot binaries (cmd/_*) — never shipped. Go's build
+# tooling already skips paths starting with _, but ignore explicitly
+# so an accidental `git add cmd/.` can't sneak them into a release.
+/cmd/_*/