feat: ensure .DS_Store in .gitignore for all new vaults

Extract ensure_gitignore from init_repo so it can be reused by
clone_repo (GitHub "Create New" flow) and repair_vault. New vaults
created via any path now get .DS_Store excluded by default.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src-tauri/src/github/clone.rs

@@ -37,6 +37,9 @@ pub fn clone_repo(url: &str, token: &str, local_path: &str) -> Result<String, St
     // Configure the remote to use token auth for future pushes
     configure_remote_auth(local_path, url, token)?;
 
+    // Ensure sensible .gitignore defaults (especially .DS_Store on macOS)
+    crate::git::ensure_gitignore(local_path)?;
+
     Ok(format!("Cloned to {}", local_path))
 }