Generated configs out of the repo: *.example.* templates only; configure.py refuses to apply over CHANGEME placeholders

A deploy copied mediamtx.yml (template) over the server's generated file and the next apply
wiped all streamers. Generated files are now gitignored so scp -r cannot clobber them.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mediamtx.example.yml

@@ -0,0 +1,68 @@
+# MediaMTX — ingest only. No playback endpoints exposed.
+logLevel: info
+
+rtsp: no
+metrics: no
+pprof: no
+
+# live portal (served to the browser only via Caddy + Authentik on live.HOST; these ports are published on 127.0.0.1)
+api: yes
+apiAddress: :9997
+hls: yes
+hlsAddress: :8888
+hlsVariant: lowLatency
+hlsAlwaysRemux: no
+webrtc: yes
+webrtcAddress: :8889
+webrtcLocalUDPAddress: :8189
+webrtcLocalTCPAddress: :8189
+webrtcIPsFromInterfaces: no
+# webrtcAdditionalHosts is set via env MTX_WEBRTCADDITIONALHOSTS (= the public hostname) in docker-compose.yml
+
+rtmp: yes
+rtmpAddress: :1935
+
+srt: yes
+srtAddress: :8890
+
+# ---- auth -------------------------------------------------------------
+# Each streamer may publish only under their own prefix.
+# RTMP key:  techy/Title?user=techy&pass=CHANGEME
+# SRT:       srt://HOST:8890?streamid=publish:techy/Title:techy:CHANGEME
+authMethod: internal
+authInternalUsers:
+  - user: any
+    permissions:
+      - action: read
+      - action: playback
+      - action: api
+  - user: techy
+    pass: CHANGEME_TECHY
+    permissions:
+      - action: publish
+        path: ~^techy/[A-Za-z0-9_.-]+$
+  - user: diceofire
+    pass: CHANGEME_DICE
+    permissions:
+      - action: publish
+        path: ~^diceofire/[A-Za-z0-9_.-]+$
+
+# ---- recording --------------------------------------------------------
+pathDefaults:
+  record: yes
+  recordPath: /recordings/%path/.live/%Y-%m-%d_%H-%M-%S   # hidden while recording; the sweep publishes the finished file one level up
+  recordFormat: fmp4
+  recordPartDuration: 1s
+  recordSegmentDuration: 12h      # one file per stream unless it runs >12h
+  recordDeleteAfter: 0s           # never auto-delete; the archive job handles it
+  # optional Discord "is live" notice (LIVE_WEBHOOK_URL set in .env). busybox wget in the -ffmpeg image.
+  runOnReady: >
+    sh -c '[ -n "$LIVE_WEBHOOK_URL" ] || exit 0;
+    u="${MTX_PATH%%/*}"; t="${MTX_PATH#*/}";
+    wget -q -O /dev/null --header="Content-Type: application/json"
+    --post-data="{\"content\":\"🔴 **$u** is live: $t — https://$LIVE_HOST/\"}" "$LIVE_WEBHOOK_URL"'
+  runOnReadyRestart: no
+
+paths:
+  # any name under a streamer's prefix; inherits pathDefaults
+  ~^(techy|diceofire)/[A-Za-z0-9_.-]+$: {}