ci: protect local .env files from rsync --delete via filter rules

.github/workflows/ci-cd-web-desktop.yml

@@ -30,10 +30,14 @@ jobs:
           node-version: 20
           cache: 'pnpm'
 
-      - name: Sync workspace to APP_DIR
+      - name: Sync workspace to APP_DIR (preserving local env)
         run: |
           mkdir -p "$APP_DIR"
           rsync -az --delete \
+            --filter='protect .env' \
+            --filter='protect .env*' \
+            --filter='protect apps/desktop/.env*' \
+            --filter='protect convex/.env*' \
             --exclude '.git' \
             --exclude '.next' \
             --exclude '.env*' \