chore: add Claude Code project settings and gitignore local overrides

Summary

• Adds .claude/settings.json with an empty allow list and /tmp as an additional directory, providing a clean baseline for project-level Claude Code permissions
• Gitignores .claude/settings.local.json so personal tool approvals (user-specific paths, one-off commands) don't get accidentally committed to the repo

Why

Claude Code writes every "Always allow" approval to .claude/settings.json by default. Without this setup, personal/local permissions accumulate in a tracked file and get committed alongside team-appropriate settings. The settings.local.json convention mirrors patterns like .env / .env.local — project config is shared, personal overrides stay local.