Add retrieved/ and .codex to .gitignore; document manual credential setup

.gitignore:
- Add retrieved/ (org retrieve scratch metadata — not source of truth)
- Add .codex (Claude Code agent state)

SALESFORCE_SETUP.md:
- Add AcctDemo_NamedCreds to named credentials list with note that it must
  be created manually in the target org (not in source)
- Add "Manual post-deploy steps" section documenting AcctDemo_NamedCreds
  setup and the DocusignJWT external credential demo values (iss/sub/aud)
  that need to be replaced before use in a real org

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -15,3 +15,9 @@ __pycache__/
 # OS
 .DS_Store
 Thumbs.db
+
+# Scratch retrieved metadata (org retrieves for reference only)
+retrieved/
+
+# Claude Code agent state
+.codex

docs/SALESFORCE_SETUP.md

@@ -42,7 +42,7 @@
 - `CLMuatNamedCreds`, `CLMs1NamedCreds` — CLM API calls
 - `CLMuatDownload`, `CLMs1Download` — CLM document downloads
 - `Esignature_Demo_NamedCreds` — eSignature REST API
-- `AcctDemo_NamedCreds` — eSignature OAuth/userinfo
+- `AcctDemo_NamedCreds` — eSignature OAuth/userinfo (**not in source; must be created manually in the target org**)
 
 ### Layouts and UI
 - Page layouts for `Appraiser_Case__c` and `Appraiser_Case_Deficiency__c`
@@ -59,6 +59,18 @@
 ### Sample data
 - Anonymous Apex script: `scripts/apex/createSampleAppraiserCase.apex`
 
+## Manual post-deploy steps
+
+### Named credentials requiring org-side setup
+The following are not deployable via source and must be configured in the target org:
+
+- **`AcctDemo_NamedCreds`** — eSignature OAuth/userinfo credential referenced by `DTC_CLM_Demo` account setting. Create a Named Credential pointing to the DocuSign account server (e.g., `https://account-d.docusign.com`) with the appropriate OAuth settings.
+
+### DocusignJWT external credential
+`force-app/main/default/externalCredentials/DocusignJWT.externalCredential-meta.xml` contains demo values for `iss` (integration key) and `sub` (user GUID) targeting `account-d.docusign.com`. Replace these with your org's actual integration key and impersonation user GUID before use.
+
+---
+
 ## Deploy
 
 From the project root: