chore(docker): add .dockerignore to keep secrets and scratch out of the build context

BuildKit walks the working tree (not the git index), so files like a
local `.env`, `.planning/`, `coverage/`, the e2e Playwright
`storageState.json`, captured HARs, and `.git/` history were all shipped
into the build cache by default. The runner stage doesn't COPY any of
them into the final image, but they sit in the builder layer cache and
leak through any operation that reads cache layers (e.g. `docker save`).

The list mirrors `.gitignore` for the entries that matter, plus the
scratch directories that live in the working tree but aren't version
controlled. `.env.example` and `.env.production.example` stay explicitly
allowed so the documented self-host bootstrap keeps working.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,45 @@
+# Keep the BuildKit build context small and free of secrets / scratch.
+# Mirrors `.gitignore` for the files that matter, with a few additions
+# (planning scratch, e2e storage state) that aren't in version control
+# but live in the working tree.
+
+# Local environment files. The image reads its runtime config from the
+# compose `environment:` block at boot — `.env` should never ship.
+.env
+.env.*
+!.env.example
+!.env.production.example
+
+# Version control + CI metadata.
+.git
+.github
+.gitleaks.toml
+
+# Build / install output that gets regenerated inside the builder stage.
+node_modules
+.next
+out
+coverage
+test-results
+playwright-report
+e2e-results
+.eslintcache
+
+# Persisted session state from e2e runs.
+e2e/setup/storageState.json
+
+# Planning scratch + per-release audit notes (operator-local).
+.planning
+docs/audit
+
+# Captures from local debugging sessions.
+*.har
+*.heapsnapshot
+
+# Editor / agent worktrees + caches.
+.claude
+.cursor
+.aider*
+.vscode
+.idea
+.DS_Store