Add Dockerfile and .dockerignore for improved containerization and security

.dockerignore

@@ -0,0 +1,17 @@
+# Secrets and runtime state — never in the build context.
+config.php
+db/fitz.sqlite*
+cache/
+
+# Rebuilt inside the image.
+node_modules/
+dist/
+styles.css
+styles.css.map
+
+# Dev-only.
+.git/
+.claude/
+.DS_Store
+.hintrc
+dev.sh