chore: add dockerignore for scripts, local artifacts, and env files

The image previously inherited everything from a `COPY . .`, including
.env (secrets), local notes.db copies, and admin scripts that should
not run in prod containers.

.dockerignore

@@ -0,0 +1,25 @@
+# version control / editor / OS
+.git/
+.gitignore
+.github/
+.idea/
+.vscode/
+.DS_Store
+
+# local SQLite + sidecars (DB lives at /data in the container)
+*.db
+*.db-shm
+*.db-wal
+*.db-journal
+remote-db/
+
+# secrets — provide via the orchestrator's env config, not baked into the image
+.env
+.env.*
+
+# admin / dev-only scripts (run locally, not in prod containers)
+scripts/
+
+# logs and caches
+*.log
+.cache/