fix: add a .dockerignore for the docs image #463

Why?

The docs image's builder stage runs COPY . . without a .dockerignore, so local .env* files reach the build. Only static output ships, and the NEXT_PUBLIC_* values are URLs today, but a secret in a local .env could end up in the bundle.

What?

• Add a .dockerignore excluding .env* (except .env.example), node_modules and other local files.

Acceptance criteria

• Local .env* files never reach the docs image build.