chore(16-04): add .dockerignore (secrets/dev/bulk, preserve builder inputs)

- Exclude .env/.env.* with !.env.example un-ignore so template survives
- Exclude apps/api/scripts/seed-credential.mjs (defense-in-depth)
- Exclude .git, dist/, node_modules/, tests/, Playwright artifacts
- Exclude .planning/, docs/, editor/OS, CI config, SQL dumps
- Do NOT exclude apps/api/src or apps/pwa/src (builder stage needs them)
- Add NOTE comment on migration .sql files and multi-stage COPY semantics

.dockerignore

@@ -0,0 +1,58 @@
+# === Secrets and credentials (NEVER in build context) ===
+.env
+.env.*
+!.env.example
+apps/api/scripts/seed-credential.mjs
+
+# === VCS (large and unnecessary) ===
+.git
+.gitignore
+
+# === Build artifacts (regenerated in-build) ===
+**/dist/
+**/.dist/
+
+# === Dependencies (reinstalled in-build) ===
+**/node_modules/
+
+# === Tests (not needed in build; keep out of prod) ===
+apps/api/tests/
+apps/api/test/
+apps/pwa/e2e/
+
+# === Playwright artifacts ===
+apps/pwa/test-results/
+apps/pwa/playwright-report/
+apps/pwa/blob-report/
+.playwright/
+.playwright-cli/
+
+# === Planning / docs / dev tooling ===
+.planning/
+docs/
+graphify-out/
+.venv/
+
+# === Editor / OS ===
+.vscode/
+.idea/
+.DS_Store
+
+# === CI / dev config files (not needed in image) ===
+.gitea/
+.markdownlint-cli2.jsonc
+.prettierignore
+.prettierrc
+eslint.config.js
+
+# === SQL dumps (if any) ===
+*.sql.dump
+*.sql.gz
+
+# NOTE: apps/api/src/db/migrations/*.sql are included in the build context
+# because the builder stage's `COPY apps/api ./apps/api` needs them.
+# However, migrations are applied at runtime (drizzle-kit migrate), not
+# baked into the image — they travel with the app source in builder stage only.
+# The production stage does NOT copy apps/api/src directly; it only copies
+# apps/api/dist (via --from=builder) and apps/api/package.json.
+# So migration .sql files in src/db/migrations/ never reach the production image.