feat(19-01): add local_credentials schema, 0003 migration, generate-secrets LOCAL_SESSION_SECRET, .dockerignore D-15

- schema.ts: export localCredentials = mysqlTable('local_credentials', {...})
  - user_id FK->users(cascade), username, password_hash, createdAt, updatedAt
  - UNIQUE(user_id), UNIQUE(username), INDEX(user_id)
- 0003_warm_deathstrike.sql: purely additive CREATE TABLE (no ALTER/DROP/TRUNCATE on existing tables)
  - Applied to dev DB: pnpm --filter @familysync/api db:migrate exits 0
- test/setup.ts: add localCredentials to afterEach delete cleanup (FK-safe ordering)
- generate-secrets.mjs: emit LOCAL_SESSION_SECRET (base64 32-byte, >=32 chars, D-05)
- .dockerignore: add apps/api/scripts/ exclusion (D-15/IMG-02) — entire break-glass dir excluded

apps/api/test/setup.ts

@@ -24,7 +24,7 @@
 
 import { afterEach } from 'vitest';
 import { db } from '../src/db/client.js';
-import { lists, listItems, listShares, pushSubscriptions } from '../src/db/schema.js';
+import { lists, listItems, listShares, pushSubscriptions, localCredentials } from '../src/db/schema.js';
 
 /**
  * Truncate list and push tables in FK-safe order after each test.
@@ -39,6 +39,9 @@ afterEach(async () => {
     await db.delete(listShares);
     await db.delete(pushSubscriptions);
     await db.delete(lists);
+    // Phase 19: local_credentials has FK to users (cascade delete via users); truncate here
+    // so each test starts with a clean credential slate. users intentionally left intact.
+    await db.delete(localCredentials);
   } catch {
     // DB may not be available in pure-unit test runs (no DB_HOST configured).
     // Swallow the error — pure-logic tests do not need cleanup.