Put .dockerignore where Docker actually reads it

Every service builds with `context: ..`, and Docker only consults the
.dockerignore at the context root — the copies under frontend/ and backend/
never applied, so the host's dist/, node_modules/ and caches were shipped
into each build context.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CB8uwHkH52qxLxAkGN4gTo

.dockerignore

@@ -0,0 +1,45 @@
+# Docker reads .dockerignore only from the root of the build context, and every
+# service in docker/compose.yml builds with `context: ..` — this directory. The
+# copies under frontend/ and backend/ were therefore never consulted, and the
+# host's stale build outputs and node_modules were shipped into every build.
+#
+# Keep `package.json` and `bun.lock` at this root: frontend/Dockerfile copies
+# them before the workspace install.
+
+# Build outputs — regenerated inside the image.
+**/dist
+**/dist-ssr
+site
+
+# Dependencies — installed inside the image, and the host copies are built for
+# the host's platform.
+**/node_modules
+**/.venv
+
+# Caches
+**/__pycache__
+**/*.pyc
+**/.mypy_cache
+**/.ruff_cache
+**/.pytest_cache
+**/.cache
+**/.vite
+**/.tanstack
+**/fluksio.egg-info
+**/.coverage
+**/htmlcov
+
+# Test artefacts
+**/playwright-report
+**/test-results
+**/screenshots
+
+# Secrets never belong in a build context. Values reach the build as ARGs and
+# the runtime as compose `environment`.
+**/.env
+**/.env.*
+!**/.env.example
+
+.git
+**/*.log
+**/.DS_Store