No .dockerignore — build context includes .git, target/, and other unneeded files

There is no `.dockerignore` file in the repository root. Without one, `docker build .` sends the entire working directory (including `.git/`, any local `target/` build artifacts, and `.env`) into the build context, slowing builds and risking accidental inclusion of secrets or large binaries in image layers.

Add a `.dockerignore` excluding `target/`, `.git/`, `.env`, and `*.md`.