Add a .dockerignore to shrink production build context

## Task

There is no `.dockerignore`. `docker build -f Dockerfile.prod` sends tests, htmlcov, `.git`, and local artifacts as context.

## Scope

Exclude at least: `.git`, `tests/`, `htmlcov/`, `.github/`, `*.pyc`, `.venv`, `.env`, `.env.production`.
Keep whatever `Dockerfile.prod` actually COPYs (`src/`, `pyproject.toml`, `README.md`, alembic, dashboard, public, deploy templates as needed).

## Acceptance criteria

- [ ] `.dockerignore` at repo root
- [ ] `docker build -f Dockerfile.prod` still works (CI `docker-build`)
- [ ] Dashboard, demo, and alembic still present in the image
- [ ] PR notes before/after context size if easy to measure

Start with Dockerfile.prod and the repository paths it COPYs, then review the CI docker-build check. Add a root .dockerignore covering the listed tests, artifacts, credentials, and metadata while retaining the paths needed for the production image; done means the build succeeds and the dashboard, demo, and alembic remain present.

Written by the indexing model from the issue text.