Add BuildKit cache mounts and trim Docker build context

- npm ci and composer install now use type=cache mounts, so a lockfile
  bump only re-fetches the packages that changed instead of the whole
  dependency tree.
- .dockerignore excludes .gitea/, so workflow edits no longer bust the
  COPY . . layer (and the dump-autoload / frontend re-copy it triggers).
- Fold the entrypoint chmod into COPY --chmod, dropping a layer.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -6,9 +6,11 @@ FROM node:24-alpine AS frontend
 WORKDIR /web
 
 # Dependencies in their own layer, cached unless the manifests change. npm ci
-# resolves this stage's (musl) platform binaries for rollup/esbuild.
+# resolves this stage's (musl) platform binaries for rollup/esbuild. The cache
+# mount keeps the npm download cache warm across builds, so a lockfile bump
+# only re-fetches what actually changed.
 COPY web/package.json web/package-lock.json ./
-RUN npm ci
+RUN --mount=type=cache,target=/root/.npm npm ci
 
 COPY web/ ./
 RUN npm run build          # vue-tsc type-check, then `vite build` -> /web/dist
@@ -56,14 +58,17 @@ COPY docker/apache.conf /etc/apache2/conf.d/zz-app.conf
 # Copied early, alongside the other rarely-changing setup above -- after
 # COPY . . (below) every later layer re-runs on nearly every build, so this
 # would otherwise redo work for a file that essentially never changes.
-COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
-RUN chmod +x /usr/local/bin/entrypoint.sh
+COPY --chmod=0755 docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 
 WORKDIR /var/www/html
 
 # --- PHP dependencies (own layer, cached unless composer.* changes) --------
+# The cache mount keeps Composer's package cache warm across builds, so a
+# composer.lock bump only re-fetches the packages that changed.
 COPY composer.json composer.lock ./
-RUN composer install --no-dev --no-interaction --no-progress --prefer-dist --no-autoloader
+RUN --mount=type=cache,target=/tmp/composer-cache \
+    COMPOSER_CACHE_DIR=/tmp/composer-cache \
+    composer install --no-dev --no-interaction --no-progress --prefer-dist --no-autoloader
 
 # --- Application source ----------------------------------------------------
 COPY . .