Trim .dockerignore to everything the build context doesn't need

Verified against the Dockerfile's actual COPY instructions -- src/,
bin/, migrations/, public/, docker/, composer.json/lock, and web/'s
own build inputs are the only things either stage touches. Everything
else that COPY . . would otherwise sweep in now excluded: tests/,
phpunit.xml, docker-compose.yml, .env.example, and web/'s own
non-build files (README.md, .env.example, .gitignore, .dockerignore).

web/.dockerignore itself is dead either way -- the build context is
the repo root (docker-compose.yml's `build: .`), not web/, so it was
never actually consulted by anything -- but there's no harm leaving it
for a hypothetical standalone frontend build.

Verified: rebuilt the image, confirmed the excluded paths are genuinely
absent from it, app still serves and 401s correctly unauthenticated,
and PHPUnit (run from the host, unaffected either way) still 88/88.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.dockerignore

@@ -4,12 +4,22 @@
 vendor
 storage
 .env
+.env.example
 .phpunit.cache
 .phpunit.result.cache
+phpunit.xml
+tests
 docs
 README.md
+docker-compose.yml
 
-# Frontend: the build runs `npm ci` in its own stage, and dist/ is emitted there.
+# Frontend: the build runs `npm ci` in its own stage, and dist/ is emitted
+# there -- none of this reaches either stage's COPY (web/package.json,
+# web/package-lock.json, web/), it'd just be dead weight in the build context.
 web/node_modules
 web/dist
 web/dev-dist
+web/.gitignore
+web/.dockerignore
+web/.env.example
+web/README.md