perf(docker): slim the fallback Dockerfile build
The Dockerfile ran `nix-build` twice — once for the `result` symlink and again with `--no-out-link` just to resolve the path for a second symlink. Build once with `-o result` and run from `result/bin/...` directly. Add a `.dockerignore` so `COPY . /app` no longer pulls `.git`, `node_modules`, `dist`, `result` and coverage into the image layer (smaller context, fewer cache busts). The in-image `nix-build` already filters these via `lib.cleanSource`, but the COPY layer carried them. Note: this is the manual/fallback build path; the image actually published by CI is the Nix `dockerTools` image (see flake.nix), which is addressed separately in this PR. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>