Send only the source to Docker builds

.dockerignore is now an allowlist (go.mod, go.sum, cmd, internal, web),
so data, backups, .env and anything a deploy tool keeps in the project
folder never go into the build context. A file changing or failing to
read while the context is sent cuts the upload short, which Docker
reports as "failed to read dockerfile: unexpected EOF". Also drops a
stray blank first line from the Dockerfile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -1,4 +1,10 @@
-.git
-data
-.env
-canon
+# Send only what the build needs. Anything else in the project folder
+# (data, backups, .env, files a deploy tool adds) stays out of the build,
+# so it can't bloat the upload or change while it's being sent.
+*
+!go.mod
+!go.sum
+!cmd/
+!internal/
+!web/
+**/*_test.go

Dockerfile

@@ -1,4 +1,3 @@
-
 FROM golang:1-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum ./