first commit

.dockerignore

@@ -0,0 +1,57 @@
+# Docker build context excludes.
+#
+# WITHOUT this file, the `COPY . .` in the builder stage ships the host's
+# .next/ (2.1 GB, almost all of it the Turbopack dev cache) and node_modules/
+# (639 MB, with darwin-arm64 sharp binaries that are wrong for Alpine) into
+# the build context. That is what filled the production disk.
+
+# Dependencies — reinstalled from the lockfile in the deps stage
+node_modules
+.pnp
+.pnp.*
+.yarn
+
+# Build output — regenerated by `npm run build` in the builder stage.
+# .next/dev alone is 1.8 GB of dev-server cache that must never leave the host.
+.next
+out
+build
+dist
+
+# VCS + local tooling
+.git
+.gitignore
+.github
+.claude
+.vscode
+.idea
+
+# Incremental compiler state (253 KB and host-specific)
+*.tsbuildinfo
+next-env.d.ts
+
+# Environment.
+#
+# `.env` IS copied in (see the Dockerfile's runner stage) — it holds the
+# production platform host, which is not a secret, and is what the standalone
+# server reads at boot. Excluding it is what shipped an image with no
+# LOYALY_API_BASE and made every BFF call fail.
+#
+# `.env.*` stays out, and that exclusion is load-bearing: a developer's
+# `.env.local` points LOYALY_API_BASE at http://127.0.0.1:8088, and @next/env
+# loads `.env.local` AHEAD of `.env`. One leaked into the image and the
+# deployed console calls localhost — silently, with no error to read.
+.env.*
+*.pem
+
+# Docs and infra that the build does not read
+*.md
+Dockerfile
+.dockerignore
+nginx.conf
+
+# Noise
+.DS_Store
+coverage
+npm-debug.log*
+yarn-error.log*