Ship config as .env.production - Dokploy was overwriting the committed .env

The container was never getting its configuration, so it started with nothing
set and Traefik reported a Bad Gateway on every route.

Dokploy writes its own .env into the build context from the service's
Environment tab AFTER cloning the repository. That tab is empty, so it wrote a
zero-byte file over the committed one, and `COPY .env .` faithfully copied the
empty result into the image. The checkout showed it exactly: every file
timestamped 08:33, and .env alone at 08:34 with a size of 0. Inside the running
container, /app/.env was 0 bytes.

Nothing about this is visible from the outside. The build log shows the COPY
succeeding, the image is produced, and the platform reports only a 502.

Dokploy does not manage .env.production, so the config now travels under that
name and the Dockerfile copies it to /app/.env in the image. Anything set in the
Environment tab still wins at runtime, because settings.py calls load_dotenv()
without override=True.

Verified by reconstructing the build context the way Dokploy does - git archive
of HEAD, then an empty .env written over it - applying .dockerignore and the
COPY lines, and booting the result with an empty environment: /app/.env is 4938
bytes, the sign-in passwords are absent, and scripts/check_deploy.sh reports 6
passed, 0 failed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,5 +1,10 @@
-# .env is committed deliberately, at the repo owner's instruction, so the
-# deployment does not depend on re-entering config in the Dokploy UI.
+# .env.production is committed deliberately, at the repo owner's instruction, so
+# the deployment does not depend on re-entering config in the Dokploy UI.
+#
+# It is NOT named .env, and that matters: Dokploy writes its own .env into the
+# build context from the service's Environment tab after cloning, so a committed
+# .env is silently replaced (with an empty file when that tab is blank).
+# The Dockerfile copies .env.production to /app/.env inside the image.
 #
 # The two database secrets are NOT in it - they are set as Dokploy environment
 # variables, which override the file (settings.py calls load_dotenv() without
@@ -9,7 +14,8 @@
 # anyone with read access to this repository can mint an admin token, and git
 # history keeps it after any rotation. Regenerate with
 # `python scripts/make_auth_secrets.py` if that stops being acceptable.
-!.env
+!.env.production
+.env
 
 # Local overrides and the generated sign-in passwords stay out of git.
 .env.local