diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..165e1cc
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,32 @@
+# What must never enter the build context.
+#
+# There was no .dockerignore at all, so every one of these was being uploaded to
+# the Docker daemon on each build and then copied into the builder image by
+# `COPY . .`.
+#
+# `.git` is the one that matters for speed — it carries the entire history, and
+# it grows forever while being worthless to a build. The rest is correctness:
+# `dist` and `node_modules` from a developer's machine would be copied in and
+# then overwritten by the build, but only after being transferred, and a stale
+# `dist` copied over the fresh one is a genuinely confusing failure.
+.git
+.gitignore
+node_modules
+dist
+
+# Scratch. `_to_delete` is spent files awaiting removal and has no business in
+# an image.
+_to_delete
+*.zip
+*.tgz
+_inv.txt
+
+# Per-machine overrides. `.env` itself IS wanted — it carries VITE_API_BASE and
+# the build needs it — but `.env.local` is a developer's private override and
+# must not decide what production talks to.
+.env.local
+*.local
+
+.vscode
+.DS_Store
+README.md
diff --git a/.gitignore b/.gitignore
index bf6e7ac..864bb73 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,11 @@ dist
 *.local
 .DS_Store
 .vscode
+
+# Spent files awaiting deletion. Was tracked, which put it in the repo and in
+# every Docker build context.
+_to_delete
+
+# Transfer archives.
+*.zip
+*.tgz
diff --git a/_to_delete/ProductsPage.tsx b/_to_delete/ProductsPage.tsx
deleted file mode 100644
index e69de29..0000000
diff --git a/_to_delete/old-nginx.conf b/_to_delete/old-nginx.conf
deleted file mode 100644
index 10ba96f..0000000
--- a/_to_delete/old-nginx.conf
+++ /dev/null
@@ -1,25 +0,0 @@
-server {
-    listen 80;
-    server_name localhost;
-
-    # Serve the React App
-    location / {
-        root   /usr/share/nginx/html;
-        index  index.html index.htm;
-        # Force Nginx to pass routing back to React Router
-        try_files $uri $uri/ /index.html;
-    }
-
-    # Proxy /hasura to the live API, exactly like Vite dev server does
-    location /hasura/ {
-        proxy_pass https://api.workolik.com/api/rest/;
-        proxy_set_header x-hasura-admin-secret "nearle-admin-secret";
-        proxy_ssl_server_name on;
-        
-        # Pass standard proxy headers
-        proxy_set_header Host api.workolik.com;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}