build: dockerignore, drop _to_delete from the repo

.dockerignore

@@ -0,0 +1,32 @@
+# What must never enter the build context.
+#
+# There was no .dockerignore at all, so every one of these was being uploaded to
+# the Docker daemon on each build and then copied into the builder image by
+# `COPY . .`.
+#
+# `.git` is the one that matters for speed — it carries the entire history, and
+# it grows forever while being worthless to a build. The rest is correctness:
+# `dist` and `node_modules` from a developer's machine would be copied in and
+# then overwritten by the build, but only after being transferred, and a stale
+# `dist` copied over the fresh one is a genuinely confusing failure.
+.git
+.gitignore
+node_modules
+dist
+
+# Scratch. `_to_delete` is spent files awaiting removal and has no business in
+# an image.
+_to_delete
+*.zip
+*.tgz
+_inv.txt
+
+# Per-machine overrides. `.env` itself IS wanted — it carries VITE_API_BASE and
+# the build needs it — but `.env.local` is a developer's private override and
+# must not decide what production talks to.
+.env.local
+*.local
+
+.vscode
+.DS_Store
+README.md