🔒 fix: exclude .env from Docker build context

The builder stage runs COPY . . and Docker does not read .gitignore,
so a real .env (this repo ships .env.example) lands in builder-stage
layers in the local build cache. The final image is unaffected
(multi-stage, binary-only), but cache layers are exportable and
--target builder images would carry the secret. /certs was already
excluded; .env now is too.

Author: luiscosio

.dockerignore

@@ -6,3 +6,5 @@
 /logs.txt
 /*.log
 /*.jsonl
+/.env
+/.env.*