feat(docker): self-contained runtime dirs, image healthcheck, spec-compliant Dockerfile

- Create the runtime write targets (/app/storage, /app/public/nitro-assets,
  /app/public/swf, /var/www/Gamedata) owned by UID/GID 33 in the runner image
  so running without the bound volumes no longer hits ENOENT.
- Bake a HEALTHCHECK into the image so `docker run` (ci-deploy.sh) also reports
  Docker-level health; compose can still override it with its own probe.
- Add the dockerfile:1 syntax pragma and ignore non-pnpm lockfiles so a stray
  package-lock.json/yarn.lock can never taint the build context.

.dockerignore

@@ -7,6 +7,12 @@ storage
 prod.log
 update.log
 .pm2
+# Only the pnpm lockfile is used. Ignore other lockfile formats and stray
+# package managers so they never taint the build context by accident.
+package-lock.json
+yarn.lock
+bun.lockb
+.npmrc.bak
 # NOTE: .env is intentionally NOT ignored here — the build loads it (only inside
 # a build RUN layer) to produce NEXT_PUBLIC_* + validated build-time values.
 # It is not copied into the runtime image (the runner stage copies only