Docker: volledige Dockerized deployment (volumes, host-netwerk, multi-package-manager build)

- docker-compose.yml: network_mode host zodat 127.0.0.1 refs (.env) blijven werken;
  /var/www/Gamedata + write-volumes gemonteerd; /api/health healthcheck; mem_limit
- Dockerfile: multi-package-manager detectie (pnpm/yarn/npm) + PACKAGE_MANAGER arg;
  draait als www-data (UID/GID 33) zodat gamedata schrijfbaar is; .env geladen
  alleen voor de build (geen secrets in image); build op host-netwerk
- README: Docker deployment sectie (paden, volumes, chown, migraties op host)

.dockerignore

@@ -7,8 +7,12 @@ storage
 prod.log
 update.log
 .pm2
-.env
+# NOTE: .env is intentionally NOT ignored here — the build loads it (only inside
+# a build RUN layer) to produce NEXT_PUBLIC_* + validated build-time values.
+# It is not copied into the runtime image (the runner stage copies only
+# .next/standalone, public/, and .next/static).
+# .env
 *.tsbuildinfo
-# ~3GB client assets; mounted as a volume at runtime (see docker-compose.yml)
+# Runtime write targets; bound as RW volumes at runtime (see docker-compose.yml)
 public/nitro-assets
 public/swf