feat(docker): prepare portable images with runtime hotel configuration

.dockerignore

@@ -13,11 +13,14 @@ package-lock.json
 yarn.lock
 bun.lockb
 .npmrc.bak
-# NOTE: .env is intentionally NOT ignored here — the build loads it (only inside
-# a build RUN layer) to produce NEXT_PUBLIC_* + validated build-time values.
-# It is not copied into the runtime image (the runner stage copies only
-# .next/standalone, public/, and .next/static).
-# .env
+# Installation secrets must never enter any image layer (including migrations).
+.env
+.env.*
+**/.env
+**/.env.*
+!.env.example
+*.pem
+*.key
 *.tsbuildinfo
 # Runtime write targets; bound as RW volumes at runtime (see docker-compose.yml)
 public/nitro-assets
@@ -25,3 +28,14 @@ public/swf
 
 .deploy.lock
 logs
+
+# Other installation data and local tool artifacts
+public/cache
+public/tmp
+db_backup_*.sql
+*.log
+playwright-report
+test-results
+blob-report
+.codex
+.agents