Docker: full Dockerized deployment (volumes, host networking, multi-package-manager build)

- docker-compose.yml: network_mode host so 127.0.0.1 refs (.env) keep working;
  mounts /var/www/Gamedata + write volumes; /api/health healthcheck; mem_limit
- Dockerfile: package-manager detection (pnpm/yarn/npm) + PACKAGE_MANAGER arg;
  runs as www-data (UID/GID 33) so gamedata is writable; .env loaded only for
  the build (no secrets baked in); build runs on the host network
- .dockerignore: .env stays in the build context (needed for NEXT_PUBLIC_*)
- README: Docker deployment section (paths, volumes, chown, migrations on host)

.dockerignore

@@ -7,8 +7,12 @@ storage
 prod.log
 update.log
 .pm2
-.env
+# NOTE: .env is intentionally NOT ignored here — the build loads it (only inside
+# a build RUN layer) to produce NEXT_PUBLIC_* + validated build-time values.
+# It is not copied into the runtime image (the runner stage copies only
+# .next/standalone, public/, and .next/static).
+# .env
 *.tsbuildinfo
-# ~3GB client assets; mounted as a volume at runtime (see docker-compose.yml)
+# Runtime write targets; bound as RW volumes at runtime (see docker-compose.yml)
 public/nitro-assets
 public/swf