Exclude local secrets and build output from Docker build context

[kmcginnes]

Description

.dockerignore didn't exclude .env* files, defaultConnection.json, cert-info/ (self-signed dev certs), *.local.* files, or dist/ build output. The Dockerfile copies the whole tree (COPY . /graph-explorer/), so a developer who has run Graph Explorer locally has all of these in their working tree, and a local docker build . bakes their database endpoint, AWS region, and locally generated certs into an image layer.

This only affects images built locally. CI builds from a clean checkout, so published images are unaffected.

An initial pass at this used blanket patterns (**/.env*, **/cert-info/) and broke real functionality: packages/graph-explorer/.env is a tracked default that docker-entrypoint.sh requires to exist at startup, and cert-info/cert.conf/csr.conf are tracked OpenSSL templates setup-ssl.sh needs to generate a cert at runtime. The patterns are narrowed to **/.env.local (the project's actual local-override convention, per docs/development.md) and to the specific generated cert artifacts (*.key, *.crt, *.csr, *.srl) inside cert-info/, leaving the tracked templates in place.

How to read

1. .dockerignore — the whole change: new patterns for local secrets and build output, each prefixed with **/ since these files can live at any depth in the workspace (e.g. cert-info/ lives under packages/graph-explorer-proxy-server/).

Validation

Verified end to end with actual docker build/docker run, not just by reading the patterns:

• Created fixtures for the local artifacts: packages/graph-explorer/.env.local, defaultConnection.json, config.local.json, a fake generated cert set (rootCA.key, rootCA.crt, rootCA.srl, server.key, server.csr, server.crt) inside cert-info/, and a stale dist/marker.txt.
• Built with the pre-fix .dockerignore and confirmed all of it was present and readable inside the image.
• Applied the fix, rebuilt, and confirmed all of it was absent, while packages/graph-explorer/.env and cert-info/{cert,csr}.conf (tracked, required at runtime) were still present.
• Ran the actual container (docker run --env HOST=localhost ..., entrypoint not overridden): it generated a real self-signed cert, started the proxy server, and served /explorer over HTTPS (301 response). This is what caught the first pass's regression — inspecting the image with --entrypoint sh alone wouldn't have.
• pnpm checks and pnpm test (222 files, 2707 tests) pass.

Related Issues

None found in the backlog for this specific gap.

Check List

• I confirm that my contribution is made under the terms of the Apache 2.0 license.
• I have verified pnpm checks passes with no errors.
• I have verified pnpm test passes with no failures.
• I have covered new added functionality with unit tests if necessary. (Not applicable — a .dockerignore pattern change isn't unit-testable; verified with an actual docker build/docker run instead, see Validation.)
• I have updated documentation if necessary.