Keep git-ignored files and data/ out of the Docker build context (closes #266)

.dockerignore now lists every .gitignore pattern, each with **/ so Docker
matches it in every directory as git does, plus the top-level data/
directory. git-ignored secrets such as .env.local, *.key files and
data/session.key no longer reach the build stages or the build cache. A last
!.git/** line sends all of .git again, since git never applies these patterns
inside it, so a branch named like fix/session.key still resolves. No tracked
file is listed, so the version still comes from git describe without -dirty.

data/, where upaasd keeps its database and session key when run from the
checkout, is now git-ignored.

Model: opus-5-5

.gitignore

@@ -1,3 +1,5 @@
+# .dockerignore repeats these patterns; change both together.
+
 # OS
 .DS_Store
 Thumbs.db
@@ -29,3 +31,6 @@ bin/
 *.dylib
 *.test
 *.out
+
+# upaasd's data directory when it runs from the checkout (UPAAS_DATA_DIR default)
+/data/