Keep git-ignored files and data/ out of the Docker build context (closes #266)

.dockerignore now lists every .gitignore pattern, each with **/ so Docker
matches it in every directory as git does, plus the top-level data/
directory. git-ignored secrets such as .env.local, *.key files and
data/session.key no longer reach the build stages or the build cache. A last
!.git/** line sends all of .git again, since git never applies these patterns
inside it, so a branch named like fix/session.key still resolves. No tracked
file is listed, so the version still comes from git describe without -dirty.

data/, where upaasd keeps its database and session key when run from the
checkout, is now git-ignored.

Model: opus-5-5

.dockerignore

@@ -29,3 +29,7 @@
 
 # Git never applies its ignore patterns inside .git; send all of it again.
 !.git/**
+
+# .git is sent without its config, because a remote URL there can carry a
+# credential; `git describe` does not need it. Keep this after !.git/**.
+.git/config

TODO.md

@@ -25,6 +25,10 @@ regress.
   key, into the build stages and the build cache: `.dockerignore` now leaves out
   everything `.gitignore` does, and `data/` is git-ignored (#266).
 
+- 2026-10-02: `.dockerignore` leaves out `.git/config`, so a remote URL there
+  that carries a credential no longer goes into the Docker build; the image
+  still shows the commit it was built from (#269).
+
 - 2026-10-02: The build no longer passes the CPU architecture in: upaas reads it
   from Go's `runtime.GOARCH` when it runs, and the startup log line reports it
   as `arch`. `CONVENTIONS.md` follows the updated conventions in `sneak/prompts`