Keep git-ignored files and data/ out of the Docker build context (closes #266)

.dockerignore now lists every .gitignore pattern, each with **/ so Docker
matches it in every directory as git does, plus the top-level data/
directory. git-ignored secrets such as .env.local, *.key files and
data/session.key no longer reach the build stages or the build cache. .git
stays in the context and no tracked file is listed, so the version still
comes from git describe without -dirty.

data/, where upaasd keeps its database and session key when run from the
checkout, is now git-ignored.

Model: opus-5-5

.dockerignore

@@ -26,6 +26,3 @@
 **/*.test
 **/*.out
 /data/
-
-# Git never applies its ignore patterns inside .git; send all of it again.
-!.git/**