chore: dockerize Next.js app (multi-stage build, standalone output)

- Dockerfile: 3-stage build (deps → builder → runner) using node:20-alpine
- .dockerignore: excludes node_modules, .next, secrets, graphify-out
- docker-compose.yml: runtime secrets via env, build-time NEXT_PUBLIC_* via args
- Render worker service pre-wired (commented out, opt-in)

.dockerignore

@@ -0,0 +1,34 @@
+# Source control
+.git
+.gitignore
+
+# Build output (rebuilt inside container)
+.next
+out
+
+# Dependencies (reinstalled inside container)
+node_modules
+
+# Local secrets — never bake into image
+.env
+.env.local
+.env*.local
+
+# Dev / tooling
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Generated / large files
+graphify-out
+coverage
+.vercel
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Docker files themselves
+Dockerfile
+.dockerignore
+docker-compose*.yml