fix: exclude deployment secrets from image

AI-Co-Authored-By: Codex

.dockerignore

@@ -25,3 +25,9 @@ admin-web/test-results/
 admin-web/playwright-report/
 .pytest_cache/
 .ruff_cache/
+# deployment-only secrets and persistent runtime state
+config.env
+runtime/
+sessions/
+backups/
+*.log