build: run the container through dotenvx with the encrypted .env.production

- image installs @dotenvx/dotenvx (pinned) and starts via
  'dotenvx run -f .env.production --strict -- node server.js'
- only DOTENV_PRIVATE_KEY_PRODUCTION is supplied at runtime; without it the
  container exits(1) (MISSING_PRIVATE_KEY) instead of booting with
  undecryptable credentials
- .env.production copied with --chown=node:node (the source mode is 600)
- .dockerignore excludes .env/.env.local/.env.keys so local envs and the
  private keys never enter the build context

.dockerignore

@@ -4,6 +4,10 @@
 openspec
 tools/node_modules
 tools/test
+# never bake local env files or the private keys into the image
+.env
+.env.local
+.env.keys
 Dockerfile
 .dockerignore
 README.md