build: run the container through dotenvx with the encrypted .env.production

- image installs @dotenvx/dotenvx (pinned) and starts via
  'dotenvx run -f .env.production --strict -- node server.js'
- only DOTENV_PRIVATE_KEY_PRODUCTION is supplied at runtime; without it the
  container exits(1) (MISSING_PRIVATE_KEY) instead of booting with
  undecryptable credentials
- .env.production copied with --chown=node:node (the source mode is 600)
- .dockerignore excludes .env/.env.local/.env.keys so local envs and the
  private keys never enter the build context

README.md

@@ -91,11 +91,20 @@ dotenvx run -f .env -- node tools/server.js          # local, from the repo root
 dotenvx set MINIO_SECRET_KEY "<value>" -f .env       # add/rotate a value
 ```
 
-Deploying with Docker: `--env-file` cannot read encrypted values, so either
-decrypt at deploy time (`dotenvx decrypt -f .env.production --stdout` into a
-runtime env file) or pass `DOTENV_PRIVATE_KEY_PRODUCTION` into the container
-and run through `dotenvx` inside the image (ask if you want the Dockerfile
-wired for that).
+The Docker image contains the encrypted `.env.production` and runs through
+`dotenvx`; only the private key is supplied at runtime (never baked in):
+
+```sh
+docker build -t yreka-tools .
+docker run -d -p 4173:4173 --name yreka-tools \
+  --env DOTENV_PRIVATE_KEY_PRODUCTION="$(grep -oP '^DOTENV_PRIVATE_KEY_PRODUCTION=\K.*' .env.keys)" \
+  yreka-tools
+```
+
+`dotenvx run --strict` makes the container exit rather than start with
+undecryptable credentials. Note that `--env` values are visible to
+`docker inspect`; on a shared host prefer an env file with restrictive
+permissions (`--env-file deploy.keys`) or your platform's secret store.
 
 ## Tests