Docker: add .env.example, .dockerignore; polish README Docker section

- Add .env.example (referenced by README Quick Start; populates
  SECRET_KEY/POSTGRES_*/AUTH0_* used by docker-compose).
- Add .dockerignore so `COPY . .` no longer bakes .git, __pycache__,
  venv, local data, and secrets into the image.
- Rewrite README Docker Deployment into a single `docker compose
  up -d --build` flow on port 5021; fix local-dev access port 5000->5021.
- Drop obsolete `version: '3.8'` from docker-compose.yml.

Co-Authored-By: Claude <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,38 @@
+# Version control
+.git
+.gitignore
+
+# Python caches / virtualenvs
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Local environment / secrets — never bake into the image
+.env
+.env.local
+openrouter_key.txt
+
+# Editor / OS
+.DS_Store
+.idea/
+.vscode/
+
+# Local runtime data (mounted as volumes in docker-compose, not baked in)
+data/
+backups/
+app.log
+*.db
+*.sqlite
+
+# Docker artifacts
+Dockerfile
+docker-compose.yml
+.dockerignore
+
+# Docs / design notes not needed at runtime
+*.md