Docker: add .env.example, .dockerignore; polish README Docker section

- Add .env.example (referenced by README Quick Start; populates
  SECRET_KEY/POSTGRES_*/AUTH0_* used by docker-compose).
- Add .dockerignore so `COPY . .` no longer bakes .git, __pycache__,
  venv, local data, and secrets into the image.
- Rewrite README Docker Deployment into a single `docker compose
  up -d --build` flow on port 5021; fix local-dev access port 5000->5021.
- Drop obsolete `version: '3.8'` from docker-compose.yml.

Co-Authored-By: Claude <noreply@anthropic.com>

.env.example

@@ -0,0 +1,33 @@
+# BalanceBoard environment configuration
+# Copy this file to .env and edit values for your deployment:
+#   cp .env.example .env
+
+# --- Flask ---
+# Secret key for session signing. CHANGE THIS in production (use a long random string).
+SECRET_KEY=change-this-secret-key-in-production
+
+# Allow browsing the public feed without an account (true/false).
+ALLOW_ANONYMOUS_ACCESS=true
+
+# App branding (optional).
+APP_NAME=BalanceBoard
+LOGO_PATH=logo.png
+
+# --- Database ---
+# A full SQLAlchemy URI takes precedence over the POSTGRES_* vars below.
+# Example: postgresql+psycopg2://balanceboard:balanceboard123@localhost:5432/balanceboard
+DATABASE_URL=
+
+# Used when DATABASE_URL is empty. docker-compose sets these for the app container;
+# for local dev, point these at your own PostgreSQL instance.
+POSTGRES_HOST=localhost
+POSTGRES_PORT=5432
+POSTGRES_USER=balanceboard
+POSTGRES_PASSWORD=balanceboard123
+POSTGRES_DB=balanceboard
+
+# --- Auth0 (optional; leave blank to disable OAuth login) ---
+AUTH0_DOMAIN=
+AUTH0_CLIENT_ID=
+AUTH0_CLIENT_SECRET=
+AUTH0_AUDIENCE=