Security: tighten Docker build contexts and .dockerignore rules

apps/marketing-site/.dockerignore

@@ -1,8 +1,43 @@
-node_modules
-dist
-.astro
-.git
+# Dependencies and build outputs
+node_modules/
+dist/
+.astro/
+build/
+coverage/
+
+# Version control
+.git/
+.gitignore
+
+# Environment and secrets
+.env
+.env.*
+*.pem
+*.key
+*.p12
+*.pfx
+*.crt
+*.csr
+*.agekey
+secrets/
+.sops.yaml
+
+# Development and test tooling (not needed at build time)
+tests/
+playwright-report/
+test-results/
+playwright.config.ts
+vitest.config.ts
+eslint.config.js
+.prettierrc
+.trivyignore
+nginx.conf
+
+# Documentation
 *.md
-.env*
-playwright-report
-test-results
+
+# OS and editor artefacts
+.DS_Store
+*.suo
+*.user
+Thumbs.db

apps/marketing-site/Dockerfile

@@ -3,7 +3,7 @@
 FROM node:26-alpine@sha256:e71ac5e964b9201072425d59d2e876359efa25dc96bb1768cb73295728d6e4ea AS builder
 WORKDIR /app
 
-COPY package.json package-lock.json* ./
+COPY package.json package-lock.json ./
 RUN npm ci --ignore-scripts
 
 COPY . .

services/core-api/.dockerignore

@@ -1,2 +1,36 @@
+# Build outputs
 **/bin/
 **/obj/
+**/TestResults/
+**/coverage/
+
+# Test projects (not needed for production build)
+tests/
+
+# Version control
+.git/
+.gitignore
+
+# Environment and secrets
+.env
+.env.*
+*.pem
+*.key
+*.p12
+*.pfx
+*.crt
+*.csr
+*.agekey
+secrets/
+.sops.yaml
+
+# Documentation and solution metadata
+*.md
+*.slnx
+
+# OS and editor artefacts
+.DS_Store
+*.suo
+*.user
+*.DotSettings.user
+Thumbs.db