build(docker): keep keys out of the image and run as non-root by default

The build context excluded only .env, so .env.local and the like or
pinokio/ENVIRONMENT would be baked into image layers; exclude every dotenv
file except .env.example, plus local state and QA output. Pin the base to
CI's Node 24.14.0 by digest, default to the image's node user, and correct
the HOST comment. Log the trusted peers as the operator's when set. README
notes that MCP and ChatGPT sign-in voice are unavailable under Docker, and
how to trust no gateway when widening the publish.

.dockerignore

@@ -1,9 +1,24 @@
-node_modules
+# Keep keys and local state out of the build context: compose bind-mounts the
+# checkout at run time, so the image never needs them.
 .git
+node_modules
+dist
 .env
+.env.*
+!.env.example
+**/ENVIRONMENT
+pinokio/ENVIRONMENT
+pinokio/.installed
 .gev-cache
 .gev-logs
-dist
+qa-artifacts
+qa-shots
+screenshots
+output
+3d-models
+.gstack
+*.log
+.DS_Store
 # AppleDouble sidecars from a macOS `tar` copy; `npm test` would otherwise
 # collect `._*.test.mjs` as test files.
 ._*