fix: dockerfile install order; add .dockerignore; update .gitignore

.gitignore

@@ -12,15 +12,19 @@ dist/
 build/
 *.egg
 .eggs/
+.pytest_cache/
+.coverage
+htmlcov/
 
 # Virtual environments
 .venv/
 venv/
 env/
 
-# Environment / secrets
+# Secrets / local config (use config.example.yaml as template)
 .env
 *.env.local
+config.yaml
 
 # Database
 *.db
@@ -40,11 +44,5 @@ Thumbs.db
 *.swp
 *.swo
 
-# Alembic (generated, not secrets — keep migrations in VCS but exclude caches)
-# (nothing to exclude here by default)
-
-# Docker
-.dockerignore
-
 # Playbook cache (runtime data)
 playbook_cache/