chore(ci): .dockerignore + path filters on existing workflows

The repo now contains the Flutter mobile client at flutter_client/
(M7 #356). Two cleanups so the existing build pipelines don't churn
on Flutter-only changes:

1. .dockerignore — keep the Flutter project (and docs/, IDE noise,
   git metadata) out of the Docker build context. The runtime image
   was already unaffected (multi-stage drops everything but the Go
   binary), but the COPY . . layer cache invalidated on every
   Flutter edit. Build context shrinks ~2.4 MB and Flutter-only
   pushes no longer force Go rebuilds.
2. test.yml + release.yml — paths-ignore on flutter_client/**,
   docs/**, and **/*.md. Go/web tests + container build now skip
   when the diff doesn't touch them. Tag releases still build broadly
   since server + Flutter ship paired.

The Flutter-side workflow lands in M7 Task 21 with its own paths
filter restricting it to flutter_client/** and the shared web/
inputs (tokens.json, error-copy.json, album-fallback.svg).

.dockerignore

@@ -0,0 +1,31 @@
+# Build artifacts and node_modules — never useful inside the Docker context.
+**/.git
+**/.gitignore
+**/node_modules
+**/.svelte-kit
+**/build
+web/build
+
+# Flutter mobile client — built separately on developer machines / Flutter CI.
+# Including it in the Go build context wastes ~70 files and invalidates the
+# `COPY . .` layer cache on every Flutter-only change.
+flutter_client/
+
+# Docs and IDE noise
+docs/
+**/.idea
+**/.vscode
+**/.DS_Store
+
+# Test outputs
+**/coverage
+**/.nyc_output
+
+# Local env / secrets — fail closed.
+.env
+.env.*
+!.env.example
+
+# CI workflow files don't need to ship in the image.
+.forgejo/
+.github/

.forgejo/workflows/release.yml

@@ -10,6 +10,14 @@ on:
   push:
     branches: [main]
     tags: ['v*']
+    # Tag pushes still build (tag releases are intentional, server + Flutter
+    # share the version). Branch pushes skip when the diff is Flutter-only —
+    # rebuilding the Go image for a Flutter-only merge wastes CI and churns
+    # the registry.
+    paths-ignore:
+      - 'flutter_client/**'
+      - 'docs/**'
+      - '**/*.md'
   workflow_dispatch:
 
 jobs:

.forgejo/workflows/test.yml

@@ -8,8 +8,15 @@ on:
   # CI on their own — opening a PR fires the pull_request event and gates
   # the merge. Avoids the duplicate push+pull_request runs we were
   # accumulating on every PR commit.
+  #
+  # paths-ignore skips this workflow when only Flutter-client files change;
+  # the Flutter workflow (.forgejo/workflows/flutter.yml) handles those.
   pull_request:
     branches: [main]
+    paths-ignore:
+      - 'flutter_client/**'
+      - 'docs/**'
+      - '**/*.md'
 
 jobs:
   test: