Without a .dockerignore, COPY . . baked the .env file (including the
webhook secret) into the image and overwrote the container's
node_modules with the host's. Pass public build-time values as build
args and provide the rest at runtime through env_file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
