docker: stop a Windows checkout from breaking the backend image

The repo had no .gitattributes at all, so nothing pinned line endings —
`git ls-files --eol backend/docker-entrypoint.sh` showed an empty attr/.
Git for Windows installs with core.autocrlf=true, which rewrites the
entrypoint to CRLF on checkout. The image then ships a script whose
shebang is "#!/bin/sh\r" and the container dies at startup with

  exec /usr/local/bin/docker-entrypoint.sh: no such file or directory

naming the file it just copied in, which reads like the COPY failed.

Verified by building an image from a deliberately CRLF-ified copy of the
entrypoint: it reproduces that exact error, and passes with the sed.

Pin *.sh (and the Dockerfiles) to LF, and strip CR in the image before
chmod as well — .gitattributes only helps fresh clones, and a Windows
contributor who cloned before this commit still has CRLF on disk.
Renormalizing changes no tracked file today; this is purely a guard.

The arm64/Apple Silicon failure that prompted this is already fixed by
6127a0a (Turbopack has no musl/arm64 binding; the build uses webpack).
Confirmed by building both images on an arm64 Mac. Release publishes
linux/amd64 + linux/arm64, there are no bind mounts, no platform: keys
and no host.docker.internal, so the remaining cross-platform hazard was
just the line endings.

Also tighten .dockerignore: backend was shipping docker-compose.tunnel
.yml, fly.toml, railway.json, render.yaml, .env.example and
drizzle.config.ts into the build context; frontend was shipping
tsconfig.tsbuildinfo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/Dockerfile

@@ -19,7 +19,13 @@ RUN npm ci --omit=dev
 COPY --from=build /app/dist ./dist
 COPY --from=build /app/drizzle ./drizzle
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+# Strip CR before chmod. .gitattributes keeps this file LF on fresh clones, but
+# a Windows checkout made before that existed still has CRLF on disk, and a
+# "#!/bin/sh\r" shebang fails at container start with a "no such file or
+# directory" error that names the file it just copied in. Cheap to make the
+# image self-healing rather than rely on every contributor re-cloning.
+RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh \
+  && chmod +x /usr/local/bin/docker-entrypoint.sh
 EXPOSE 4000
 # The entrypoint auto-generates any missing secrets, then we apply migrations
 # and start the API.