fix: address Docker security and stability issues from PR review

Fixes all issues raised in PR #47 review:

1. Add .dockerignore to prevent:
   - Real .env secrets baked into image layers
   - Host node_modules (glibc) overwriting alpine (musl) → ABI mismatch
   - .git, reports/, evidence/ bloating the image

2. Fix compose host-binding:
   - Remove T3MP3ST_HOST=127.0.0.1 override (was breaking port forwarding)
   - Server now binds to 0.0.0.0 in-container (DOCKER=true from Dockerfile)
   - Host mapping stays 127.0.0.1:3333:3333 for security

3. Add critical security warning in DOCKER.md:
   - Explain exposure risk of 0.0.0.0 binding + disabled Host-header guard
   - Document safe vs unsafe deployment patterns
   - Warn against network_mode: host and -p 3333:3333 without 127.0.0.1

4. Update base image:
   - node:18-alpine → node:22-alpine (Node 18 EOL)
   - Pin by digest @sha256:16e22a550... (prevent floating tag drift)

5. Fix healthcheck in compose:
   - Was always returning success (process.exit(0))
   - Now actually tests /api/health endpoint
   - Add start_period: 40s to align with Dockerfile

6. Fix port typos in DOCKER.md:
   - 3000 → 3333 in troubleshooting examples
   - Update all example snippets to node:22-alpine with digest

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM node:18-alpine
+FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2
 
 # Install dependencies
 RUN apk add --no-cache \