fix: address Docker security and stability issues from PR review

Fixes all issues raised in PR #47 review:

1. Add .dockerignore to prevent:
   - Real .env secrets baked into image layers
   - Host node_modules (glibc) overwriting alpine (musl) → ABI mismatch
   - .git, reports/, evidence/ bloating the image

2. Fix compose host-binding:
   - Remove T3MP3ST_HOST=127.0.0.1 override (was breaking port forwarding)
   - Server now binds to 0.0.0.0 in-container (DOCKER=true from Dockerfile)
   - Host mapping stays 127.0.0.1:3333:3333 for security

3. Add critical security warning in DOCKER.md:
   - Explain exposure risk of 0.0.0.0 binding + disabled Host-header guard
   - Document safe vs unsafe deployment patterns
   - Warn against network_mode: host and -p 3333:3333 without 127.0.0.1

4. Update base image:
   - node:18-alpine → node:22-alpine (Node 18 EOL)
   - Pin by digest @sha256:16e22a550... (prevent floating tag drift)

5. Fix healthcheck in compose:
   - Was always returning success (process.exit(0))
   - Now actually tests /api/health endpoint
   - Add start_period: 40s to align with Dockerfile

6. Fix port typos in DOCKER.md:
   - 3000 → 3333 in troubleshooting examples
   - Update all example snippets to node:22-alpine with digest

docker-compose.yml

@@ -8,7 +8,6 @@ services:
     env_file:
       - .env
     environment:
-      - T3MP3ST_HOST=127.0.0.1
       - T3MP3ST_PORT=3333
     volumes:
       - ./reports:/app/reports
@@ -16,7 +15,8 @@ services:
     ports:
       - "127.0.0.1:3333:3333"
     healthcheck:
-      test: ["CMD", "node", "-e", "process.exit(0)"]
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3333/api/health"]
       interval: 30s
       timeout: 10s
       retries: 3
+      start_period: 40s