[jdotc1]

Closes #279 (WEB-018).

Security impact

Local .env and .env*.local files should not enter Docker build contexts, and the development image should not run application code as root.

Changes

• Ignore local environment files in .dockerignore.
• Give the development working directory to node and activate USER node after dependency installation.
• Add focused Jest regression tests for both safeguards.

Verification

• Baseline security checks failed before the fix and pass against the patch.
• Source diff is limited to .dockerignore, Dockerfile, and the test file.
• Full Docker/Jest CI execution is pending upstream checks.