Dokploy deploy: Dockerfile, DB CA cert, blog images, CSP

- Add Dockerfile (multi-stage Node 20), .dockerignore, docker-compose.yml, and
  DEPLOY-DOKPLOY.md for container deployment on Dokploy.
- Commit the DigitalOcean managed-Postgres Project CA cert (certs/ca-certificate.crt)
  so production TLS verification (fail-closed) works in-container. Public CA, safe to commit.
- Blog cover images served from DO Spaces; allow *.digitaloceanspaces.com in the prod CSP img-src.
- Includes the AI (case summaries) and Cloudflare Turnstile bot-protection features.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,42 @@
+# Keep the build context small and NEVER bake secrets or host-built artifacts into the image.
+
+# Secrets — must never enter the image (env is injected by Dokploy at runtime).
+.env
+.env.*
+!.env.example
+
+# Dependencies + build outputs (reinstalled / rebuilt inside the image).
+node_modules
+**/node_modules
+apps/web/dist
+apps/api/dist
+dist
+build
+.turbo
+.cache
+coverage
+
+# VCS / CI / editor / OS noise.
+.git
+.gitignore
+.github
+.vscode
+.idea
+.DS_Store
+Thumbs.db
+
+# Logs and legacy Plesk/Passenger runtime scratch.
+*.log
+logs
+tmp
+
+# Local-only storage dirs (documents live in Spaces).
+storage
+uploads
+
+# Tests aren't needed in the runtime image.
+apps/api/test
+**/*.test.ts
+
+# Note: certs/ is intentionally NOT ignored — the Postgres CA cert (if committed) is baked in
+# so production TLS verification works. See DEPLOY-DOKPLOY.md.