Stop build.py sweeping secrets and bytecode into gen/

gen/<room>/ is the docker build context and soleprint/Dockerfile is `COPY . .`,
so anything reaching gen/ reaches an image layer — and registry.mcrn.ar is
public-read. station/tools/tester/.env has been gitignored since the last
incident, but .gitignore does not bind shutil: copy_path() called
shutil.copytree() with no ignore=, so the key was copied into every built room.
Verified extractable from soleprint_localtest-soleprint:latest (built 8 days
ago) at /app/station/tools/tester/.env.

ctrl/deploy.sh's --exclude='.env' is why this looked handled; it only covers the
rsync path, not the build-and-push path.

Two layers now:
  - copy_path()/merge_into() filter .env, __pycache__, *.pyc, .git, node_modules
    and virtualenvs out of bulk directory copies. Single-file copies named by a
    caller are untouched, so cfg/<room>/.env.example still ships.
  - soleprint/.dockerignore repeats the rule at the docker boundary and is
    copied into the context beside the Dockerfile. Follows the convention
    soleprint/atlas/.dockerignore already set (.env, .env.*, !.env.example).

Runtime is unaffected: no Dockerfile COPYs a .env, and the room compose files
supply it with `env_file: - .env`, read from the host at run time.

The key itself still needs rotating — it remains in git history.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

soleprint/.dockerignore

@@ -0,0 +1,24 @@
+# The build context is gen/<room>/, and the Dockerfile is `COPY . .` — so this
+# file is the last thing standing between a stray secret and a public image
+# layer. build.py already filters these out of the copy into gen/; this repeats
+# the rule at the docker boundary so a hand-built context, or a future copy path
+# that forgets, still cannot bake one in.
+#
+# Copied into gen/<room>/ by build.py's named-file list alongside the Dockerfile.
+
+.env
+.env.*
+**/.env
+**/.env.*
+!.env.example
+!**/.env.example
+
+__pycache__/
+**/__pycache__/
+*.pyc
+*.pyo
+
+.git/
+.venv/
+venv/
+node_modules/