chore: keep secrets out of the Docker build context; drop stale README step

The build stage of the Dockerfile runs `COPY . .`, so anything left in the
checkout root is sent to the builder and copied into the build stage. Exclude
the local secrets and backups that the install and backup scripts create
there: .env, config.json, jwt.key and backups/. keys/ was already excluded.

The Docker Compose (manual) section of the README still told users to build
the single binary before `docker compose up -d --build`. Since the
multi-stage Dockerfile builds the frontend and the Go binary itself, that
step is no longer needed; remove it.

.dockerignore

@@ -6,6 +6,10 @@ server/webui/dist
 /artex
 data
 keys
+backups
+.env
+config.json
+jwt.key
 *.db
 transcripts
 bench/kv

README.md

@@ -100,7 +100,6 @@ The web UI is published on `127.0.0.1` by default. To reach it from another mach
 git clone https://github.com/BaaRai/ARTEX.git
 cd ARTEX
 cp .env.example .env          # set POSTGRES_PASSWORD, optionally ANTHROPIC_API_KEY
-# build the single binary first (frontend, then go build -tags embedui), see the Dockerfile header
 docker compose up -d --build  # builds artex from this checkout + starts postgres
 # → http://localhost:8787
 ```