Add .dockerignore files for api and caddy

Both use an allowlist so only the files each Dockerfile copies are sent
to the build context. For caddy this keeps the TLS certificates and keys
in data/ and config/ out of the context; for api it skips training code,
datasets, saved models and caches.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

api/.dockerignore

@@ -0,0 +1,13 @@
+# Allowlist: the Dockerfile only copies these three things, so nothing
+# else (training code, datasets, saved models, caches) is sent to the daemon.
+*
+!requirements.txt
+!src/production
+!build_models
+
+# Re-exclude junk inside the allowed paths
+**/__pycache__
+**/*.pyc
+**/*.bat
+**/.env
+**/*.env