fix(ci): correct CI workflow paths, build context, and branch gate

Fix 5 issues found during automated code review:
- BUG-001: Docker build context now uses repo root (.) matching compose.yml
- BUG-002: Replace invalid `bun ci` with `bun install --frozen-lockfile`
- FUNC-001: Fix lint/mypy paths to use `app/` relative to working-directory
- FUNC-002: Add frontend-ci to alls-green gate with allowed-skips
- SEC-001: Create root .dockerignore to exclude secrets from build context

Related to AYG-72

🤖 Generated by Aygentic

Co-Authored-By: Aygentic <noreply@aygentic.com>

Author: amostt

.dockerignore

@@ -0,0 +1,29 @@
+# Secrets
+.env
+.env.*
+!.env.example
+
+# Version control
+.git
+.github
+
+# IDE
+.vscode
+.idea
+
+# Dependencies (installed in container)
+node_modules
+frontend/node_modules
+
+# Caches and build artifacts
+**/__pycache__
+**/.mypy_cache
+**/.pytest_cache
+**/htmlcov
+**/.coverage
+**/.ruff_cache
+
+# Documentation and config
+docs/
+*.md
+!backend/README.md

.github/workflows/ci.yml

@@ -26,13 +26,13 @@ jobs:
         run: uv sync
         working-directory: backend
       - name: Ruff check
-        run: uv run ruff check backend/app/
+        run: uv run ruff check app/
         working-directory: backend
       - name: Ruff format check
-        run: uv run ruff format --check backend/app/
+        run: uv run ruff format --check app/
         working-directory: backend
       - name: Mypy
-        run: uv run mypy backend/app
+        run: uv run mypy app
         working-directory: backend
 
   backend-test:
@@ -82,7 +82,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
       - name: Install dependencies
-        run: bun ci
+        run: bun install --frozen-lockfile
         working-directory: frontend
       - name: Lint
         run: bun run lint
@@ -99,16 +99,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
       - name: Build backend image
-        run: docker build -t test-backend backend/ -f backend/Dockerfile
+        run: docker build -t test-backend . -f backend/Dockerfile
 
   # Branch protection gate
   alls-green:
     name: CI Complete
     runs-on: ubuntu-latest
-    needs: [backend-lint, backend-test, docker-build]
+    needs: [backend-lint, backend-test, docker-build, frontend-ci]
     if: always()
     steps:
       - name: Check all jobs
         uses: re-actors/alls-green@release/v1
         with:
           jobs: ${{ toJSON(needs) }}
+          allowed-skips: frontend-ci