build: add container image and ignore rules

Dockerfile builds a static-web-server image serving src/ with the third-party
assets vendored in a first stage, so the runtime layer carries no Node and no
shell tooling. WITH_FFMPEG=0 drops the 18.5 MB asm.js encoder for a smaller
image, at the cost of fetching it at export time.

.gitignore covers dist/, which the release scripts write on every run: without
it a fresh clone reports the build output as untracked and publish.ps1 warns
that the worktree is dirty on every build.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,15 @@
+services:
+  motionity:
+    build:
+      context: .
+      # WITH_FFMPEG: "0" trims 18.5 MB by fetching the MP4/GIF encoder from
+      # archive.org at runtime instead of shipping it.
+      args:
+        WITH_FFMPEG: "1"
+    image: motionity:latest
+    ports:
+      - "8080:8080"
+    restart: unless-stopped
+    read_only: true
+    security_opt:
+      - no-new-privileges:true