speed up docker build: bun everywhere, buildx layer cache, tighter dockerignore

Root cause of 6+ min builds: Dockerfile stage 1 ran 'npm install' with no
package-lock.json, so every build re-resolved + re-fetched the full npm tree
from scratch on a fresh runner.

- Dockerfile: replace node:22-slim+npm stage with oven/bun:1-slim; both
  stages now 'bun install --frozen-lockfile' against the tracked bun.lock;
  --mount=type=cache for the bun install cache
- workflow: switch to docker/build-push-action with registry buildcache
  (cache-from + cache-to) so layers persist across runs
- dockerignore: add .worktrees, docs, tests, tsbuildinfo so the build context
  ships less

Dockerfile

@@ -1,15 +1,20 @@
-FROM node:22-slim AS build
-WORKDIR /app
-COPY package.json ./
-RUN npm install
-COPY . .
-RUN npx vite build
+# syntax=docker/dockerfile:1.7
 
-FROM oven/bun:1
+FROM oven/bun:1-slim AS build
+WORKDIR /app
+# Install deps first for layer caching — only rebuilds when the lockfile changes.
+COPY package.json bun.lock ./
+RUN --mount=type=cache,target=/root/.bun/install/cache \
+	bun install --frozen-lockfile
+COPY . .
+RUN bun run build
+
+FROM oven/bun:1-slim
 RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
-COPY package.json bun.lock* ./
-RUN bun install --frozen-lockfile --production
+COPY package.json bun.lock ./
+RUN --mount=type=cache,target=/root/.bun/install/cache \
+	bun install --frozen-lockfile --production
 COPY --from=build /app/dist/ ./dist/
 COPY --from=build /app/server/ ./server/
 EXPOSE 3000