Package verified Dune checkpoints for TrueNAS and HTTPS proxying

Serve built Workers directly through pinned Miniflare with persistent D1-compatible storage and startup migrations. Build and verify Docker images in CI; publish main checkpoints to GHCR for manual TrueNAS updates on port 33046. Preserve explicit public-origin checks and LAN-compatible cryptographic operation IDs.

Validation: 5,153 offline tests, typecheck, lint and build; 49 HTTP integration cases; HTTPS-origin create/join/chat/seat protection, foreign-origin rejection, exact saved-seat restart and browser asset serving. Independent persistence/proxy review completed. Clean Docker CI and actual NAS installation follow this source checkpoint.

.dockerignore

@@ -0,0 +1,34 @@
+# Allow only build inputs. Never send saved games, credentials or Git history.
+**
+!package.json
+!package-lock.json
+!tsconfig.json
+!next.config.ts
+!vite.config.ts
+!.oxlintrc.json
+!components.json
+!drizzle.config.ts
+!README.md
+!AGENTS.md
+!THIRD_PARTY_NOTICES.md
+!docs/**
+!.openai/
+!.openai/hosting.json
+!app/**
+!components/**
+!db/**
+!drizzle/**
+!game/**
+!hooks/**
+!lib/**
+!public/**
+!tests/**
+!tools/**
+!deploy/container-entrypoint.sh
+!deploy/serve.mjs
+**/*.orig
+**/*.rej
+**/.env*
+**/.dev.vars*
+**/*.sqlite*
+**/*.pem