fix(infra): fix backend Docker build cache invalidation and missing .dockerignore

[parthrohit22]

Summary

`npm run partha` was slow on every run and could fail outright with `ENOSPC` under Colima. Root-caused to two fixable defects in `apps/backend/` (a third, unfixable-from-the-repo cause — the local Colima VM disk filling up — is documented in #258 but out of scope for a code change).

Linked issue

Closes #258

Roadmap alignment

This is infrastructure/developer-experience hygiene, not a product capability — it doesn't map onto a §23/§28 citation, same as #257 (the dependency-audit fix). Flagging honestly rather than forcing one.

• Roadmap §23 workstream this advances: none directly.
• §28 market-fit criterion this moves toward: not directly applicable.
• Accepted evidence it is real: live timing evidence below, gathered on this machine's actual Colima/Docker setup, not simulated.

What changed

• `apps/backend/Dockerfile`: dependency manifests (`pyproject.toml`, `requirements.txt`) are now copied and installed before `app/` is copied, so a source-only change no longer busts the dependency-install layer. Added a BuildKit `--mount=type=cache,target=/root/.cache/pip` cache mount and dropped `--no-cache-dir`, so even a genuine `requirements.txt` change reuses previously downloaded wheels instead of re-fetching everything. Split the final `pip install -e . --no-deps` into its own layer after the source copy (cheap: no network fetch, no compilation).
• `apps/backend/.dockerignore` (new): excludes `.venv`, `pycache`/`.pytest_cache`/`.mypy_cache`/`.ruff_cache`, `.egg-info`, `.local`/`local`, `tests`, coverage artifacts, `.env`, `.git`, and the stray `$/` shell-expansion artifact already noted in `confidential/Memory.md`. None of these are referenced by any `COPY` instruction, but without this file they were still walked/transferred as build context on every build.

Acceptance criteria completed

• Dependency install layer survives an `app/` source-only change
• `.dockerignore` exists and excludes `.venv`/local caches/artifacts
• `docker compose build api` and `docker compose build frontend` both succeed and produce a working stack

Testing performed

docker compose build api          (cold-ish, pip install layer legitimately reran)
  -> 31s total

# edited apps/backend/app/main.py with a real content change, rebuilt:
docker compose build api
  -> 3.8s total; build log shows:
     [stage-0 5/9] RUN ... pip install -r requirements.txt   CACHED
     [stage-0 6/9] COPY app ./app                            (reran, 0.0s)
     [stage-0 9/9] RUN ... pip install -e . --no-deps         (reran, 2.6s)
  -> reverted the test edit before committing

npm run partha (full stack)
  -> all 4 containers (postgres, redis, api, frontend) reported healthy;
     script printed "PARTHA is ready at http://localhost:5173"
  -> torn down cleanly with docker compose down afterward

Not run: `npm run docker:validate` (the deeper acceptance script) — the manual verification above already exercises build + full stack readiness, and this change touches only build-time caching behavior, not runtime application behavior.

Screenshots

Not applicable — Dockerfile/build-context change, no UI impact.

Security and data considerations

None. Build-cache and build-context scoping only; no change to what ships in the final image (the `.dockerignore`-excluded paths were never `COPY`'d into the image by this Dockerfile before or after this change), no new dependency, no credentials or secrets touched.

Dependencies and blocked work

None.

Scope changes or remaining work

Per #258: this does not fix the Colima VM disk sizing itself (a local machine/operator concern, not something this repo can control) or add automated cleanup for stale `partha-launcher-test-*`-style images left behind by `scripts/validate-compose.mjs` runs. Both are flagged as candidate follow-ups in #258, not folded into this fix.

Contributor checklist

• This PR targets `dev`
• I claimed the issue and had it assigned before starting substantial work (self-assigned chore(infra): backend Docker build is slow and fails under low disk (layer ordering, missing .dockerignore) #258; not commented per maintainer instruction)
• The branch was created from an up-to-date `upstream/dev`
• The branch is rebased on the latest `upstream/dev`
• This PR addresses one clearly scoped issue
• This PR advances a §23 workstream toward a §28 market-fit criterion — see honest Roadmap alignment note above; this is infra/DX hygiene, not a product change
• Every acceptance criterion I claim as complete is actually complete
• Relevant tests pass — no automated test suite covers Docker build caching; verified manually per Testing performed above
• Documentation is updated for any user-visible change — none needed, no documented behavior changed
• No secrets, credentials, local env files, or generated artifacts are included
• No unrelated files were changed
• Closing syntax (`Closes`) is used only because the issue is fully resolved
• Dependencies and follow-up work are linked