fix: add .dockerignore and env_file to docker-compose

Prevents .env from being baked into Docker image (was overriding
config defaults). Adds env_file directive so containers load host
.env properly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/unit/services/test_auth_service.py

@@ -23,7 +23,7 @@ class TestAuthService:
     def test_login_user_success(self, db, test_user):
         """Test successful user login."""
         user_credentials = UserLogin(
-            email_or_username=test_user.username, password="testpass123"
+            email_or_username=test_user.username, password="testpass123"  # noqa: SEC-001
         )
 
         result = self.service.login_user(db, user_credentials)
@@ -39,7 +39,7 @@ class TestAuthService:
     def test_login_user_with_email(self, db, test_user):
         """Test login with email instead of username."""
         user_credentials = UserLogin(
-            email_or_username=test_user.email, password="testpass123"
+            email_or_username=test_user.email, password="testpass123"  # noqa: SEC-001
         )
 
         result = self.service.login_user(db, user_credentials)
@@ -50,7 +50,7 @@ class TestAuthService:
     def test_login_user_wrong_username(self, db):
         """Test login fails with wrong username."""
         user_credentials = UserLogin(
-            email_or_username="nonexistentuser", password="testpass123"
+            email_or_username="nonexistentuser", password="testpass123"  # noqa: SEC-001
         )
 
         with pytest.raises(InvalidCredentialsException) as exc_info:
@@ -64,7 +64,7 @@ class TestAuthService:
     def test_login_user_wrong_password(self, db, test_user):
         """Test login fails with wrong password."""
         user_credentials = UserLogin(
-            email_or_username=test_user.username, password="wrongpassword"
+            email_or_username=test_user.username, password="wrongpassword"  # noqa: SEC-001
         )
 
         with pytest.raises(InvalidCredentialsException) as exc_info:
@@ -85,7 +85,7 @@ class TestAuthService:
         db.commit()
 
         user_credentials = UserLogin(
-            email_or_username=test_user.username, password="testpass123"
+            email_or_username=test_user.username, password="testpass123"  # noqa: SEC-001
         )
 
         with pytest.raises(UserNotActiveException) as exc_info:
@@ -102,7 +102,7 @@ class TestAuthService:
 
     def test_hash_password(self):
         """Test password hashing."""
-        password = "testpassword123"
+        password = "testpassword123"  # noqa: SEC-001
         hashed = self.service.hash_password(password)
 
         assert hashed != password
@@ -111,7 +111,7 @@ class TestAuthService:
 
     def test_hash_password_different_results(self):
         """Test that hashing same password produces different hashes (salt)."""
-        password = "testpassword123"
+        password = "testpassword123"  # noqa: SEC-001
         hash1 = self.service.hash_password(password)
         hash2 = self.service.hash_password(password)