Add arm64 compose files: one builds the image, one runs the published one

docker-compose.arm64.build.yml builds the image for linux/arm64 from
source and tags it for the registry (docker compose ... build, then push);
it can also build and run directly on an arm64 machine. Building on x86
works through QEMU, with the one-time binfmt setup noted in the file.

docker-compose.arm64.yml runs that published image on the arm64 machine
with no build there. Both use the same image name and an :arm64 tag, kept
apart from the default image so the existing docker-compose.yml is
untouched. IMAGE_REPO and ARM64_TAG (in .env or the shell) switch the
registry or pin a release tag.

Also adds a .dockerignore, which the repo lacked. The Dockerfile runs
COPY . . after npm ci, so a local build from a developer checkout would
overwrite the container's node_modules with the host's (Windows/x86
binaries) and break the build -- most visibly when cross-building for
arm64. It also keeps .env, data/ and .git out of the build context.

libsql's arm64 musl binary is present in package-lock.json, and the
Dockerfile's node:22-alpine base is multi-arch.

Not built or run: Docker isn't available in this environment, so neither
the emulated arm64 build nor the compose files themselves have been
executed. The YAML was only checked for whitespace and against the
runtime section of docker-compose.yml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,22 @@
+# Keep the build context to source. The important one is node_modules: the Dockerfile runs `COPY . .` after
+# `npm ci`, so a host node_modules (Windows/macOS/x86 binaries) would overwrite the container's own and break the
+# build — most visibly when cross-building for arm64.
+**/node_modules
+**/dist
+**/build
+**/*.tsbuildinfo
+
+# Never send secrets or data into a build.
+.env
+.env.*
+!.env.example
+data
+
+.git
+.gitignore
+.claude
+*.log
+.DS_Store
+
+# Compose files aren't needed inside the image.
+docker-compose*.yml