Bake cron scripts into the image instead of bind-mounting them

DokPloy's redeploy process rm -rf's the host code dir and recreates it.
The cron container is `restart: unless-stopped` so docker-compose
doesn't recreate it when only scripts/* change — but its bind mount on
./scripts:/app/scripts then points at orphaned inodes inside the
running container, leaving /app/scripts empty until someone manually
`docker restart`s it.

Bake the scripts into the image instead. A scripts/* change now forces
a Dockerfile rebuild → docker-compose recreates the cron service →
fresh /app/scripts inside, no manual restart required. content/ and
.git/ stay bind-mounted because the export job needs to write commits
the host can see.

Also adds .dockerignore so the host's scripts/node_modules (potentially
darwin-specific) doesn't get COPY'd into the alpine image and shadow
the deps installed by `npm install` at build time.

docker-compose.yml

@@ -76,7 +76,10 @@ services:
     depends_on:
       - postgres
     volumes:
-      - ./scripts:/app/scripts:ro
+      # NOTE: scripts/ is intentionally NOT bind-mounted — it's baked into
+      # the cron image (see cron/Dockerfile) so DokPloy redeploys can't
+      # orphan it. content/ and .git/ stay mounted because the export job
+      # writes commits the host needs to see.
       - ./content:/app/content
       - ./.git:/app/.git
       - /var/run/docker.sock:/var/run/docker.sock:ro