refactor(docker): split requirements by role, slim enterprise bundle by default

Split requirements.txt into role-specific files:
  - requirements-backend.txt — FastAPI API runtime
  - requirements-agent.txt — Gradio/LangGraph agent (no embeddings)
  - requirements-embeddings.txt — opt-in sentence-transformers

Default enterprise bundle (./build.sh bundle) builds slim agent without
sentence-transformers/torch (~500 MB saved). Embeddings opt-in via
./build.sh bundle:embeddings <tag>. Embedding router degrades gracefully
when package is absent (ImportError catch in _embedding_router.py).

Updated Dockerfiles:
  - backend.Dockerfile → requirements-backend.txt
  - Dockerfile.agent → requirements-agent.txt + WITH_EMBEDDINGS build arg
  - all-in-one.Dockerfile → requirements-backend.txt

Added embeddings variant to build.sh with full manifest/digest output.
Hardened .dockerignore (cache, report, model, archive patterns).

Other branch work: align git route mocks with async services, remove
legacy agent test files superseded by contract tests.

.dockerignore

@@ -2,22 +2,33 @@
 .gitignore
 .pytest_cache
 .ruff_cache
+.mypy_cache
 .vscode
 .ai
 .specify
 .kilocode
 .codex
+.codeium
 .agent
 venv
+.venv
 backend/.venv
 backend/.pytest_cache
+backend/.mypy_cache
+backend/.ruff_cache
+backend/.coverage*
+backend/htmlcov
+backend/coverage_html_final
+backend/__pycache__
+backend/src/__pycache__
+backend/tests/__pycache__
 frontend/node_modules
 frontend/.svelte-kit
 frontend/.vite
 frontend/build
-backend/__pycache__
-backend/src/__pycache__
-backend/tests/__pycache__
+frontend/playwright-report
+frontend/test-results
+frontend/coverage
 **/__pycache__
 *.pyc
 *.pyo
@@ -25,9 +36,18 @@ backend/tests/__pycache__
 *.db
 *.log
 .env*
+.env.*
 coverage/
 Dockerfile*
 .dockerignore
 backups
 semantics
 specs
+dist
+models
+.huggingface
+.cache/huggingface
+*.tar
+*.tar.xz
+*.tar.gz
+*.zip