infra: .dockerignore, remove exposed port, healthcheck, pin caddy

- add repo-root .dockerignore (target, node_modules, .git, dist)
- colony: expose instead of ports (internal network only)
- colony: healthcheck via /api/health
- caddy: pin to 2.11, mount Caddyfile read-only
- caddy: depends_on service_healthy

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,9 @@
+target/
+**/node_modules/
+**/dist/
+.git/
+*.db
+*.db-wal
+*.db-shm
+.claude/
+docs/