fix(docker): keep embedded panel/ and deploy/ in the image build context

`docker build` failed twice over because .dockerignore excluded two trees the
image actually needs. The panel stage's `COPY panel/ ./` hit `"/panel": not
found`, and even past that the Go build would fail: the root felis package
//go:embeds deploy/bootstrap.sh and deploy/crd/*.yaml, which `COPY . .` dropped
along with the excluded deploy/.

The stale header comment claimed only internal/store/migrations was embedded,
which is what licensed the over-broad exclusions. Rewrite it to name all three
embedded trees (migrations, deploy assets, panel static) and warn against
re-adding panel/, deploy/, or internal/ without re-checking the go:embed list.

Tighten node_modules -> **/node_modules so a working-tree build no longer drags
panel/node_modules over the Linux modules npm ci installs in the panel stage.

.dockerignore

@@ -1,15 +1,15 @@
-# Keep the felis image build context tiny: the binary is pure Go (only
+# Keep the felis image build context lean, but mind the embeds: three trees MUST
-# internal/store/migrations/*.sql is embedded), so none of the web/plugin/doc
+# stay in the context or the image build fails. internal/store/migrations/*.sql,
-# assets are needed and shipping them would bloat the context and slow `docker
+# deploy/bootstrap.sh and deploy/crd/*.yaml are //go:embed-ed by Go packages the
-# build` on a small host.
+# binary compiles, and internal/panel/static is the panel the Dockerfile panel
+# stage builds from panel/. Exclude only build-irrelevant trees below; never add
+# panel/, deploy/, or internal/ here without checking `grep -rn go:embed`.
 .git
 .claude
-node_modules
+**/node_modules
-panel
 plugins
 docs
 *.md
-deploy
 Dockerfile
 .dockerignore
 .gitignore