fix(build): stop the host tree leaking into the image, split the tsc lanes

Review round 1 fallout, all of it verified against real builds:

- .dockerignore: `node_modules/` is anchored at the context root and has no
  implicit `**/` (unlike gitignore), so it never matched frontend/node_modules.
  `COPY frontend/ ./` was overlaying the Windows host's node_modules on top of
  what `npm ci` had installed — the image carried @esbuild/win32-x64 and 31 .cmd
  shims, and the new typecheck ran a tsc resolved from that merged tree. Build
  context transfer drops 3.05 GB -> 19 kB. Also excludes e2e/.auth (a live
  Playwright session), the report/result dirs and logs.
- build no longer type-checks the e2e project: a type error in a spec must not
  make the app unbuildable for a self-hoster. The gate still checks it via
  `npm run typecheck` (now three named lanes).
- tsconfig.json references tsconfig.node.json, so editors check vite.config.ts /
  vitest.config.ts under the same config the gate uses instead of an inferred one.
- vitest include accepts .test.tsx: an uncollected test file does not fail, it
  silently never runs.

frontend/tsconfig.node.json

@@ -4,6 +4,15 @@
   // so until now nothing type-checked these files at all (R2 / C-4.5). `npm run typecheck`
   // runs this project alongside src and e2e.
   "compilerOptions": {
+    // composite: required to be the target of tsconfig.json's `references` (which is what makes
+    // editors check these files under THIS config instead of an inferred one). A composite project
+    // may not disable emit (TS6310), so it emits declarations only, into node_modules — nothing
+    // lands in the repo and nothing reaches the bundle. Hence `tsc -p` without --noEmit below.
+    "composite": true,
+    "declaration": true,
+    "emitDeclarationOnly": true,
+    "outDir": "./node_modules/.tmp/tsconfig-node",
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig-node/.tsbuildinfo",
     "target": "ES2022",
     "module": "ESNext",
     "moduleResolution": "bundler",
@@ -11,7 +20,6 @@
     "types": ["node"],
     "strict": true,
     "skipLibCheck": true,
-    "noEmit": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "resolveJsonModule": true