Root .dockerignore still copies unrelated trees into every service's build context

[mushrafmim]

Current Limitation

Flagged by @ginaxu1 on PR #517 as a follow-up (not blocking that PR). The root .dockerignore excludes some non-Go trees (portals/, audit-service/, observability/, docs, etc.) but still lets tests/, exchange/, and each service's own source under cmd/*/internal/* into every Docker build context. Each service's runtime image is binary-only, so this is unnecessary weight/cache invalidation on every build.

Suggested Improvement

Exclude tests/ and exchange/ (once fully retired) from the root .dockerignore. Note that cmd/*/internal/* can't simply be blanket-excluded per sibling service the way the comment suggests, since .dockerignore applies globally to the whole build context regardless of which service's Dockerfile is building — excluding e.g. cmd/ce would also break cmd/ce's own Docker build. Reducing the per-service copy would need each Dockerfile to COPY only its own cmd/<x> + internal/<x> + shared internal/* paths explicitly instead of relying on COPY . ..

Version

commit 431af58 (cmd/pb + internal/pb root-module migration, PR #517)

Additional Context

See PR #517 review discussion: #517