[Sebas1705]

Phase 1 items 3, 6, 7 for the Backoffice web app.

Changes

• Dockerfile.dockerignore (new): CI builds from the workspace root (the checkout lives at backoffice/), and this repo had no ignore file at all, so .git, local .env*, node_modules, docs and e2e specs all went into the context. BuildKit reads this file because it is named after the Dockerfile; patterns are relative to the context root and exclude .git, .env* (keeping .env.example), node_modules, dist, coverage, *.tsbuildinfo, Playwright output, e2e and docs. Unit tests under src/src are kept because tsc -b type-checks them.
• Node 20 -> 22 in Dockerfile and ci.yml (both jobs). No engines field exists.
• Workflows: concurrency (cancel-in-progress only for pull_request) and timeout-minutes on every job of ci.yml and security.yml. No docker/build-push-action or never-building trigger exists in this repo.

Verified locally

• docker build -f backoffice/Dockerfile from a workspace-root context with the checkout under backoffice/ (includes tsc -b and vite build on Node 22): succeeds, nginx image contains the built assets and config.js; context is ~1.5 MB. A planted src/.env.production was in the context directory during that build.
• npm ci + vitest run inside a node:22 container: 144/144 tests pass (on Node 24 one locale-dependent test, service-console-panel.integration, fails on an unchanged main source; not related to this PR).

Not verified

• The Actions workflow changes were not run locally; this PR's checks exercise them.
• I did not prove from inside the image that the planted .env.production was excluded, only that the build succeeds and the context size shrank.
• The backoffice/ (lowercase) path in the Dockerfile is unchanged.
• Item 8 (docs) and npm install -> npm ci are left for a separate PR.

Overlap

No open PRs known to touch these files.