fix: publish and use production Docker image (#393)

## Summary
  - publish a GHCR production image built from `Dockerfile.production`
- point production Docker Compose and Coolify template to `:production`
- add `.dockerignore` so host `.env`, `vendor`, and `node_modules` do
not leak into image builds
  - clarify Docker self-hosting docs and Compose log command

  ## Verification
- `docker build -f Dockerfile.production -t
whisper-money:production-test .`
  - `docker compose -f docker-compose.production.yml config --images`
  - `vendor/bin/pint --dirty --format agent`
  - `vendor/bin/pest tests/Unit/DockerProductionImageTest.php`

---------

Co-authored-by: Víctor Falcón <victoor89@gmail.com>

.dockerignore

@@ -0,0 +1,32 @@
+.git
+.github
+.agents
+.claude
+.cursor
+.opencode
+.pi
+
+.env
+.env.*
+!.env.example
+!.env.production.example
+
+node_modules
+vendor
+
+storage/app/*
+storage/framework/cache/*
+storage/framework/sessions/*
+storage/framework/views/*
+storage/logs/*
+!storage/app/.gitignore
+!storage/framework/cache/.gitignore
+!storage/framework/sessions/.gitignore
+!storage/framework/views/.gitignore
+!storage/logs/.gitignore
+
+Dockerfile
+Dockerfile.*
+docker-compose*.yml
+
+screenshots

.github/workflows/ci.yml

@@ -338,6 +338,11 @@ jobs:
               - 'docker/**'
               - '.dockerignore'
               - '.env.example'
+              - '.env.production.example'
+              - 'docker-compose.production.yml'
+              - 'docker-compose.production.local.yml'
+              - 'templates/coolify/**'
+              - '.github/workflows/ci.yml'
 
   build-image:
     runs-on: ubuntu-latest
@@ -392,7 +397,21 @@ jobs:
             type=sha,prefix=
             type=raw,value=latest
 
-      - name: Build and push
+      - name: Extract package version
+        id: package-version
+        run: node -e "console.log('version=' + require('./package.json').version)" >> "$GITHUB_OUTPUT"
+
+      - name: Extract production metadata
+        id: production-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=sha,prefix=,suffix=-production
+            type=raw,value=production
+            type=raw,value=v${{ steps.package-version.outputs.version }}-production
+
+      - name: Build and push development image
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -405,6 +424,20 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Build and push production image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.production
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.production-meta.outputs.tags }}
+          labels: ${{ steps.production-meta.outputs.labels }}
+          build-args: |
+            SENTRY_RELEASE=${{ env.SENTRY_RELEASE }}
+          cache-from: type=gha,scope=production
+          cache-to: type=gha,mode=max,scope=production
+
   deploy:
     runs-on: ubuntu-latest
     needs: [build-image, changes]