Give the web server its own .env, where PORT means its port

The previous commit made `pnpm --filter web start` load the repository-root
.env, which was the wrong file: Strapi reads a bare PORT as well
(apps/cms/config/server.ts uses env.int('PORT', 1337)), so one value there
would have moved the CMS onto the website's port the moment anyone exported
it - and the root .env is docker compose's file, whose WEB_PORT is a
published host port, not a listen port.

The web app now loads apps/web/.env, the way Strapi already loads
apps/cms/.env. PORT and HOST are per-application because they mean something
different to each server. apps/web/.env.example documents them together with
SITE_URL, STRAPI_URL and STRAPI_TOKEN, and warns against the VITE_ prefix,
which would inline a value into the client bundle - STRAPI_TOKEN lives in
that file.

Still no default port: with PORT unset, react-router-serve keeps its own
behaviour of taking the first free port from 3000 upwards. A real
environment variable wins over the file, so a systemd unit or a container
that injects PORT is unaffected.

.dockerignore now excludes .env at every depth, not only at the root.
`COPY apps/web ./apps/web` would otherwise have baked a developer's
apps/web/.env - STRAPI_TOKEN included - into the image.

Verified against the existing build: PORT=8140 HOST=127.0.0.1 in
apps/web/.env listens on 127.0.0.1:8140, and PORT=8141 in the environment
overrides the file while HOST still comes from it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -14,10 +14,12 @@ apps/cms/.strapi
 apps/cms/.tmp
 apps/cms/.cache
 
-# Secrets. The containers receive their environment from docker compose.
-.env
-.env.*
-!.env.example
+# Secrets. The containers receive their environment from docker compose, so no
+# .env belongs in an image - including the per-application ones (apps/web/.env,
+# apps/cms/.env), which COPY apps/web / COPY apps/cms would otherwise pick up.
+**/.env
+**/.env.*
+!**/.env.example
 
 # Licensed fonts are mounted or copied in at deploy time, never baked into a
 # published image. See the FONTS section of README.md.