fix(build): pin pnpm to packageManager version and allow its native builds

An unpinned 'npm i -g pnpm' drifted to pnpm 12, which hard-errors on
unapproved build scripts (ERR_PNPM_IGNORED_BUILDS) for esbuild/sharp/
unrs-resolver. Pin 10.33.0 (matching the packageManager field), approve
those three via pnpm.onlyBuiltDependencies, install with
--frozen-lockfile, and add a .dockerignore so local node_modules can
never ride into the build. Also refresh uv.lock to latest.

.dockerignore

@@ -0,0 +1,23 @@
+.git
+.gitignore
+.dockerignore
+.gitea
+.github
+.idea
+.mise.toml
+mise.toml
+.docker
+Dockerfile
+docker-compose.yaml
+justfile
+**/node_modules
+**/dist
+**/.next
+**/out
+mta-sign-ui/out
+.venv
+**/__pycache__
+.pytest_cache
+.ruff_cache
+*.pyc
+attachments