chore: add vitest, commit the lockfile, fix gitignore and docker install

Groundwork before pulling logic out of App.svelte.

Vitest runs in a node environment. Nothing under test needs a DOM, because
every module takes its dependencies as arguments.

package-lock.json is tracked now and the Dockerfile installs with npm ci,
so the nightly rebuild can't quietly land on different versions.

.gitignore: .DS_Store was anchored to the root and missed nested copies,
and dist/ wasn't ignored at all.

Dockerfile

@@ -6,8 +6,8 @@ WORKDIR /app
 # Copy package files
 COPY package*.json ./
 
-# Install dependencies with proper optional dependency handling for Alpine/musl
-RUN npm install --include=optional
+# Install from the committed lockfile so builds are reproducible
+RUN npm ci --include=optional
 
 # Copy source code
 COPY . .