feat: quick wins - dockerignore, env secrets, gzip, cache-control

- Add .dockerignore to exclude .git, __pycache__, docs, etc. from Docker context
- Create .env.example template with documented env vars
- Move OBSIGATE_ADMIN_PASSWORD from docker-compose.yml to env_file: .env
- Add .env.* to .gitignore (excluding .env.example)
- Enable GZipMiddleware for ~70% bandwidth reduction on text responses
- Add Cache-Control: immutable for /static/ assets
- Update ROADMAP: mark all 4 quick wins as done, add audit findings
- Add comprehensive technical audit report (AUDIT_TECHNIQUE_2026-05-27.md)

backend/main.py

@@ -490,6 +490,9 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
             "connect-src 'self' https://esm.sh https://unpkg.com https://cdnjs.cloudflare.com https://fonts.googleapis.com https://fonts.gstatic.com; "
             "font-src 'self' https://fonts.gstatic.com;"
         )
+        # Cache static assets aggressively (fingerprinted by PWA manifest hash)
+        if request.url.path.startswith("/static/"):
+            response.headers["Cache-Control"] = "public, max-age=31536000, immutable"
         return response
 
 
@@ -552,6 +555,10 @@ async def lifespan(app: FastAPI):
 
 app = FastAPI(title="ObsiGate", version="1.4.0", lifespan=lifespan)
 
+# GZip compression — reduces bandwidth by ~70% for text responses
+from fastapi.middleware.gzip import GZipMiddleware
+app.add_middleware(GZipMiddleware, minimum_size=1000)
+
 # Security headers on all responses
 app.add_middleware(SecurityHeadersMiddleware)