feat: quick wins - dockerignore, env secrets, gzip, cache-control

- Add .dockerignore to exclude .git, __pycache__, docs, etc. from Docker context
- Create .env.example template with documented env vars
- Move OBSIGATE_ADMIN_PASSWORD from docker-compose.yml to env_file: .env
- Add .env.* to .gitignore (excluding .env.example)
- Enable GZipMiddleware for ~70% bandwidth reduction on text responses
- Add Cache-Control: immutable for /static/ assets
- Update ROADMAP: mark all 4 quick wins as done, add audit findings
- Add comprehensive technical audit report (AUDIT_TECHNIQUE_2026-05-27.md)

docker-compose.yml

@@ -41,8 +41,10 @@ services:
       - VAULT_5_PATH=/vaults/SessionsManager
       - DIR_1_NAME=Bruno
       - DIR_1_PATH=/vaults/bruno
-      # Auth configuration (uncomment to enable)
+      # Auth configuration (edit values in .env file)
       - OBSIGATE_AUTH_ENABLED=true
       - OBSIGATE_ADMIN_USER=admin
-      - OBSIGATE_ADMIN_PASSWORD=chab30 # Leave empty = auto-generated (check logs)
+      # OBSIGATE_ADMIN_PASSWORD → définir dans .env (pas ici !)
       # - OBSIGATE_SECURE_COOKIES=false  # Set true if behind HTTPS reverse proxy
+    env_file:
+      - .env