Cut the node_modules prose to one home each; drop a stray tracked file

Dockerfile

@@ -1,18 +1,16 @@
 # Node 24 runs TypeScript directly (type stripping) — no build step. Pinned exact tag.
 FROM node:24.19.0-alpine3.24
 
-# Deps land at /node_modules, one level above WORKDIR: Node resolves upward, so dev's `.:/app`
-# bind mount cannot shadow them. Mounting a volume at /app/node_modules instead has the daemon
-# create that destination in the developer's own checkout, root-owned whatever user runs the
-# container. Reproducible install from the lockfile; dev deps kept so typecheck/test run in-image.
+# Above WORKDIR so dev's `.:/app` bind mount can't shadow them; a volume at /app/node_modules
+# instead leaves a root-owned dir in the checkout (the daemon creates mount destinations as root).
+# Dev deps kept so typecheck/test run in-image.
 COPY package.json package-lock.json .npmrc /deps/
 RUN cd /deps && npm ci && mv node_modules /node_modules && rm -rf /deps
 
 WORKDIR /app
 COPY . .
 
-# Lockfile edits run as the host user (README → Extending the core) so the rewritten files stay
-# theirs; that uid has no home in this image, and npm's default cache would land in unwritable /.
+# The host uid running a lockfile edit has no home here, so npm's cache would land in unwritable /.
 ENV npm_config_cache=/tmp/.npm
 ENV PORT=3000
 EXPOSE 3000