Fix Docker image bloat: exclude local venvs from build context, move transformers.js to devDependencies.

docs/WorkBreakdown.md

@@ -204,13 +204,16 @@ Notes (M5):
   boundaries), and cancel by aborting the fetch (D-018 amendment) — browser
   runs keep worker-termination cancel. The choice persists in localStorage
   but only takes effect while signed in with the engine available.
-- Deployment: multi-stage `Dockerfile` — `runtime` (Bun-only, 244 MB) is the
-  default target so plain `docker build .` (existing CI) is unchanged;
-  `--target with-server-engine` (405 MB) adds python3 + faster-whisper in a
-  venv at `/opt/faster-whisper` (wired via `SIDECAR_PYTHON`), with
-  `FASTER_WHISPER_DOWNLOAD_ROOT` under the `/app/data` volume so weights
-  persist. README.md documents both flavors, all runtime env vars, the DB
-  volume, and the HTTPS/reverse-proxy requirement. Verified live in Docker:
+- Deployment: multi-stage `Dockerfile` — `runtime` (Bun-only, ~400-450 MB, see
+  D-031) is the default target so plain `docker build .` (existing CI) is
+  unchanged; `--target with-server-engine` (several GB — two Whisper models
+  pre-downloaded at build time, D-031) adds python3 + faster-whisper in a venv
+  at `/opt/faster-whisper` (wired via `SIDECAR_PYTHON`), with
+  `FASTER_WHISPER_DOWNLOAD_ROOT` pointed at `/opt/faster-whisper/models`
+  (deliberately outside the `/app/data` volume, D-031) so weights persist
+  without a volume and there's no first-request download. README.md documents
+  both flavors, all runtime env vars, the DB volume, and the HTTPS/reverse-proxy
+  requirement. Verified live in Docker:
   Bun-only image degrades per D-013 (`available:false`, "python3 is not
   available…"); server-engine image ran a real `POST /api/transcribe` of
   `en_aiproblem.m4a` end-to-end, streamed segments matching the fixture
@@ -271,7 +274,21 @@ Notes (M5):
       explicit Download button and the lazy auto-load on file-drop/live-start
       alike.
 - [ ] Basic a11y pass (keyboard, focus, aria on progress/live transcript)
-- [ ] Production build + `bun start` deployment check; README for deployers
+- [x] Production build + `bun start` deployment check; README for deployers —
+      `bun run build` + `bun start` smoke-tested live (headers, hashed-asset
+      immutability, `/api/*` routing, `AUTH_ENABLED=false`, server-engine
+      graceful degradation all matched the README's claims). A real
+      `docker build .` from this checkout also caught two real bugs (D-031):
+      local Python venvs leaking into the image (858 MB, via a nested
+      `.gitignore` `.dockerignore` doesn't read) and `@huggingface/transformers`
+      +`onnxruntime-node`/`-web` (341 MB) sitting in the production
+      `dependencies` despite never being imported at server runtime — both
+      fixed, bringing the Bun-only image from a buggy 2.18 GB down to ~421 MB.
+      Also corrected stale docs: the with-server-engine image is legitimately
+      several GB (it bakes in two Whisper models at build time), and
+      `FASTER_WHISPER_DOWNLOAD_ROOT`'s real default in that image is
+      `/opt/faster-whisper/models`, not under `/app/data` as previously
+      written.
 
 ## M7 — Live microphone transcription (browser engine, D-016)
 Promoted out of the out-of-scope list via D-016. Browser engine only: audio