Build: imagen autocontenida, .dockerignore y limpieza de requirements

- Dockerfile copia el proyecto Django, no la raiz del repo, para que
  manage.py y wsgi.py queden donde gunicorn los espera
- collectstatic en tiempo de construccion y CMD en la imagen
- .dockerignore: evita que .env, .git y artefactos locales entren en la imagen
- requirements.txt sin BOM

.dockerignore

@@ -0,0 +1,27 @@
+# Secrets — these must never end up in an image layer.
+.env
+db.env
+*.env
+!.env.example
+
+# Version control and IDE noise.
+.git
+.gitignore
+.vscode
+.idea
+
+# Local artifacts that would otherwise be copied in by COPY.
+__pycache__/
+*.py[cod]
+*.bak
+venv/
+.venv/
+db.sqlite3
+staticfiles/
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Documentation and planning, not needed at runtime.
+*.md
+LICENSE

.gitignore

@@ -129,6 +129,7 @@ venv/
 ENV/
 env.bak/
 venv.bak/
+db.env
 
 # Spyder project settings
 .spyderproject
@@ -161,3 +162,5 @@ cython_debug/
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
 
+staticfiles/
+*.bak

Dockerfile

@@ -0,0 +1,31 @@
+FROM python:3.11-slim
+
+# Fail fast and log straight to stdout, so `docker-compose logs` is useful.
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+# Dependencies first: this layer is cached and only rebuilt when
+# requirements.txt changes, not on every code change.
+COPY expenses_manager/requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy the Django project itself, not the repository root, so that /app is
+# the directory holding manage.py. The previous version copied the repo root
+# into /app/expenses_manager, which left manage.py and wsgi.py one level
+# deeper than the gunicorn command expected.
+COPY expenses_manager/ .
+
+# Collect static files at build time so the running container never needs to
+# write to its own filesystem. SECRET_KEY is required by settings.py when
+# DEBUG is False, but collectstatic never uses it, so a throwaway value is
+# enough — the real one comes from the environment at runtime.
+RUN SECRET_KEY=build-time-placeholder \
+    DEBUG=False \
+    ALLOWED_HOSTS=localhost \
+    python manage.py collectstatic --noinput
+
+EXPOSE 8000
+
+CMD ["gunicorn", "expenses_manager.wsgi:application", "--bind", "0.0.0.0:8000"]