test(deploy): lock down image build context

next/tests/test_deployment_assets.py

@@ -44,3 +44,19 @@ def test_portainer_preflight_is_pinned_to_the_release_candidate() -> None:
     assert "546c5af1a3010bbf0cf37e5d8b1a440fe6dfbfe80b471cddf430d4363a7b1a4a" in manifest
     for expected in ("用户 | 3", "自选 | 6", "选股归档 | 107", "策略跟踪 | 16"):
         assert expected in manifest
+
+
+def test_image_context_excludes_private_and_non_runtime_assets() -> None:
+    ignored = {
+        line.strip()
+        for line in ROOT.joinpath(".dockerignore").read_text(encoding="utf-8").splitlines()
+        if line.strip() and not line.lstrip().startswith("#")
+    }
+    assert {".git", ".venv", "data", ".env", "docs/evidence", "tests"} <= ignored
+
+    dockerfile = ROOT.joinpath("Dockerfile").read_text(encoding="utf-8")
+    assert "COPY . " not in dockerfile
+    assert "COPY backend/ ./backend/" in dockerfile
+    assert "COPY config/ ./config/" in dockerfile
+    assert "COPY tools/ ./tools/" in dockerfile
+    assert "COPY --from=frontend-build /build/frontend/dist ./frontend/dist" in dockerfile