.dockerignore: let moments.js into the image; guard test checks the allowlist too

f38f218 failed to build: .dockerignore is an allowlist and kept
moments.js out of the build context. Verified by building the image and
starting the reader from it (health ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -10,6 +10,7 @@
 !backup.js
 !reading-analytics.js
 !reading-access.js
+!moments.js
 !public/
 !public/**
 !greatest/

test/dockerfile.test.js

@@ -18,5 +18,10 @@ test('every top-level module the reader requires is copied into the image', () =
       else pending.push(name + '.js');
     }
   }
-  for (const file of seen) assert.ok(copied.has(file), `${file} is required but not copied by the Dockerfile`);
+  // .dockerignore is an allowlist too: a file not let through never reaches COPY.
+  const allowed = new Set(fs.readFileSync(path.join(root, '.dockerignore'), 'utf8').split(/\r?\n/).filter(line => line.startsWith('!')).map(line => line.slice(1)));
+  for (const file of seen) {
+    assert.ok(copied.has(file), `${file} is required but not copied by the Dockerfile`);
+    assert.ok(allowed.has(file), `${file} is required but not allowed through .dockerignore`);
+  }
 });