fix(api): constrain disposition_overrides keys; close docker paper cuts

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

api/.dockerignore

@@ -1,16 +0,0 @@
-# Keep the build context small and secrets out of the image.
-.env
-.env.*
-__pycache__/
-*.py[cod]
-.venv/
-venv/
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
-.coverage
-htmlcov/
-docs/
-README.md
-Dockerfile
-.dockerignore

api/tests/test_content_resolution.py

@@ -38,3 +38,10 @@ def test_null_quest_ref_resolves():
     origin = copy.deepcopy(load_origin(DESERTER))
     origin["start_quest_id"] = None
     assert unresolved_refs(origin, world) == []
+
+
+def test_broken_disposition_npc_ref_is_detected():
+    world = load_world(CONTENT_ROOT)
+    origin = copy.deepcopy(load_origin(DESERTER))
+    origin["disposition_overrides"]["ghost_npc"] = 10
+    assert "npc:ghost_npc" in unresolved_refs(origin, world)

api/tests/test_origin_schema.py

@@ -46,3 +46,9 @@ def test_extra_field_is_rejected():
     doc = copy.deepcopy(VALID_ORIGIN)
     doc["surprise"] = True
     assert validate_origin(doc) != []
+
+
+def test_disposition_override_key_must_match_id_pattern():
+    doc = copy.deepcopy(VALID_ORIGIN)
+    doc["disposition_overrides"] = {"Brannoc Thane": 40}
+    assert validate_origin(doc) != []

docker-compose.yml

@@ -10,7 +10,8 @@ services:
     ports:
       - "8000:8000"
     env_file:
-      - ./api/.env
+      - path: ./api/.env
+        required: false
     environment:
       PORT: 8000
     # Mount source + schemas so edits are live without a rebuild.

docs/schemas/origin.schema.json

@@ -20,6 +20,7 @@
     "opening_facts": { "type": "array", "items": { "type": "string", "minLength": 1 } },
     "disposition_overrides": {
       "type": "object",
+      "propertyNames": { "pattern": "^[a-z0-9_]+$" },
       "additionalProperties": { "type": "integer", "minimum": -100, "maximum": 100 }
     },
     "inventory_grants": {