fix(api): constrain disposition_overrides keys; close docker paper cuts

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

api/.dockerignore

@@ -1,16 +0,0 @@
-# Keep the build context small and secrets out of the image.
-.env
-.env.*
-__pycache__/
-*.py[cod]
-.venv/
-venv/
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
-.coverage
-htmlcov/
-docs/
-README.md
-Dockerfile
-.dockerignore

api/tests/test_content_resolution.py

@@ -38,3 +38,10 @@ def test_null_quest_ref_resolves():
     origin = copy.deepcopy(load_origin(DESERTER))
     origin["start_quest_id"] = None
     assert unresolved_refs(origin, world) == []
+
+
+def test_broken_disposition_npc_ref_is_detected():
+    world = load_world(CONTENT_ROOT)
+    origin = copy.deepcopy(load_origin(DESERTER))
+    origin["disposition_overrides"]["ghost_npc"] = 10
+    assert "npc:ghost_npc" in unresolved_refs(origin, world)

api/tests/test_origin_schema.py

@@ -46,3 +46,9 @@ def test_extra_field_is_rejected():
     doc = copy.deepcopy(VALID_ORIGIN)
     doc["surprise"] = True
     assert validate_origin(doc) != []
+
+
+def test_disposition_override_key_must_match_id_pattern():
+    doc = copy.deepcopy(VALID_ORIGIN)
+    doc["disposition_overrides"] = {"Brannoc Thane": 40}
+    assert validate_origin(doc) != []