fix(docker): pin shell scripts and Dockerfiles to LF

Same root cause as the backend fix: no .gitattributes plus core.autocrlf
meant docker/40-render-config.sh was checked out with CRLF on Windows and
copied into the image that way.

Less severe here than in the backend, because nginx's docker-entrypoint.sh
sources a non-executable file in /docker-entrypoint.d rather than exec'ing
it, so the CRLF shebang is not fatal. It is still wrong, and it puts the
config-rendering step one permission change away from failing the same
opaque way. Pinning it keeps both images consistent.

.gitattributes

@@ -0,0 +1,13 @@
+# Files that must keep LF regardless of the checkout platform.
+#
+# `core.autocrlf=true` is the Windows default, and `docker build` copies the
+# working tree into the image - so on a Windows checkout a CRLF shebang makes
+# the kernel look for an interpreter literally named "/bin/sh\r". That fails as
+# a bare "not found" with exit 127, which reads like a missing file rather than
+# a line-ending problem. CRLF also collapses backslash line continuations in a
+# Dockerfile RUN block.
+#
+# CI checks out on Linux and never saw this; only local builds break.
+*.sh        text eol=lf
+Dockerfile  text eol=lf
+Dockerfile.* text eol=lf