Remove .env from Docker image, replace copy button with save

- Remove COPY .env from Dockerfile and add .env to .dockerignore
so secrets are injected at runtime instead of baked into the image
- Replace clipboard copy with file download (Save button) that
exports the review as a named .md file

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.dockerignore

@@ -1,5 +1,5 @@
 node_modules/
-.env*
 .git/
 .claude/
 .DS_Store
+.env

public/app.js

@@ -312,14 +312,22 @@ function buildMarkdownExport() {
   return output.trim();
 }
 
-copyBtn.addEventListener("click", async () => {
+saveBtn.addEventListener("click", () => {
   const markdown = buildMarkdownExport();
-  try {
-    await navigator.clipboard.writeText(markdown);
-    showToast();
-  } catch (err) {
-    console.error("Copy failed:", err);
-  }
+  const filename = `${metaRepo.textContent.replace(/\//g, '-')}-${metaPath.textContent.split('/').pop()}-${brutalityLevel}.md`;
+  
+  const blob = new Blob([markdown], { type: 'text/markdown' });
+  const url = URL.createObjectURL(blob);
+  
+  const a = document.createElement('a');
+  a.href = url;
+  a.download = filename;
+  document.body.appendChild(a);
+  a.click();
+  document.body.removeChild(a);
+  URL.revokeObjectURL(url);
+  
+  showToast();
 });
 
 function showToast() {

public/index.html

@@ -268,7 +268,7 @@
         <button class="tab" data-section="security">Security</button>
         <button class="tab" data-section="suggestions">Suggestions</button>
         <button class="tab" data-section="verdicts">Verdicts</button>
-        <button type="button" id="copy-btn" hidden>Copy Review</button>
+        <button type="button" id="save-btn" hidden>Save</button>
       </nav>
       <div id="tab-content" class="tab-content"></div>
     </div>