fix(showcase/shell-docs): guard ag-ui + reference filesystem reads against path traversal

The ag-ui and reference catch-all routes accept arbitrary URL segments
and feed them directly to path.join(CONTENT_DIR, slugPath) + fs.readFileSync.
A crafted request like /ag-ui/..%2F..%2Fsecrets decodes to a slugPath
that path.join happily resolves outside CONTENT_DIR, leaking arbitrary
files on disk.

Route every user-controlled filesystem access through the existing
safe-fs helpers (resolveWithinDir / safeReadFileSync) so escapes
return a safe miss and fall through to notFound().

.dockerignore

@@ -7,11 +7,15 @@ assets
 Dockerfile
 **/.venv
 **/.env
+**/.env.local
+**/.env.*.local
 **/.vscode
 infra
 docs
 **/.turbo
 **/.husky
+**/.next
+**/coverage
 **/dist
 **/build
 **/__pycache__
@@ -19,4 +23,5 @@ docs
 **/.git
 **/.DS_Store
 **/node_modules
-**/.langgraph_api
+**/.langgraph_api
+**/*.log