Fix Docker BuildKit secrets warnings for secure builds

[nicholaspsmith]

Summary

This PR fixes Docker BuildKit security warnings (SecretsUsedInArgOrEnv and LegacyKeyValueFormat) by improving secret handling and configuration format in the Dockerfile.

Changes

1. BuildKit secrets for sensitive data: Using BuildKit secrets for SENTRY_AUTH_TOKEN instead of build-args, ensuring sensitive tokens are not baked into image layers or build cache
2. Placeholder for runtime secrets: API_KEY_ENCRYPTION_SECRET uses a placeholder at build time with the real value injected at runtime via environment variables
3. Fixed legacy ENV format: Updated all ENV statements to use modern key=value format instead of separate key value declarations

Why This Matters

• Security: Sensitive credentials are mounted as secrets during build only, not stored in image history
• Best practices: Follows Docker and BuildKit security recommendations for handling credentials
• Clean builds: Eliminates Docker build warnings about secret usage and environment format

Test Plan

• Docker image builds successfully without warnings
• Verify Sentry integration still works in production
• Confirm API key encryption works at runtime
• Test local development build with docker-compose

🤖 Generated with Claude Code