Static musl release image, and fix JWT verification broken by #28

.dockerignore

@@ -1,2 +1,9 @@
 .git
-target
+target
+
+# Local devbox toolchain (~1.3GB). It self-ignores via .devbox/.gitignore, which
+# .dockerignore does not honour, so it has to be excluded explicitly.
+.devbox
+.envrc
+devbox.json
+devbox.lock

.github/workflows/rust.yml

@@ -20,10 +20,10 @@ jobs:
         uses: actions/checkout@v4
 
       - name: build
-        run: cargo build --release
+        run: cargo build --release --locked --workspace
 
       - name: test
-        run: cargo test
+        run: cargo test --workspace
 
   docker:
     name: push docker image to hub

.gitignore

@@ -1,2 +1,3 @@
 target
 .DS_Store
+.envrc