chore: address simplify findings

- Drop redundant `npm cache clean --force` after `npm ci` (no-op).
- Add `*.log`, `.env.*`, `coverage`, `.vitest-cache` to .dockerignore.
- Add isSecretRef test for bare `var:` (undefined) in YAML.

Author: yerzhansa

.dockerignore

@@ -21,9 +21,15 @@ scripts
 
 # Local secrets / configs
 .env
+.env.*
 .env.example
 CLAUDE.local.md
 
+# Local artifacts
+*.log
+coverage
+.vitest-cache
+
 # Repo metadata not needed in image
 README.md
 CONTRIBUTING.md

Dockerfile

@@ -19,7 +19,7 @@ ENV NODE_ENV=production
 ENV CYCLING_COACH_HOME=/data
 
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev && npm cache clean --force
+RUN npm ci --omit=dev
 
 COPY --from=builder /app/dist ./dist
 COPY SOUL.md ./SOUL.md

tests/secrets/types.test.ts

@@ -69,6 +69,10 @@ describe("isSecretRef", () => {
   it("rejects env shape missing var", () => {
     expect(isSecretRef({ source: "env" })).toBe(false);
   });
+
+  it("rejects env shape with undefined var (e.g., bare 'var:' in YAML)", () => {
+    expect(isSecretRef({ source: "env", var: undefined })).toBe(false);
+  });
 });
 
 describe("SecretResolutionError", () => {