[KARLalpha4768]

Changes

• ARCH-01: src/cpp/photometry.cpp stays canonical; src/photometry.cpp becomes a thin include so the legacy Docker build still compiles.
• DEPLOY-04: root .dockerignore for git metadata, env files, venvs, node_modules, caches, tests, DBs, secrets/keys, CMake output.
• CI-01: CI installs pytest, runs a repo-wide fatal-error ruff lint (excluding the known-invalid ascom_hal.py, fixed in Fix HIGH correctness bugs CORR-01..05 #5), runs pytest -q, and fails unknown CMake errors (only missing-CUDA is tolerated).
• TEST-01: test_science_modules.py uses production OrbitalElements / OrbitPropagator.propagate instead of local toy math.

Tests

• tests/test_build_hygiene.py.

Not verified

• No C++ compiler was run for the forwarding include; CI workflow not yet run on GitHub (this PR's own run is the first check). The CI requirements.txt install must provide test deps.

Verification

• Full suite with the new tests passes locally on this branch (25 existing + new tests, pytest on Windows, Python venv).
• py_compile clean; ruff fatal-error lint (E9,F63,F7,F82) clean.
• Does not touch files owned by open PRs Move Cesium token, API key and DB DSN to environment variables #1-Fix HIGH correctness bugs CORR-01..05 #5.

Drafted by Codex from the medium/low review findings; split and re-verified per branch.