Fix web/Dockerfile dropping two of its three VITE_* build args

Only VITE_API_BASE_URL had a matching ARG/ENV pair; docker-compose.yml's
build args for VITE_ALERTING_API_BASE_URL and
VITE_ENTERPRISE_AUTH_BASE_URL were silently dropped by Docker (an
undeclared --build-arg is dropped, not an error). enterpriseAuthBase
came out undefined in the built bundle, so the tenant-picker page threw
"enterprise-auth is not configured" against a real running container
even though docker-compose.yml looked correct. The other two vars masked
this because web/src/lib/api.ts's apiBase/alertingBase both have
hardcoded fallbacks that happen to match the intended values.

Found while wiring a real Auth0 developer tenant into enterprise-auth to
close §3a/§12's remaining "real external IdP" gap. Also gitignores
docker-compose.override.yml, since that's where such real credentials
belong for local testing -- never committed.

.gitignore

@@ -22,6 +22,10 @@ web/.svelte-kit/
 # Dev-only generated secrets
 hack/dev-certs/out/
 
+# Local overrides that may carry real credentials (e.g. a real OIDC/SAML
+# dev-tenant client secret for manual SSO testing) -- never committed.
+docker-compose.override.yml
+
 # OS / editor
 .DS_Store
 Thumbs.db