build: pin swag CLI to v1.16.6 and oauth2-proxy to v7.15.3, add backend/.dockerignore

[DoDiODev]

Summary

Make the backend container build inputs reproducible and shrink the Docker
build context. This is a low-risk infrastructure/tooling change with no
functional or runtime code changes.

• swag CLI pin → v1.16.6 across backend/Makefile, backend/Dockerfile
  and backend/Dockerfile.local, so local, CI and image builds all generate
  Swagger docs with the same tool version (previously v1.16.1).
• oauth2-proxy dev image pin → v7.15.3-amd64 in both
  docker-compose-dev-mysql.yml and docker-compose-dev-postgresql.yml
  (previously v7.4.0-amd64).
• New backend/.dockerignore keeping regenerated build artifacts out of
  the Docker build context: bin/, mocks/, logs/, Python venv/build
  output, coverage files and OS junk. Source under python/ is retained.

Explicitly out of scope

• No MySQL/PostgreSQL image bumps.
• No Node/nginx/npm or frontend lockfile changes.
• No Grafana or Python library changes.
• No Dockerfile.server / build-cache restructuring.

Automated tests / checks

• git diff --check clean (no whitespace errors).
• docker compose -f docker-compose-dev-mysql.yml config -q and the
  PostgreSQL equivalent validate successfully.
• docker build --check for backend/Dockerfile and
  backend/Dockerfile.local report no errors (only pre-existing
  FromAsCasing style warnings, unrelated to this change).
• swag init with v1.16.6 regenerates Swagger docs with no additional
  generated diff.

Manual testing

• Verified the effective pinned versions in the changed files.
• Confirmed the Docker build context excludes the regenerated artifacts via
  the new .dockerignore while retaining python/ sources.

Rollback

Revert this single commit; it only changes pinned tool/image versions and
adds a .dockerignore.

Known follow-ups / dependencies

Independent of other version-upgrade PRs. MySQL, PostgreSQL, Grafana, Python
and frontend bumps are handled in separate PRs.