chore: phase 0 reproducible docker/dev setup with version pinning

backend/Dockerfile

@@ -4,7 +4,14 @@
 FROM python:3.12-slim
 
 ENV PYTHONUNBUFFERED=1 \
-    PIP_NO_CACHE_DIR=1
+    PIP_NO_CACHE_DIR=1 \
+    # Venv + managed Python live outside the repo bind-mount: a venv under
+    # backend/ used to be shadowed by a named volume (empty on first start)
+    # and backed by a root-owned interpreter vscode could not execute.
+    # /opt is image-local, world-readable, identical in dev and prod.
+    UV_PYTHON_INSTALL_DIR=/opt/python \
+    UV_PROJECT_ENVIRONMENT=/opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
@@ -14,7 +21,9 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends sudo openssh-client \
     && rm -rf /var/lib/apt/lists/* \
     && useradd -m -s /bin/bash vscode \
-    && echo "vscode ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/vscode
+    && echo "vscode ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/vscode \
+    && mkdir -p /opt/python /opt/venv \
+    && chmod 755 /opt/python /opt/venv
 
 WORKDIR /srv/kirche-einfach/backend
 COPY pyproject.toml alembic.ini entrypoint.sh ./
@@ -23,7 +32,8 @@ COPY migrations ./migrations
 COPY scripts ./scripts
 # No lockfile is committed; dependencies resolve at build time.
 # Full groups (incl. dev): pytest and friends must work in dev with zero steps.
-RUN uv sync && chmod +x entrypoint.sh
+# a+rX: the image builds as root, but the attached devcontainer runs as vscode.
+RUN uv sync && chmod +x entrypoint.sh && chmod -R a+rX /opt/python /opt/venv
 
 ENV FLOWS_WATCH_ENABLED=true
 EXPOSE 8000

backend/entrypoint.sh

@@ -6,10 +6,18 @@ set -e
 
 cd /srv/kirche-einfach/backend
 
-.venv/bin/alembic upgrade head
+# Runtime SQLite file lives in the bind-mount: ensure the dir exists and is
+# owned by vscode (the entrypoint runs as root, but the editor runs as
+# vscode — a root-owned data/ dir made the DB unwritable).
+mkdir -p data
+if id vscode >/dev/null 2>&1; then
+  chown -R vscode:vscode data 2>/dev/null || true
+fi
+
+/opt/venv/bin/alembic upgrade head
 
 if [ "${APP_ENV:-prod}" = "dev" ]; then
-  exec .venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload
+  exec /opt/venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload
 else
-  exec .venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000
+  exec /opt/venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000
 fi

backend/pyproject.toml

@@ -27,7 +27,9 @@ testpaths = ["tests"]
 
 [dependency-groups]
 dev = [
-    "lfx",
+    # Pinned to the Langflow minor (contract: major.minor must match).
+    # Bump together with LANGFLOW_VERSION (.env.example) + Dockerfile.lfx.
+    "lfx~=1.12.0",
     "pytest>=8",
     "pytest-asyncio>=0.24",
     "pytest-cov>=6",