chore: phase 0 reproducible docker/dev setup with version pinning

backend/Dockerfile

@@ -4,7 +4,14 @@
 FROM python:3.12-slim
 
 ENV PYTHONUNBUFFERED=1 \
-    PIP_NO_CACHE_DIR=1
+    PIP_NO_CACHE_DIR=1 \
+    # Venv + managed Python live outside the repo bind-mount: a venv under
+    # backend/ used to be shadowed by a named volume (empty on first start)
+    # and backed by a root-owned interpreter vscode could not execute.
+    # /opt is image-local, world-readable, identical in dev and prod.
+    UV_PYTHON_INSTALL_DIR=/opt/python \
+    UV_PROJECT_ENVIRONMENT=/opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
@@ -14,7 +21,9 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends sudo openssh-client \
     && rm -rf /var/lib/apt/lists/* \
     && useradd -m -s /bin/bash vscode \
-    && echo "vscode ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/vscode
+    && echo "vscode ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/vscode \
+    && mkdir -p /opt/python /opt/venv \
+    && chmod 755 /opt/python /opt/venv
 
 WORKDIR /srv/kirche-einfach/backend
 COPY pyproject.toml alembic.ini entrypoint.sh ./
@@ -23,7 +32,8 @@ COPY migrations ./migrations
 COPY scripts ./scripts
 # No lockfile is committed; dependencies resolve at build time.
 # Full groups (incl. dev): pytest and friends must work in dev with zero steps.
-RUN uv sync && chmod +x entrypoint.sh
+# a+rX: the image builds as root, but the attached devcontainer runs as vscode.
+RUN uv sync && chmod +x entrypoint.sh && chmod -R a+rX /opt/python /opt/venv
 
 ENV FLOWS_WATCH_ENABLED=true
 EXPOSE 8000