chore: phase 0 reproducible docker/dev setup with version pinning

frontend/entrypoint.sh

@@ -6,6 +6,12 @@ set -e
 
 cd /srv/kirche-einfach/frontend
 
+# node_modules lives in the repo bind-mount (no named volume by design):
+# install on first start after a fresh checkout (dev and prod).
+if [ ! -x "node_modules/.bin/vite" ]; then
+  npm ci
+fi
+
 if [ "${FRONTEND_MODE:-dev}" = "dev" ]; then
   exec npm run dev -- --host 0.0.0.0 --port 3000
 else