refactor: finish declutter - test_flow removal, NOT NULL schema, parametrized tests, smoke harness, docs

README.md

@@ -24,9 +24,12 @@ needs judgment. Every step is documented and traceable.
   can automatically start a follow-up ("continuation") flow.
 - **Access management** — public landing page (German) with an access-request
   form (request + approval). Approved users get a passwordless magic-link
-  invite by email (SMTP via `.env`); sessions are HttpOnly cookies, tenants
-  come from the session. First admin via `POST /api/auth/admin-bootstrap`
-  (only on an empty user table, email must be in `ADMIN_EMAILS`).
+  invite by email (SMTP via `.env`); sessions are stateless JWTs (HS256,
+  7-day expiry) in HttpOnly cookies — no server-side revocation, logout
+  clears the cookie, deleted users fail closed. Tenants come from the
+  session. `JWT_SECRET` (long random value) signs the cookies. First admin
+  via `POST /api/auth/admin-bootstrap` (only on an empty user table, email
+  must be in `ADMIN_EMAILS`).
 - **Dynamic forms** — flows declare form fields as typed inputs on a
   `CustomInput*` custom component (reusable library in
   `backend/components/`, mounted into Langflow via
@@ -125,6 +128,8 @@ Frontend (node lives in the `frontend` container):
   running via compose; this is for a second instance or flags).
 - `docker compose exec frontend npm run build` — typecheck + build.
 - Without a docker socket: VS Code "Attach to Running Container" → frontend.
+- Local `npm install`: use `--legacy-peer-deps` (Mantine 9 + React 19
+  peer range); `npm ci` inside the image works off the committed lockfile.
 
 Flow workflow: design in Langflow → press "Aus Langflow synchronisieren"
 in Verwaltung (manual full pass: Langflow → `backend/flows/<name>.json` →
@@ -160,7 +165,9 @@ proxy — nothing here substitutes for it):
   critical unauthenticated RCEs — treat its UI as privileged tooling,
   never share flows publicly ("Shareable Playground" = RCE risk).
 - Secrets: all `*_KEY`/`*_TOKEN`/`*_PASSWORD` long and random; rotate
-  after any incident or staff change; re-run `check_prod.py`.
+  after any incident or staff change; re-run `check_prod.py`. `JWT_SECRET`
+  signs session cookies — rotating it logs everyone out (same on every
+  deploy that drops session state: users re-login via magic link).
 - Langflow/LFX upgrades (pinned in lockstep): bump `LANGFLOW_VERSION`
   (`.env`), `Dockerfile.lfx` ARG, and backend `lfx~=` together, then
   `lfx upgrade --upgrade-flow=safe` + `lfx validate --level 4` on