fix: make Langflow-synced flows visible (lfx volume perms, pull dedup)

Dockerfile.lfx

@@ -16,11 +16,18 @@ RUN pip install "lfx~=${LFX_VERSION}" requests
 # Non-root runtime: uploads persist into the mounted volume. The user needs
 # a home directory: lfx resolves settings/cache paths from $HOME, and
 # without one every flow run fails ("Settings service not found").
+# gosu drops privileges in the entrypoint after chowning /flows: the named
+# volume arrives root-owned and the server user could otherwise never write
+# uploads (every deploy would fail with "Permission denied").
 ENV HOME=/home/lfx
-RUN useradd -r -m -s /bin/false lfx && mkdir -p /flows && chown lfx /flows
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends gosu \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd -r -m -s /bin/false lfx && mkdir -p /flows && chown lfx /flows
+COPY lfx-entrypoint.sh /usr/local/bin/lfx-entrypoint.sh
 VOLUME /flows
 EXPOSE 6004
-USER lfx
+ENTRYPOINT ["sh", "/usr/local/bin/lfx-entrypoint.sh"]
 
 # Serve the /flows dir (uploaded flows persist there via --flow-dir).
 # No positional path: with one, lfx>=1.12.1 exits when the dir holds no