feat: unify on single repo-root compose file for dev and prod

backend/Dockerfile

@@ -1,4 +1,6 @@
-# Production image for the FastAPI backend.
+# Backend image for dev and prod (single image, full dependencies).
+# Dev specifics (APP_ENV=dev for autoreload, opencode, SSH keys) arrive via
+# devcontainer.json / setup.sh — never via this file.
 FROM python:3.12-slim
 
 ENV PYTHONUNBUFFERED=1 \
@@ -6,16 +8,24 @@ ENV PYTHONUNBUFFERED=1 \
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
-WORKDIR /srv/backend
-COPY pyproject.toml alembic.ini ./
+# Foundational, inert in prod: non-root user for the editor, sudo for setup,
+# openssh-client for the devcontainer post-start hook.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends sudo openssh-client \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd -m -s /bin/bash vscode \
+    && echo "vscode ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/vscode
+
+WORKDIR /srv/kirche-einfach/backend
+COPY pyproject.toml alembic.ini entrypoint.sh ./
 COPY app ./app
 COPY migrations ./migrations
 COPY scripts ./scripts
 # No lockfile is committed; dependencies resolve at build time.
-RUN uv sync --no-dev
+# Full groups (incl. dev): pytest and friends must work in dev with zero steps.
+RUN uv sync && chmod +x entrypoint.sh
 
 ENV FLOWS_WATCH_ENABLED=true
 EXPOSE 8000
 
-# Migrate on start, then serve (watcher reconciles backend/flows automatically).
-CMD ["sh", "-c", ".venv/bin/alembic upgrade head && exec .venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000"]
+ENTRYPOINT ["./entrypoint.sh"]