fix: devcontainer build and setup on fresh clones

backend/.dockerignore

@@ -0,0 +1,9 @@
+# Keep the build context lean: only pyproject/alembic/entrypoint plus
+# app/migrations/scripts are COPYed. Local venvs, databases and caches must
+# never enter the context (slow builds, root-owned file leaks).
+.venv/
+data/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+uv.lock

backend/Dockerfile

@@ -16,9 +16,10 @@ ENV PATH="/opt/venv/bin:$PATH"
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
 # Foundational, inert in prod: non-root user for the editor, sudo for setup,
-# openssh-client for the devcontainer post-start hook.
+# openssh-client for the devcontainer post-start hook, curl for the opencode
+# installer in setup.sh, git for the VS Code source-control view.
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends sudo openssh-client \
+    && apt-get install -y --no-install-recommends sudo openssh-client curl git ca-certificates \
     && rm -rf /var/lib/apt/lists/* \
     && useradd -m -s /bin/bash vscode \
     && echo "vscode ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/vscode \

backend/entrypoint.sh

@@ -16,6 +16,12 @@ fi
 
 /opt/venv/bin/alembic upgrade head
 
+# Migrate ran as root: hand the (possibly just created) DB files back to
+# vscode so editor-run commands stay writable.
+if id vscode >/dev/null 2>&1; then
+  chown -R vscode:vscode data 2>/dev/null || true
+fi
+
 if [ "${APP_ENV:-prod}" = "dev" ]; then
   exec /opt/venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload
 else