diff --git a/Dockerfile.lfx b/Dockerfile.lfx
index 378b23d..ffd452e 100644
--- a/Dockerfile.lfx
+++ b/Dockerfile.lfx
@@ -18,5 +18,9 @@ VOLUME /flows
 EXPOSE 6004
 
 # Serve the /flows dir (uploaded flows persist there via --flow-dir).
-# Flags verified against `lfx serve --help` (lfx 1.12.0).
-CMD ["lfx", "serve", "--host", "0.0.0.0", "--port", "6004", "--flow-dir", "/flows", "/flows"]
+# No positional path: with one, lfx>=1.12.1 exits when the dir holds no
+# .json yet ("No .json files found"), restart-looping the container on
+# first boot. --flow-dir alone starts clean (health 200); the API sync
+# deploys backend/flows/*.json right after boot.
+# Flags verified against `lfx serve --help` (lfx 1.12.x).
+CMD ["lfx", "serve", "--host", "0.0.0.0", "--port", "6004", "--flow-dir", "/flows"]
diff --git a/PLAN_NEXT.md b/PLAN_NEXT.md
index b0e1afc..ace771c 100644
--- a/PLAN_NEXT.md
+++ b/PLAN_NEXT.md
@@ -43,8 +43,36 @@ run build`, `docker compose config --quiet`.
 
 **Still open (docs-only):** `README.md` + `.env.example` uncommitted diff
 describes the target vision (access mgmt, dynamic forms, new Web UI) that is
-NOT yet implemented: `app/auth/` is empty, `backend/components/kirche/` is
+NOT yet implemented: `backend/components/kirche/` is
 empty, frontend is still the old 3-tab UI, no `input-schema` endpoint.
+(Phase 1 backend auth IS implemented since this was written.)
+
+## 0.1 Follow-up fixes (commits after Phase 0)
+
+`fix: devcontainer build and setup on fresh clones` + `feat: magic-link
+auth` + the LFX/stack repair commit:
+
+* `docker-outside-of-docker` needs `"moby": false` (`python:3.12-slim` is
+  Debian trixie, no moby-cli in its repos). Removed the manual
+  `/var/run/docker.sock` bind (breaks Windows, feature handles it).
+* `setup.sh` used `su vscode -c` (drops env incl. `UV_PROJECT_ENVIRONMENT`
+  → stray `backend/.venv`, blind sync). Now `sudo -u vscode -E` helper.
+  Missing `.env` is provisioned from `.env.example`, not fatal.
+* Compose `env_file` is `required: false` everywhere (fresh clones, CI).
+  Images install `curl git ca-certificates`; `.dockerignore` files keep
+  host `node_modules/.venv/data` out of build contexts.
+* `settings.database_url` default is now a real `sqlite:///` URL (bare
+  path crashed `create_engine`/alembic; api could never boot uncconfigured).
+* `Dockerfile.lfx` CMD dropped the positional `/flows`: `lfx>=1.12.1`
+  exits on an empty flow dir (restart-loop → whole stack `unhealthy`).
+  `lfx` service blanks `LANGFLOW_API_KEY` (server prefers it over
+  `LFX_API_KEY`, so backend deploys 401'd and `/flows` stayed empty).
+* Both entrypoints run via explicit `sh` (git tracks them 100644; the
+  bind-mount shadows image perms, breaking Windows checkouts).
+* Verified live: full `compose up` green (api/frontend/langflow/lfx),
+  startup sync deploys `backend/flows` to LFX, `uv run pytest` 60 green.
+  Before Reopen in Container: `docker compose down` any manual stack
+  (same project name → port clash).
 
 ## 1. Locked decisions (do not re-ask)
 
diff --git a/backend/Dockerfile b/backend/Dockerfile
index d31f76b..adc28ce 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -39,4 +39,6 @@ RUN uv sync && chmod +x entrypoint.sh && chmod -R a+rX /opt/python /opt/venv
 ENV FLOWS_WATCH_ENABLED=true
 EXPOSE 8000
 
-ENTRYPOINT ["./entrypoint.sh"]
+# Explicit interpreter: the repo bind-mount shadows the image at runtime and
+# git tracks entrypoint.sh as 100644, so the exec bit cannot be relied on.
+ENTRYPOINT ["/bin/sh", "./entrypoint.sh"]
diff --git a/docker-compose.yml b/docker-compose.yml
index 5ca297a..27f3bf7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -121,6 +121,12 @@ services:
       # Runtime secrets come from `.env` when present (see setup.sh).
       - path: .env
         required: false
+    environment:
+      # lfx resolves its serve key via get_api_key(), which prefers
+      # LANGFLOW_API_KEY over LFX_API_KEY. Our backend talks to LFX with
+      # LFX_API_KEY, so blank the former here (empty counts as unset) —
+      # otherwise every flow deploy 401s and /flows stays empty.
+      LANGFLOW_API_KEY: ""
     volumes:
       - lfx-data:/flows
     ports:
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index c9d2c0f..7d387c0 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -5,9 +5,13 @@ FROM node:22-slim
 
 WORKDIR /srv/kirche-einfach/frontend
 COPY package.json package-lock.json entrypoint.sh ./
-RUN npm ci && chmod +x entrypoint.sh
+RUN npm ci
 COPY . ./
+RUN chmod +x entrypoint.sh
 
 EXPOSE 3000
 
-ENTRYPOINT ["./entrypoint.sh"]
+# Explicit `sh`: the repo bind-mount shadows the image at runtime, and git
+# tracks entrypoint.sh as 100644 — relying on the exec bit breaks Windows
+# checkouts (and fresh Linux clones). `sh script` needs read-only.
+ENTRYPOINT ["sh", "./entrypoint.sh"]