fix: lfx boot, deploy key, and entrypoint perms for compose/devcontainer

PLAN_NEXT.md

@@ -43,8 +43,36 @@ run build`, `docker compose config --quiet`.
 
 **Still open (docs-only):** `README.md` + `.env.example` uncommitted diff
 describes the target vision (access mgmt, dynamic forms, new Web UI) that is
-NOT yet implemented: `app/auth/` is empty, `backend/components/kirche/` is
+NOT yet implemented: `backend/components/kirche/` is
 empty, frontend is still the old 3-tab UI, no `input-schema` endpoint.
+(Phase 1 backend auth IS implemented since this was written.)
+
+## 0.1 Follow-up fixes (commits after Phase 0)
+
+`fix: devcontainer build and setup on fresh clones` + `feat: magic-link
+auth` + the LFX/stack repair commit:
+
+* `docker-outside-of-docker` needs `"moby": false` (`python:3.12-slim` is
+  Debian trixie, no moby-cli in its repos). Removed the manual
+  `/var/run/docker.sock` bind (breaks Windows, feature handles it).
+* `setup.sh` used `su vscode -c` (drops env incl. `UV_PROJECT_ENVIRONMENT`
+  → stray `backend/.venv`, blind sync). Now `sudo -u vscode -E` helper.
+  Missing `.env` is provisioned from `.env.example`, not fatal.
+* Compose `env_file` is `required: false` everywhere (fresh clones, CI).
+  Images install `curl git ca-certificates`; `.dockerignore` files keep
+  host `node_modules/.venv/data` out of build contexts.
+* `settings.database_url` default is now a real `sqlite:///` URL (bare
+  path crashed `create_engine`/alembic; api could never boot uncconfigured).
+* `Dockerfile.lfx` CMD dropped the positional `/flows`: `lfx>=1.12.1`
+  exits on an empty flow dir (restart-loop → whole stack `unhealthy`).
+  `lfx` service blanks `LANGFLOW_API_KEY` (server prefers it over
+  `LFX_API_KEY`, so backend deploys 401'd and `/flows` stayed empty).
+* Both entrypoints run via explicit `sh` (git tracks them 100644; the
+  bind-mount shadows image perms, breaking Windows checkouts).
+* Verified live: full `compose up` green (api/frontend/langflow/lfx),
+  startup sync deploys `backend/flows` to LFX, `uv run pytest` 60 green.
+  Before Reopen in Container: `docker compose down` any manual stack
+  (same project name → port clash).
 
 ## 1. Locked decisions (do not re-ask)