fix: edge hardening, rootless containers, fail-closed frontend mode

Dockerfile.lfx

@@ -13,9 +13,11 @@ ENV PYTHONUNBUFFERED=1 \
 ARG LFX_VERSION=1.12.0
 RUN pip install "lfx~=${LFX_VERSION}" requests
 
-RUN mkdir -p /flows
+# Non-root runtime: uploads persist into the mounted volume.
+RUN useradd -r -s /bin/false lfx && mkdir -p /flows && chown lfx /flows
 VOLUME /flows
 EXPOSE 6004
+USER lfx
 
 # Serve the /flows dir (uploaded flows persist there via --flow-dir).
 # No positional path: with one, lfx>=1.12.1 exits when the dir holds no