fix: edge hardening, rootless containers, fail-closed frontend mode

frontend/Dockerfile

@@ -3,11 +3,17 @@
 # file. DevDeps are included: `npm run dev` must work with zero steps.
 FROM node:22-slim
 
+# gosu drops privileges before serving (node user, uid 1000 — same as the
+# vscode editor user, so the bind-mounted node_modules stays writable).
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends gosu \
+    && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /srv/kirche-einfach/frontend
 COPY package.json package-lock.json entrypoint.sh ./
 RUN npm ci
 COPY . ./
-RUN chmod +x entrypoint.sh
+RUN chmod +x entrypoint.sh && chown -R node:node /srv/kirche-einfach/frontend
 
 EXPOSE 3000
 

frontend/entrypoint.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # Frontend entrypoint (dev + prod).
-# FRONTEND_MODE=dev (compose default) runs the HMR dev server.
-# FRONTEND_MODE=preview (prod .env) builds once and serves the bundle.
+# Fail closed: unset means the production preview server; dev sets
+# FRONTEND_MODE=dev in .env (see .devcontainer/setup.sh).
 set -e
 
 cd /srv/kirche-einfach/frontend
@@ -9,12 +9,13 @@ cd /srv/kirche-einfach/frontend
 # node_modules lives in the repo bind-mount (no named volume by design):
 # install on first start after a fresh checkout (dev and prod).
 if [ ! -x "node_modules/.bin/vite" ]; then
-  npm ci
+  gosu node npm ci
 fi
 
-if [ "${FRONTEND_MODE:-dev}" = "dev" ]; then
-  exec npm run dev -- --host 0.0.0.0 --port 3000
+if [ "${FRONTEND_MODE:-preview}" = "dev" ]; then
+  exec gosu node npm run dev -- --host 0.0.0.0 --port 3000
 else
-  npm run build
-  exec npm run preview -- --host 0.0.0.0 --port 3000
+  # Build as node so dist/ stays editor-writable; preview serves as node.
+  gosu node npm run build
+  exec gosu node npm run preview -- --host 0.0.0.0 --port 3000
 fi