fix: edge hardening, rootless containers, fail-closed frontend mode

frontend/Dockerfile

@@ -3,11 +3,17 @@
 # file. DevDeps are included: `npm run dev` must work with zero steps.
 FROM node:22-slim
 
+# gosu drops privileges before serving (node user, uid 1000 — same as the
+# vscode editor user, so the bind-mounted node_modules stays writable).
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends gosu \
+    && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /srv/kirche-einfach/frontend
 COPY package.json package-lock.json entrypoint.sh ./
 RUN npm ci
 COPY . ./
-RUN chmod +x entrypoint.sh
+RUN chmod +x entrypoint.sh && chown -R node:node /srv/kirche-einfach/frontend
 
 EXPOSE 3000