diff --git a/frontend-modern/pnpm-lock.yaml b/frontend-modern/pnpm-lock.yaml
new file mode 100644
index 0000000..e697b3c
Binary files /dev/null and b/frontend-modern/pnpm-lock.yaml differ
diff --git a/scripts/hot-dev.sh b/scripts/hot-dev.sh
index 739ac10..163c97a 100755
--- a/scripts/hot-dev.sh
+++ b/scripts/hot-dev.sh
@@ -166,7 +166,7 @@ if [[ -f "${ROOT_DIR}/mock.env" ]]; then
     else
         # Sync production config when not in mock mode
         echo "Syncing production configuration..."
-        "${ROOT_DIR}/scripts/sync-production-config.sh"
+        DEV_DIR="${ROOT_DIR}/tmp/dev-config" "${ROOT_DIR}/scripts/sync-production-config.sh"
     fi
 fi
 
@@ -181,6 +181,10 @@ fi
 printf "[hot-dev] Starting backend on port %s...\n" "${PULSE_DEV_API_PORT}"
 cd "${ROOT_DIR}"
 
+# Ensure dummy frontend file exists for go:embed
+mkdir -p internal/api/frontend-modern/dist
+touch internal/api/frontend-modern/dist/index.html
+
 go build -o pulse ./cmd/pulse
 
 # CRITICAL: Export all required environment variables for the backend
@@ -192,7 +196,7 @@ export FRONTEND_PORT PULSE_DEV_API_PORT PORT
 
 # Set data directory strategy for the backend
 if [[ ${PULSE_MOCK_MODE:-false} == "true" ]]; then
-    export PULSE_DATA_DIR=/opt/pulse/tmp/mock-data
+    export PULSE_DATA_DIR="${ROOT_DIR}/tmp/mock-data"
     mkdir -p "$PULSE_DATA_DIR"
     echo "[hot-dev] Mock mode: Using isolated data directory: ${PULSE_DATA_DIR}"
 else
@@ -216,7 +220,7 @@ else
         elif [[ ${PULSE_DATA_DIR} == "${ROOT_DIR}/tmp/dev-config" ]]; then
             DEV_KEY_FILE="${PULSE_DATA_DIR}/.encryption.key"
             if [[ ! -f "${DEV_KEY_FILE}" ]]; then
-                openssl rand -hex 32 > "${DEV_KEY_FILE}"
+                openssl rand -base64 32 > "${DEV_KEY_FILE}"
                 chmod 600 "${DEV_KEY_FILE}"
                 echo "[hot-dev] Generated dev encryption key at ${DEV_KEY_FILE}"
             fi
diff --git a/scripts/sync-production-config.sh b/scripts/sync-production-config.sh
index a257029..3d416b2 100755
--- a/scripts/sync-production-config.sh
+++ b/scripts/sync-production-config.sh
@@ -5,7 +5,7 @@
 set -euo pipefail
 
 PROD_DIR="/etc/pulse"
-DEV_DIR="/opt/pulse/tmp/dev-config"
+DEV_DIR=${DEV_DIR:-"/opt/pulse/tmp/dev-config"}
 
 # Ensure dev config directory exists
 mkdir -p "$DEV_DIR"
@@ -44,7 +44,7 @@ else
     echo "⚠ Production encryption key not found. Using dev-only key."
     if [ ! -f "$DEV_DIR/.encryption.key" ]; then
         # Generate a dev-only encryption key so backend can start
-        openssl rand -hex 32 > "$DEV_DIR/.encryption.key"
+        openssl rand -base64 32 > "$DEV_DIR/.encryption.key"
         chmod 600 "$DEV_DIR/.encryption.key"
         echo "✓ Generated dev encryption key at $DEV_DIR/.encryption.key"
     else