Add repository line ending policy

.build_number

@@ -1 +1 @@
-251261937
+0103262231

.gitattributes

@@ -0,0 +1,17 @@
+* text=auto eol=lf
+
+*.bat text eol=crlf
+*.cmd text eol=crlf
+*.ps1 text eol=crlf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.pdf binary
+*.zip binary
+*.gz binary
+*.tgz binary
+*.woff binary
+*.woff2 binary

Dockerfile

@@ -0,0 +1,53 @@
+FROM node:24-slim AS frontend-builder
+
+WORKDIR /frontend
+
+ENV NODE_ENV=production \
+    BACKEND_INTERNAL_URL=http://127.0.0.1:8000 \
+    NEXT_PUBLIC_API_BASE=/api
+
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci --include=dev
+
+COPY frontend/app ./app
+COPY frontend/public ./public
+COPY frontend/next-env.d.ts ./next-env.d.ts
+COPY frontend/next.config.js ./next.config.js
+COPY frontend/tsconfig.json ./tsconfig.json
+
+RUN npm run build
+
+FROM python:3.14-slim
+
+WORKDIR /app
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    NODE_ENV=production
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl gnupg supervisor \
+    && curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY backend/requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY backend/app ./app
+COPY data/branding /app/data/branding
+
+COPY --from=frontend-builder /frontend/.next /app/frontend/.next
+COPY --from=frontend-builder /frontend/public /app/frontend/public
+COPY --from=frontend-builder /frontend/node_modules /app/frontend/node_modules
+COPY --from=frontend-builder /frontend/package.json /app/frontend/package.json
+COPY --from=frontend-builder /frontend/next.config.js /app/frontend/next.config.js
+COPY --from=frontend-builder /frontend/next-env.d.ts /app/frontend/next-env.d.ts
+COPY --from=frontend-builder /frontend/tsconfig.json /app/frontend/tsconfig.json
+
+COPY docker/supervisord.conf /etc/supervisor/conf.d/magent.conf
+
+EXPOSE 3000 8000
+
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/magent.conf"]

README.md

@@ -1,10 +1,10 @@
 # Magent
 
-Magent is a friendly, AI-assisted request tracker for Jellyseerr + Arr services. It shows a clear timeline of where a request is stuck, explains what is happening in plain English, and offers safe actions to help fix issues.
+Magent is a friendly, AI-assisted request tracker for Seerr + Arr services. It shows a clear timeline of where a request is stuck, explains what is happening in plain English, and offers safe actions to help fix issues.
 
 ## How it works
 
-1) Requests are pulled from Jellyseerr and stored locally.
+1) Requests are pulled from Seerr and stored locally.
 2) Magent joins that request to Sonarr/Radarr, Prowlarr, qBittorrent, and Jellyfin using TMDB/TVDB IDs and download hashes.
 3) A state engine normalizes noisy service statuses into a simple, user-friendly state.
 4) The UI renders a timeline and a central status box for each request.
@@ -14,7 +14,7 @@ Magent is a friendly, AI-assisted request tracker for Jellyseerr + Arr services.
 
 - Request search by title/year or request ID.
 - Recent requests list with posters and status.
-- Timeline view across Jellyseerr, Arr, Prowlarr, qBittorrent, Jellyfin.
+- Timeline view across Seerr, Arr, Prowlarr, qBittorrent, Jellyfin.
 - Central status box with clear reason + next steps.
 - Safe action buttons (search, resume, re-add, etc.).
 - Admin settings for service URLs, API keys, profiles, and root folders.
@@ -160,7 +160,7 @@ If you prefer the browser to call the backend directly, set `NEXT_PUBLIC_API_BAS
 
 ### No recent requests
 
-- Confirm Jellyseerr credentials in Settings.
+- Confirm Seerr credentials in Settings.
 - Run a full sync from Settings -> Requests.
 
 ### Docker images not updating

backend/Dockerfile

@@ -2,11 +2,8 @@ FROM python:3.12-slim
 
 WORKDIR /app
 
-ARG BUILD_NUMBER=dev
-
 ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    SITE_BUILD_NUMBER=${BUILD_NUMBER}
+    PYTHONUNBUFFERED=1
 
 COPY backend/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt

backend/app/ai/triage.py

@@ -9,12 +9,12 @@ def triage_snapshot(snapshot: Snapshot) -> TriageResult:
 
     if snapshot.state == NormalizedState.requested:
         root_cause = "approval"
-        summary = "The request is waiting for approval in Jellyseerr."
+        summary = "The request is waiting for approval in Seerr."
         recommendations.append(
             TriageRecommendation(
                 action_id="wait_for_approval",
                 title="Ask an admin to approve the request",
-                reason="Jellyseerr has not marked this request as approved.",
+                reason="Seerr has not marked this request as approved.",
                 risk="low",
             )
         )

backend/app/auth.py

@@ -1,4 +1,5 @@
-from typing import Dict, Any
+from datetime import datetime, timezone
+from typing import Dict, Any, Optional
 
 from fastapi import Depends, HTTPException, status, Request
 from fastapi.security import OAuth2PasswordBearer
@@ -8,6 +9,21 @@ from .security import safe_decode_token, TokenError
 
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/auth/login")
 
+
+def _is_expired(expires_at: str | None) -> bool:
+    if not isinstance(expires_at, str) or not expires_at.strip():
+        return False
+    candidate = expires_at.strip()
+    if candidate.endswith("Z"):
+        candidate = candidate[:-1] + "+00:00"
+    try:
+        parsed = datetime.fromisoformat(candidate)
+    except ValueError:
+        return False
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=timezone.utc)
+    return parsed <= datetime.now(timezone.utc)
+
 def _extract_client_ip(request: Request) -> str:
     forwarded = request.headers.get("x-forwarded-for")
     if forwarded:
@@ -22,11 +38,18 @@ def _extract_client_ip(request: Request) -> str:
     return "unknown"
 
 
-def get_current_user(token: str = Depends(oauth2_scheme), request: Request = None) -> Dict[str, Any]:
+def _load_current_user_from_token(
+    token: str,
+    request: Optional[Request] = None,
+    allowed_token_types: Optional[set[str]] = None,
+) -> Dict[str, Any]:
     try:
         payload = safe_decode_token(token)
     except TokenError as exc:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token") from exc
+    token_type = str(payload.get("typ") or "access").strip().lower()
+    if allowed_token_types and token_type not in allowed_token_types:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token type")
 
     username = payload.get("sub")
     if not username:
@@ -37,6 +60,8 @@ def get_current_user(token: str = Depends(oauth2_scheme), request: Request = Non
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found")
     if user.get("is_blocked"):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User is blocked")
+    if _is_expired(user.get("expires_at")):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User access has expired")
 
     if request is not None:
         ip = _extract_client_ip(request)
@@ -47,10 +72,49 @@ def get_current_user(token: str = Depends(oauth2_scheme), request: Request = Non
         "username": user["username"],
         "role": user["role"],
         "auth_provider": user.get("auth_provider", "local"),
+        "jellyseerr_user_id": user.get("jellyseerr_user_id"),
+        "auto_search_enabled": bool(user.get("auto_search_enabled", True)),
+        "invite_management_enabled": bool(user.get("invite_management_enabled", False)),
+        "profile_id": user.get("profile_id"),
+        "expires_at": user.get("expires_at"),
+        "is_expired": bool(user.get("is_expired", False)),
     }
 
 
+def get_current_user(token: str = Depends(oauth2_scheme), request: Request = None) -> Dict[str, Any]:
+    return _load_current_user_from_token(token, request)
+
+
+def get_current_user_event_stream(request: Request) -> Dict[str, Any]:
+    """EventSource cannot send Authorization headers, so allow a short-lived stream token via query."""
+    token = None
+    stream_query_token = None
+    auth_header = request.headers.get("authorization", "")
+    if auth_header.lower().startswith("bearer "):
+        token = auth_header.split(" ", 1)[1].strip()
+    if not token:
+        stream_query_token = request.query_params.get("stream_token")
+    if not token and not stream_query_token:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Missing token")
+    if token:
+        # Allow standard bearer tokens in Authorization for non-browser EventSource clients.
+        return _load_current_user_from_token(token, None)
+    return _load_current_user_from_token(
+        str(stream_query_token),
+        None,
+        allowed_token_types={"sse"},
+    )
+
+
 def require_admin(user: Dict[str, Any] = Depends(get_current_user)) -> Dict[str, Any]:
     if user.get("role") != "admin":
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
     return user
+
+
+def require_admin_event_stream(
+    user: Dict[str, Any] = Depends(get_current_user_event_stream),
+) -> Dict[str, Any]:
+    if user.get("role") != "admin":
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user

backend/app/build_info.py

@@ -0,0 +1,7 @@
+BUILD_NUMBER = "0103262231"
+CHANGELOG = '2026-01-22\\n- Initial commit\\n- Ignore build artifacts\\n- Update README\\n- Update README with Docker-first guide\\n\\n2026-01-23\\n- Fix cache titles via Seerr media lookup\\n- Split search actions and improve download options\\n- Fallback manual grab to qBittorrent\\n- Hide header actions when signed out\\n- Add feedback form and webhook\\n- Fix cache titles and move feedback link\\n- Show available status on landing when in Jellyfin\\n- Add default branding assets when missing\\n- Use bundled branding assets\\n- Remove password fields from users page\\n- Add Docker Hub compose override\\n- Fix backend Dockerfile paths for root context\\n- Copy public assets into frontend image\\n- Use backend branding assets for logo and favicon\\n\\n2026-01-24\\n- Route grabs through Sonarr/Radarr only\\n- Document fix buttons in how-it-works\\n- Clarify how-it-works steps and fixes\\n- Map Prowlarr releases to Arr indexers for manual grab\\n- Improve request handling and qBittorrent categories\\n\\n2026-01-25\\n- Add site banner, build number, and changelog\\n- Automate build number tagging and sync\\n- Improve mobile header layout\\n- Move account actions into avatar menu\\n- Add user stats and activity tracking\\n- Add Jellyfin login cache and admin-only stats\\n- Tidy request sync controls\\n- Seed branding logo from bundled assets\\n- Serve bundled branding assets by default\\n- Harden request cache titles and cache-only reads\\n- Build 2501262041\\n\\n2026-01-26\\n- Fix cache title hydration\\n- Fix sync progress bar animation\\n\\n2026-01-27\\n- Add cache control artwork stats\\n- Improve cache stats performance (build 271261145)\\n- Fix backend cache stats import (build 271261149)\\n- Clarify request sync settings (build 271261159)\\n- Bump build number to 271261202\\n- Fix request titles in snapshots (build 271261219)\\n- Fix snapshot title fallback (build 271261228)\\n- Add cache load spinner (build 271261238)\\n- Bump build number (process 2) 271261322\\n- Add service test buttons (build 271261335)\\n- Fallback to TMDB when artwork cache fails (build 271261524)\\n- Hydrate missing artwork from Seerr (build 271261539)\\n\\n2026-01-29\\n- release: 2901262036\\n- release: 2901262044\\n- release: 2901262102\\n- Hardcode build number in backend\\n- Bake build number and changelog\\n- Update full changelog\\n- Tidy full changelog\\n- Build 2901262240: cache users\n\n2026-01-30\n- Merge backend and frontend into one container'
+
+
+
+
+

backend/app/clients/base.py

@@ -1,11 +1,16 @@
 from typing import Any, Dict, Optional
+import logging
+import time
 import httpx
 
+from ..logging_config import sanitize_headers, sanitize_value
+
 
 class ApiClient:
     def __init__(self, base_url: Optional[str], api_key: Optional[str] = None):
         self.base_url = base_url.rstrip("/") if base_url else None
         self.api_key = api_key
+        self.logger = logging.getLogger(f"{__name__}.{self.__class__.__name__}")
 
     def configured(self) -> bool:
         return bool(self.base_url)
@@ -13,20 +18,66 @@ class ApiClient:
     def headers(self) -> Dict[str, str]:
         return {"X-Api-Key": self.api_key} if self.api_key else {}
 
-    async def get(self, path: str, params: Optional[Dict[str, Any]] = None) -> Optional[Any]:
+    async def _request(
+        self,
+        method: str,
+        path: str,
+        *,
+        params: Optional[Dict[str, Any]] = None,
+        payload: Optional[Dict[str, Any]] = None,
+    ) -> Optional[Any]:
         if not self.base_url:
+            self.logger.warning("client request skipped method=%s path=%s reason=not-configured", method, path)
             return None
         url = f"{self.base_url}{path}"
-        async with httpx.AsyncClient(timeout=10.0) as client:
-            response = await client.get(url, headers=self.headers(), params=params)
-            response.raise_for_status()
+        started_at = time.perf_counter()
+        self.logger.debug(
+            "outbound request started method=%s url=%s params=%s payload=%s headers=%s",
+            method,
+            url,
+            sanitize_value(params),
+            sanitize_value(payload),
+            sanitize_headers(self.headers()),
+        )
+        try:
+            async with httpx.AsyncClient(timeout=10.0) as client:
+                response = await client.request(
+                    method,
+                    url,
+                    headers=self.headers(),
+                    params=params,
+                    json=payload,
+                )
+                response.raise_for_status()
+            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
+            self.logger.debug(
+                "outbound request completed method=%s url=%s status=%s duration_ms=%s",
+                method,
+                url,
+                response.status_code,
+                duration_ms,
+            )
+            if not response.content:
+                return None
             return response.json()
+        except Exception:
+            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
+            self.logger.exception(
+                "outbound request failed method=%s url=%s duration_ms=%s",
+                method,
+                url,
+                duration_ms,
+            )
+            raise
+
+    async def get(self, path: str, params: Optional[Dict[str, Any]] = None) -> Optional[Any]:
+        return await self._request("GET", path, params=params)
 
     async def post(self, path: str, payload: Optional[Dict[str, Any]] = None) -> Optional[Any]:
-        if not self.base_url:
-            return None
-        url = f"{self.base_url}{path}"
-        async with httpx.AsyncClient(timeout=10.0) as client:
-            response = await client.post(url, headers=self.headers(), json=payload)
-            response.raise_for_status()
-            return response.json()
+        return await self._request("POST", path, payload=payload)
+
+    async def put(self, path: str, payload: Optional[Dict[str, Any]] = None) -> Optional[Any]:
+        return await self._request("PUT", path, payload=payload)
+
+    async def delete(self, path: str) -> Optional[Any]:
+        return await self._request("DELETE", path)

backend/app/clients/jellyfin.py

@@ -10,27 +10,158 @@ class JellyfinClient(ApiClient):
     def configured(self) -> bool:
         return bool(self.base_url and self.api_key)
 
+    def _emby_headers(self) -> Dict[str, str]:
+        return {"X-Emby-Token": self.api_key} if self.api_key else {}
+
+    @staticmethod
+    def _extract_user_id(payload: Any) -> Optional[str]:
+        if not isinstance(payload, dict):
+            return None
+        candidate = payload.get("User") if isinstance(payload.get("User"), dict) else payload
+        if not isinstance(candidate, dict):
+            return None
+        for key in ("Id", "id", "UserId", "userId"):
+            value = candidate.get(key)
+            if value is None:
+                continue
+            if isinstance(value, (str, int)):
+                text = str(value).strip()
+                if text:
+                    return text
+        return None
+
     async def get_users(self) -> Optional[Dict[str, Any]]:
         if not self.base_url:
             return None
         url = f"{self.base_url}/Users"
-        headers = {"X-Emby-Token": self.api_key} if self.api_key else {}
+        headers = self._emby_headers()
         async with httpx.AsyncClient(timeout=10.0) as client:
             response = await client.get(url, headers=headers)
             response.raise_for_status()
             return response.json()
 
+    async def get_user(self, user_id: str) -> Optional[Dict[str, Any]]:
+        if not self.base_url or not self.api_key:
+            return None
+        url = f"{self.base_url}/Users/{user_id}"
+        headers = self._emby_headers()
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            response = await client.get(url, headers=headers)
+            response.raise_for_status()
+            return response.json()
+
+    async def find_user_by_name(self, username: str) -> Optional[Dict[str, Any]]:
+        users = await self.get_users()
+        if not isinstance(users, list):
+            return None
+        target = username.strip().lower()
+        for user in users:
+            if not isinstance(user, dict):
+                continue
+            name = str(user.get("Name") or "").strip().lower()
+            if name and name == target:
+                return user
+        return None
+
     async def authenticate_by_name(self, username: str, password: str) -> Optional[Dict[str, Any]]:
         if not self.base_url:
             return None
         url = f"{self.base_url}/Users/AuthenticateByName"
-        headers = {"X-Emby-Token": self.api_key} if self.api_key else {}
+        headers = self._emby_headers()
         payload = {"Username": username, "Pw": password}
         async with httpx.AsyncClient(timeout=10.0) as client:
             response = await client.post(url, headers=headers, json=payload)
             response.raise_for_status()
             return response.json()
 
+    async def create_user(self, username: str) -> Optional[Dict[str, Any]]:
+        if not self.base_url or not self.api_key:
+            return None
+        url = f"{self.base_url}/Users/New"
+        headers = self._emby_headers()
+        payload = {"Name": username}
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            response = await client.post(url, headers=headers, json=payload)
+            response.raise_for_status()
+            if not response.content:
+                return None
+            return response.json()
+
+    async def set_user_password(self, user_id: str, password: str) -> None:
+        if not self.base_url or not self.api_key:
+            return None
+        headers = self._emby_headers()
+        payloads = [
+            {"CurrentPw": "", "NewPw": password},
+            {"CurrentPwd": "", "NewPw": password},
+            {"CurrentPw": "", "NewPw": password, "ResetPassword": False},
+            {"CurrentPwd": "", "NewPw": password, "ResetPassword": False},
+            {"NewPw": password, "ResetPassword": False},
+        ]
+        paths = [
+            f"/Users/{user_id}/Password",
+            f"/Users/{user_id}/EasyPassword",
+        ]
+        last_error: Exception | None = None
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            for path in paths:
+                url = f"{self.base_url}{path}"
+                for payload in payloads:
+                    try:
+                        response = await client.post(url, headers=headers, json=payload)
+                        response.raise_for_status()
+                        return
+                    except httpx.HTTPStatusError as exc:
+                        last_error = exc
+                        continue
+                    except Exception as exc:
+                        last_error = exc
+                        continue
+        if last_error:
+            raise last_error
+
+    async def set_user_disabled(self, user_id: str, disabled: bool = True) -> None:
+        if not self.base_url or not self.api_key:
+            return None
+        user = await self.get_user(user_id)
+        if not isinstance(user, dict):
+            raise RuntimeError("Jellyfin user details not available")
+        policy = user.get("Policy") if isinstance(user.get("Policy"), dict) else {}
+        payload = {**policy, "IsDisabled": bool(disabled)}
+        url = f"{self.base_url}/Users/{user_id}/Policy"
+        headers = self._emby_headers()
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            response = await client.post(url, headers=headers, json=payload)
+            response.raise_for_status()
+
+    async def delete_user(self, user_id: str) -> None:
+        if not self.base_url or not self.api_key:
+            return None
+        url = f"{self.base_url}/Users/{user_id}"
+        headers = self._emby_headers()
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            response = await client.delete(url, headers=headers)
+            response.raise_for_status()
+
+    async def create_user_with_password(self, username: str, password: str) -> Optional[Dict[str, Any]]:
+        created = await self.create_user(username)
+        user_id = self._extract_user_id(created)
+        if not user_id:
+            users = await self.get_users()
+            if isinstance(users, list):
+                for user in users:
+                    if not isinstance(user, dict):
+                        continue
+                    name = str(user.get("Name") or "").strip()
+                    if name.lower() == username.strip().lower():
+                        created = user
+                        user_id = self._extract_user_id(user)
+                        break
+        if not user_id:
+            raise RuntimeError("Jellyfin user created but user ID was not returned")
+        await self.set_user_password(user_id, password)
+        return created
+
     async def search_items(
         self, term: str, item_types: Optional[list[str]] = None, limit: int = 20
     ) -> Optional[Dict[str, Any]]:
@@ -43,7 +174,7 @@ class JellyfinClient(ApiClient):
             "Recursive": "true",
             "Limit": limit,
         }
-        headers = {"X-Emby-Token": self.api_key}
+        headers = self._emby_headers()
         async with httpx.AsyncClient(timeout=10.0) as client:
             response = await client.get(url, headers=headers, params=params)
             response.raise_for_status()
@@ -53,7 +184,7 @@ class JellyfinClient(ApiClient):
         if not self.base_url or not self.api_key:
             return None
         url = f"{self.base_url}/System/Info"
-        headers = {"X-Emby-Token": self.api_key}
+        headers = self._emby_headers()
         async with httpx.AsyncClient(timeout=10.0) as client:
             response = await client.get(url, headers=headers)
             response.raise_for_status()
@@ -63,7 +194,7 @@ class JellyfinClient(ApiClient):
         if not self.base_url or not self.api_key:
             return None
         url = f"{self.base_url}/Library/Refresh"
-        headers = {"X-Emby-Token": self.api_key}
+        headers = self._emby_headers()
         params = {"Recursive": "true" if recursive else "false"}
         async with httpx.AsyncClient(timeout=10.0) as client:
             response = await client.post(url, headers=headers, params=params)

backend/app/clients/jellyseerr.py

@@ -1,4 +1,5 @@
 from typing import Any, Dict, Optional
+import httpx
 from .base import ApiClient
 
 
@@ -18,9 +19,6 @@ class JellyseerrClient(ApiClient):
             },
         )
 
-    async def get_media(self, media_id: int) -> Optional[Dict[str, Any]]:
-        return await self.get(f"/api/v1/media/{media_id}")
-
     async def get_movie(self, tmdb_id: int) -> Optional[Dict[str, Any]]:
         return await self.get(f"/api/v1/movie/{tmdb_id}")
 
@@ -35,3 +33,29 @@ class JellyseerrClient(ApiClient):
                 "page": page,
             },
         )
+
+    async def get_users(self, take: int = 50, skip: int = 0) -> Optional[Dict[str, Any]]:
+        return await self.get(
+            "/api/v1/user",
+            params={
+                "take": take,
+                "skip": skip,
+            },
+        )
+
+    async def get_user(self, user_id: int) -> Optional[Dict[str, Any]]:
+        return await self.get(f"/api/v1/user/{user_id}")
+
+    async def delete_user(self, user_id: int) -> Optional[Dict[str, Any]]:
+        return await self.delete(f"/api/v1/user/{user_id}")
+
+    async def login_local(self, email: str, password: str) -> Optional[Dict[str, Any]]:
+        payload = {"email": email, "password": password}
+        try:
+            return await self.post("/api/v1/auth/local", payload=payload)
+        except httpx.HTTPStatusError as exc:
+            # Backward compatibility for older Seerr/Overseerr deployments
+            # that still expose /auth/login instead of /auth/local.
+            if exc.response is not None and exc.response.status_code in {404, 405}:
+                return await self.post("/api/v1/auth/login", payload=payload)
+            raise

backend/app/clients/radarr.py

@@ -9,6 +9,9 @@ class RadarrClient(ApiClient):
     async def get_movie_by_tmdb_id(self, tmdb_id: int) -> Optional[Dict[str, Any]]:
         return await self.get("/api/v3/movie", params={"tmdbId": tmdb_id})
 
+    async def get_movie(self, movie_id: int) -> Optional[Dict[str, Any]]:
+        return await self.get(f"/api/v3/movie/{movie_id}")
+
     async def get_movies(self) -> Optional[Dict[str, Any]]:
         return await self.get("/api/v3/movie")
 
@@ -44,6 +47,9 @@ class RadarrClient(ApiClient):
         }
         return await self.post("/api/v3/movie", payload=payload)
 
+    async def update_movie(self, payload: Dict[str, Any]) -> Optional[Dict[str, Any]]:
+        return await self.put("/api/v3/movie", payload=payload)
+
     async def grab_release(self, guid: str, indexer_id: int) -> Optional[Dict[str, Any]]:
         return await self.post("/api/v3/release", payload={"guid": guid, "indexerId": indexer_id})
 

backend/app/clients/sonarr.py

@@ -9,6 +9,9 @@ class SonarrClient(ApiClient):
     async def get_series_by_tvdb_id(self, tvdb_id: int) -> Optional[Dict[str, Any]]:
         return await self.get("/api/v3/series", params={"tvdbId": tvdb_id})
 
+    async def get_series(self, series_id: int) -> Optional[Dict[str, Any]]:
+        return await self.get(f"/api/v3/series/{series_id}")
+
     async def get_root_folders(self) -> Optional[Dict[str, Any]]:
         return await self.get("/api/v3/rootfolder")
 
@@ -51,6 +54,9 @@ class SonarrClient(ApiClient):
             payload["title"] = title
         return await self.post("/api/v3/series", payload=payload)
 
+    async def update_series(self, payload: Dict[str, Any]) -> Optional[Dict[str, Any]]:
+        return await self.put("/api/v3/series", payload=payload)
+
     async def grab_release(self, guid: str, indexer_id: int) -> Optional[Dict[str, Any]]:
         return await self.post("/api/v3/release", payload={"guid": guid, "indexerId": indexer_id})
 

backend/app/config.py

@@ -2,6 +2,7 @@ from typing import Optional
 from pydantic import AliasChoices, Field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
+from .build_info import BUILD_NUMBER, CHANGELOG
 
 class Settings(BaseSettings):
     model_config = SettingsConfigDict(env_prefix="")
@@ -10,10 +11,32 @@ class Settings(BaseSettings):
     sqlite_path: str = Field(default="data/magent.db", validation_alias=AliasChoices("SQLITE_PATH"))
     jwt_secret: str = Field(default="change-me", validation_alias=AliasChoices("JWT_SECRET"))
     jwt_exp_minutes: int = Field(default=720, validation_alias=AliasChoices("JWT_EXP_MINUTES"))
+    api_docs_enabled: bool = Field(default=False, validation_alias=AliasChoices("API_DOCS_ENABLED"))
+    auth_rate_limit_window_seconds: int = Field(
+        default=60, validation_alias=AliasChoices("AUTH_RATE_LIMIT_WINDOW_SECONDS")
+    )
+    auth_rate_limit_max_attempts_ip: int = Field(
+        default=15, validation_alias=AliasChoices("AUTH_RATE_LIMIT_MAX_ATTEMPTS_IP")
+    )
+    auth_rate_limit_max_attempts_user: int = Field(
+        default=5, validation_alias=AliasChoices("AUTH_RATE_LIMIT_MAX_ATTEMPTS_USER")
+    )
     admin_username: str = Field(default="admin", validation_alias=AliasChoices("ADMIN_USERNAME"))
     admin_password: str = Field(default="adminadmin", validation_alias=AliasChoices("ADMIN_PASSWORD"))
     log_level: str = Field(default="INFO", validation_alias=AliasChoices("LOG_LEVEL"))
     log_file: str = Field(default="data/magent.log", validation_alias=AliasChoices("LOG_FILE"))
+    log_file_max_bytes: int = Field(
+        default=20_000_000, validation_alias=AliasChoices("LOG_FILE_MAX_BYTES")
+    )
+    log_file_backup_count: int = Field(
+        default=10, validation_alias=AliasChoices("LOG_FILE_BACKUP_COUNT")
+    )
+    log_http_client_level: str = Field(
+        default="INFO", validation_alias=AliasChoices("LOG_HTTP_CLIENT_LEVEL")
+    )
+    log_background_sync_level: str = Field(
+        default="INFO", validation_alias=AliasChoices("LOG_BACKGROUND_SYNC_LEVEL")
+    )
     requests_sync_ttl_minutes: int = Field(
         default=1440, validation_alias=AliasChoices("REQUESTS_SYNC_TTL_MINUTES")
     )
@@ -38,9 +61,7 @@ class Settings(BaseSettings):
     artwork_cache_mode: str = Field(
         default="remote", validation_alias=AliasChoices("ARTWORK_CACHE_MODE")
     )
-    site_build_number: Optional[str] = Field(
-        default=None, validation_alias=AliasChoices("SITE_BUILD_NUMBER")
-    )
+    site_build_number: Optional[str] = Field(default=BUILD_NUMBER)
     site_banner_enabled: bool = Field(
         default=False, validation_alias=AliasChoices("SITE_BANNER_ENABLED")
     )
@@ -50,8 +71,126 @@ class Settings(BaseSettings):
     site_banner_tone: str = Field(
         default="info", validation_alias=AliasChoices("SITE_BANNER_TONE")
     )
-    site_changelog: Optional[str] = Field(
-        default=None, validation_alias=AliasChoices("SITE_CHANGELOG")
+    site_changelog: Optional[str] = Field(default=CHANGELOG)
+
+    magent_application_url: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_APPLICATION_URL")
+    )
+    magent_application_port: int = Field(
+        default=3000, validation_alias=AliasChoices("MAGENT_APPLICATION_PORT")
+    )
+    magent_api_url: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_API_URL")
+    )
+    magent_api_port: int = Field(
+        default=8000, validation_alias=AliasChoices("MAGENT_API_PORT")
+    )
+    magent_bind_host: str = Field(
+        default="0.0.0.0", validation_alias=AliasChoices("MAGENT_BIND_HOST")
+    )
+    magent_proxy_enabled: bool = Field(
+        default=False, validation_alias=AliasChoices("MAGENT_PROXY_ENABLED")
+    )
+    magent_proxy_base_url: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_PROXY_BASE_URL")
+    )
+    magent_proxy_trust_forwarded_headers: bool = Field(
+        default=True, validation_alias=AliasChoices("MAGENT_PROXY_TRUST_FORWARDED_HEADERS")
+    )
+    magent_proxy_forwarded_prefix: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_PROXY_FORWARDED_PREFIX")
+    )
+    magent_ssl_bind_enabled: bool = Field(
+        default=False, validation_alias=AliasChoices("MAGENT_SSL_BIND_ENABLED")
+    )
+    magent_ssl_certificate_path: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_SSL_CERTIFICATE_PATH")
+    )
+    magent_ssl_private_key_path: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_SSL_PRIVATE_KEY_PATH")
+    )
+    magent_ssl_certificate_pem: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_SSL_CERTIFICATE_PEM")
+    )
+    magent_ssl_private_key_pem: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_SSL_PRIVATE_KEY_PEM")
+    )
+
+    magent_notify_enabled: bool = Field(
+        default=False, validation_alias=AliasChoices("MAGENT_NOTIFY_ENABLED")
+    )
+    magent_notify_email_enabled: bool = Field(
+        default=False, validation_alias=AliasChoices("MAGENT_NOTIFY_EMAIL_ENABLED")
+    )
+    magent_notify_email_smtp_host: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_EMAIL_SMTP_HOST")
+    )
+    magent_notify_email_smtp_port: int = Field(
+        default=587, validation_alias=AliasChoices("MAGENT_NOTIFY_EMAIL_SMTP_PORT")
+    )
+    magent_notify_email_smtp_username: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_EMAIL_SMTP_USERNAME")
+    )
+    magent_notify_email_smtp_password: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_EMAIL_SMTP_PASSWORD")
+    )
+    magent_notify_email_from_address: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_EMAIL_FROM_ADDRESS")
+    )
+    magent_notify_email_from_name: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_EMAIL_FROM_NAME")
+    )
+    magent_notify_email_use_tls: bool = Field(
+        default=True, validation_alias=AliasChoices("MAGENT_NOTIFY_EMAIL_USE_TLS")
+    )
+    magent_notify_email_use_ssl: bool = Field(
+        default=False, validation_alias=AliasChoices("MAGENT_NOTIFY_EMAIL_USE_SSL")
+    )
+
+    magent_notify_discord_enabled: bool = Field(
+        default=False, validation_alias=AliasChoices("MAGENT_NOTIFY_DISCORD_ENABLED")
+    )
+    magent_notify_discord_webhook_url: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_DISCORD_WEBHOOK_URL")
+    )
+
+    magent_notify_telegram_enabled: bool = Field(
+        default=False, validation_alias=AliasChoices("MAGENT_NOTIFY_TELEGRAM_ENABLED")
+    )
+    magent_notify_telegram_bot_token: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_TELEGRAM_BOT_TOKEN")
+    )
+    magent_notify_telegram_chat_id: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_TELEGRAM_CHAT_ID")
+    )
+
+    magent_notify_push_enabled: bool = Field(
+        default=False, validation_alias=AliasChoices("MAGENT_NOTIFY_PUSH_ENABLED")
+    )
+    magent_notify_push_provider: Optional[str] = Field(
+        default="ntfy", validation_alias=AliasChoices("MAGENT_NOTIFY_PUSH_PROVIDER")
+    )
+    magent_notify_push_base_url: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_PUSH_BASE_URL")
+    )
+    magent_notify_push_topic: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_PUSH_TOPIC")
+    )
+    magent_notify_push_token: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_PUSH_TOKEN")
+    )
+    magent_notify_push_user_key: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_PUSH_USER_KEY")
+    )
+    magent_notify_push_device: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_PUSH_DEVICE")
+    )
+
+    magent_notify_webhook_enabled: bool = Field(
+        default=False, validation_alias=AliasChoices("MAGENT_NOTIFY_WEBHOOK_ENABLED")
+    )
+    magent_notify_webhook_url: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("MAGENT_NOTIFY_WEBHOOK_URL")
     )
 
     jellyseerr_base_url: Optional[str] = Field(

backend/app/logging_config.py

@@ -1,10 +1,148 @@
+import contextvars
+import json
 import logging
 import os
 from logging.handlers import RotatingFileHandler
-from typing import Optional
+from typing import Any, Mapping, Optional
+from urllib.parse import parse_qs
+
+REQUEST_ID_CONTEXT: contextvars.ContextVar[str] = contextvars.ContextVar(
+    "magent_request_id", default="-"
+)
+
+_SENSITIVE_KEYWORDS = (
+    "api_key",
+    "authorization",
+    "cert",
+    "cookie",
+    "jwt",
+    "key",
+    "pass",
+    "password",
+    "pem",
+    "private",
+    "secret",
+    "session",
+    "signature",
+    "token",
+)
+_MAX_BODY_BYTES = 4096
 
 
-def configure_logging(log_level: Optional[str], log_file: Optional[str]) -> None:
+class RequestContextFilter(logging.Filter):
+    def filter(self, record: logging.LogRecord) -> bool:
+        record.request_id = REQUEST_ID_CONTEXT.get("-")
+        return True
+
+
+def bind_request_id(request_id: str) -> contextvars.Token[str]:
+    return REQUEST_ID_CONTEXT.set(request_id or "-")
+
+
+def reset_request_id(token: contextvars.Token[str]) -> None:
+    REQUEST_ID_CONTEXT.reset(token)
+
+
+def current_request_id() -> str:
+    return REQUEST_ID_CONTEXT.get("-")
+
+
+def _is_sensitive_key(key: str) -> bool:
+    lowered = key.strip().lower()
+    return any(marker in lowered for marker in _SENSITIVE_KEYWORDS)
+
+
+def _redact_scalar(value: Any) -> Any:
+    if value is None or isinstance(value, (int, float, bool)):
+        return value
+    text = str(value)
+    if len(text) <= 4:
+        return "***"
+    return f"{text[:2]}***{text[-2:]}"
+
+
+def sanitize_value(value: Any, *, key_hint: Optional[str] = None, depth: int = 0) -> Any:
+    if key_hint and _is_sensitive_key(key_hint):
+        return _redact_scalar(value)
+    if value is None or isinstance(value, (bool, int, float)):
+        return value
+    if isinstance(value, bytes):
+        return f"<bytes:{len(value)}>"
+    if isinstance(value, str):
+        return value if len(value) <= 512 else f"{value[:509]}..."
+    if depth >= 3:
+        return f"<{type(value).__name__}>"
+    if isinstance(value, Mapping):
+        return {
+            str(key): sanitize_value(item, key_hint=str(key), depth=depth + 1)
+            for key, item in value.items()
+        }
+    if isinstance(value, (list, tuple, set)):
+        return [sanitize_value(item, depth=depth + 1) for item in list(value)[:20]]
+    if hasattr(value, "model_dump"):
+        try:
+            return sanitize_value(value.model_dump(), depth=depth + 1)
+        except Exception:
+            return f"<{type(value).__name__}>"
+    return str(value)
+
+
+def sanitize_headers(headers: Mapping[str, Any]) -> dict[str, Any]:
+    return {
+        str(key).lower(): sanitize_value(value, key_hint=str(key))
+        for key, value in headers.items()
+    }
+
+
+def summarize_http_body(body: bytes, content_type: Optional[str]) -> Any:
+    if not body:
+        return None
+    normalized = (content_type or "").split(";")[0].strip().lower()
+    if normalized == "application/json":
+        preview = body[:_MAX_BODY_BYTES]
+        try:
+            payload = json.loads(preview.decode("utf-8"))
+            summary = sanitize_value(payload)
+            if len(body) > _MAX_BODY_BYTES:
+                return {"truncated": True, "bytes": len(body), "payload": summary}
+            return summary
+        except Exception:
+            pass
+    if normalized == "application/x-www-form-urlencoded":
+        try:
+            parsed = parse_qs(body.decode("utf-8"), keep_blank_values=True)
+            compact = {
+                key: value[0] if len(value) == 1 else value
+                for key, value in parsed.items()
+            }
+            return sanitize_value(compact)
+        except Exception:
+            pass
+    if normalized.startswith("multipart/"):
+        return {"content_type": normalized, "bytes": len(body)}
+    preview = body[: min(len(body), 256)].decode("utf-8", errors="replace")
+    return {
+        "content_type": normalized or "unknown",
+        "bytes": len(body),
+        "preview": preview if len(body) <= 256 else f"{preview}...",
+    }
+
+
+def _coerce_level(level_name: Optional[str], fallback: int) -> int:
+    if not level_name:
+        return fallback
+    return getattr(logging, str(level_name).upper(), fallback)
+
+
+def configure_logging(
+    log_level: Optional[str],
+    log_file: Optional[str],
+    *,
+    log_file_max_bytes: int = 20_000_000,
+    log_file_backup_count: int = 10,
+    log_http_client_level: Optional[str] = "INFO",
+    log_background_sync_level: Optional[str] = "INFO",
+) -> None:
     level_name = (log_level or "INFO").upper()
     level = getattr(logging, level_name, logging.INFO)
 
@@ -18,15 +156,20 @@ def configure_logging(log_level: Optional[str], log_file: Optional[str]) -> None
             log_path = os.path.join(os.getcwd(), log_path)
         os.makedirs(os.path.dirname(log_path), exist_ok=True)
         file_handler = RotatingFileHandler(
-            log_path, maxBytes=2_000_000, backupCount=3, encoding="utf-8"
+            log_path,
+            maxBytes=max(1_000_000, int(log_file_max_bytes or 20_000_000)),
+            backupCount=max(1, int(log_file_backup_count or 10)),
+            encoding="utf-8",
         )
         handlers.append(file_handler)
 
+    context_filter = RequestContextFilter()
     formatter = logging.Formatter(
-        fmt="%(asctime)s | %(levelname)s | %(name)s | %(message)s",
+        fmt="%(asctime)s | %(levelname)s | %(name)s | request_id=%(request_id)s | %(message)s",
         datefmt="%Y-%m-%d %H:%M:%S",
     )
     for handler in handlers:
+        handler.addFilter(context_filter)
         handler.setFormatter(formatter)
 
     root = logging.getLogger()
@@ -38,4 +181,10 @@ def configure_logging(log_level: Optional[str], log_file: Optional[str]) -> None
 
     logging.getLogger("uvicorn").setLevel(level)
     logging.getLogger("uvicorn.error").setLevel(level)
-    logging.getLogger("uvicorn.access").setLevel(level)
+    logging.getLogger("uvicorn.access").setLevel(logging.WARNING)
+    http_client_level = _coerce_level(log_http_client_level, logging.DEBUG)
+    background_sync_level = _coerce_level(log_background_sync_level, logging.INFO)
+    logging.getLogger("app.clients.base").setLevel(http_client_level)
+    logging.getLogger("app.routers.requests").setLevel(background_sync_level)
+    logging.getLogger("httpx").setLevel(logging.WARNING if level > logging.DEBUG else logging.INFO)
+    logging.getLogger("httpcore").setLevel(logging.WARNING)

backend/app/main.py

@@ -1,10 +1,14 @@
 import asyncio
+import logging
+import time
+import uuid
+from typing import Awaitable, Callable
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 
 from .config import settings
-from .db import init_db, set_setting
+from .db import init_db
 from .routers.requests import (
     router as requests_router,
     startup_warmup_requests_cache,
@@ -13,17 +17,33 @@ from .routers.requests import (
     run_daily_db_cleanup,
 )
 from .routers.auth import router as auth_router
-from .routers.admin import router as admin_router
+from .routers.admin import router as admin_router, events_router as admin_events_router
 from .routers.images import router as images_router
 from .routers.branding import router as branding_router
 from .routers.status import router as status_router
 from .routers.feedback import router as feedback_router
 from .routers.site import router as site_router
+from .routers.events import router as events_router
 from .services.jellyfin_sync import run_daily_jellyfin_sync
-from .logging_config import configure_logging
+from .logging_config import (
+    bind_request_id,
+    configure_logging,
+    reset_request_id,
+    sanitize_headers,
+    sanitize_value,
+    summarize_http_body,
+)
 from .runtime import get_runtime_settings
 
-app = FastAPI(title=settings.app_name)
+logger = logging.getLogger(__name__)
+_background_tasks: list[asyncio.Task[None]] = []
+
+app = FastAPI(
+    title=settings.app_name,
+    docs_url="/docs" if settings.api_docs_enabled else None,
+    redoc_url=None,
+    openapi_url="/openapi.json" if settings.api_docs_enabled else None,
+)
 
 app.add_middleware(
     CORSMiddleware,
@@ -34,29 +54,161 @@ app.add_middleware(
 )
 
 
+@app.middleware("http")
+async def log_requests_and_add_security_headers(request: Request, call_next):
+    request_id = request.headers.get("X-Request-ID") or uuid.uuid4().hex[:12]
+    token = bind_request_id(request_id)
+    request.state.request_id = request_id
+    started_at = time.perf_counter()
+    body = await request.body()
+    body_summary = summarize_http_body(body, request.headers.get("content-type"))
+
+    async def receive() -> dict:
+        return {"type": "http.request", "body": body, "more_body": False}
+
+    request._receive = receive
+    logger.info(
+        "request started method=%s path=%s query=%s client=%s headers=%s body=%s",
+        request.method,
+        request.url.path,
+        sanitize_value(dict(request.query_params)),
+        request.client.host if request.client else "-",
+        sanitize_headers(
+            {
+                key: value
+                for key, value in request.headers.items()
+                if key.lower()
+                in {
+                    "content-type",
+                    "content-length",
+                    "user-agent",
+                    "x-forwarded-for",
+                    "x-forwarded-proto",
+                    "x-request-id",
+                }
+            }
+        ),
+        body_summary,
+    )
+    try:
+        response = await call_next(request)
+    except Exception:
+        duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
+        logger.exception(
+            "request failed method=%s path=%s duration_ms=%s",
+            request.method,
+            request.url.path,
+            duration_ms,
+        )
+        reset_request_id(token)
+        raise
+
+    duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
+    response.headers.setdefault("X-Request-ID", request_id)
+    response.headers.setdefault("X-Content-Type-Options", "nosniff")
+    response.headers.setdefault("X-Frame-Options", "DENY")
+    response.headers.setdefault("Referrer-Policy", "no-referrer")
+    response.headers.setdefault("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
+    # Keep API responses non-executable and non-embeddable by default.
+    if request.url.path not in {"/docs", "/redoc"} and not request.url.path.startswith("/openapi"):
+        response.headers.setdefault(
+            "Content-Security-Policy",
+            "default-src 'none'; frame-ancestors 'none'; base-uri 'none'",
+        )
+    logger.info(
+        "request completed method=%s path=%s status=%s duration_ms=%s response_headers=%s",
+        request.method,
+        request.url.path,
+        response.status_code,
+        duration_ms,
+        sanitize_headers(
+            {
+                key: value
+                for key, value in response.headers.items()
+                if key.lower() in {"content-type", "content-length", "x-request-id"}
+            }
+        ),
+    )
+    reset_request_id(token)
+    return response
+
+
 @app.get("/health")
 async def health() -> dict:
     return {"status": "ok"}
 
+
+async def _run_background_task(
+    name: str, coroutine_factory: Callable[[], Awaitable[None]]
+) -> None:
+    token = bind_request_id(f"task-{name}")
+    logger.info("background task started task=%s", name)
+    try:
+        await coroutine_factory()
+        logger.warning("background task exited task=%s", name)
+    except asyncio.CancelledError:
+        logger.info("background task cancelled task=%s", name)
+        raise
+    except Exception:
+        logger.exception("background task crashed task=%s", name)
+        raise
+    finally:
+        reset_request_id(token)
+
+
+def _launch_background_task(name: str, coroutine_factory: Callable[[], Awaitable[None]]) -> None:
+    task = asyncio.create_task(
+        _run_background_task(name, coroutine_factory), name=f"magent:{name}"
+    )
+    _background_tasks.append(task)
+
+
 @app.on_event("startup")
 async def startup() -> None:
+    configure_logging(
+        settings.log_level,
+        settings.log_file,
+        log_file_max_bytes=settings.log_file_max_bytes,
+        log_file_backup_count=settings.log_file_backup_count,
+        log_http_client_level=settings.log_http_client_level,
+        log_background_sync_level=settings.log_background_sync_level,
+    )
+    logger.info("startup begin app=%s build=%s", settings.app_name, settings.site_build_number)
     init_db()
-    if settings.site_build_number and settings.site_build_number.strip():
-        set_setting("site_build_number", settings.site_build_number.strip())
     runtime = get_runtime_settings()
-    configure_logging(runtime.log_level, runtime.log_file)
-    asyncio.create_task(run_daily_jellyfin_sync())
-    asyncio.create_task(startup_warmup_requests_cache())
-    asyncio.create_task(run_requests_delta_loop())
-    asyncio.create_task(run_daily_requests_full_sync())
-    asyncio.create_task(run_daily_db_cleanup())
+    configure_logging(
+        runtime.log_level,
+        runtime.log_file,
+        log_file_max_bytes=runtime.log_file_max_bytes,
+        log_file_backup_count=runtime.log_file_backup_count,
+        log_http_client_level=runtime.log_http_client_level,
+        log_background_sync_level=runtime.log_background_sync_level,
+    )
+    logger.info(
+        "runtime settings applied log_level=%s log_file=%s log_file_max_bytes=%s log_file_backup_count=%s log_http_client_level=%s log_background_sync_level=%s request_source=%s",
+        runtime.log_level,
+        runtime.log_file,
+        runtime.log_file_max_bytes,
+        runtime.log_file_backup_count,
+        runtime.log_http_client_level,
+        runtime.log_background_sync_level,
+        runtime.requests_data_source,
+    )
+    _launch_background_task("jellyfin-sync", run_daily_jellyfin_sync)
+    _launch_background_task("requests-warmup", startup_warmup_requests_cache)
+    _launch_background_task("requests-delta-loop", run_requests_delta_loop)
+    _launch_background_task("requests-full-sync", run_daily_requests_full_sync)
+    _launch_background_task("db-cleanup", run_daily_db_cleanup)
+    logger.info("startup complete")
 
 
 app.include_router(requests_router)
 app.include_router(auth_router)
 app.include_router(admin_router)
+app.include_router(admin_events_router)
 app.include_router(images_router)
 app.include_router(branding_router)
 app.include_router(status_router)
 app.include_router(feedback_router)
 app.include_router(site_router)
+app.include_router(events_router)

backend/app/routers/events.py

@@ -0,0 +1,249 @@
+from __future__ import annotations
+
+import asyncio
+import json
+import time
+from datetime import datetime, timezone
+from typing import Any, Dict, Optional
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import StreamingResponse
+
+from ..auth import get_current_user_event_stream
+from . import requests as requests_router
+from .status import services_status
+
+router = APIRouter(prefix="/events", tags=["events"])
+
+
+def _sse_json(payload: Dict[str, Any]) -> str:
+    return f"data: {json.dumps(payload, ensure_ascii=True, separators=(',', ':'), default=str)}\n\n"
+
+
+def _jsonable(value: Any) -> Any:
+    if hasattr(value, "model_dump"):
+        try:
+            return value.model_dump(mode="json")
+        except TypeError:
+            return value.model_dump()
+    if hasattr(value, "dict"):
+        try:
+            return value.dict()
+        except TypeError:
+            return value
+    return value
+
+
+def _request_history_brief(entries: Any) -> list[dict[str, Any]]:
+    if not isinstance(entries, list):
+        return []
+    items: list[dict[str, Any]] = []
+    for entry in entries:
+        if not isinstance(entry, dict):
+            continue
+        items.append(
+            {
+                "request_id": entry.get("request_id"),
+                "state": entry.get("state"),
+                "state_reason": entry.get("state_reason"),
+                "created_at": entry.get("created_at"),
+            }
+        )
+    return items
+
+
+def _request_actions_brief(entries: Any) -> list[dict[str, Any]]:
+    if not isinstance(entries, list):
+        return []
+    items: list[dict[str, Any]] = []
+    for entry in entries:
+        if not isinstance(entry, dict):
+            continue
+        items.append(
+            {
+                "request_id": entry.get("request_id"),
+                "action_id": entry.get("action_id"),
+                "label": entry.get("label"),
+                "status": entry.get("status"),
+                "message": entry.get("message"),
+                "created_at": entry.get("created_at"),
+            }
+        )
+    return items
+
+
+@router.get("/stream")
+async def events_stream(
+    request: Request,
+    recent_days: int = 90,
+    user: Dict[str, Any] = Depends(get_current_user_event_stream),
+) -> StreamingResponse:
+    recent_days = max(0, min(int(recent_days or 90), 3650))
+    recent_take = 50 if user.get("role") == "admin" else 6
+
+    async def event_generator():
+        yield "retry: 2000\n\n"
+        last_recent_signature: Optional[str] = None
+        last_services_signature: Optional[str] = None
+        next_recent_at = 0.0
+        next_services_at = 0.0
+        heartbeat_counter = 0
+
+        while True:
+            if await request.is_disconnected():
+                break
+
+            now = time.monotonic()
+            sent_any = False
+
+            if now >= next_recent_at:
+                next_recent_at = now + 15.0
+                try:
+                    recent_payload = await requests_router.recent_requests(
+                        take=recent_take,
+                        skip=0,
+                        days=recent_days,
+                        user=user,
+                    )
+                    results = recent_payload.get("results") if isinstance(recent_payload, dict) else []
+                    payload = {
+                        "type": "home_recent",
+                        "ts": datetime.now(timezone.utc).isoformat(),
+                        "days": recent_days,
+                        "results": results if isinstance(results, list) else [],
+                    }
+                except Exception as exc:
+                    payload = {
+                        "type": "home_recent",
+                        "ts": datetime.now(timezone.utc).isoformat(),
+                        "days": recent_days,
+                        "error": str(exc),
+                    }
+                signature = json.dumps(payload, ensure_ascii=True, separators=(",", ":"), default=str)
+                if signature != last_recent_signature:
+                    last_recent_signature = signature
+                    yield _sse_json(payload)
+                    sent_any = True
+
+            if now >= next_services_at:
+                next_services_at = now + 30.0
+                try:
+                    status_payload = await services_status()
+                    payload = {
+                        "type": "home_services",
+                        "ts": datetime.now(timezone.utc).isoformat(),
+                        "status": status_payload,
+                    }
+                except Exception as exc:
+                    payload = {
+                        "type": "home_services",
+                        "ts": datetime.now(timezone.utc).isoformat(),
+                        "error": str(exc),
+                    }
+                signature = json.dumps(payload, ensure_ascii=True, separators=(",", ":"), default=str)
+                if signature != last_services_signature:
+                    last_services_signature = signature
+                    yield _sse_json(payload)
+                    sent_any = True
+
+            if sent_any:
+                heartbeat_counter = 0
+            else:
+                heartbeat_counter += 1
+                if heartbeat_counter >= 15:
+                    yield ": ping\n\n"
+                    heartbeat_counter = 0
+
+            await asyncio.sleep(1.0)
+
+    headers = {
+        "Cache-Control": "no-cache",
+        "Connection": "keep-alive",
+        "X-Accel-Buffering": "no",
+    }
+    return StreamingResponse(event_generator(), media_type="text/event-stream", headers=headers)
+
+
+@router.get("/requests/{request_id}/stream")
+async def request_events_stream(
+    request_id: str,
+    request: Request,
+    user: Dict[str, Any] = Depends(get_current_user_event_stream),
+) -> StreamingResponse:
+    request_id = str(request_id).strip()
+    if not request_id:
+        raise HTTPException(status_code=400, detail="Missing request id")
+
+    async def event_generator():
+        yield "retry: 2000\n\n"
+        last_signature: Optional[str] = None
+        next_refresh_at = 0.0
+        heartbeat_counter = 0
+
+        while True:
+            if await request.is_disconnected():
+                break
+
+            now = time.monotonic()
+            sent_any = False
+
+            if now >= next_refresh_at:
+                next_refresh_at = now + 2.0
+                try:
+                    snapshot = await requests_router.get_snapshot(request_id=request_id, user=user)
+                    history_payload = await requests_router.request_history(
+                        request_id=request_id, limit=5, user=user
+                    )
+                    actions_payload = await requests_router.request_actions(
+                        request_id=request_id, limit=5, user=user
+                    )
+                    payload = {
+                        "type": "request_live",
+                        "request_id": request_id,
+                        "ts": datetime.now(timezone.utc).isoformat(),
+                        "snapshot": _jsonable(snapshot),
+                        "history": _request_history_brief(
+                            history_payload.get("snapshots", []) if isinstance(history_payload, dict) else []
+                        ),
+                        "actions": _request_actions_brief(
+                            actions_payload.get("actions", []) if isinstance(actions_payload, dict) else []
+                        ),
+                    }
+                except HTTPException as exc:
+                    payload = {
+                        "type": "request_live",
+                        "request_id": request_id,
+                        "ts": datetime.now(timezone.utc).isoformat(),
+                        "error": str(exc.detail),
+                        "status_code": int(exc.status_code),
+                    }
+                except Exception as exc:
+                    payload = {
+                        "type": "request_live",
+                        "request_id": request_id,
+                        "ts": datetime.now(timezone.utc).isoformat(),
+                        "error": str(exc),
+                    }
+
+                signature = json.dumps(payload, ensure_ascii=True, separators=(",", ":"), default=str)
+                if signature != last_signature:
+                    last_signature = signature
+                    yield _sse_json(payload)
+                    sent_any = True
+
+            if sent_any:
+                heartbeat_counter = 0
+            else:
+                heartbeat_counter += 1
+                if heartbeat_counter >= 15:
+                    yield ": ping\n\n"
+                    heartbeat_counter = 0
+
+            await asyncio.sleep(1.0)
+
+    headers = {
+        "Cache-Control": "no-cache",
+        "Connection": "keep-alive",
+        "X-Accel-Buffering": "no",
+    }
+    return StreamingResponse(event_generator(), media_type="text/event-stream", headers=headers)

backend/app/routers/feedback.py

@@ -11,7 +11,10 @@ router = APIRouter(prefix="/feedback", tags=["feedback"], dependencies=[Depends(
 @router.post("")
 async def send_feedback(payload: Dict[str, Any], user: Dict[str, str] = Depends(get_current_user)) -> dict:
     runtime = get_runtime_settings()
-    webhook_url = runtime.discord_webhook_url
+    webhook_url = (
+        getattr(runtime, "magent_notify_discord_webhook_url", None)
+        or runtime.discord_webhook_url
+    )
     if not webhook_url:
         raise HTTPException(status_code=400, detail="Discord webhook not configured")
 

backend/app/routers/images.py

@@ -1,6 +1,8 @@
 import os
 import re
 import mimetypes
+import logging
+from typing import Optional
 from fastapi import APIRouter, HTTPException, Response
 from fastapi.responses import FileResponse, RedirectResponse
 import httpx
@@ -11,6 +13,7 @@ router = APIRouter(prefix="/images", tags=["images"])
 
 _TMDB_BASE = "https://image.tmdb.org/t/p"
 _ALLOWED_SIZES = {"w92", "w154", "w185", "w342", "w500", "w780", "original"}
+logger = logging.getLogger(__name__)
 
 
 def _safe_filename(path: str) -> str:
@@ -19,13 +22,24 @@ def _safe_filename(path: str) -> str:
     safe = re.sub(r"[^A-Za-z0-9_.-]", "_", trimmed)
     return safe or "image"
 
-
-async def cache_tmdb_image(path: str, size: str = "w342") -> bool:
+def tmdb_cache_path(path: str, size: str) -> Optional[str]:
     if not path or "://" in path or ".." in path:
-        return False
+        return None
     if not path.startswith("/"):
         path = f"/{path}"
     if size not in _ALLOWED_SIZES:
+        return None
+    cache_dir = os.path.join(os.getcwd(), "data", "artwork", "tmdb", size)
+    return os.path.join(cache_dir, _safe_filename(path))
+
+
+def is_tmdb_cached(path: str, size: str) -> bool:
+    file_path = tmdb_cache_path(path, size)
+    return bool(file_path and os.path.exists(file_path))
+
+
+async def cache_tmdb_image(path: str, size: str = "w342") -> bool:
+    if not path or "://" in path or ".." in path:
         return False
 
     runtime = get_runtime_settings()
@@ -33,9 +47,10 @@ async def cache_tmdb_image(path: str, size: str = "w342") -> bool:
     if cache_mode != "cache":
         return False
 
-    cache_dir = os.path.join(os.getcwd(), "data", "artwork", "tmdb", size)
-    os.makedirs(cache_dir, exist_ok=True)
-    file_path = os.path.join(cache_dir, _safe_filename(path))
+    file_path = tmdb_cache_path(path, size)
+    if not file_path:
+        return False
+    os.makedirs(os.path.dirname(file_path), exist_ok=True)
     if os.path.exists(file_path):
         return True
 
@@ -64,9 +79,10 @@ async def tmdb_image(path: str, size: str = "w342"):
     if cache_mode != "cache":
         return RedirectResponse(url=url)
 
-    cache_dir = os.path.join(os.getcwd(), "data", "artwork", "tmdb", size)
-    os.makedirs(cache_dir, exist_ok=True)
-    file_path = os.path.join(cache_dir, _safe_filename(path))
+    file_path = tmdb_cache_path(path, size)
+    if not file_path:
+        raise HTTPException(status_code=400, detail="Invalid image path")
+    os.makedirs(os.path.dirname(file_path), exist_ok=True)
     headers = {"Cache-Control": "public, max-age=86400"}
     if os.path.exists(file_path):
         media_type = mimetypes.guess_type(file_path)[0] or "image/jpeg"
@@ -77,6 +93,8 @@ async def tmdb_image(path: str, size: str = "w342"):
         if os.path.exists(file_path):
             media_type = mimetypes.guess_type(file_path)[0] or "image/jpeg"
             return FileResponse(file_path, media_type=media_type, headers=headers)
-        raise HTTPException(status_code=502, detail="Image cache failed")
-    except httpx.HTTPError as exc:
-        raise HTTPException(status_code=502, detail=f"Image fetch failed: {exc}") from exc
+        logger.warning("TMDB cache miss after fetch: path=%s size=%s", path, size)
+    except (httpx.HTTPError, OSError) as exc:
+        logger.warning("TMDB cache failed: path=%s size=%s error=%s", path, size, exc)
+
+    return RedirectResponse(url=url)

backend/app/routers/requests.py

@@ -3,6 +3,7 @@ import asyncio
 import httpx
 import json
 import logging
+import os
 import time
 from urllib.parse import quote
 from datetime import datetime, timezone, timedelta
@@ -17,7 +18,7 @@ from ..clients.prowlarr import ProwlarrClient
 from ..ai.triage import triage_snapshot
 from ..auth import get_current_user
 from ..runtime import get_runtime_settings
-from .images import cache_tmdb_image
+from .images import cache_tmdb_image, is_tmdb_cached
 from ..db import (
     save_action,
     get_recent_actions,
@@ -30,11 +31,16 @@ from ..db import (
     get_request_cache_last_updated,
     get_request_cache_count,
     get_request_cache_payloads,
+    get_request_cache_payloads_missing,
     repair_request_cache_titles,
     prune_duplicate_requests_cache,
     upsert_request_cache,
+    upsert_artwork_cache_status,
+    get_artwork_cache_missing_count,
+    get_artwork_cache_status_count,
     get_setting,
     set_setting,
+    update_artwork_cache_stats,
     cleanup_history,
 )
 from ..models import Snapshot, TriageResult, RequestType
@@ -65,11 +71,11 @@ _artwork_prefetch_state: Dict[str, Any] = {
     "processed": 0,
     "total": 0,
     "message": "",
+    "only_missing": False,
     "started_at": None,
     "finished_at": None,
 }
 _artwork_prefetch_task: Optional[asyncio.Task] = None
-_media_endpoint_supported: Optional[bool] = None
 
 STATUS_LABELS = {
     1: "Waiting for approval",
@@ -106,9 +112,34 @@ def _normalize_username(value: Any) -> Optional[str]:
     if not isinstance(value, str):
         return None
     normalized = value.strip().lower()
+    if not normalized:
+        return None
+    if "@" in normalized:
+        normalized = normalized.split("@", 1)[0]
     return normalized if normalized else None
 
 
+def _user_can_use_search_auto(user: Dict[str, Any]) -> bool:
+    if user.get("role") == "admin":
+        return True
+    return bool(user.get("auto_search_enabled", True))
+
+
+def _filter_snapshot_actions_for_user(snapshot: Snapshot, user: Dict[str, Any]) -> Snapshot:
+    if _user_can_use_search_auto(user):
+        return snapshot
+    snapshot.actions = [action for action in snapshot.actions if action.id != "search_auto"]
+    return snapshot
+
+
+def _quality_profile_id(value: Any) -> Optional[int]:
+    if isinstance(value, int):
+        return value
+    if isinstance(value, str) and value.strip().isdigit():
+        return int(value.strip())
+    return None
+
+
 def _request_matches_user(request_data: Any, username: str) -> bool:
     requested_by = None
     if isinstance(request_data, dict):
@@ -157,6 +188,21 @@ def _normalize_requested_by(request_data: Any) -> Optional[str]:
         normalized = normalized.split("@", 1)[0]
     return normalized
 
+def _extract_requested_by_id(request_data: Any) -> Optional[int]:
+    if not isinstance(request_data, dict):
+        return None
+    requested_by = request_data.get("requestedBy") or request_data.get("requestedByUser")
+    if isinstance(requested_by, dict):
+        for key in ("id", "userId", "Id"):
+            value = requested_by.get(key)
+            if value is None:
+                continue
+            try:
+                return int(value)
+            except (TypeError, ValueError):
+                continue
+    return None
+
 
 def _format_upstream_error(service: str, exc: httpx.HTTPStatusError) -> str:
     response = exc.response
@@ -199,6 +245,7 @@ def _parse_request_payload(item: Dict[str, Any]) -> Dict[str, Any]:
     updated_at = item.get("updatedAt") or created_at
     requested_by = _request_display_name(item)
     requested_by_norm = _normalize_requested_by(item)
+    requested_by_id = _extract_requested_by_id(item)
     return {
         "request_id": item.get("id"),
         "media_id": media_id,
@@ -209,6 +256,7 @@ def _parse_request_payload(item: Dict[str, Any]) -> Dict[str, Any]:
         "year": year,
         "requested_by": requested_by,
         "requested_by_norm": requested_by_norm,
+        "requested_by_id": requested_by_id,
         "created_at": created_at,
         "updated_at": updated_at,
     }
@@ -227,6 +275,108 @@ def _extract_artwork_paths(item: Dict[str, Any]) -> tuple[Optional[str], Optiona
         backdrop_path = item.get("backdropPath") or item.get("backdrop_path")
     return poster_path, backdrop_path
 
+def _extract_tmdb_lookup(payload: Dict[str, Any]) -> tuple[Optional[int], Optional[str]]:
+    media = payload.get("media") or {}
+    if not isinstance(media, dict):
+        media = {}
+    tmdb_id = media.get("tmdbId") or payload.get("tmdbId")
+    media_type = (
+        media.get("mediaType")
+        or payload.get("mediaType")
+        or payload.get("type")
+    )
+    try:
+        tmdb_id = int(tmdb_id) if tmdb_id is not None else None
+    except (TypeError, ValueError):
+        tmdb_id = None
+    if isinstance(media_type, str):
+        media_type = media_type.strip().lower() or None
+    else:
+        media_type = None
+    return tmdb_id, media_type
+
+
+def _artwork_missing_for_payload(payload: Dict[str, Any]) -> bool:
+    poster_path, backdrop_path = _extract_artwork_paths(payload)
+    tmdb_id, media_type = _extract_tmdb_lookup(payload)
+    can_hydrate = bool(tmdb_id and media_type)
+    if poster_path:
+        if not is_tmdb_cached(poster_path, "w185") or not is_tmdb_cached(poster_path, "w342"):
+            return True
+    elif can_hydrate:
+        return True
+    if backdrop_path:
+        if not is_tmdb_cached(backdrop_path, "w780"):
+            return True
+    elif can_hydrate:
+        return True
+    return False
+
+
+def _compute_cached_flags(
+    poster_path: Optional[str],
+    backdrop_path: Optional[str],
+    cache_mode: str,
+    poster_cached: Optional[bool] = None,
+    backdrop_cached: Optional[bool] = None,
+) -> tuple[bool, bool]:
+    if cache_mode != "cache":
+        return True, True
+    poster = poster_cached
+    backdrop = backdrop_cached
+    if poster is None:
+        poster = bool(poster_path) and is_tmdb_cached(poster_path, "w185") and is_tmdb_cached(
+            poster_path, "w342"
+        )
+    if backdrop is None:
+        backdrop = bool(backdrop_path) and is_tmdb_cached(backdrop_path, "w780")
+    return bool(poster), bool(backdrop)
+
+
+def _upsert_artwork_status(
+    payload: Dict[str, Any],
+    cache_mode: str,
+    poster_cached: Optional[bool] = None,
+    backdrop_cached: Optional[bool] = None,
+) -> None:
+    parsed = _parse_request_payload(payload)
+    request_id = parsed.get("request_id")
+    if not isinstance(request_id, int):
+        return
+    tmdb_id, media_type = _extract_tmdb_lookup(payload)
+    poster_path, backdrop_path = _extract_artwork_paths(payload)
+    has_tmdb = bool(tmdb_id and media_type)
+    poster_cached_flag, backdrop_cached_flag = _compute_cached_flags(
+        poster_path, backdrop_path, cache_mode, poster_cached, backdrop_cached
+    )
+    upsert_artwork_cache_status(
+        request_id=request_id,
+        tmdb_id=tmdb_id,
+        media_type=media_type,
+        poster_path=poster_path,
+        backdrop_path=backdrop_path,
+        has_tmdb=has_tmdb,
+        poster_cached=poster_cached_flag,
+        backdrop_cached=backdrop_cached_flag,
+    )
+
+
+def _collect_artwork_cache_disk_stats() -> tuple[int, int]:
+    cache_root = os.path.join(os.getcwd(), "data", "artwork")
+    total_bytes = 0
+    total_files = 0
+    if not os.path.isdir(cache_root):
+        return 0, 0
+    for root, _, files in os.walk(cache_root):
+        for name in files:
+            path = os.path.join(root, name)
+            try:
+                total_bytes += os.path.getsize(path)
+                total_files += 1
+            except OSError:
+                continue
+    return total_bytes, total_files
+
 
 async def _get_request_details(client: JellyseerrClient, request_id: int) -> Optional[Dict[str, Any]]:
     cache_key = f"request:{request_id}"
@@ -268,23 +418,6 @@ async def _hydrate_title_from_tmdb(
     return None, None
 
 
-async def _hydrate_media_details(client: JellyseerrClient, media_id: Optional[int]) -> Optional[Dict[str, Any]]:
-    if not media_id:
-        return None
-    global _media_endpoint_supported
-    if _media_endpoint_supported is False:
-        return None
-    try:
-        details = await client.get_media(int(media_id))
-    except httpx.HTTPStatusError as exc:
-        if exc.response is not None and exc.response.status_code == 405:
-            _media_endpoint_supported = False
-            logger.info("Jellyseerr media endpoint rejected GET requests; skipping media lookups.")
-        return None
-    _media_endpoint_supported = True
-    return details if isinstance(details, dict) else None
-
-
 async def _hydrate_artwork_from_tmdb(
     client: JellyseerrClient, media_type: Optional[str], tmdb_id: Optional[int]
 ) -> tuple[Optional[str], Optional[str]]:
@@ -360,7 +493,7 @@ async def _sync_all_requests(client: JellyseerrClient) -> int:
     skip = 0
     stored = 0
     cache_mode = (get_runtime_settings().artwork_cache_mode or "remote").lower()
-    logger.info("Jellyseerr sync starting: take=%s", take)
+    logger.info("Seerr sync starting: take=%s", take)
     _sync_state.update(
         {
             "status": "running",
@@ -376,11 +509,11 @@ async def _sync_all_requests(client: JellyseerrClient) -> int:
         try:
             response = await client.get_recent_requests(take=take, skip=skip)
         except httpx.HTTPError as exc:
-            logger.warning("Jellyseerr sync failed at skip=%s: %s", skip, exc)
+            logger.warning("Seerr sync failed at skip=%s: %s", skip, exc)
             _sync_state.update({"status": "failed", "message": f"Sync failed: {exc}"})
             break
         if not isinstance(response, dict):
-            logger.warning("Jellyseerr sync stopped: non-dict response at skip=%s", skip)
+            logger.warning("Seerr sync stopped: non-dict response at skip=%s", skip)
             _sync_state.update({"status": "failed", "message": "Invalid response"})
             break
         if _sync_state["total"] is None:
@@ -395,7 +528,7 @@ async def _sync_all_requests(client: JellyseerrClient) -> int:
                 _sync_state["total"] = total
         items = response.get("results") or []
         if not isinstance(items, list) or not items:
-            logger.info("Jellyseerr sync completed: no more results at skip=%s", skip)
+            logger.info("Seerr sync completed: no more results at skip=%s", skip)
             break
         for item in items:
             if not isinstance(item, dict):
@@ -408,38 +541,18 @@ async def _sync_all_requests(client: JellyseerrClient) -> int:
                     cached = get_request_cache_by_id(request_id)
                     if cached and cached.get("title"):
                         cached_title = cached.get("title")
-                if not payload.get("title") or not payload.get("media_id"):
-                    logger.debug("Jellyseerr sync hydrate request_id=%s", request_id)
+                needs_details = (
+                    not payload.get("title")
+                    or not payload.get("media_id")
+                    or not payload.get("tmdb_id")
+                    or not payload.get("media_type")
+                )
+                if needs_details:
+                    logger.debug("Seerr sync hydrate request_id=%s", request_id)
                     details = await _get_request_details(client, request_id)
                     if isinstance(details, dict):
                         payload = _parse_request_payload(details)
                         item = details
-                if (
-                    not payload.get("title")
-                    and payload.get("media_id")
-                    and (not payload.get("tmdb_id") or not payload.get("media_type"))
-                ):
-                    media_details = await _hydrate_media_details(client, payload.get("media_id"))
-                    if isinstance(media_details, dict):
-                        media_title = media_details.get("title") or media_details.get("name")
-                        if media_title:
-                            payload["title"] = media_title
-                        if not payload.get("year") and media_details.get("year"):
-                            payload["year"] = media_details.get("year")
-                        if not payload.get("tmdb_id") and media_details.get("tmdbId"):
-                            payload["tmdb_id"] = media_details.get("tmdbId")
-                        if not payload.get("media_type") and media_details.get("mediaType"):
-                            payload["media_type"] = media_details.get("mediaType")
-                        if isinstance(item, dict):
-                            existing_media = item.get("media")
-                            if isinstance(existing_media, dict):
-                                merged = dict(media_details)
-                                for key, value in existing_media.items():
-                                    if value is not None:
-                                        merged[key] = value
-                                item["media"] = merged
-                            else:
-                                item["media"] = media_details
                 poster_path, backdrop_path = _extract_artwork_paths(item)
                 if cache_mode == "cache" and not (poster_path or backdrop_path):
                     details = await _get_request_details(client, request_id)
@@ -468,19 +581,22 @@ async def _sync_all_requests(client: JellyseerrClient) -> int:
                 year=payload.get("year"),
                 requested_by=payload.get("requested_by"),
                 requested_by_norm=payload.get("requested_by_norm"),
+                requested_by_id=payload.get("requested_by_id"),
                 created_at=payload.get("created_at"),
                 updated_at=payload.get("updated_at"),
                 payload_json=payload_json,
             )
+            if isinstance(item, dict):
+                _upsert_artwork_status(item, cache_mode)
             stored += 1
             _sync_state["stored"] = stored
         if len(items) < take:
-            logger.info("Jellyseerr sync completed: stored=%s", stored)
+            logger.info("Seerr sync completed: stored=%s", stored)
             break
         skip += take
         _sync_state["skip"] = skip
         _sync_state["message"] = f"Synced {stored} requests"
-        logger.info("Jellyseerr sync progress: stored=%s skip=%s", stored, skip)
+        logger.debug("Seerr sync progress: stored=%s skip=%s", stored, skip)
     _sync_state.update(
         {
             "status": "completed",
@@ -491,6 +607,11 @@ async def _sync_all_requests(client: JellyseerrClient) -> int:
     )
     set_setting(_sync_last_key, datetime.now(timezone.utc).isoformat())
     _refresh_recent_cache_from_db()
+    if cache_mode == "cache":
+        update_artwork_cache_stats(
+            missing_count=get_artwork_cache_missing_count(),
+            total_requests=get_request_cache_count(),
+        )
     return stored
 
 
@@ -500,7 +621,7 @@ async def _sync_delta_requests(client: JellyseerrClient) -> int:
     stored = 0
     unchanged_pages = 0
     cache_mode = (get_runtime_settings().artwork_cache_mode or "remote").lower()
-    logger.info("Jellyseerr delta sync starting: take=%s", take)
+    logger.info("Seerr delta sync starting: take=%s", take)
     _sync_state.update(
         {
             "status": "running",
@@ -516,16 +637,16 @@ async def _sync_delta_requests(client: JellyseerrClient) -> int:
         try:
             response = await client.get_recent_requests(take=take, skip=skip)
         except httpx.HTTPError as exc:
-            logger.warning("Jellyseerr delta sync failed at skip=%s: %s", skip, exc)
+            logger.warning("Seerr delta sync failed at skip=%s: %s", skip, exc)
             _sync_state.update({"status": "failed", "message": f"Delta sync failed: {exc}"})
             break
         if not isinstance(response, dict):
-            logger.warning("Jellyseerr delta sync stopped: non-dict response at skip=%s", skip)
+            logger.warning("Seerr delta sync stopped: non-dict response at skip=%s", skip)
             _sync_state.update({"status": "failed", "message": "Invalid response"})
             break
         items = response.get("results") or []
         if not isinstance(items, list) or not items:
-            logger.info("Jellyseerr delta sync completed: no more results at skip=%s", skip)
+            logger.info("Seerr delta sync completed: no more results at skip=%s", skip)
             break
         page_changed = False
         for item in items:
@@ -539,37 +660,17 @@ async def _sync_delta_requests(client: JellyseerrClient) -> int:
                 cached_title = cached.get("title") if cached else None
                 if cached and incoming_updated and cached.get("updated_at") == incoming_updated and cached.get("title"):
                     continue
-                if not payload.get("title") or not payload.get("media_id"):
+                needs_details = (
+                    not payload.get("title")
+                    or not payload.get("media_id")
+                    or not payload.get("tmdb_id")
+                    or not payload.get("media_type")
+                )
+                if needs_details:
                     details = await _get_request_details(client, request_id)
                     if isinstance(details, dict):
                         payload = _parse_request_payload(details)
                         item = details
-                if (
-                    not payload.get("title")
-                    and payload.get("media_id")
-                    and (not payload.get("tmdb_id") or not payload.get("media_type"))
-                ):
-                    media_details = await _hydrate_media_details(client, payload.get("media_id"))
-                    if isinstance(media_details, dict):
-                        media_title = media_details.get("title") or media_details.get("name")
-                        if media_title:
-                            payload["title"] = media_title
-                        if not payload.get("year") and media_details.get("year"):
-                            payload["year"] = media_details.get("year")
-                        if not payload.get("tmdb_id") and media_details.get("tmdbId"):
-                            payload["tmdb_id"] = media_details.get("tmdbId")
-                        if not payload.get("media_type") and media_details.get("mediaType"):
-                            payload["media_type"] = media_details.get("mediaType")
-                        if isinstance(item, dict):
-                            existing_media = item.get("media")
-                            if isinstance(existing_media, dict):
-                                merged = dict(media_details)
-                                for key, value in existing_media.items():
-                                    if value is not None:
-                                        merged[key] = value
-                                item["media"] = merged
-                            else:
-                                item["media"] = media_details
                 poster_path, backdrop_path = _extract_artwork_paths(item)
                 if cache_mode == "cache" and not (poster_path or backdrop_path):
                     details = await _get_request_details(client, request_id)
@@ -598,10 +699,13 @@ async def _sync_delta_requests(client: JellyseerrClient) -> int:
                 year=payload.get("year"),
                 requested_by=payload.get("requested_by"),
                 requested_by_norm=payload.get("requested_by_norm"),
+                requested_by_id=payload.get("requested_by_id"),
                 created_at=payload.get("created_at"),
                 updated_at=payload.get("updated_at"),
                 payload_json=payload_json,
             )
+            if isinstance(item, dict):
+                _upsert_artwork_status(item, cache_mode)
             stored += 1
             page_changed = True
             _sync_state["stored"] = stored
@@ -610,15 +714,15 @@ async def _sync_delta_requests(client: JellyseerrClient) -> int:
         else:
             unchanged_pages = 0
         if len(items) < take or unchanged_pages >= 2:
-            logger.info("Jellyseerr delta sync completed: stored=%s", stored)
+            logger.info("Seerr delta sync completed: stored=%s", stored)
             break
         skip += take
         _sync_state["skip"] = skip
         _sync_state["message"] = f"Delta synced {stored} requests"
-        logger.info("Jellyseerr delta sync progress: stored=%s skip=%s", stored, skip)
+        logger.debug("Seerr delta sync progress: stored=%s skip=%s", stored, skip)
     deduped = prune_duplicate_requests_cache()
     if deduped:
-        logger.info("Jellyseerr delta sync removed duplicate rows: %s", deduped)
+        logger.info("Seerr delta sync removed duplicate rows: %s", deduped)
     _sync_state.update(
         {
             "status": "completed",
@@ -629,10 +733,20 @@ async def _sync_delta_requests(client: JellyseerrClient) -> int:
     )
     set_setting(_sync_last_key, datetime.now(timezone.utc).isoformat())
     _refresh_recent_cache_from_db()
+    if cache_mode == "cache":
+        update_artwork_cache_stats(
+            missing_count=get_artwork_cache_missing_count(),
+            total_requests=get_request_cache_count(),
+        )
     return stored
 
 
-async def _prefetch_artwork_cache(client: JellyseerrClient) -> None:
+async def _prefetch_artwork_cache(
+    client: JellyseerrClient,
+    only_missing: bool = False,
+    total: Optional[int] = None,
+    use_missing_query: bool = False,
+) -> None:
     runtime = get_runtime_settings()
     cache_mode = (runtime.artwork_cache_mode or "remote").lower()
     if cache_mode != "cache":
@@ -645,74 +759,101 @@ async def _prefetch_artwork_cache(client: JellyseerrClient) -> None:
         )
         return
 
-    total = get_request_cache_count()
+    total = total if total is not None else get_request_cache_count()
     _artwork_prefetch_state.update(
         {
             "status": "running",
             "processed": 0,
             "total": total,
-            "message": "Starting artwork prefetch",
+            "message": "Starting missing artwork prefetch"
+            if only_missing
+            else "Starting artwork prefetch",
+            "only_missing": only_missing,
             "started_at": datetime.now(timezone.utc).isoformat(),
             "finished_at": None,
         }
     )
+    if only_missing and total == 0:
+        _artwork_prefetch_state.update(
+            {
+                "status": "completed",
+                "processed": 0,
+                "message": "No missing artwork to cache.",
+                "finished_at": datetime.now(timezone.utc).isoformat(),
+            }
+        )
+        return
     offset = 0
     limit = 200
     processed = 0
     while True:
-        batch = get_request_cache_payloads(limit=limit, offset=offset)
+        if use_missing_query:
+            batch = get_request_cache_payloads_missing(limit=limit, offset=offset)
+        else:
+            batch = get_request_cache_payloads(limit=limit, offset=offset)
         if not batch:
             break
         for row in batch:
             payload = row.get("payload")
             if not isinstance(payload, dict):
-                processed += 1
+                if not only_missing:
+                    processed += 1
+                continue
+            if only_missing and not use_missing_query and not _artwork_missing_for_payload(payload):
                 continue
             poster_path, backdrop_path = _extract_artwork_paths(payload)
-            if not (poster_path or backdrop_path) and client.configured():
+            tmdb_id, media_type = _extract_tmdb_lookup(payload)
+            if (not poster_path or not backdrop_path) and client.configured() and tmdb_id and media_type:
                 media = payload.get("media") or {}
-                tmdb_id = media.get("tmdbId") or payload.get("tmdbId")
-                media_type = media.get("mediaType") or payload.get("type")
-                if tmdb_id and media_type:
-                    hydrated_poster, hydrated_backdrop = await _hydrate_artwork_from_tmdb(
-                        client, media_type, tmdb_id
-                    )
-                    poster_path = poster_path or hydrated_poster
-                    backdrop_path = backdrop_path or hydrated_backdrop
-                    if hydrated_poster or hydrated_backdrop:
-                        media = dict(media) if isinstance(media, dict) else {}
-                        if hydrated_poster:
-                            media["posterPath"] = hydrated_poster
-                        if hydrated_backdrop:
-                            media["backdropPath"] = hydrated_backdrop
-                        payload["media"] = media
-                        parsed = _parse_request_payload(payload)
-                        request_id = parsed.get("request_id")
-                        if isinstance(request_id, int):
-                            upsert_request_cache(
-                                request_id=request_id,
-                                media_id=parsed.get("media_id"),
-                                media_type=parsed.get("media_type"),
-                                status=parsed.get("status"),
-                                title=parsed.get("title"),
-                                year=parsed.get("year"),
-                                requested_by=parsed.get("requested_by"),
-                                requested_by_norm=parsed.get("requested_by_norm"),
-                                created_at=parsed.get("created_at"),
-                                updated_at=parsed.get("updated_at"),
-                                payload_json=json.dumps(payload, ensure_ascii=True),
-                            )
+                hydrated_poster, hydrated_backdrop = await _hydrate_artwork_from_tmdb(
+                    client, media_type, tmdb_id
+                )
+                poster_path = poster_path or hydrated_poster
+                backdrop_path = backdrop_path or hydrated_backdrop
+                if hydrated_poster or hydrated_backdrop:
+                    media = dict(media) if isinstance(media, dict) else {}
+                    if hydrated_poster:
+                        media["posterPath"] = hydrated_poster
+                    if hydrated_backdrop:
+                        media["backdropPath"] = hydrated_backdrop
+                    payload["media"] = media
+                    parsed = _parse_request_payload(payload)
+                    request_id = parsed.get("request_id")
+                    if isinstance(request_id, int):
+                        upsert_request_cache(
+                            request_id=request_id,
+                            media_id=parsed.get("media_id"),
+                            media_type=parsed.get("media_type"),
+                            status=parsed.get("status"),
+                            title=parsed.get("title"),
+                            year=parsed.get("year"),
+                            requested_by=parsed.get("requested_by"),
+                            requested_by_norm=parsed.get("requested_by_norm"),
+                            requested_by_id=parsed.get("requested_by_id"),
+                            created_at=parsed.get("created_at"),
+                            updated_at=parsed.get("updated_at"),
+                            payload_json=json.dumps(payload, ensure_ascii=True),
+                        )
+            poster_cached_flag = False
+            backdrop_cached_flag = False
             if poster_path:
                 try:
-                    await cache_tmdb_image(poster_path, "w185")
-                    await cache_tmdb_image(poster_path, "w342")
+                    poster_cached_flag = bool(
+                        await cache_tmdb_image(poster_path, "w185")
+                    ) and bool(await cache_tmdb_image(poster_path, "w342"))
                 except httpx.HTTPError:
-                    pass
+                    poster_cached_flag = False
             if backdrop_path:
                 try:
-                    await cache_tmdb_image(backdrop_path, "w780")
+                    backdrop_cached_flag = bool(await cache_tmdb_image(backdrop_path, "w780"))
                 except httpx.HTTPError:
-                    pass
+                    backdrop_cached_flag = False
+            _upsert_artwork_status(
+                payload,
+                cache_mode,
+                poster_cached=poster_cached_flag if poster_path else None,
+                backdrop_cached=backdrop_cached_flag if backdrop_path else None,
+            )
             processed += 1
             if processed % 25 == 0:
                 _artwork_prefetch_state.update(
@@ -720,6 +861,15 @@ async def _prefetch_artwork_cache(client: JellyseerrClient) -> None:
                 )
         offset += limit
 
+    total_requests = get_request_cache_count()
+    missing_count = get_artwork_cache_missing_count()
+    cache_bytes, cache_files = _collect_artwork_cache_disk_stats()
+    update_artwork_cache_stats(
+        cache_bytes=cache_bytes,
+        cache_files=cache_files,
+        missing_count=missing_count,
+        total_requests=total_requests,
+    )
     _artwork_prefetch_state.update(
         {
             "status": "completed",
@@ -730,25 +880,52 @@ async def _prefetch_artwork_cache(client: JellyseerrClient) -> None:
     )
 
 
-async def start_artwork_prefetch(base_url: Optional[str], api_key: Optional[str]) -> Dict[str, Any]:
+async def start_artwork_prefetch(
+    base_url: Optional[str], api_key: Optional[str], only_missing: bool = False
+) -> Dict[str, Any]:
     global _artwork_prefetch_task
     if _artwork_prefetch_task and not _artwork_prefetch_task.done():
         return dict(_artwork_prefetch_state)
     client = JellyseerrClient(base_url, api_key)
+    status_count = get_artwork_cache_status_count()
+    total_requests = get_request_cache_count()
+    use_missing_query = only_missing and status_count >= total_requests and total_requests > 0
+    if only_missing and use_missing_query:
+        total = get_artwork_cache_missing_count()
+    else:
+        total = total_requests
     _artwork_prefetch_state.update(
         {
             "status": "running",
             "processed": 0,
-            "total": get_request_cache_count(),
-            "message": "Starting artwork prefetch",
+            "total": total,
+            "message": "Seeding artwork cache status"
+            if only_missing and not use_missing_query
+            else ("Starting missing artwork prefetch" if only_missing else "Starting artwork prefetch"),
+            "only_missing": only_missing,
             "started_at": datetime.now(timezone.utc).isoformat(),
             "finished_at": None,
         }
     )
+    if only_missing and total == 0:
+        _artwork_prefetch_state.update(
+            {
+                "status": "completed",
+                "processed": 0,
+                "message": "No missing artwork to cache.",
+                "finished_at": datetime.now(timezone.utc).isoformat(),
+            }
+        )
+        return dict(_artwork_prefetch_state)
 
     async def _runner() -> None:
         try:
-            await _prefetch_artwork_cache(client)
+            await _prefetch_artwork_cache(
+                client,
+                only_missing=only_missing,
+                total=total,
+                use_missing_query=use_missing_query,
+            )
         except Exception:
             logger.exception("Artwork prefetch failed")
             _artwork_prefetch_state.update(
@@ -795,19 +972,39 @@ def _recent_cache_stale() -> bool:
     return (datetime.now(timezone.utc) - parsed).total_seconds() > RECENT_CACHE_TTL_SECONDS
 
 
+def _parse_iso_datetime(value: Optional[str]) -> Optional[datetime]:
+    if not value:
+        return None
+    try:
+        parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        return parsed.replace(tzinfo=timezone.utc)
+    return parsed
+
+
 def _get_recent_from_cache(
     requested_by_norm: Optional[str],
+    requested_by_id: Optional[int],
     limit: int,
     offset: int,
     since_iso: Optional[str],
 ) -> List[Dict[str, Any]]:
     items = _recent_cache.get("items") or []
     results = []
+    since_dt = _parse_iso_datetime(since_iso)
     for item in items:
-        if requested_by_norm and item.get("requested_by_norm") != requested_by_norm:
-            continue
-        if since_iso and item.get("created_at") and item["created_at"] < since_iso:
+        if requested_by_id is not None:
+            if item.get("requested_by_id") != requested_by_id:
+                continue
+        elif requested_by_norm and item.get("requested_by_norm") != requested_by_norm:
             continue
+        if since_dt:
+            candidate = item.get("created_at") or item.get("updated_at")
+            item_dt = _parse_iso_datetime(candidate)
+            if not item_dt or item_dt < since_dt:
+                continue
         results.append(item)
     return results[offset : offset + limit]
 
@@ -863,7 +1060,7 @@ async def run_daily_requests_full_sync() -> None:
         runtime = get_runtime_settings()
         client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
         if not client.configured():
-            logger.info("Daily full sync skipped: Jellyseerr not configured.")
+            logger.info("Daily full sync skipped: Seerr not configured.")
             continue
         if _sync_task and not _sync_task.done():
             logger.info("Daily full sync skipped: another sync is running.")
@@ -889,7 +1086,7 @@ async def start_requests_sync(base_url: Optional[str], api_key: Optional[str]) -
     if _sync_task and not _sync_task.done():
         return dict(_sync_state)
     if not base_url:
-        _sync_state.update({"status": "failed", "message": "Jellyseerr not configured"})
+        _sync_state.update({"status": "failed", "message": "Seerr not configured"})
         return dict(_sync_state)
     client = JellyseerrClient(base_url, api_key)
     _sync_state.update(
@@ -908,7 +1105,7 @@ async def start_requests_sync(base_url: Optional[str], api_key: Optional[str]) -
         try:
             await _sync_all_requests(client)
         except Exception as exc:
-            logger.exception("Jellyseerr sync failed")
+            logger.exception("Seerr sync failed")
             _sync_state.update(
                 {
                     "status": "failed",
@@ -926,7 +1123,7 @@ async def start_requests_delta_sync(base_url: Optional[str], api_key: Optional[s
     if _sync_task and not _sync_task.done():
         return dict(_sync_state)
     if not base_url:
-        _sync_state.update({"status": "failed", "message": "Jellyseerr not configured"})
+        _sync_state.update({"status": "failed", "message": "Seerr not configured"})
         return dict(_sync_state)
     client = JellyseerrClient(base_url, api_key)
     _sync_state.update(
@@ -945,7 +1142,7 @@ async def start_requests_delta_sync(base_url: Optional[str], api_key: Optional[s
         try:
             await _sync_delta_requests(client)
         except Exception as exc:
-            logger.exception("Jellyseerr delta sync failed")
+            logger.exception("Seerr delta sync failed")
             _sync_state.update(
                 {
                     "status": "failed",
@@ -1242,7 +1439,8 @@ async def get_snapshot(request_id: str, user: Dict[str, str] = Depends(get_curre
     client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
     if client.configured():
         await _ensure_request_access(client, int(request_id), user)
-    return await build_snapshot(request_id)
+    snapshot = await build_snapshot(request_id)
+    return _filter_snapshot_actions_for_user(snapshot, user)
 
 
 @router.get("/recent")
@@ -1258,23 +1456,25 @@ async def recent_requests(
     allow_remote = mode == "always_js"
     if allow_remote:
         if not client.configured():
-            raise HTTPException(status_code=400, detail="Jellyseerr not configured")
+            raise HTTPException(status_code=400, detail="Seerr not configured")
         try:
             await _ensure_requests_cache(client)
         except httpx.HTTPStatusError as exc:
             raise HTTPException(status_code=502, detail=str(exc)) from exc
 
     username_norm = _normalize_username(user.get("username", ""))
+    requested_by_id = user.get("jellyseerr_user_id")
     requested_by = None if user.get("role") == "admin" else username_norm
+    requested_by_id = None if user.get("role") == "admin" else requested_by_id
     since_iso = None
     if days > 0:
         since_iso = (datetime.now(timezone.utc) - timedelta(days=days)).isoformat()
     if _recent_cache_stale():
         _refresh_recent_cache_from_db()
-    rows = _get_recent_from_cache(requested_by, take, skip, since_iso)
+    rows = _get_recent_from_cache(requested_by, requested_by_id, take, skip, since_iso)
     cache_mode = (runtime.artwork_cache_mode or "remote").lower()
     allow_title_hydrate = False
-    allow_artwork_hydrate = allow_remote
+    allow_artwork_hydrate = client.configured()
     jellyfin = JellyfinClient(runtime.jellyfin_base_url, runtime.jellyfin_api_key)
     jellyfin_cache: Dict[str, bool] = {}
 
@@ -1347,6 +1547,7 @@ async def recent_requests(
                         year=year or payload.get("year"),
                         requested_by=payload.get("requested_by"),
                         requested_by_norm=payload.get("requested_by_norm"),
+                        requested_by_id=payload.get("requested_by_id"),
                         created_at=payload.get("created_at"),
                         updated_at=payload.get("updated_at"),
                         payload_json=json.dumps(details, ensure_ascii=True),
@@ -1394,6 +1595,7 @@ async def recent_requests(
                             year=payload.get("year"),
                             requested_by=payload.get("requested_by"),
                             requested_by_norm=payload.get("requested_by_norm"),
+                            requested_by_id=payload.get("requested_by_id"),
                             created_at=payload.get("created_at"),
                             updated_at=payload.get("updated_at"),
                             payload_json=json.dumps(details, ensure_ascii=True),
@@ -1412,6 +1614,7 @@ async def recent_requests(
                 "status": status,
                 "statusLabel": status_label,
                 "mediaId": row.get("media_id"),
+                "createdAt": row.get("created_at") or row.get("updated_at"),
                 "artwork": {
                     "poster_url": _artwork_url(poster_path, "w185", cache_mode),
                     "backdrop_url": _artwork_url(backdrop_path, "w780", cache_mode),
@@ -1429,7 +1632,7 @@ async def search_requests(
     runtime = get_runtime_settings()
     client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
     if not client.configured():
-        raise HTTPException(status_code=400, detail="Jellyseerr not configured")
+        raise HTTPException(status_code=400, detail="Seerr not configured")
 
     try:
         response = await client.search(query=query, page=page)
@@ -1466,8 +1669,14 @@ async def search_requests(
             status_label = _status_label(status)
         elif isinstance(media_info_id, int):
             username_norm = _normalize_username(user.get("username", ""))
+            requested_by_id = user.get("jellyseerr_user_id")
             requested_by = None if user.get("role") == "admin" else username_norm
-            cached = get_cached_request_by_media_id(media_info_id, requested_by_norm=requested_by)
+            requested_by_id = None if user.get("role") == "admin" else requested_by_id
+            cached = get_cached_request_by_media_id(
+                media_info_id,
+                requested_by_norm=requested_by,
+                requested_by_id=requested_by_id,
+            )
             if cached:
                 request_id = cached.get("request_id")
                 status = cached.get("status")
@@ -1502,7 +1711,7 @@ async def ai_triage(request_id: str, user: Dict[str, str] = Depends(get_current_
     client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
     if client.configured():
         await _ensure_request_access(client, int(request_id), user)
-    snapshot = await build_snapshot(request_id)
+    snapshot = _filter_snapshot_actions_for_user(await build_snapshot(request_id), user)
     return triage_snapshot(snapshot)
 
 
@@ -1539,6 +1748,8 @@ async def action_search(request_id: str, user: Dict[str, str] = Depends(get_curr
 
 @router.post("/{request_id}/actions/search_auto")
 async def action_search_auto(request_id: str, user: Dict[str, str] = Depends(get_current_user)) -> dict:
+    if not _user_can_use_search_auto(user):
+        raise HTTPException(status_code=403, detail="Auto search and download is disabled for this user")
     runtime = get_runtime_settings()
     client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
     if client.configured():
@@ -1552,10 +1763,23 @@ async def action_search_auto(request_id: str, user: Dict[str, str] = Depends(get
         client = SonarrClient(runtime.sonarr_base_url, runtime.sonarr_api_key)
         if not client.configured():
             raise HTTPException(status_code=400, detail="Sonarr not configured")
+        target_profile_id = _quality_profile_id(runtime.sonarr_quality_profile_id)
+        current_profile_id = _quality_profile_id(arr_item.get("qualityProfileId"))
+        profile_message = None
+        series_id = _quality_profile_id(arr_item.get("id"))
+        if target_profile_id and series_id and current_profile_id != target_profile_id:
+            series = await client.get_series(series_id)
+            if not isinstance(series, dict):
+                raise HTTPException(status_code=502, detail="Could not load Sonarr series before search")
+            series["qualityProfileId"] = target_profile_id
+            await client.update_series(series)
+            profile_message = f"Sonarr quality profile updated to {target_profile_id} before search."
         episodes = await client.get_episodes(int(arr_item["id"]))
         missing_by_season = _missing_episode_ids_by_season(episodes)
         if not missing_by_season:
             message = "No missing monitored episodes found."
+            if profile_message:
+                message = f"{profile_message} {message}"
             await asyncio.to_thread(
                 save_action, request_id, "search_auto", "Search and auto-download", "ok", message
             )
@@ -1569,6 +1793,8 @@ async def action_search_auto(request_id: str, user: Dict[str, str] = Depends(get
                     {"season": season_number, "episodeCount": len(episode_ids), "response": response}
                 )
         message = "Search sent to Sonarr."
+        if profile_message:
+            message = f"{profile_message} {message}"
         await asyncio.to_thread(
             save_action, request_id, "search_auto", "Search and auto-download", "ok", message
         )
@@ -1577,8 +1803,21 @@ async def action_search_auto(request_id: str, user: Dict[str, str] = Depends(get
         client = RadarrClient(runtime.radarr_base_url, runtime.radarr_api_key)
         if not client.configured():
             raise HTTPException(status_code=400, detail="Radarr not configured")
+        target_profile_id = _quality_profile_id(runtime.radarr_quality_profile_id)
+        current_profile_id = _quality_profile_id(arr_item.get("qualityProfileId"))
+        profile_message = None
+        movie_id = _quality_profile_id(arr_item.get("id"))
+        if target_profile_id and movie_id and current_profile_id != target_profile_id:
+            movie = await client.get_movie(movie_id)
+            if not isinstance(movie, dict):
+                raise HTTPException(status_code=502, detail="Could not load Radarr movie before search")
+            movie["qualityProfileId"] = target_profile_id
+            await client.update_movie(movie)
+            profile_message = f"Radarr quality profile updated to {target_profile_id} before search."
         response = await client.search(int(arr_item["id"]))
         message = "Search sent to Radarr."
+        if profile_message:
+            message = f"{profile_message} {message}"
         await asyncio.to_thread(
             save_action, request_id, "search_auto", "Search and auto-download", "ok", message
         )

backend/app/routers/status.py

@@ -1,6 +1,6 @@
 from typing import Any, Dict
 import httpx
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, HTTPException
 
 from ..auth import get_current_user
 from ..runtime import get_runtime_settings
@@ -41,7 +41,7 @@ async def services_status() -> Dict[str, Any]:
     services = []
     services.append(
         await _check(
-            "Jellyseerr",
+            "Seerr",
             jellyseerr.configured(),
             lambda: jellyseerr.get_recent_requests(take=1, skip=0),
         )
@@ -93,3 +93,47 @@ async def services_status() -> Dict[str, Any]:
         overall = "degraded"
 
     return {"overall": overall, "services": services}
+
+
+@router.post("/services/{service}/test")
+async def test_service(service: str) -> Dict[str, Any]:
+    runtime = get_runtime_settings()
+    jellyseerr = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
+    sonarr = SonarrClient(runtime.sonarr_base_url, runtime.sonarr_api_key)
+    radarr = RadarrClient(runtime.radarr_base_url, runtime.radarr_api_key)
+    prowlarr = ProwlarrClient(runtime.prowlarr_base_url, runtime.prowlarr_api_key)
+    qbittorrent = QBittorrentClient(
+        runtime.qbittorrent_base_url, runtime.qbittorrent_username, runtime.qbittorrent_password
+    )
+    jellyfin = JellyfinClient(runtime.jellyfin_base_url, runtime.jellyfin_api_key)
+
+    service_key = service.strip().lower()
+    checks = {
+        "seerr": (
+            "Seerr",
+            jellyseerr.configured(),
+            lambda: jellyseerr.get_recent_requests(take=1, skip=0),
+        ),
+        "jellyseerr": (
+            "Seerr",
+            jellyseerr.configured(),
+            lambda: jellyseerr.get_recent_requests(take=1, skip=0),
+        ),
+        "sonarr": ("Sonarr", sonarr.configured(), sonarr.get_system_status),
+        "radarr": ("Radarr", radarr.configured(), radarr.get_system_status),
+        "prowlarr": ("Prowlarr", prowlarr.configured(), prowlarr.get_health),
+        "qbittorrent": ("qBittorrent", qbittorrent.configured(), qbittorrent.get_app_version),
+        "jellyfin": ("Jellyfin", jellyfin.configured(), jellyfin.get_system_info),
+    }
+
+    if service_key not in checks:
+        raise HTTPException(status_code=404, detail="Unknown service")
+
+    name, configured, func = checks[service_key]
+    result = await _check(name, configured, func)
+    if name == "Prowlarr" and result.get("status") == "up":
+        health = result.get("detail")
+        if isinstance(health, list) and health:
+            result["status"] = "degraded"
+            result["message"] = "Health warnings"
+    return result

backend/app/runtime.py

@@ -2,18 +2,35 @@ from .config import settings
 from .db import get_settings_overrides
 
 _INT_FIELDS = {
+    "magent_application_port",
+    "magent_api_port",
     "sonarr_quality_profile_id",
     "radarr_quality_profile_id",
     "jwt_exp_minutes",
+    "log_file_max_bytes",
+    "log_file_backup_count",
     "requests_sync_ttl_minutes",
     "requests_poll_interval_seconds",
     "requests_delta_sync_interval_minutes",
     "requests_cleanup_days",
+    "magent_notify_email_smtp_port",
 }
 _BOOL_FIELDS = {
+    "magent_proxy_enabled",
+    "magent_proxy_trust_forwarded_headers",
+    "magent_ssl_bind_enabled",
+    "magent_notify_enabled",
+    "magent_notify_email_enabled",
+    "magent_notify_email_use_tls",
+    "magent_notify_email_use_ssl",
+    "magent_notify_discord_enabled",
+    "magent_notify_telegram_enabled",
+    "magent_notify_push_enabled",
+    "magent_notify_webhook_enabled",
     "jellyfin_sync_to_arr",
     "site_banner_enabled",
 }
+_SKIP_OVERRIDE_FIELDS = {"site_build_number", "site_changelog"}
 
 
 def get_runtime_settings():
@@ -22,6 +39,8 @@ def get_runtime_settings():
     for key, value in overrides.items():
         if value is None:
             continue
+        if key in _SKIP_OVERRIDE_FIELDS:
+            continue
         if key in _INT_FIELDS:
             try:
                 update[key] = int(value)

backend/app/security.py

@@ -18,11 +18,30 @@ def verify_password(plain_password: str, hashed_password: str) -> bool:
     return _pwd_context.verify(plain_password, hashed_password)
 
 
+def _create_token(
+    subject: str,
+    role: str,
+    *,
+    expires_at: datetime,
+    token_type: str = "access",
+) -> str:
+    payload: Dict[str, Any] = {
+        "sub": subject,
+        "role": role,
+        "typ": token_type,
+        "exp": expires_at,
+    }
+    return jwt.encode(payload, settings.jwt_secret, algorithm=_ALGORITHM)
+
 def create_access_token(subject: str, role: str, expires_minutes: Optional[int] = None) -> str:
     minutes = expires_minutes or settings.jwt_exp_minutes
     expires = datetime.now(timezone.utc) + timedelta(minutes=minutes)
-    payload: Dict[str, Any] = {"sub": subject, "role": role, "exp": expires}
-    return jwt.encode(payload, settings.jwt_secret, algorithm=_ALGORITHM)
+    return _create_token(subject, role, expires_at=expires, token_type="access")
+
+
+def create_stream_token(subject: str, role: str, expires_seconds: int = 120) -> str:
+    expires = datetime.now(timezone.utc) + timedelta(seconds=max(30, int(expires_seconds or 120)))
+    return _create_token(subject, role, expires_at=expires, token_type="sse")
 
 
 def decode_token(token: str) -> Dict[str, Any]:

backend/app/services/diagnostics.py

@@ -0,0 +1,696 @@
+from __future__ import annotations
+
+import asyncio
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from time import perf_counter
+from typing import Any, Awaitable, Callable, Dict, List, Optional, Sequence
+from urllib.parse import urlparse
+
+import httpx
+
+from ..clients.jellyfin import JellyfinClient
+from ..clients.jellyseerr import JellyseerrClient
+from ..clients.prowlarr import ProwlarrClient
+from ..clients.qbittorrent import QBittorrentClient
+from ..clients.radarr import RadarrClient
+from ..clients.sonarr import SonarrClient
+from ..config import settings as env_settings
+from ..db import run_integrity_check
+from ..runtime import get_runtime_settings
+from .invite_email import send_test_email, smtp_email_config_ready
+
+
+DiagnosticRunner = Callable[[], Awaitable[Dict[str, Any]]]
+
+
+@dataclass(frozen=True)
+class DiagnosticCheck:
+    key: str
+    label: str
+    category: str
+    description: str
+    live_safe: bool
+    configured: bool
+    config_detail: str
+    target: Optional[str]
+    runner: DiagnosticRunner
+
+
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _clean_text(value: Any, fallback: str = "") -> str:
+    if value is None:
+        return fallback
+    if isinstance(value, str):
+        trimmed = value.strip()
+        return trimmed if trimmed else fallback
+    return str(value)
+
+
+def _url_target(url: Optional[str]) -> Optional[str]:
+    raw = _clean_text(url)
+    if not raw:
+        return None
+    try:
+        parsed = urlparse(raw)
+    except Exception:
+        return raw
+    host = parsed.hostname or parsed.netloc or raw
+    if parsed.port:
+        host = f"{host}:{parsed.port}"
+    return host
+
+
+def _host_port_target(host: Optional[str], port: Optional[int]) -> Optional[str]:
+    resolved_host = _clean_text(host)
+    if not resolved_host:
+        return None
+    if port is None:
+        return resolved_host
+    return f"{resolved_host}:{port}"
+
+
+def _http_error_detail(exc: Exception) -> str:
+    if isinstance(exc, httpx.HTTPStatusError):
+        response = exc.response
+        body = ""
+        try:
+            body = response.text.strip()
+        except Exception:
+            body = ""
+        if body:
+            return f"HTTP {response.status_code}: {body}"
+        return f"HTTP {response.status_code}"
+    return str(exc)
+
+
+def _config_status(detail: str) -> str:
+    lowered = detail.lower()
+    if "disabled" in lowered:
+        return "disabled"
+    return "not_configured"
+
+
+def _discord_config_ready(runtime) -> tuple[bool, str]:
+    if not runtime.magent_notify_enabled or not runtime.magent_notify_discord_enabled:
+        return False, "Discord notifications are disabled."
+    if _clean_text(runtime.magent_notify_discord_webhook_url) or _clean_text(runtime.discord_webhook_url):
+        return True, "ok"
+    return False, "Discord webhook URL is required."
+
+
+def _telegram_config_ready(runtime) -> tuple[bool, str]:
+    if not runtime.magent_notify_enabled or not runtime.magent_notify_telegram_enabled:
+        return False, "Telegram notifications are disabled."
+    if _clean_text(runtime.magent_notify_telegram_bot_token) and _clean_text(runtime.magent_notify_telegram_chat_id):
+        return True, "ok"
+    return False, "Telegram bot token and chat ID are required."
+
+
+def _webhook_config_ready(runtime) -> tuple[bool, str]:
+    if not runtime.magent_notify_enabled or not runtime.magent_notify_webhook_enabled:
+        return False, "Generic webhook notifications are disabled."
+    if _clean_text(runtime.magent_notify_webhook_url):
+        return True, "ok"
+    return False, "Generic webhook URL is required."
+
+
+def _push_config_ready(runtime) -> tuple[bool, str]:
+    if not runtime.magent_notify_enabled or not runtime.magent_notify_push_enabled:
+        return False, "Push notifications are disabled."
+    provider = _clean_text(runtime.magent_notify_push_provider, "ntfy").lower()
+    if provider == "ntfy":
+        if _clean_text(runtime.magent_notify_push_base_url) and _clean_text(runtime.magent_notify_push_topic):
+            return True, "ok"
+        return False, "ntfy requires a base URL and topic."
+    if provider == "gotify":
+        if _clean_text(runtime.magent_notify_push_base_url) and _clean_text(runtime.magent_notify_push_token):
+            return True, "ok"
+        return False, "Gotify requires a base URL and app token."
+    if provider == "pushover":
+        if _clean_text(runtime.magent_notify_push_token) and _clean_text(runtime.magent_notify_push_user_key):
+            return True, "ok"
+        return False, "Pushover requires an application token and user key."
+    if provider == "webhook":
+        if _clean_text(runtime.magent_notify_push_base_url):
+            return True, "ok"
+        return False, "Webhook relay requires a target URL."
+    if provider == "telegram":
+        return _telegram_config_ready(runtime)
+    if provider == "discord":
+        return _discord_config_ready(runtime)
+    return False, f"Unsupported push provider: {provider or 'unknown'}"
+
+
+def _summary_from_results(results: Sequence[Dict[str, Any]]) -> Dict[str, int]:
+    summary = {
+        "total": len(results),
+        "up": 0,
+        "down": 0,
+        "degraded": 0,
+        "not_configured": 0,
+        "disabled": 0,
+    }
+    for result in results:
+        status = str(result.get("status") or "").strip().lower()
+        if status in summary:
+            summary[status] += 1
+    return summary
+
+
+async def _run_http_json_get(
+    url: str,
+    *,
+    headers: Optional[Dict[str, str]] = None,
+    params: Optional[Dict[str, Any]] = None,
+) -> Dict[str, Any]:
+    async with httpx.AsyncClient(timeout=10.0, follow_redirects=True) as client:
+        response = await client.get(url, headers=headers, params=params)
+        response.raise_for_status()
+        payload = response.json()
+    return {"response": payload}
+
+
+async def _run_http_text_get(url: str) -> Dict[str, Any]:
+    async with httpx.AsyncClient(timeout=10.0, follow_redirects=True) as client:
+        response = await client.get(url)
+        response.raise_for_status()
+        body = response.text
+    return {"response": body, "message": f"HTTP {response.status_code}"}
+
+
+async def _run_http_post(
+    url: str,
+    *,
+    json_payload: Optional[Dict[str, Any]] = None,
+    data_payload: Any = None,
+    params: Optional[Dict[str, Any]] = None,
+    headers: Optional[Dict[str, str]] = None,
+) -> Dict[str, Any]:
+    async with httpx.AsyncClient(timeout=15.0, follow_redirects=True) as client:
+        response = await client.post(url, json=json_payload, data=data_payload, params=params, headers=headers)
+        response.raise_for_status()
+        if not response.content:
+            return {"message": f"HTTP {response.status_code}"}
+        content_type = response.headers.get("content-type", "")
+        if "application/json" in content_type.lower():
+            try:
+                return {"response": response.json(), "message": f"HTTP {response.status_code}"}
+            except Exception:
+                pass
+        return {"response": response.text.strip(), "message": f"HTTP {response.status_code}"}
+
+
+async def _run_database_check() -> Dict[str, Any]:
+    integrity = await asyncio.to_thread(run_integrity_check)
+    status = "up" if integrity == "ok" else "degraded"
+    return {
+        "status": status,
+        "message": f"SQLite integrity_check returned {integrity}",
+        "detail": integrity,
+    }
+
+
+async def _run_magent_api_check(runtime) -> Dict[str, Any]:
+    base_url = _clean_text(runtime.magent_api_url) or f"http://127.0.0.1:{int(runtime.magent_api_port or 8000)}"
+    result = await _run_http_json_get(f"{base_url.rstrip('/')}/health")
+    payload = result.get("response")
+    build_number = payload.get("build") if isinstance(payload, dict) else None
+    message = "Health endpoint responded"
+    if build_number:
+        message = f"Health endpoint responded (build {build_number})"
+    return {"message": message, "detail": payload}
+
+
+async def _run_magent_web_check(runtime) -> Dict[str, Any]:
+    base_url = _clean_text(runtime.magent_application_url) or f"http://127.0.0.1:{int(runtime.magent_application_port or 3000)}"
+    result = await _run_http_text_get(base_url.rstrip("/"))
+    body = result.get("response")
+    if isinstance(body, str) and "<html" in body.lower():
+        return {"message": "Application page responded", "detail": "html"}
+    return {"status": "degraded", "message": "Application responded with unexpected content"}
+
+
+async def _run_seerr_check(runtime) -> Dict[str, Any]:
+    client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
+    payload = await client.get_status()
+    version = payload.get("version") if isinstance(payload, dict) else None
+    message = "Seerr responded"
+    if version:
+        message = f"Seerr version {version}"
+    return {"message": message, "detail": payload}
+
+
+async def _run_sonarr_check(runtime) -> Dict[str, Any]:
+    client = SonarrClient(runtime.sonarr_base_url, runtime.sonarr_api_key)
+    payload = await client.get_system_status()
+    version = payload.get("version") if isinstance(payload, dict) else None
+    message = "Sonarr responded"
+    if version:
+        message = f"Sonarr version {version}"
+    return {"message": message, "detail": payload}
+
+
+async def _run_radarr_check(runtime) -> Dict[str, Any]:
+    client = RadarrClient(runtime.radarr_base_url, runtime.radarr_api_key)
+    payload = await client.get_system_status()
+    version = payload.get("version") if isinstance(payload, dict) else None
+    message = "Radarr responded"
+    if version:
+        message = f"Radarr version {version}"
+    return {"message": message, "detail": payload}
+
+
+async def _run_prowlarr_check(runtime) -> Dict[str, Any]:
+    client = ProwlarrClient(runtime.prowlarr_base_url, runtime.prowlarr_api_key)
+    payload = await client.get_health()
+    if isinstance(payload, list) and payload:
+        return {
+            "status": "degraded",
+            "message": f"Prowlarr health warnings: {len(payload)}",
+            "detail": payload,
+        }
+    return {"message": "Prowlarr reported healthy", "detail": payload}
+
+
+async def _run_qbittorrent_check(runtime) -> Dict[str, Any]:
+    client = QBittorrentClient(
+        runtime.qbittorrent_base_url,
+        runtime.qbittorrent_username,
+        runtime.qbittorrent_password,
+    )
+    version = await client.get_app_version()
+    message = "qBittorrent responded"
+    if isinstance(version, str) and version:
+        message = f"qBittorrent version {version}"
+    return {"message": message, "detail": version}
+
+
+async def _run_jellyfin_check(runtime) -> Dict[str, Any]:
+    client = JellyfinClient(runtime.jellyfin_base_url, runtime.jellyfin_api_key)
+    payload = await client.get_system_info()
+    version = payload.get("Version") if isinstance(payload, dict) else None
+    message = "Jellyfin responded"
+    if version:
+        message = f"Jellyfin version {version}"
+    return {"message": message, "detail": payload}
+
+
+async def _run_email_check(recipient_email: Optional[str] = None) -> Dict[str, Any]:
+    result = await send_test_email(recipient_email=recipient_email)
+    recipient = _clean_text(result.get("recipient_email"), "configured recipient")
+    return {"message": f"Test email sent to {recipient}", "detail": result}
+
+
+async def _run_discord_check(runtime) -> Dict[str, Any]:
+    webhook_url = _clean_text(runtime.magent_notify_discord_webhook_url) or _clean_text(runtime.discord_webhook_url)
+    payload = {
+        "content": f"{env_settings.app_name} diagnostics ping\nBuild {env_settings.site_build_number or 'unknown'}",
+    }
+    result = await _run_http_post(webhook_url, json_payload=payload)
+    return {"message": "Discord webhook accepted ping", "detail": result.get("response")}
+
+
+async def _run_telegram_check(runtime) -> Dict[str, Any]:
+    bot_token = _clean_text(runtime.magent_notify_telegram_bot_token)
+    chat_id = _clean_text(runtime.magent_notify_telegram_chat_id)
+    url = f"https://api.telegram.org/bot{bot_token}/sendMessage"
+    payload = {
+        "chat_id": chat_id,
+        "text": f"{env_settings.app_name} diagnostics ping\nBuild {env_settings.site_build_number or 'unknown'}",
+    }
+    result = await _run_http_post(url, json_payload=payload)
+    return {"message": "Telegram ping accepted", "detail": result.get("response")}
+
+
+async def _run_webhook_check(runtime) -> Dict[str, Any]:
+    webhook_url = _clean_text(runtime.magent_notify_webhook_url)
+    payload = {
+        "type": "diagnostics.ping",
+        "application": env_settings.app_name,
+        "build": env_settings.site_build_number,
+        "checked_at": _now_iso(),
+    }
+    result = await _run_http_post(webhook_url, json_payload=payload)
+    return {"message": "Webhook accepted ping", "detail": result.get("response")}
+
+
+async def _run_push_check(runtime) -> Dict[str, Any]:
+    provider = _clean_text(runtime.magent_notify_push_provider, "ntfy").lower()
+    message = f"{env_settings.app_name} diagnostics ping"
+    build_suffix = f"Build {env_settings.site_build_number or 'unknown'}"
+
+    if provider == "ntfy":
+        base_url = _clean_text(runtime.magent_notify_push_base_url)
+        topic = _clean_text(runtime.magent_notify_push_topic)
+        result = await _run_http_post(
+            f"{base_url.rstrip('/')}/{topic}",
+            data_payload=f"{message}\n{build_suffix}",
+            headers={"Content-Type": "text/plain; charset=utf-8"},
+        )
+        return {"message": "ntfy push accepted", "detail": result.get("response")}
+
+    if provider == "gotify":
+        base_url = _clean_text(runtime.magent_notify_push_base_url)
+        token = _clean_text(runtime.magent_notify_push_token)
+        result = await _run_http_post(
+            f"{base_url.rstrip('/')}/message",
+            json_payload={"title": env_settings.app_name, "message": build_suffix, "priority": 5},
+            params={"token": token},
+        )
+        return {"message": "Gotify push accepted", "detail": result.get("response")}
+
+    if provider == "pushover":
+        token = _clean_text(runtime.magent_notify_push_token)
+        user_key = _clean_text(runtime.magent_notify_push_user_key)
+        device = _clean_text(runtime.magent_notify_push_device)
+        payload = {
+            "token": token,
+            "user": user_key,
+            "message": f"{message}\n{build_suffix}",
+            "title": env_settings.app_name,
+        }
+        if device:
+            payload["device"] = device
+        result = await _run_http_post("https://api.pushover.net/1/messages.json", data_payload=payload)
+        return {"message": "Pushover push accepted", "detail": result.get("response")}
+
+    if provider == "webhook":
+        base_url = _clean_text(runtime.magent_notify_push_base_url)
+        payload = {
+            "type": "diagnostics.push",
+            "application": env_settings.app_name,
+            "build": env_settings.site_build_number,
+            "checked_at": _now_iso(),
+        }
+        result = await _run_http_post(base_url, json_payload=payload)
+        return {"message": "Push webhook accepted", "detail": result.get("response")}
+
+    if provider == "telegram":
+        return await _run_telegram_check(runtime)
+
+    if provider == "discord":
+        return await _run_discord_check(runtime)
+
+    raise RuntimeError(f"Unsupported push provider: {provider}")
+
+
+def _build_diagnostic_checks(recipient_email: Optional[str] = None) -> List[DiagnosticCheck]:
+    runtime = get_runtime_settings()
+    seerr_target = _url_target(runtime.jellyseerr_base_url)
+    jellyfin_target = _url_target(runtime.jellyfin_base_url)
+    sonarr_target = _url_target(runtime.sonarr_base_url)
+    radarr_target = _url_target(runtime.radarr_base_url)
+    prowlarr_target = _url_target(runtime.prowlarr_base_url)
+    qbittorrent_target = _url_target(runtime.qbittorrent_base_url)
+    application_target = _url_target(runtime.magent_application_url) or _host_port_target("127.0.0.1", runtime.magent_application_port)
+    api_target = _url_target(runtime.magent_api_url) or _host_port_target("127.0.0.1", runtime.magent_api_port)
+    smtp_target = _host_port_target(runtime.magent_notify_email_smtp_host, runtime.magent_notify_email_smtp_port)
+    discord_target = _url_target(runtime.magent_notify_discord_webhook_url) or _url_target(runtime.discord_webhook_url)
+    telegram_target = "api.telegram.org" if _clean_text(runtime.magent_notify_telegram_bot_token) else None
+    webhook_target = _url_target(runtime.magent_notify_webhook_url)
+
+    push_provider = _clean_text(runtime.magent_notify_push_provider, "ntfy").lower()
+    push_target = None
+    if push_provider == "pushover":
+        push_target = "api.pushover.net"
+    elif push_provider == "telegram":
+        push_target = telegram_target or "api.telegram.org"
+    elif push_provider == "discord":
+        push_target = discord_target or "discord.com"
+    else:
+        push_target = _url_target(runtime.magent_notify_push_base_url)
+
+    email_ready, email_detail = smtp_email_config_ready()
+    discord_ready, discord_detail = _discord_config_ready(runtime)
+    telegram_ready, telegram_detail = _telegram_config_ready(runtime)
+    push_ready, push_detail = _push_config_ready(runtime)
+    webhook_ready, webhook_detail = _webhook_config_ready(runtime)
+
+    checks = [
+        DiagnosticCheck(
+            key="magent-web",
+            label="Magent application",
+            category="Application",
+            description="Checks that the frontend application URL is responding.",
+            live_safe=True,
+            configured=True,
+            config_detail="ok",
+            target=application_target,
+            runner=lambda runtime=runtime: _run_magent_web_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="magent-api",
+            label="Magent API",
+            category="Application",
+            description="Checks the Magent API health endpoint.",
+            live_safe=True,
+            configured=True,
+            config_detail="ok",
+            target=api_target,
+            runner=lambda runtime=runtime: _run_magent_api_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="database",
+            label="SQLite database",
+            category="Application",
+            description="Runs SQLite integrity_check against the current Magent database.",
+            live_safe=True,
+            configured=True,
+            config_detail="ok",
+            target="sqlite",
+            runner=_run_database_check,
+        ),
+        DiagnosticCheck(
+            key="seerr",
+            label="Seerr",
+            category="Media services",
+            description="Checks Seerr API reachability and version.",
+            live_safe=True,
+            configured=bool(runtime.jellyseerr_base_url and runtime.jellyseerr_api_key),
+            config_detail="Seerr URL and API key are required.",
+            target=seerr_target,
+            runner=lambda runtime=runtime: _run_seerr_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="jellyfin",
+            label="Jellyfin",
+            category="Media services",
+            description="Checks Jellyfin system info with the configured API key.",
+            live_safe=True,
+            configured=bool(runtime.jellyfin_base_url and runtime.jellyfin_api_key),
+            config_detail="Jellyfin URL and API key are required.",
+            target=jellyfin_target,
+            runner=lambda runtime=runtime: _run_jellyfin_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="sonarr",
+            label="Sonarr",
+            category="Media services",
+            description="Checks Sonarr system status with the configured API key.",
+            live_safe=True,
+            configured=bool(runtime.sonarr_base_url and runtime.sonarr_api_key),
+            config_detail="Sonarr URL and API key are required.",
+            target=sonarr_target,
+            runner=lambda runtime=runtime: _run_sonarr_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="radarr",
+            label="Radarr",
+            category="Media services",
+            description="Checks Radarr system status with the configured API key.",
+            live_safe=True,
+            configured=bool(runtime.radarr_base_url and runtime.radarr_api_key),
+            config_detail="Radarr URL and API key are required.",
+            target=radarr_target,
+            runner=lambda runtime=runtime: _run_radarr_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="prowlarr",
+            label="Prowlarr",
+            category="Media services",
+            description="Checks Prowlarr health and flags warnings as degraded.",
+            live_safe=True,
+            configured=bool(runtime.prowlarr_base_url and runtime.prowlarr_api_key),
+            config_detail="Prowlarr URL and API key are required.",
+            target=prowlarr_target,
+            runner=lambda runtime=runtime: _run_prowlarr_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="qbittorrent",
+            label="qBittorrent",
+            category="Media services",
+            description="Checks qBittorrent login and app version.",
+            live_safe=True,
+            configured=bool(
+                runtime.qbittorrent_base_url and runtime.qbittorrent_username and runtime.qbittorrent_password
+            ),
+            config_detail="qBittorrent URL, username, and password are required.",
+            target=qbittorrent_target,
+            runner=lambda runtime=runtime: _run_qbittorrent_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="email",
+            label="SMTP email",
+            category="Notifications",
+            description="Sends a live test email using the configured SMTP provider.",
+            live_safe=False,
+            configured=email_ready,
+            config_detail=email_detail,
+            target=smtp_target,
+            runner=lambda recipient_email=recipient_email: _run_email_check(recipient_email),
+        ),
+        DiagnosticCheck(
+            key="discord",
+            label="Discord webhook",
+            category="Notifications",
+            description="Posts a live test message to the configured Discord webhook.",
+            live_safe=False,
+            configured=discord_ready,
+            config_detail=discord_detail,
+            target=discord_target,
+            runner=lambda runtime=runtime: _run_discord_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="telegram",
+            label="Telegram",
+            category="Notifications",
+            description="Sends a live test message to the configured Telegram chat.",
+            live_safe=False,
+            configured=telegram_ready,
+            config_detail=telegram_detail,
+            target=telegram_target,
+            runner=lambda runtime=runtime: _run_telegram_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="push",
+            label="Push/mobile provider",
+            category="Notifications",
+            description="Sends a live test message through the configured push provider.",
+            live_safe=False,
+            configured=push_ready,
+            config_detail=push_detail,
+            target=push_target,
+            runner=lambda runtime=runtime: _run_push_check(runtime),
+        ),
+        DiagnosticCheck(
+            key="webhook",
+            label="Generic webhook",
+            category="Notifications",
+            description="Posts a live test payload to the configured generic webhook.",
+            live_safe=False,
+            configured=webhook_ready,
+            config_detail=webhook_detail,
+            target=webhook_target,
+            runner=lambda runtime=runtime: _run_webhook_check(runtime),
+        ),
+    ]
+    return checks
+
+
+async def _execute_check(check: DiagnosticCheck) -> Dict[str, Any]:
+    if not check.configured:
+        return {
+            "key": check.key,
+            "label": check.label,
+            "category": check.category,
+            "description": check.description,
+            "target": check.target,
+            "live_safe": check.live_safe,
+            "configured": False,
+            "status": _config_status(check.config_detail),
+            "message": check.config_detail,
+            "checked_at": _now_iso(),
+            "duration_ms": 0,
+        }
+
+    started = perf_counter()
+    checked_at = _now_iso()
+    try:
+        payload = await check.runner()
+        status = _clean_text(payload.get("status"), "up")
+        message = _clean_text(payload.get("message"), "Check passed")
+        detail = payload.get("detail")
+        return {
+            "key": check.key,
+            "label": check.label,
+            "category": check.category,
+            "description": check.description,
+            "target": check.target,
+            "live_safe": check.live_safe,
+            "configured": True,
+            "status": status,
+            "message": message,
+            "detail": detail,
+            "checked_at": checked_at,
+            "duration_ms": round((perf_counter() - started) * 1000, 1),
+        }
+    except httpx.HTTPError as exc:
+        return {
+            "key": check.key,
+            "label": check.label,
+            "category": check.category,
+            "description": check.description,
+            "target": check.target,
+            "live_safe": check.live_safe,
+            "configured": True,
+            "status": "down",
+            "message": _http_error_detail(exc),
+            "checked_at": checked_at,
+            "duration_ms": round((perf_counter() - started) * 1000, 1),
+        }
+    except Exception as exc:
+        return {
+            "key": check.key,
+            "label": check.label,
+            "category": check.category,
+            "description": check.description,
+            "target": check.target,
+            "live_safe": check.live_safe,
+            "configured": True,
+            "status": "down",
+            "message": str(exc),
+            "checked_at": checked_at,
+            "duration_ms": round((perf_counter() - started) * 1000, 1),
+        }
+
+
+def get_diagnostics_catalog() -> Dict[str, Any]:
+    checks = _build_diagnostic_checks()
+    items = []
+    for check in checks:
+        items.append(
+            {
+                "key": check.key,
+                "label": check.label,
+                "category": check.category,
+                "description": check.description,
+                "live_safe": check.live_safe,
+                "target": check.target,
+                "configured": check.configured,
+                "config_status": "configured" if check.configured else _config_status(check.config_detail),
+                "config_detail": "Ready to test." if check.configured else check.config_detail,
+            }
+        )
+    categories = sorted({item["category"] for item in items})
+    return {
+        "checks": items,
+        "categories": categories,
+        "generated_at": _now_iso(),
+    }
+
+
+async def run_diagnostics(keys: Optional[Sequence[str]] = None, recipient_email: Optional[str] = None) -> Dict[str, Any]:
+    checks = _build_diagnostic_checks(recipient_email=recipient_email)
+    selected = {str(key).strip().lower() for key in (keys or []) if str(key).strip()}
+    if selected:
+        checks = [check for check in checks if check.key.lower() in selected]
+    results = await asyncio.gather(*(_execute_check(check) for check in checks))
+    return {
+        "results": results,
+        "summary": _summary_from_results(results),
+        "checked_at": _now_iso(),
+    }

backend/app/services/invite_email.py

@@ -0,0 +1,518 @@
+from __future__ import annotations
+
+import asyncio
+import html
+import json
+import logging
+import re
+import smtplib
+from email.message import EmailMessage
+from email.utils import formataddr
+from typing import Any, Dict, Optional
+
+from ..build_info import BUILD_NUMBER
+from ..config import settings as env_settings
+from ..db import delete_setting, get_setting, set_setting
+from ..runtime import get_runtime_settings
+
+logger = logging.getLogger(__name__)
+
+TEMPLATE_SETTING_PREFIX = "invite_email_template_"
+TEMPLATE_KEYS = ("invited", "welcome", "warning", "banned")
+EMAIL_PATTERN = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
+PLACEHOLDER_PATTERN = re.compile(r"{{\s*([a-zA-Z0-9_]+)\s*}}")
+
+TEMPLATE_METADATA: Dict[str, Dict[str, Any]] = {
+    "invited": {
+        "label": "You have been invited",
+        "description": "Sent when an invite link is created and emailed to a recipient.",
+    },
+    "welcome": {
+        "label": "Welcome / How it works",
+        "description": "Sent after an invited user completes signup.",
+    },
+    "warning": {
+        "label": "Warning",
+        "description": "Manual warning template for account or behavior notices.",
+    },
+    "banned": {
+        "label": "Banned",
+        "description": "Sent when an account is banned or removed.",
+    },
+}
+
+TEMPLATE_PLACEHOLDERS = [
+    "app_name",
+    "app_url",
+    "build_number",
+    "how_it_works_url",
+    "invite_code",
+    "invite_description",
+    "invite_expires_at",
+    "invite_label",
+    "invite_link",
+    "invite_remaining_uses",
+    "inviter_username",
+    "message",
+    "reason",
+    "recipient_email",
+    "role",
+    "username",
+]
+
+DEFAULT_TEMPLATES: Dict[str, Dict[str, str]] = {
+    "invited": {
+        "subject": "{{app_name}} invite for {{recipient_email}}",
+        "body_text": (
+            "You have been invited to {{app_name}}.\n\n"
+            "Invite code: {{invite_code}}\n"
+            "Signup link: {{invite_link}}\n"
+            "Invited by: {{inviter_username}}\n"
+            "Invite label: {{invite_label}}\n"
+            "Expires: {{invite_expires_at}}\n"
+            "Remaining uses: {{invite_remaining_uses}}\n\n"
+            "{{invite_description}}\n\n"
+            "{{message}}\n\n"
+            "How it works: {{how_it_works_url}}\n"
+            "Build: {{build_number}}\n"
+        ),
+        "body_html": (
+            "<h1>You have been invited</h1>"
+            "<p>You have been invited to <strong>{{app_name}}</strong>.</p>"
+            "<p><strong>Invite code:</strong> {{invite_code}}<br />"
+            "<strong>Invited by:</strong> {{inviter_username}}<br />"
+            "<strong>Invite label:</strong> {{invite_label}}<br />"
+            "<strong>Expires:</strong> {{invite_expires_at}}<br />"
+            "<strong>Remaining uses:</strong> {{invite_remaining_uses}}</p>"
+            "<p>{{invite_description}}</p>"
+            "<p>{{message}}</p>"
+            "<p><a href=\"{{invite_link}}\">Accept invite and create account</a></p>"
+            "<p><a href=\"{{how_it_works_url}}\">How it works</a></p>"
+            "<p class=\"meta\">Build {{build_number}}</p>"
+        ),
+    },
+    "welcome": {
+        "subject": "Welcome to {{app_name}}",
+        "body_text": (
+            "Welcome to {{app_name}}, {{username}}.\n\n"
+            "Your account is ready.\n"
+            "Open: {{app_url}}\n"
+            "How it works: {{how_it_works_url}}\n"
+            "Role: {{role}}\n\n"
+            "{{message}}\n"
+        ),
+        "body_html": (
+            "<h1>Welcome</h1>"
+            "<p>Your {{app_name}} account is ready, <strong>{{username}}</strong>.</p>"
+            "<p><strong>Role:</strong> {{role}}</p>"
+            "<p><a href=\"{{app_url}}\">Open {{app_name}}</a><br />"
+            "<a href=\"{{how_it_works_url}}\">Read how it works</a></p>"
+            "<p>{{message}}</p>"
+        ),
+    },
+    "warning": {
+        "subject": "{{app_name}} account warning",
+        "body_text": (
+            "Hello {{username}},\n\n"
+            "This is a warning regarding your {{app_name}} account.\n\n"
+            "Reason: {{reason}}\n\n"
+            "{{message}}\n\n"
+            "If you need help, contact the admin.\n"
+        ),
+        "body_html": (
+            "<h1>Account warning</h1>"
+            "<p>Hello <strong>{{username}}</strong>,</p>"
+            "<p>This is a warning regarding your {{app_name}} account.</p>"
+            "<p><strong>Reason:</strong> {{reason}}</p>"
+            "<p>{{message}}</p>"
+            "<p>If you need help, contact the admin.</p>"
+        ),
+    },
+    "banned": {
+        "subject": "{{app_name}} account status changed",
+        "body_text": (
+            "Hello {{username}},\n\n"
+            "Your {{app_name}} account has been banned or removed.\n\n"
+            "Reason: {{reason}}\n\n"
+            "{{message}}\n"
+        ),
+        "body_html": (
+            "<h1>Account status changed</h1>"
+            "<p>Hello <strong>{{username}}</strong>,</p>"
+            "<p>Your {{app_name}} account has been banned or removed.</p>"
+            "<p><strong>Reason:</strong> {{reason}}</p>"
+            "<p>{{message}}</p>"
+        ),
+    },
+}
+
+
+def _template_setting_key(template_key: str) -> str:
+    return f"{TEMPLATE_SETTING_PREFIX}{template_key}"
+
+
+def _is_valid_email(value: object) -> bool:
+    if not isinstance(value, str):
+        return False
+    candidate = value.strip()
+    if not candidate:
+        return False
+    return bool(EMAIL_PATTERN.match(candidate))
+
+
+def _normalize_email(value: object) -> Optional[str]:
+    if not _is_valid_email(value):
+        return None
+    return str(value).strip()
+
+
+def _normalize_display_text(value: object, fallback: str = "") -> str:
+    if value is None:
+        return fallback
+    if isinstance(value, str):
+        trimmed = value.strip()
+        return trimmed if trimmed else fallback
+    return str(value)
+
+
+def _template_context_value(value: object, fallback: str = "") -> str:
+    if value is None:
+        return fallback
+    if isinstance(value, str):
+        return value.strip()
+    return str(value)
+
+
+def _safe_template_context(context: Dict[str, object]) -> Dict[str, str]:
+    safe: Dict[str, str] = {}
+    for key in TEMPLATE_PLACEHOLDERS:
+        safe[key] = _template_context_value(context.get(key), "")
+    return safe
+
+
+def _render_template_string(template: str, context: Dict[str, str], *, escape_html: bool = False) -> str:
+    if not isinstance(template, str):
+        return ""
+
+    def _replace(match: re.Match[str]) -> str:
+        key = match.group(1)
+        value = context.get(key, "")
+        return html.escape(value) if escape_html else value
+
+    return PLACEHOLDER_PATTERN.sub(_replace, template)
+
+
+def _strip_html_for_text(value: str) -> str:
+    text = re.sub(r"<br\s*/?>", "\n", value, flags=re.IGNORECASE)
+    text = re.sub(r"</p>", "\n\n", text, flags=re.IGNORECASE)
+    text = re.sub(r"<[^>]+>", "", text)
+    return html.unescape(text).strip()
+
+
+def _build_default_base_url() -> str:
+    runtime = get_runtime_settings()
+    for candidate in (
+        runtime.magent_application_url,
+        runtime.magent_proxy_base_url,
+        env_settings.cors_allow_origin,
+    ):
+        normalized = _normalize_display_text(candidate)
+        if normalized:
+            return normalized.rstrip("/")
+    port = int(getattr(runtime, "magent_application_port", 3000) or 3000)
+    return f"http://localhost:{port}"
+
+
+def build_invite_email_context(
+    *,
+    invite: Optional[Dict[str, Any]] = None,
+    user: Optional[Dict[str, Any]] = None,
+    recipient_email: Optional[str] = None,
+    message: Optional[str] = None,
+    reason: Optional[str] = None,
+    overrides: Optional[Dict[str, object]] = None,
+) -> Dict[str, str]:
+    app_url = _build_default_base_url()
+    invite_code = _normalize_display_text(invite.get("code") if invite else None, "Not set")
+    invite_link = f"{app_url}/signup?code={invite_code}" if invite_code != "Not set" else f"{app_url}/signup"
+    remaining_uses = invite.get("remaining_uses") if invite else None
+    resolved_recipient = _normalize_email(recipient_email)
+    if not resolved_recipient and invite:
+        resolved_recipient = _normalize_email(invite.get("recipient_email"))
+    if not resolved_recipient and user:
+        resolved_recipient = resolve_user_delivery_email(user)
+
+    context: Dict[str, object] = {
+        "app_name": env_settings.app_name,
+        "app_url": app_url,
+        "build_number": BUILD_NUMBER,
+        "how_it_works_url": f"{app_url}/how-it-works",
+        "invite_code": invite_code,
+        "invite_description": _normalize_display_text(invite.get("description") if invite else None, "No extra details."),
+        "invite_expires_at": _normalize_display_text(invite.get("expires_at") if invite else None, "Never"),
+        "invite_label": _normalize_display_text(invite.get("label") if invite else None, "No label"),
+        "invite_link": invite_link,
+        "invite_remaining_uses": (
+            "Unlimited" if remaining_uses in (None, "") else _normalize_display_text(remaining_uses)
+        ),
+        "inviter_username": _normalize_display_text(
+            invite.get("created_by") if invite else (user.get("username") if user else None),
+            "Admin",
+        ),
+        "message": _normalize_display_text(message, ""),
+        "reason": _normalize_display_text(reason, "Not specified"),
+        "recipient_email": _normalize_display_text(resolved_recipient, "No email supplied"),
+        "role": _normalize_display_text(user.get("role") if user else None, "user"),
+        "username": _normalize_display_text(user.get("username") if user else None, "there"),
+    }
+    if isinstance(overrides, dict):
+        context.update(overrides)
+    return _safe_template_context(context)
+
+
+def get_invite_email_templates() -> Dict[str, Dict[str, Any]]:
+    templates: Dict[str, Dict[str, Any]] = {}
+    for template_key in TEMPLATE_KEYS:
+        template = dict(DEFAULT_TEMPLATES[template_key])
+        raw_value = get_setting(_template_setting_key(template_key))
+        if raw_value:
+            try:
+                stored = json.loads(raw_value)
+            except (TypeError, json.JSONDecodeError):
+                stored = {}
+            if isinstance(stored, dict):
+                for field in ("subject", "body_text", "body_html"):
+                    if isinstance(stored.get(field), str):
+                        template[field] = stored[field]
+        templates[template_key] = {
+            "key": template_key,
+            "label": TEMPLATE_METADATA[template_key]["label"],
+            "description": TEMPLATE_METADATA[template_key]["description"],
+            "placeholders": TEMPLATE_PLACEHOLDERS,
+            **template,
+        }
+    return templates
+
+
+def get_invite_email_template(template_key: str) -> Dict[str, Any]:
+    if template_key not in TEMPLATE_KEYS:
+        raise ValueError(f"Unknown email template: {template_key}")
+    return get_invite_email_templates()[template_key]
+
+
+def save_invite_email_template(
+    template_key: str,
+    *,
+    subject: str,
+    body_text: str,
+    body_html: str,
+) -> Dict[str, Any]:
+    if template_key not in TEMPLATE_KEYS:
+        raise ValueError(f"Unknown email template: {template_key}")
+    payload = {
+        "subject": subject,
+        "body_text": body_text,
+        "body_html": body_html,
+    }
+    set_setting(_template_setting_key(template_key), json.dumps(payload))
+    return get_invite_email_template(template_key)
+
+
+def reset_invite_email_template(template_key: str) -> Dict[str, Any]:
+    if template_key not in TEMPLATE_KEYS:
+        raise ValueError(f"Unknown email template: {template_key}")
+    delete_setting(_template_setting_key(template_key))
+    return get_invite_email_template(template_key)
+
+
+def render_invite_email_template(
+    template_key: str,
+    *,
+    invite: Optional[Dict[str, Any]] = None,
+    user: Optional[Dict[str, Any]] = None,
+    recipient_email: Optional[str] = None,
+    message: Optional[str] = None,
+    reason: Optional[str] = None,
+    overrides: Optional[Dict[str, object]] = None,
+) -> Dict[str, str]:
+    template = get_invite_email_template(template_key)
+    context = build_invite_email_context(
+        invite=invite,
+        user=user,
+        recipient_email=recipient_email,
+        message=message,
+        reason=reason,
+        overrides=overrides,
+    )
+    body_html = _render_template_string(template["body_html"], context, escape_html=True)
+    body_text = _render_template_string(template["body_text"], context, escape_html=False)
+    if not body_text.strip() and body_html.strip():
+        body_text = _strip_html_for_text(body_html)
+    subject = _render_template_string(template["subject"], context, escape_html=False)
+    return {
+        "subject": subject.strip(),
+        "body_text": body_text.strip(),
+        "body_html": body_html.strip(),
+    }
+
+
+def resolve_user_delivery_email(user: Optional[Dict[str, Any]], invite: Optional[Dict[str, Any]] = None) -> Optional[str]:
+    if not isinstance(user, dict):
+        return _normalize_email(invite.get("recipient_email") if isinstance(invite, dict) else None)
+    username_email = _normalize_email(user.get("username"))
+    if username_email:
+        return username_email
+    if isinstance(invite, dict):
+        invite_email = _normalize_email(invite.get("recipient_email"))
+        if invite_email:
+            return invite_email
+    return None
+
+
+def smtp_email_config_ready() -> tuple[bool, str]:
+    runtime = get_runtime_settings()
+    if not runtime.magent_notify_enabled:
+        return False, "Notifications are disabled."
+    if not runtime.magent_notify_email_enabled:
+        return False, "Email notifications are disabled."
+    if not _normalize_display_text(runtime.magent_notify_email_smtp_host):
+        return False, "SMTP host is not configured."
+    if not _normalize_email(runtime.magent_notify_email_from_address):
+        return False, "From email address is not configured."
+    return True, "ok"
+
+
+def _send_email_sync(*, recipient_email: str, subject: str, body_text: str, body_html: str) -> None:
+    runtime = get_runtime_settings()
+    host = _normalize_display_text(runtime.magent_notify_email_smtp_host)
+    port = int(runtime.magent_notify_email_smtp_port or 587)
+    username = _normalize_display_text(runtime.magent_notify_email_smtp_username)
+    password = _normalize_display_text(runtime.magent_notify_email_smtp_password)
+    from_address = _normalize_email(runtime.magent_notify_email_from_address)
+    from_name = _normalize_display_text(runtime.magent_notify_email_from_name, env_settings.app_name)
+    use_tls = bool(runtime.magent_notify_email_use_tls)
+    use_ssl = bool(runtime.magent_notify_email_use_ssl)
+    if not host or not from_address:
+        raise RuntimeError("SMTP email settings are incomplete.")
+    logger.info(
+        "smtp send started recipient=%s from=%s host=%s port=%s tls=%s ssl=%s auth=%s subject=%s",
+        recipient_email,
+        from_address,
+        host,
+        port,
+        use_tls,
+        use_ssl,
+        bool(username and password),
+        subject,
+    )
+
+    message = EmailMessage()
+    message["Subject"] = subject
+    message["From"] = formataddr((from_name, from_address))
+    message["To"] = recipient_email
+    message.set_content(body_text or _strip_html_for_text(body_html))
+    if body_html.strip():
+        message.add_alternative(body_html, subtype="html")
+
+    if use_ssl:
+        with smtplib.SMTP_SSL(host, port, timeout=20) as smtp:
+            logger.debug("smtp ssl connection opened host=%s port=%s", host, port)
+            if username and password:
+                smtp.login(username, password)
+                logger.debug("smtp login succeeded host=%s username=%s", host, username)
+            smtp.send_message(message)
+            logger.info("smtp send accepted recipient=%s host=%s mode=ssl", recipient_email, host)
+        return
+
+    with smtplib.SMTP(host, port, timeout=20) as smtp:
+        logger.debug("smtp connection opened host=%s port=%s", host, port)
+        smtp.ehlo()
+        if use_tls:
+            smtp.starttls()
+            smtp.ehlo()
+            logger.debug("smtp starttls negotiated host=%s port=%s", host, port)
+        if username and password:
+            smtp.login(username, password)
+            logger.debug("smtp login succeeded host=%s username=%s", host, username)
+        smtp.send_message(message)
+        logger.info("smtp send accepted recipient=%s host=%s mode=plain", recipient_email, host)
+
+
+async def send_templated_email(
+    template_key: str,
+    *,
+    invite: Optional[Dict[str, Any]] = None,
+    user: Optional[Dict[str, Any]] = None,
+    recipient_email: Optional[str] = None,
+    message: Optional[str] = None,
+    reason: Optional[str] = None,
+    overrides: Optional[Dict[str, object]] = None,
+) -> Dict[str, str]:
+    ready, detail = smtp_email_config_ready()
+    if not ready:
+        raise RuntimeError(detail)
+
+    resolved_email = _normalize_email(recipient_email)
+    if not resolved_email:
+        resolved_email = resolve_user_delivery_email(user, invite)
+    if not resolved_email:
+        raise RuntimeError("No valid recipient email is available for this action.")
+
+    rendered = render_invite_email_template(
+        template_key,
+        invite=invite,
+        user=user,
+        recipient_email=resolved_email,
+        message=message,
+        reason=reason,
+        overrides=overrides,
+    )
+    await asyncio.to_thread(
+        _send_email_sync,
+        recipient_email=resolved_email,
+        subject=rendered["subject"],
+        body_text=rendered["body_text"],
+        body_html=rendered["body_html"],
+    )
+    logger.info("Email template sent: template=%s recipient=%s", template_key, resolved_email)
+    return {
+        "recipient_email": resolved_email,
+        "subject": rendered["subject"],
+    }
+
+
+async def send_test_email(recipient_email: Optional[str] = None) -> Dict[str, str]:
+    ready, detail = smtp_email_config_ready()
+    if not ready:
+        raise RuntimeError(detail)
+
+    runtime = get_runtime_settings()
+    resolved_email = _normalize_email(recipient_email) or _normalize_email(
+        runtime.magent_notify_email_from_address
+    )
+    if not resolved_email:
+        raise RuntimeError("No valid recipient email is configured for the test message.")
+
+    application_url = _normalize_display_text(runtime.magent_application_url, "Not configured")
+    subject = f"{env_settings.app_name} email test"
+    body_text = (
+        f"This is a test email from {env_settings.app_name}.\n\n"
+        f"Build: {BUILD_NUMBER}\n"
+        f"Application URL: {application_url}\n"
+    )
+    body_html = (
+        f"<h1>{html.escape(env_settings.app_name)} email test</h1>"
+        f"<p>This is a test email from <strong>{html.escape(env_settings.app_name)}</strong>.</p>"
+        f"<p><strong>Build:</strong> {html.escape(BUILD_NUMBER)}<br />"
+        f"<strong>Application URL:</strong> {html.escape(application_url)}</p>"
+    )
+
+    await asyncio.to_thread(
+        _send_email_sync,
+        recipient_email=resolved_email,
+        subject=subject,
+        body_text=body_text,
+        body_html=body_html,
+    )
+    logger.info("SMTP test email sent: recipient=%s", resolved_email)
+    return {"recipient_email": resolved_email, "subject": subject}

backend/app/services/jellyfin_sync.py

@@ -3,8 +3,19 @@ import logging
 from fastapi import HTTPException
 
 from ..clients.jellyfin import JellyfinClient
-from ..db import create_user_if_missing
+from ..db import (
+    create_user_if_missing,
+    get_user_by_username,
+    set_user_auth_provider,
+    set_user_jellyseerr_id,
+)
 from ..runtime import get_runtime_settings
+from .user_cache import (
+    build_jellyseerr_candidate_map,
+    get_cached_jellyseerr_users,
+    match_jellyseerr_user_id,
+    save_jellyfin_users_cache,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -17,6 +28,11 @@ async def sync_jellyfin_users() -> int:
     users = await client.get_users()
     if not isinstance(users, list):
         return 0
+    save_jellyfin_users_cache(users)
+    # Jellyfin is the canonical source for local user objects; Seerr IDs are
+    # matched as enrichment when possible.
+    jellyseerr_users = get_cached_jellyseerr_users()
+    candidate_map = build_jellyseerr_candidate_map(jellyseerr_users or [])
     imported = 0
     for user in users:
         if not isinstance(user, dict):
@@ -24,8 +40,26 @@ async def sync_jellyfin_users() -> int:
         name = user.get("Name")
         if not name:
             continue
-        if create_user_if_missing(name, "jellyfin-user", role="user", auth_provider="jellyfin"):
+        matched_id = match_jellyseerr_user_id(name, candidate_map) if candidate_map else None
+        created = create_user_if_missing(
+            name,
+            "jellyfin-user",
+            role="user",
+            auth_provider="jellyfin",
+            jellyseerr_user_id=matched_id,
+        )
+        if created:
             imported += 1
+        else:
+            existing = get_user_by_username(name)
+            if (
+                existing
+                and str(existing.get("role") or "user").strip().lower() != "admin"
+                and str(existing.get("auth_provider") or "local").strip().lower() != "jellyfin"
+            ):
+                set_user_auth_provider(name, "jellyfin")
+            if matched_id is not None:
+                set_user_jellyseerr_id(name, matched_id)
     return imported
 
 

backend/app/services/snapshot.py

@@ -11,7 +11,14 @@ from ..clients.radarr import RadarrClient
 from ..clients.prowlarr import ProwlarrClient
 from ..clients.qbittorrent import QBittorrentClient
 from ..runtime import get_runtime_settings
-from ..db import save_snapshot, get_request_cache_payload, get_recent_snapshots, get_setting, set_setting
+from ..db import (
+    save_snapshot,
+    get_request_cache_payload,
+    get_request_cache_by_id,
+    get_recent_snapshots,
+    get_setting,
+    set_setting,
+)
 from ..models import ActionOption, NormalizedState, RequestType, Snapshot, TimelineHop
 
 logger = logging.getLogger(__name__)
@@ -219,17 +226,30 @@ async def build_snapshot(request_id: str) -> Snapshot:
             logging.getLogger(__name__).debug(
                 "snapshot cache miss: request_id=%s mode=%s", request_id, mode
             )
+        if cached_request is not None:
+            cache_meta = get_request_cache_by_id(int(request_id))
+            cached_title = cache_meta.get("title") if cache_meta else None
+            if cached_title and isinstance(cached_request, dict):
+                media = cached_request.get("media")
+                if not isinstance(media, dict):
+                    media = {}
+                    cached_request["media"] = media
+                if not media.get("title") and not media.get("name"):
+                    media["title"] = cached_title
+                    media["name"] = cached_title
+                if not cached_request.get("title") and not cached_request.get("name"):
+                    cached_request["title"] = cached_title
 
     allow_remote = mode == "always_js" and jellyseerr.configured()
     if not jellyseerr.configured() and not cached_request:
-        timeline.append(TimelineHop(service="Jellyseerr", status="not_configured"))
+        timeline.append(TimelineHop(service="Seerr", status="not_configured"))
         timeline.append(TimelineHop(service="Sonarr/Radarr", status="not_configured"))
         timeline.append(TimelineHop(service="Prowlarr", status="not_configured"))
         timeline.append(TimelineHop(service="qBittorrent", status="not_configured"))
         snapshot.timeline = timeline
         return snapshot
     if cached_request is None and not allow_remote:
-        timeline.append(TimelineHop(service="Jellyseerr", status="cache_miss"))
+        timeline.append(TimelineHop(service="Seerr", status="cache_miss"))
         snapshot.timeline = timeline
         snapshot.state = NormalizedState.unknown
         snapshot.state_reason = "Request not found in cache"
@@ -240,29 +260,37 @@ async def build_snapshot(request_id: str) -> Snapshot:
         try:
             jelly_request = await jellyseerr.get_request(request_id)
             logging.getLogger(__name__).debug(
-                "snapshot jellyseerr fetch: request_id=%s mode=%s", request_id, mode
+                "snapshot Seerr fetch: request_id=%s mode=%s", request_id, mode
             )
         except Exception as exc:
-            timeline.append(TimelineHop(service="Jellyseerr", status="error", details={"error": str(exc)}))
+            timeline.append(TimelineHop(service="Seerr", status="error", details={"error": str(exc)}))
             snapshot.timeline = timeline
             snapshot.state = NormalizedState.failed
-            snapshot.state_reason = "Failed to reach Jellyseerr"
+            snapshot.state_reason = "Failed to reach Seerr"
             return snapshot
 
     if not jelly_request:
-        timeline.append(TimelineHop(service="Jellyseerr", status="not_found"))
+        timeline.append(TimelineHop(service="Seerr", status="not_found"))
         snapshot.timeline = timeline
         snapshot.state = NormalizedState.unknown
-        snapshot.state_reason = "Request not found in Jellyseerr"
+        snapshot.state_reason = "Request not found in Seerr"
         return snapshot
 
     jelly_status = jelly_request.get("status", "unknown")
     jelly_status_label = _status_label(jelly_status)
     jelly_type = jelly_request.get("type") or "unknown"
-    snapshot.title = jelly_request.get("media", {}).get("title", "Unknown")
-    snapshot.year = jelly_request.get("media", {}).get("year")
-    snapshot.request_type = RequestType(jelly_type) if jelly_type in {"movie", "tv"} else RequestType.unknown
     media = jelly_request.get("media", {}) if isinstance(jelly_request, dict) else {}
+    if not isinstance(media, dict):
+        media = {}
+    snapshot.title = (
+        media.get("title")
+        or media.get("name")
+        or jelly_request.get("title")
+        or jelly_request.get("name")
+        or "Unknown"
+    )
+    snapshot.year = media.get("year") or jelly_request.get("year")
+    snapshot.request_type = RequestType(jelly_type) if jelly_type in {"movie", "tv"} else RequestType.unknown
     poster_path = None
     backdrop_path = None
     if isinstance(media, dict):
@@ -310,7 +338,7 @@ async def build_snapshot(request_id: str) -> Snapshot:
 
     timeline.append(
         TimelineHop(
-            service="Jellyseerr",
+            service="Seerr",
             status=jelly_status_label,
             details={
                 "requestedBy": jelly_request.get("requestedBy", {}).get("displayName")

backend/app/services/user_cache.py

@@ -0,0 +1,158 @@
+import json
+import logging
+from datetime import datetime, timezone, timedelta
+from typing import Any, Dict, List, Optional
+
+from ..db import get_setting, set_setting, delete_setting
+
+logger = logging.getLogger(__name__)
+
+JELLYSEERR_CACHE_KEY = "jellyseerr_users_cache"
+JELLYSEERR_CACHE_AT_KEY = "jellyseerr_users_cached_at"
+JELLYFIN_CACHE_KEY = "jellyfin_users_cache"
+JELLYFIN_CACHE_AT_KEY = "jellyfin_users_cached_at"
+
+
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _parse_iso(value: Optional[str]) -> Optional[datetime]:
+    if not value:
+        return None
+    try:
+        parsed = datetime.fromisoformat(value)
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=timezone.utc)
+    return parsed
+
+
+def _cache_is_fresh(cached_at: Optional[str], max_age_minutes: int) -> bool:
+    parsed = _parse_iso(cached_at)
+    if not parsed:
+        return False
+    age = datetime.now(timezone.utc) - parsed
+    return age <= timedelta(minutes=max_age_minutes)
+
+
+def _load_cached_users(
+    cache_key: str, cache_at_key: str, max_age_minutes: int
+) -> Optional[List[Dict[str, Any]]]:
+    cached_at = get_setting(cache_at_key)
+    if not _cache_is_fresh(cached_at, max_age_minutes):
+        return None
+    raw = get_setting(cache_key)
+    if not raw:
+        return None
+    try:
+        data = json.loads(raw)
+    except (TypeError, json.JSONDecodeError):
+        return None
+    if isinstance(data, list):
+        return [item for item in data if isinstance(item, dict)]
+    return None
+
+
+def _save_cached_users(cache_key: str, cache_at_key: str, users: List[Dict[str, Any]]) -> None:
+    payload = json.dumps(users, ensure_ascii=True)
+    set_setting(cache_key, payload)
+    set_setting(cache_at_key, _now_iso())
+
+
+def _normalized_handles(value: Any) -> List[str]:
+    if not isinstance(value, str):
+        return []
+    normalized = value.strip().lower()
+    if not normalized:
+        return []
+    handles = [normalized]
+    if "@" in normalized:
+        handles.append(normalized.split("@", 1)[0])
+    return list(dict.fromkeys(handles))
+
+
+def build_jellyseerr_candidate_map(users: List[Dict[str, Any]]) -> Dict[str, int]:
+    candidate_to_id: Dict[str, int] = {}
+    for user in users:
+        if not isinstance(user, dict):
+            continue
+        user_id = user.get("id") or user.get("userId") or user.get("Id")
+        try:
+            user_id = int(user_id)
+        except (TypeError, ValueError):
+            continue
+        for key in ("username", "email", "displayName", "name"):
+            for handle in _normalized_handles(user.get(key)):
+                candidate_to_id.setdefault(handle, user_id)
+    return candidate_to_id
+
+
+def match_jellyseerr_user_id(
+    username: str, candidate_map: Dict[str, int]
+) -> Optional[int]:
+    for handle in _normalized_handles(username):
+        matched = candidate_map.get(handle)
+        if matched is not None:
+            return matched
+    return None
+
+
+def save_jellyseerr_users_cache(users: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    normalized: List[Dict[str, Any]] = []
+    for user in users:
+        if not isinstance(user, dict):
+            continue
+        normalized.append(
+            {
+                "id": user.get("id") or user.get("userId") or user.get("Id"),
+                "email": user.get("email"),
+                "username": user.get("username"),
+                "displayName": user.get("displayName"),
+                "name": user.get("name"),
+            }
+        )
+    _save_cached_users(JELLYSEERR_CACHE_KEY, JELLYSEERR_CACHE_AT_KEY, normalized)
+    logger.debug("Cached Seerr users: %s", len(normalized))
+    return normalized
+
+
+def get_cached_jellyseerr_users(max_age_minutes: int = 1440) -> Optional[List[Dict[str, Any]]]:
+    return _load_cached_users(JELLYSEERR_CACHE_KEY, JELLYSEERR_CACHE_AT_KEY, max_age_minutes)
+
+
+def save_jellyfin_users_cache(users: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    normalized: List[Dict[str, Any]] = []
+    for user in users:
+        if not isinstance(user, dict):
+            continue
+        normalized.append(
+            {
+                "id": user.get("Id"),
+                "name": user.get("Name"),
+                "hasPassword": user.get("HasPassword"),
+                "lastLoginDate": user.get("LastLoginDate"),
+            }
+        )
+    _save_cached_users(JELLYFIN_CACHE_KEY, JELLYFIN_CACHE_AT_KEY, normalized)
+    logger.debug("Cached Jellyfin users: %s", len(normalized))
+    return normalized
+
+
+def get_cached_jellyfin_users(max_age_minutes: int = 1440) -> Optional[List[Dict[str, Any]]]:
+    return _load_cached_users(JELLYFIN_CACHE_KEY, JELLYFIN_CACHE_AT_KEY, max_age_minutes)
+
+
+def clear_user_import_caches() -> Dict[str, int]:
+    cleared = 0
+    for key in (
+        JELLYSEERR_CACHE_KEY,
+        JELLYSEERR_CACHE_AT_KEY,
+        JELLYFIN_CACHE_KEY,
+        JELLYFIN_CACHE_AT_KEY,
+    ):
+        delete_setting(key)
+        cleared += 1
+    logger.debug("Cleared user import cache keys: %s", cleared)
+    return {"settingsKeysCleared": cleared}

backend/requirements.txt

@@ -1,9 +1,9 @@
-fastapi==0.115.0
-uvicorn==0.30.6
-httpx==0.27.2
-pydantic==2.9.2
-pydantic-settings==2.5.2
-python-jose[cryptography]==3.3.0
+fastapi==0.134.0
+uvicorn==0.41.0
+httpx==0.28.1
+pydantic==2.12.5
+pydantic-settings==2.13.1
+python-jose[cryptography]==3.5.0
 passlib==1.7.4
-python-multipart==0.0.9
-Pillow==10.4.0
+python-multipart==0.0.22
+Pillow==12.1.1

docker-compose.hub.yml

@@ -1,19 +1,10 @@
 services:
-  backend:
-    image: rephl3xnz/magent-backend:latest
+  magent:
+    image: rephl3xnz/magent:latest
     env_file:
       - ./.env
     ports:
+      - "3000:3000"
       - "8000:8000"
     volumes:
       - ./data:/app/data
-
-  frontend:
-    image: rephl3xnz/magent-frontend:latest
-    environment:
-      - NEXT_PUBLIC_API_BASE=/api
-      - BACKEND_INTERNAL_URL=http://backend:8000
-    ports:
-      - "3000:3000"
-    depends_on:
-      - backend

docker-compose.yml

@@ -1,25 +1,12 @@
 services:
-  backend:
+  magent:
     build:
       context: .
-      dockerfile: backend/Dockerfile
-      args:
-        BUILD_NUMBER: ${BUILD_NUMBER}
+      dockerfile: Dockerfile
     env_file:
       - ./.env
     ports:
+      - "3000:3000"
       - "8000:8000"
     volumes:
       - ./data:/app/data
-
-  frontend:
-    build:
-      context: ./frontend
-      dockerfile: Dockerfile
-    environment:
-      - NEXT_PUBLIC_API_BASE=/api
-      - BACKEND_INTERNAL_URL=http://backend:8000
-    ports:
-      - "3000:3000"
-    depends_on:
-      - backend

docker/supervisord.conf

@@ -0,0 +1,28 @@
+[supervisord]
+nodaemon=true
+logfile=/dev/null
+logfile_maxbytes=0
+pidfile=/tmp/supervisord.pid
+
+[program:backend]
+directory=/app
+command=uvicorn app.main:app --host 0.0.0.0 --port 8000
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+priority=10
+
+[program:frontend]
+directory=/app/frontend
+command=/usr/bin/npm start -- --hostname 0.0.0.0 --port 3000
+environment=NEXT_PUBLIC_API_BASE="/api",BACKEND_INTERNAL_URL="http://127.0.0.1:8000",NODE_ENV="production"
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+priority=20

frontend/app/admin/[section]/page.tsx

@@ -2,6 +2,7 @@ import { notFound } from 'next/navigation'
 import SettingsPage from '../SettingsPage'
 
 const ALLOWED_SECTIONS = new Set([
+  'seerr',
   'jellyseerr',
   'jellyfin',
   'artwork',
@@ -13,16 +14,20 @@ const ALLOWED_SECTIONS = new Set([
   'cache',
   'logs',
   'maintenance',
+  'magent',
+  'general',
+  'notifications',
   'site',
 ])
 
 type PageProps = {
-  params: { section: string }
+  params: Promise<{ section: string }>
 }
 
-export default function AdminSectionPage({ params }: PageProps) {
-  if (!ALLOWED_SECTIONS.has(params.section)) {
+export default async function AdminSectionPage({ params }: PageProps) {
+  const { section } = await params
+  if (!ALLOWED_SECTIONS.has(section)) {
     notFound()
   }
-  return <SettingsPage section={params.section} />
+  return <SettingsPage section={section} />
 }

frontend/app/admin/diagnostics/page.tsx

@@ -0,0 +1,27 @@
+'use client'
+
+import AdminShell from '../../ui/AdminShell'
+import AdminDiagnosticsPanel from '../../ui/AdminDiagnosticsPanel'
+
+export default function AdminDiagnosticsPage() {
+  return (
+    <AdminShell
+      title="Diagnostics"
+      subtitle="Run connectivity, delivery, and platform health checks for every configured dependency."
+      rail={
+        <div className="admin-rail-stack">
+          <div className="admin-rail-card">
+            <span className="admin-rail-eyebrow">Diagnostics</span>
+            <h2>Shared console</h2>
+            <p>
+              This page and Maintenance now use the same diagnostics panel, so every test target and
+              notification ping stays in one source of truth.
+            </p>
+          </div>
+        </div>
+      }
+    >
+      <AdminDiagnosticsPanel />
+    </AdminShell>
+  )
+}

frontend/app/admin/profiles/page.tsx

@@ -0,0 +1,6 @@
+import { redirect } from 'next/navigation'
+
+export default function AdminProfilesRedirectPage() {
+  redirect('/admin/invites')
+}
+

frontend/app/admin/requests-all/page.tsx

@@ -0,0 +1,172 @@
+'use client'
+
+import { useEffect, useMemo, useState } from 'react'
+import { useRouter } from 'next/navigation'
+import { authFetch, clearToken, getApiBase, getToken } from '../../lib/auth'
+import AdminShell from '../../ui/AdminShell'
+
+type RequestRow = {
+  id: number
+  title?: string | null
+  year?: number | null
+  type?: string | null
+  statusLabel?: string | null
+  requestedBy?: string | null
+  createdAt?: string | null
+}
+
+const formatDateTime = (value?: string | null) => {
+  if (!value) return 'Unknown'
+  const date = new Date(value)
+  if (Number.isNaN(date.valueOf())) return value
+  return date.toLocaleString()
+}
+
+export default function AdminRequestsAllPage() {
+  const router = useRouter()
+  const [rows, setRows] = useState<RequestRow[]>([])
+  const [total, setTotal] = useState(0)
+  const [loading, setLoading] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [pageSize, setPageSize] = useState(50)
+  const [page, setPage] = useState(1)
+
+  const pageCount = useMemo(() => {
+    if (!total || pageSize <= 0) return 1
+    return Math.max(1, Math.ceil(total / pageSize))
+  }, [total, pageSize])
+
+  const load = async () => {
+    if (!getToken()) {
+      router.push('/login')
+      return
+    }
+    setLoading(true)
+    setError(null)
+    try {
+      const baseUrl = getApiBase()
+      const skip = (page - 1) * pageSize
+      const response = await authFetch(
+        `${baseUrl}/admin/requests/all?take=${pageSize}&skip=${skip}`
+      )
+      if (!response.ok) {
+        if (response.status === 401) {
+          clearToken()
+          router.push('/login')
+          return
+        }
+        if (response.status === 403) {
+          router.push('/')
+          return
+        }
+        throw new Error(`Load failed: ${response.status}`)
+      }
+      const data = await response.json()
+      setRows(Array.isArray(data?.results) ? data.results : [])
+      setTotal(Number(data?.total ?? 0))
+    } catch (err) {
+      console.error(err)
+      setError('Unable to load requests.')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    void load()
+  }, [page, pageSize])
+
+  useEffect(() => {
+    if (page > pageCount) {
+      setPage(pageCount)
+    }
+  }, [pageCount, page])
+
+  return (
+    <AdminShell
+      title="All requests"
+      subtitle="Paginated view of every cached request."
+      actions={
+        <button type="button" onClick={() => router.push('/admin')}>
+          Back to settings
+        </button>
+      }
+    >
+      <section className="admin-section">
+        <div className="admin-toolbar">
+          <div className="admin-toolbar-info">
+            <span>{total.toLocaleString()} total</span>
+          </div>
+          <div className="admin-toolbar-actions">
+            <label className="admin-select">
+              <span>Per page</span>
+              <select value={pageSize} onChange={(e) => setPageSize(Number(e.target.value))}>
+                <option value={25}>25</option>
+                <option value={50}>50</option>
+                <option value={100}>100</option>
+                <option value={200}>200</option>
+              </select>
+            </label>
+          </div>
+        </div>
+        {loading ? (
+          <div className="status-banner">Loading requests…</div>
+        ) : error ? (
+          <div className="error-banner">{error}</div>
+        ) : rows.length === 0 ? (
+          <div className="status-banner">No requests found.</div>
+        ) : (
+          <div className="admin-table">
+            <div className="admin-table-head">
+              <span>Request</span>
+              <span>Status</span>
+              <span>Requested by</span>
+              <span>Created</span>
+            </div>
+            {rows.map((row) => (
+              <button
+                key={row.id}
+                type="button"
+                className="admin-table-row"
+                onClick={() => router.push(`/requests/${row.id}`)}
+              >
+                <span>
+                  {row.title || `Request #${row.id}`}
+                  {row.year ? ` (${row.year})` : ''}
+                </span>
+                <span>{row.statusLabel || 'Unknown'}</span>
+                <span>{row.requestedBy || 'Unknown'}</span>
+                <span>{formatDateTime(row.createdAt)}</span>
+              </button>
+            ))}
+          </div>
+        )}
+        <div className="admin-pagination">
+          <button type="button" onClick={() => setPage(1)} disabled={page <= 1}>
+            First
+          </button>
+          <button type="button" onClick={() => setPage(page - 1)} disabled={page <= 1}>
+            Previous
+          </button>
+          <span>
+            Page {page} of {pageCount}
+          </span>
+          <button
+            type="button"
+            onClick={() => setPage(page + 1)}
+            disabled={page >= pageCount}
+          >
+            Next
+          </button>
+          <button
+            type="button"
+            onClick={() => setPage(pageCount)}
+            disabled={page >= pageCount}
+          >
+            Last
+          </button>
+        </div>
+      </section>
+    </AdminShell>
+  )
+}

frontend/app/admin/system/page.tsx

@@ -0,0 +1,211 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+import { useRouter } from 'next/navigation'
+import AdminShell from '../../ui/AdminShell'
+import { authFetch, clearToken, getApiBase, getToken } from '../../lib/auth'
+
+type FlowStage = {
+  title: string
+  input: string
+  action: string
+  output: string
+}
+
+const REQUEST_FLOW: FlowStage[] = [
+  {
+    title: 'Identity + access',
+    input: 'Jellyfin/local login',
+    action: 'Magent validates credentials and role',
+    output: 'JWT token + user scope',
+  },
+  {
+    title: 'Request intake',
+    input: 'Seerr request ID',
+    action: 'Magent snapshots request + media metadata',
+    output: 'Unified request state',
+  },
+  {
+    title: 'Queue orchestration',
+    input: 'Approved request',
+    action: 'Sonarr/Radarr add/search operations',
+    output: 'Grab decision',
+  },
+  {
+    title: 'Download execution',
+    input: 'Selected release',
+    action: 'qBittorrent downloads + reports progress',
+    output: 'Import-ready payload',
+  },
+  {
+    title: 'Library import',
+    input: 'Completed download',
+    action: 'Sonarr/Radarr import and finalize',
+    output: 'Available media object',
+  },
+  {
+    title: 'Playback availability',
+    input: 'Imported media',
+    action: 'Jellyfin refresh + link resolution',
+    output: 'Ready-to-watch state',
+  },
+]
+
+export default function AdminSystemGuidePage() {
+  const router = useRouter()
+  const [loading, setLoading] = useState(true)
+  const [authorized, setAuthorized] = useState(false)
+
+  useEffect(() => {
+    let active = true
+    const load = async () => {
+      if (!getToken()) {
+        router.push('/login')
+        return
+      }
+      try {
+        const baseUrl = getApiBase()
+        const response = await authFetch(`${baseUrl}/auth/me`)
+        if (!response.ok) {
+          if (response.status === 401) {
+            clearToken()
+            router.push('/login')
+            return
+          }
+          router.push('/')
+          return
+        }
+        const me = await response.json()
+        if (!active) return
+        if (me?.role !== 'admin') {
+          router.push('/')
+          return
+        }
+        setAuthorized(true)
+      } catch (error) {
+        console.error(error)
+        router.push('/')
+      } finally {
+        if (active) setLoading(false)
+      }
+    }
+    void load()
+    return () => {
+      active = false
+    }
+  }, [router])
+
+  if (loading) {
+    return <main className="card">Loading system guide...</main>
+  }
+
+  if (!authorized) {
+    return null
+  }
+
+  const rail = (
+    <div className="admin-rail-stack">
+      <div className="admin-rail-card">
+        <span className="admin-rail-eyebrow">Guide map</span>
+        <h2>Quick path</h2>
+        <p>Identity → Intake → Queue → Download → Import → Playback.</p>
+        <span className="small-pill">Admin only</span>
+      </div>
+    </div>
+  )
+
+  return (
+    <AdminShell
+      title="System guide"
+      subtitle="Admin-only architecture and operational flow for Magent."
+      rail={rail}
+      actions={
+        <button type="button" onClick={() => router.push('/admin')}>
+          Back to settings
+        </button>
+      }
+    >
+      <section className="admin-section system-guide">
+        <div className="admin-panel">
+          <h2>End-to-end system flow</h2>
+          <p className="lede">
+            This is the exact runtime path for request processing and availability in the current build.
+          </p>
+          <div className="system-flow-track">
+            {REQUEST_FLOW.map((stage, index) => (
+              <div key={stage.title} className="system-flow-segment">
+                <article className="system-flow-card">
+                  <div className="system-flow-card-title">{index + 1}. {stage.title}</div>
+                  <div className="system-flow-card-row">
+                    <span>Input</span>
+                    <strong>{stage.input}</strong>
+                  </div>
+                  <div className="system-flow-card-row">
+                    <span>Action</span>
+                    <strong>{stage.action}</strong>
+                  </div>
+                  <div className="system-flow-card-row">
+                    <span>Output</span>
+                    <strong>{stage.output}</strong>
+                  </div>
+                </article>
+                {index < REQUEST_FLOW.length - 1 && <div className="system-flow-arrow" aria-hidden="true">→</div>}
+              </div>
+            ))}
+          </div>
+        </div>
+
+        <div className="admin-panel">
+          <h2>Operational controls by area</h2>
+          <div className="system-guide-grid">
+            <article className="system-guide-card">
+              <h3>General</h3>
+              <p>Application URL, API URL, ports, bind host, proxy base URL, and manual SSL settings.</p>
+            </article>
+            <article className="system-guide-card">
+              <h3>Notifications</h3>
+              <p>Email, Discord, Telegram, push/mobile, and generic webhook delivery channels.</p>
+            </article>
+            <article className="system-guide-card">
+              <h3>Users</h3>
+              <p>Role/profile/expiry, auto-search access, invite access, and cross-system ban/remove actions.</p>
+            </article>
+            <article className="system-guide-card">
+              <h3>Invite management</h3>
+              <p>Master template, profile assignment, invite access policy, and invite trace map lineage.</p>
+            </article>
+            <article className="system-guide-card">
+              <h3>Requests + cache</h3>
+              <p>All-requests view, sync controls, cached request records, and maintenance operations.</p>
+            </article>
+            <article className="system-guide-card">
+              <h3>Live request page</h3>
+              <p>Event-stream updates for state, action history, and torrent progress without page refresh.</p>
+            </article>
+          </div>
+        </div>
+
+        <div className="admin-panel">
+          <h2>Stall recovery path (decision flow)</h2>
+          <ol className="system-decision-list">
+            <li>
+              Request approved but not in Arr queue <span>→</span> run <strong>Re-add to Arr</strong>.
+            </li>
+            <li>
+              In queue but no release found <span>→</span> run <strong>Search releases</strong> and inspect options.
+            </li>
+            <li>
+              Release exists and user should not pick manually <span>→</span> run <strong>Search + auto-download</strong>.
+            </li>
+            <li>
+              Download paused/stalled in qBittorrent <span>→</span> run <strong>Resume download</strong>.
+            </li>
+            <li>
+              Imported but not visible to user <span>→</span> validate Jellyfin visibility/link from request page.
+            </li>
+          </ol>
+        </div>
+      </section>
+    </AdminShell>
+  )
+}

frontend/app/how-it-works/page.tsx

@@ -5,16 +5,16 @@ export default function HowItWorksPage() {
     <main className="card how-page">
       <header className="how-hero">
         <p className="eyebrow">How this works</p>
-        <h1>Your request, step by step</h1>
+        <h1>How Magent works now</h1>
         <p className="lede">
-          Magent is a friendly status checker. It looks at a few helper apps, then shows you where
-          your request is and what you can safely do next.
+          End-to-end request flow, live status updates, and the exact tools available to users and
+          admins.
         </p>
       </header>
 
       <section className="how-grid">
         <article className="how-card">
-          <h2>Jellyseerr</h2>
+          <h2>Seerr</h2>
           <p className="how-title">The request box</p>
           <p>
             This is where you ask for a movie or show. It keeps the request and whether it is
@@ -52,90 +52,172 @@ export default function HowItWorksPage() {
       </section>
 
       <section className="how-flow">
-        <h2>The pipeline in plain English</h2>
+        <h2>The pipeline (request to ready)</h2>
         <ol className="how-steps">
           <li>
-            <strong>You request a title</strong> in Jellyseerr.
+            <strong>Request created</strong> in Seerr.
           </li>
           <li>
-            <strong>Sonarr/Radarr adds it</strong> to the library list.
+            <strong>Approved</strong> and sent to Sonarr/Radarr.
           </li>
           <li>
-            <strong>Prowlarr looks for sources</strong> and sends results back.
+            <strong>Search runs</strong> against indexers via Prowlarr.
           </li>
           <li>
-            <strong>qBittorrent downloads</strong> the match.
+            <strong>Grabbed</strong> and downloaded by qBittorrent.
           </li>
           <li>
-            <strong>Sonarr/Radarr imports</strong> it into your library.
+            <strong>Imported</strong> by Sonarr/Radarr.
           </li>
           <li>
-            <strong>Jellyfin shows it</strong> when it is ready to watch.
+            <strong>Available</strong> in Jellyfin.
           </li>
         </ol>
       </section>
 
       <section className="how-flow">
-        <h2>Steps and fixes (simple and visual)</h2>
+        <h2>Live updates (no refresh needed)</h2>
         <div className="how-step-grid">
-          <article className="how-step-card step-jellyseerr">
+          <article className="how-step-card step-arr">
             <div className="step-badge">1</div>
-            <h3>Request sent</h3>
-            <p className="step-note">Jellyseerr holds your request and approval.</p>
-            <div className="step-fix-title">Fixes you can try</div>
+            <h3>Request page updates in real time</h3>
+            <p className="step-note">
+              Status, timeline hops, and action history update automatically while you are viewing
+              the request.
+            </p>
+          </article>
+          <article className="how-step-card step-qbit">
+            <div className="step-badge">2</div>
+            <h3>Download progress updates live</h3>
+            <p className="step-note">
+              Torrent progress, queue state, and downloader details refresh automatically so users
+              do not need to hard refresh.
+            </p>
+          </article>
+          <article className="how-step-card step-jellyfin">
+            <div className="step-badge">3</div>
+            <h3>Ready state appears as soon as import finishes</h3>
+            <p className="step-note">
+              As soon as Sonarr/Radarr import completes and Jellyfin can serve it, the request page
+              shows it as ready.
+            </p>
+          </article>
+        </div>
+      </section>
+
+      <section className="how-flow">
+        <h2>Request actions and when to use them</h2>
+        <div className="how-step-grid">
+          <article className="how-step-card step-seerr">
+            <div className="step-badge">1</div>
+            <h3>Re-add to Arr</h3>
+            <p className="step-note">Use when a request is approved but never entered the Arr queue.</p>
+            <div className="step-fix-title">Best for</div>
             <ul className="step-fix-list">
-              <li>Add to library queue (if it was approved but never added)</li>
+              <li>Missing NEEDS_ADD / ADDED state transitions</li>
+              <li>Queue repair after Arr-side cleanup</li>
             </ul>
           </article>
 
           <article className="how-step-card step-arr">
             <div className="step-badge">2</div>
-            <h3>Added to the library list</h3>
-            <p className="step-note">Sonarr/Radarr decide what quality to get.</p>
-            <div className="step-fix-title">Fixes you can try</div>
+            <h3>Search releases</h3>
+            <p className="step-note">Runs a search and shows concrete release options.</p>
+            <div className="step-fix-title">Best for</div>
             <ul className="step-fix-list">
-              <li>Search for releases (see options)</li>
-              <li>Search and auto-download (let it pick for you)</li>
+              <li>Manual selection of a specific release/indexer</li>
+              <li>Checking whether results currently exist</li>
             </ul>
           </article>
 
           <article className="how-step-card step-prowlarr">
             <div className="step-badge">3</div>
-            <h3>Searching for sources</h3>
-            <p className="step-note">Prowlarr checks your torrent providers.</p>
-            <div className="step-fix-title">Fixes you can try</div>
+            <h3>Search + auto-download</h3>
+            <p className="step-note">Runs search and lets Arr pick/grab automatically.</p>
+            <div className="step-fix-title">Best for</div>
             <ul className="step-fix-list">
-              <li>Search for releases (show a list to choose)</li>
+              <li>Fast recovery when users have auto-search access</li>
+              <li>Hands-off retry of stalled requests</li>
             </ul>
           </article>
 
           <article className="how-step-card step-qbit">
             <div className="step-badge">4</div>
-            <h3>Downloading the file</h3>
-            <p className="step-note">qBittorrent downloads the selected match.</p>
-            <div className="step-fix-title">Fixes you can try</div>
+            <h3>Resume download</h3>
+            <p className="step-note">Resumes a paused/stopped torrent in qBittorrent.</p>
+            <div className="step-fix-title">Best for</div>
             <ul className="step-fix-list">
-              <li>Resume download (only if it already exists there)</li>
+              <li>Paused queue entries</li>
+              <li>Downloader restarts</li>
             </ul>
           </article>
 
           <article className="how-step-card step-jellyfin">
             <div className="step-badge">5</div>
-            <h3>Ready to watch</h3>
-            <p className="step-note">Jellyfin shows it in your library.</p>
-            <div className="step-fix-title">What to do next</div>
+            <h3>Open in Jellyfin</h3>
+            <p className="step-note">Available when the item is imported and linked to Jellyfin.</p>
+            <div className="step-fix-title">Best for</div>
             <ul className="step-fix-list">
-              <li>Open in Jellyfin (watch it)</li>
+              <li>Immediate playback confirmation</li>
+              <li>User handoff from request tracking to watching</li>
             </ul>
           </article>
         </div>
       </section>
 
+      <section className="how-flow">
+        <h2>Invite and account flow</h2>
+        <ol className="how-steps">
+          <li>
+            <strong>Invite created</strong> by admin or eligible user.
+          </li>
+          <li>
+            <strong>User signs up</strong> and Magent creates/links the account.
+          </li>
+          <li>
+            <strong>Profile/defaults apply</strong> (role, auto-search, expiry, invite access).
+          </li>
+          <li>
+            <strong>Admin trace map</strong> can show inviter → invited lineage.
+          </li>
+        </ol>
+      </section>
+
+      <section className="how-flow">
+        <h2>Admin controls available</h2>
+        <div className="how-grid">
+          <article className="how-card">
+            <h3>General</h3>
+            <p>App URL/port, API URL/port, bind host, proxy base URL, and manual SSL bind options.</p>
+          </article>
+          <article className="how-card">
+            <h3>Notifications</h3>
+            <p>Email, Discord, Telegram, push/mobile, and generic webhook provider settings.</p>
+          </article>
+          <article className="how-card">
+            <h3>Users</h3>
+            <p>Bulk auto-search control, invite access control, per-user roles/profile/expiry, and system actions.</p>
+          </article>
+          <article className="how-card">
+            <h3>Invite management</h3>
+            <p>Profiles, invites, blanket rules, master template, and trace map (list/graph with lineage).</p>
+          </article>
+          <article className="how-card">
+            <h3>Request sync + cache</h3>
+            <p>Control refresh/sync behavior, view all requests, and manage cached request records.</p>
+          </article>
+          <article className="how-card">
+            <h3>Maintenance + logs</h3>
+            <p>Run cleanup/sync tasks, inspect operations, and diagnose pipeline issues quickly.</p>
+          </article>
+        </div>
+      </section>
+
       <section className="how-callout">
-        <h2>Why Magent sometimes says &quot;waiting&quot;</h2>
+        <h2>Why a request can still wait</h2>
         <p>
-          If the search helper cannot find a match yet, Magent will say there is nothing to grab.
-          That does not mean it is broken. It usually means the release is not available yet.
+          If indexers do not return a valid release yet, Magent will show waiting/search states.
+          That usually means content availability is the blocker, not a broken pipeline.
         </p>
       </section>
     </main>

frontend/app/lib/auth.ts

@@ -23,3 +23,18 @@ export const authFetch = (input: RequestInfo | URL, init?: RequestInit) => {
   }
   return fetch(input, { ...init, headers })
 }
+
+export const getEventStreamToken = async () => {
+  const baseUrl = getApiBase()
+  const response = await authFetch(`${baseUrl}/auth/stream-token`)
+  if (!response.ok) {
+    const text = await response.text()
+    throw new Error(text || `Stream token request failed: ${response.status}`)
+  }
+  const data = await response.json()
+  const token = typeof data?.stream_token === 'string' ? data.stream_token : ''
+  if (!token) {
+    throw new Error('Stream token not returned')
+  }
+  return token
+}

frontend/app/login/page.tsx

@@ -52,7 +52,7 @@ export default function LoginPage() {
     <main className="card auth-card">
       <BrandingLogo className="brand-logo brand-logo--login" />
       <h1>Sign in</h1>
-      <p className="lede">Use your Jellyfin account, or sign in with Magent instead.</p>
+      <p className="lede">Use your Jellyfin account, or sign in with a local Magent admin account.</p>
       <form onSubmit={(event) => submit(event, 'jellyfin')} className="auth-form">
         <label>
           Username
@@ -85,6 +85,9 @@ export default function LoginPage() {
         >
           Sign in with Magent account
         </button>
+        <a className="ghost-button" href="/signup">
+          Have an invite? Create your account (Jellyfin + Magent)
+        </a>
       </form>
     </main>
   )

frontend/app/page.tsx

@@ -2,7 +2,25 @@
 
 import { useRouter } from 'next/navigation'
 import { useEffect, useState } from 'react'
-import { authFetch, getApiBase, getToken, clearToken } from './lib/auth'
+import { authFetch, getApiBase, getToken, clearToken, getEventStreamToken } from './lib/auth'
+
+const normalizeRecentResults = (items: any[]) =>
+  items
+    .filter((item: any) => item?.id)
+    .map((item: any) => {
+      const id = item.id
+      const rawTitle = item.title
+      const placeholder =
+        typeof rawTitle === 'string' && rawTitle.trim().toLowerCase() === `request ${id}`
+      return {
+        id,
+        title: !rawTitle || placeholder ? `Request #${id}` : rawTitle,
+        year: item.year,
+        statusLabel: item.statusLabel,
+        artwork: item.artwork,
+        createdAt: item.createdAt ?? null,
+      }
+    })
 
 export default function HomePage() {
   const router = useRouter()
@@ -14,6 +32,7 @@ export default function HomePage() {
       year?: number
       statusLabel?: string
       artwork?: { poster_url?: string }
+      createdAt?: string | null
     }[]
   >([])
   const [recentError, setRecentError] = useState<string | null>(null)
@@ -30,6 +49,9 @@ export default function HomePage() {
   >(null)
   const [servicesLoading, setServicesLoading] = useState(false)
   const [servicesError, setServicesError] = useState<string | null>(null)
+  const [serviceTesting, setServiceTesting] = useState<Record<string, boolean>>({})
+  const [serviceTestResults, setServiceTestResults] = useState<Record<string, string | null>>({})
+  const [liveStreamConnected, setLiveStreamConnected] = useState(false)
 
   const submit = (event: React.FormEvent) => {
     event.preventDefault()
@@ -42,6 +64,61 @@ export default function HomePage() {
     void runSearch(trimmed)
   }
 
+  const toServiceSlug = (name: string) => name.toLowerCase().replace(/[^a-z0-9]/g, '')
+
+  const updateServiceStatus = (name: string, status: string, message?: string) => {
+    setServicesStatus((prev) => {
+      if (!prev) return prev
+      return {
+        ...prev,
+        services: prev.services.map((service) =>
+          service.name === name ? { ...service, status, message } : service
+        ),
+      }
+    })
+  }
+
+  const testService = async (name: string) => {
+    const slug = toServiceSlug(name)
+    setServiceTesting((prev) => ({ ...prev, [name]: true }))
+    setServiceTestResults((prev) => ({ ...prev, [name]: null }))
+    try {
+      const baseUrl = getApiBase()
+      const response = await authFetch(`${baseUrl}/status/services/${slug}/test`, {
+        method: 'POST',
+      })
+      if (!response.ok) {
+        if (response.status === 401) {
+          clearToken()
+          router.push('/login')
+          return
+        }
+        const text = await response.text()
+        throw new Error(text || `Service test failed: ${response.status}`)
+      }
+      const data = await response.json()
+      const status = data?.status ?? 'unknown'
+      const message =
+        data?.message ||
+        (status === 'up'
+          ? 'API OK'
+          : status === 'down'
+            ? 'API unreachable'
+            : status === 'degraded'
+              ? 'Health warnings'
+              : status === 'not_configured'
+                ? 'Not configured'
+                : 'Unknown')
+      setServiceTestResults((prev) => ({ ...prev, [name]: message }))
+      updateServiceStatus(name, status, data?.message)
+    } catch (error) {
+      console.error(error)
+      setServiceTestResults((prev) => ({ ...prev, [name]: 'Test failed' }))
+    } finally {
+      setServiceTesting((prev) => ({ ...prev, [name]: false }))
+    }
+  }
+
   useEffect(() => {
     if (!getToken()) {
       router.push('/login')
@@ -79,24 +156,7 @@ export default function HomePage() {
         }
         const data = await response.json()
         if (Array.isArray(data?.results)) {
-          setRecent(
-            data.results
-              .filter((item: any) => item?.id)
-              .map((item: any) => {
-                const id = item.id
-                const rawTitle = item.title
-                const placeholder =
-                  typeof rawTitle === 'string' &&
-                  rawTitle.trim().toLowerCase() === `request ${id}`
-                return {
-                  id,
-                  title: !rawTitle || placeholder ? `Request #${id}` : rawTitle,
-                  year: item.year,
-                  statusLabel: item.statusLabel,
-                  artwork: item.artwork,
-                }
-              })
-          )
+          setRecent(normalizeRecentResults(data.results))
         }
       } catch (error) {
         console.error(error)
@@ -137,10 +197,92 @@ export default function HomePage() {
       }
     }
 
-    load()
+    void load()
+    if (liveStreamConnected) {
+      return
+    }
     const timer = setInterval(load, 30000)
     return () => clearInterval(timer)
-  }, [authReady, router])
+  }, [authReady, liveStreamConnected, router])
+
+  useEffect(() => {
+    if (!authReady) {
+      setLiveStreamConnected(false)
+      return
+    }
+    if (!getToken()) {
+      setLiveStreamConnected(false)
+      return
+    }
+    const baseUrl = getApiBase()
+    let closed = false
+    let source: EventSource | null = null
+
+    const connect = async () => {
+      try {
+        const streamToken = await getEventStreamToken()
+        if (closed) return
+        const streamUrl = `${baseUrl}/events/stream?stream_token=${encodeURIComponent(streamToken)}&recent_days=${encodeURIComponent(String(recentDays))}`
+        source = new EventSource(streamUrl)
+
+        source.onopen = () => {
+          if (closed) return
+          setLiveStreamConnected(true)
+        }
+
+        source.onmessage = (event) => {
+          if (closed) return
+          setLiveStreamConnected(true)
+          try {
+            const payload = JSON.parse(event.data)
+            if (!payload || typeof payload !== 'object') {
+              return
+            }
+            if (payload.type === 'home_recent') {
+              if (Array.isArray(payload.results)) {
+                setRecent(normalizeRecentResults(payload.results))
+                setRecentError(null)
+                setRecentLoading(false)
+              } else if (typeof payload.error === 'string' && payload.error.trim()) {
+                setRecentError('Recent requests are not available right now.')
+                setRecentLoading(false)
+              }
+              return
+            }
+            if (payload.type === 'home_services') {
+              if (payload.status && typeof payload.status === 'object') {
+                setServicesStatus(payload.status)
+                setServicesError(null)
+                setServicesLoading(false)
+              } else if (typeof payload.error === 'string' && payload.error.trim()) {
+                setServicesError('Service status is not available right now.')
+                setServicesLoading(false)
+              }
+            }
+          } catch (error) {
+            console.error(error)
+          }
+        }
+
+        source.onerror = () => {
+          if (closed) return
+          setLiveStreamConnected(false)
+        }
+      } catch (error) {
+        if (closed) return
+        console.error(error)
+        setLiveStreamConnected(false)
+      }
+    }
+
+    void connect()
+
+    return () => {
+      closed = true
+      setLiveStreamConnected(false)
+      source?.close()
+    }
+  }, [authReady, recentDays])
 
   const runSearch = async (term: string) => {
     try {
@@ -179,6 +321,13 @@ export default function HomePage() {
     return url.startsWith('http') ? url : `${getApiBase()}${url}`
   }
 
+  const formatRequestTime = (value?: string | null) => {
+    if (!value) return null
+    const date = new Date(value)
+    if (Number.isNaN(date.valueOf())) return value
+    return date.toLocaleString()
+  }
+
   return (
     <main className="card">
       <div className="layout-grid">
@@ -203,7 +352,7 @@ export default function HomePage() {
               <div className="system-list">
                 {(() => {
                   const order = [
-                    'Jellyseerr',
+                    'Seerr',
                     'Sonarr',
                     'Radarr',
                     'Prowlarr',
@@ -214,21 +363,37 @@ export default function HomePage() {
                   return order.map((name) => {
                     const item = items.find((entry) => entry.name === name)
                     const status = item?.status ?? 'unknown'
+                    const testing = serviceTesting[name] ?? false
                     return (
                       <div key={name} className={`system-item system-${status}`}>
                         <span className="system-dot" />
-                        <span className="system-name">{name}</span>
-                        <span className="system-state">
-                          {status === 'up'
-                            ? 'Up'
-                            : status === 'down'
-                              ? 'Down'
-                              : status === 'degraded'
-                                ? 'Needs attention'
-                                : status === 'not_configured'
-                                  ? 'Not configured'
-                                  : 'Unknown'}
-                        </span>
+                        <div className="system-meta">
+                          <span className="system-name">{name}</span>
+                          {serviceTestResults[name] && (
+                            <span className="system-test-message">{serviceTestResults[name]}</span>
+                          )}
+                        </div>
+                        <div className="system-actions">
+                          <span className="system-state">
+                            {status === 'up'
+                              ? 'Up'
+                              : status === 'down'
+                                ? 'Down'
+                                : status === 'degraded'
+                                  ? 'Needs attention'
+                                  : status === 'not_configured'
+                                    ? 'Not configured'
+                                    : 'Unknown'}
+                          </span>
+                          <button
+                            type="button"
+                            className="system-test"
+                            onClick={() => void testService(name)}
+                            disabled={testing}
+                          >
+                            {testing ? 'Testing...' : 'Test'}
+                          </button>
+                        </div>
                       </div>
                     )
                   })
@@ -239,11 +404,12 @@ export default function HomePage() {
               <h2>{role === 'admin' ? 'All requests' : 'My recent requests'}</h2>
               {authReady && (
                 <label className="recent-filter">
-                  <span>Show last</span>
+                  <span>Show</span>
                   <select
                     value={recentDays}
                     onChange={(event) => setRecentDays(Number(event.target.value))}
                   >
+                    <option value={0}>All</option>
                     <option value={30}>30 days</option>
                     <option value={60}>60 days</option>
                     <option value={90}>90 days</option>
@@ -290,6 +456,7 @@ export default function HomePage() {
                       <span className="recent-meta">
                         {item.statusLabel ? item.statusLabel : 'Status not available yet'} · Request{' '}
                         {item.id}
+                        {item.createdAt ? ` · ${formatRequestTime(item.createdAt)}` : ''}
                       </span>
                     </span>
                   </button>

frontend/app/profile/page.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { useEffect, useState } from 'react'
+import { useEffect, useMemo, useState } from 'react'
 import { useRouter } from 'next/navigation'
 import { authFetch, clearToken, getApiBase, getToken } from '../lib/auth'
 
@@ -8,6 +8,7 @@ type ProfileInfo = {
   username: string
   role: string
   auth_provider: string
+  invite_management_enabled?: boolean
 }
 
 type ProfileStats = {
@@ -47,6 +48,68 @@ type ProfileResponse = {
   activity: ProfileActivity
 }
 
+type OwnedInvite = {
+  id: number
+  code: string
+  label?: string | null
+  description?: string | null
+  recipient_email?: string | null
+  max_uses?: number | null
+  use_count: number
+  remaining_uses?: number | null
+  enabled: boolean
+  expires_at?: string | null
+  is_expired?: boolean
+  is_usable?: boolean
+  created_at?: string | null
+  updated_at?: string | null
+}
+
+type OwnedInvitesResponse = {
+  invites?: OwnedInvite[]
+  count?: number
+  invite_access?: {
+    enabled?: boolean
+    managed_by_master?: boolean
+  }
+  master_invite?: {
+    id: number
+    code: string
+    label?: string | null
+    description?: string | null
+    max_uses?: number | null
+    enabled?: boolean
+    expires_at?: string | null
+    is_usable?: boolean
+  } | null
+}
+
+type OwnedInviteForm = {
+  code: string
+  label: string
+  description: string
+  recipient_email: string
+  max_uses: string
+  expires_at: string
+  enabled: boolean
+  send_email: boolean
+  message: string
+}
+
+type ProfileTab = 'overview' | 'activity' | 'invites' | 'security'
+
+const defaultOwnedInviteForm = (): OwnedInviteForm => ({
+  code: '',
+  label: '',
+  description: '',
+  recipient_email: '',
+  max_uses: '',
+  expires_at: '',
+  enabled: true,
+  send_email: false,
+  message: '',
+})
+
 const formatDate = (value?: string | null) => {
   if (!value) return 'Never'
   const date = new Date(value)
@@ -72,8 +135,23 @@ export default function ProfilePage() {
   const [currentPassword, setCurrentPassword] = useState('')
   const [newPassword, setNewPassword] = useState('')
   const [status, setStatus] = useState<string | null>(null)
+  const [inviteStatus, setInviteStatus] = useState<string | null>(null)
+  const [inviteError, setInviteError] = useState<string | null>(null)
+  const [invites, setInvites] = useState<OwnedInvite[]>([])
+  const [inviteSaving, setInviteSaving] = useState(false)
+  const [inviteEditingId, setInviteEditingId] = useState<number | null>(null)
+  const [inviteForm, setInviteForm] = useState<OwnedInviteForm>(defaultOwnedInviteForm())
+  const [activeTab, setActiveTab] = useState<ProfileTab>('overview')
+  const [inviteAccessEnabled, setInviteAccessEnabled] = useState(false)
+  const [inviteManagedByMaster, setInviteManagedByMaster] = useState(false)
+  const [masterInviteTemplate, setMasterInviteTemplate] = useState<OwnedInvitesResponse['master_invite']>(null)
   const [loading, setLoading] = useState(true)
 
+  const signupBaseUrl = useMemo(() => {
+    if (typeof window === 'undefined') return '/signup'
+    return `${window.location.origin}/signup`
+  }, [])
+
   useEffect(() => {
     if (!getToken()) {
       router.push('/login')
@@ -82,21 +160,32 @@ export default function ProfilePage() {
     const load = async () => {
       try {
         const baseUrl = getApiBase()
-        const response = await authFetch(`${baseUrl}/auth/profile`)
-        if (!response.ok) {
+        const [profileResponse, invitesResponse] = await Promise.all([
+          authFetch(`${baseUrl}/auth/profile`),
+          authFetch(`${baseUrl}/auth/profile/invites`),
+        ])
+        if (!profileResponse.ok || !invitesResponse.ok) {
           clearToken()
           router.push('/login')
           return
         }
-        const data = await response.json()
+        const [data, inviteData] = (await Promise.all([
+          profileResponse.json(),
+          invitesResponse.json(),
+        ])) as [ProfileResponse, OwnedInvitesResponse]
         const user = data?.user ?? {}
         setProfile({
           username: user?.username ?? 'Unknown',
           role: user?.role ?? 'user',
           auth_provider: user?.auth_provider ?? 'local',
+          invite_management_enabled: Boolean(user?.invite_management_enabled ?? false),
         })
         setStats(data?.stats ?? null)
         setActivity(data?.activity ?? null)
+        setInvites(Array.isArray(inviteData?.invites) ? inviteData.invites : [])
+        setInviteAccessEnabled(Boolean(inviteData?.invite_access?.enabled ?? false))
+        setInviteManagedByMaster(Boolean(inviteData?.invite_access?.managed_by_master ?? false))
+        setMasterInviteTemplate(inviteData?.master_invite ?? null)
       } catch (err) {
         console.error(err)
         setStatus('Could not load your profile.')
@@ -125,18 +214,194 @@ export default function ProfilePage() {
         }),
       })
       if (!response.ok) {
-        const text = await response.text()
-        throw new Error(text || 'Update failed')
+        let detail = 'Update failed'
+        try {
+          const payload = await response.json()
+          if (typeof payload?.detail === 'string' && payload.detail.trim()) {
+            detail = payload.detail
+          }
+        } catch {
+          const text = await response.text().catch(() => '')
+          if (text?.trim()) detail = text
+        }
+        throw new Error(detail)
       }
+      const data = await response.json().catch(() => ({}))
       setCurrentPassword('')
       setNewPassword('')
-      setStatus('Password updated.')
+      setStatus(
+        data?.provider === 'jellyfin'
+          ? 'Password updated in Jellyfin (and Magent cache).'
+          : 'Password updated.'
+      )
     } catch (err) {
       console.error(err)
-      setStatus('Could not update password. Check your current password.')
+      if (err instanceof Error && err.message) {
+        setStatus(`Could not update password. ${err.message}`)
+      } else {
+        setStatus('Could not update password. Check your current password.')
+      }
     }
   }
 
+  const resetInviteEditor = () => {
+    setInviteEditingId(null)
+    setInviteForm(defaultOwnedInviteForm())
+  }
+
+  const editInvite = (invite: OwnedInvite) => {
+    setInviteEditingId(invite.id)
+    setInviteError(null)
+    setInviteStatus(null)
+    setInviteForm({
+      code: invite.code ?? '',
+      label: invite.label ?? '',
+      description: invite.description ?? '',
+      recipient_email: invite.recipient_email ?? '',
+      max_uses: typeof invite.max_uses === 'number' ? String(invite.max_uses) : '',
+      expires_at: invite.expires_at ?? '',
+      enabled: invite.enabled !== false,
+      send_email: false,
+      message: '',
+    })
+  }
+
+  const reloadInvites = async () => {
+    const baseUrl = getApiBase()
+    const response = await authFetch(`${baseUrl}/auth/profile/invites`)
+    if (!response.ok) {
+      if (response.status === 401) {
+        clearToken()
+        router.push('/login')
+        return
+      }
+      throw new Error(`Invite refresh failed: ${response.status}`)
+    }
+    const data = (await response.json()) as OwnedInvitesResponse
+    setInvites(Array.isArray(data?.invites) ? data.invites : [])
+    setInviteAccessEnabled(Boolean(data?.invite_access?.enabled ?? false))
+    setInviteManagedByMaster(Boolean(data?.invite_access?.managed_by_master ?? false))
+    setMasterInviteTemplate(data?.master_invite ?? null)
+  }
+
+  const saveInvite = async (event: React.FormEvent) => {
+    event.preventDefault()
+    setInviteSaving(true)
+    setInviteError(null)
+    setInviteStatus(null)
+    try {
+      const baseUrl = getApiBase()
+      const response = await authFetch(
+        inviteEditingId == null
+          ? `${baseUrl}/auth/profile/invites`
+          : `${baseUrl}/auth/profile/invites/${inviteEditingId}`,
+        {
+          method: inviteEditingId == null ? 'POST' : 'PUT',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            code: inviteForm.code || null,
+            label: inviteForm.label || null,
+            description: inviteForm.description || null,
+            recipient_email: inviteForm.recipient_email || null,
+            max_uses: inviteForm.max_uses || null,
+            expires_at: inviteForm.expires_at || null,
+            enabled: inviteForm.enabled,
+            send_email: inviteForm.send_email,
+            message: inviteForm.message || null,
+          }),
+        }
+      )
+      if (!response.ok) {
+        if (response.status === 401) {
+          clearToken()
+          router.push('/login')
+          return
+        }
+        const text = await response.text()
+        throw new Error(text || 'Invite save failed')
+      }
+      const data = await response.json().catch(() => ({}))
+      if (data?.email?.status === 'ok') {
+        setInviteStatus(
+          `${inviteEditingId == null ? 'Invite created' : 'Invite updated'} and email sent to ${data.email.recipient_email}.`
+        )
+      } else if (data?.email?.status === 'error') {
+        setInviteStatus(
+          `${inviteEditingId == null ? 'Invite created' : 'Invite updated'}, but email failed: ${data.email.detail}`
+        )
+      } else {
+        setInviteStatus(inviteEditingId == null ? 'Invite created.' : 'Invite updated.')
+      }
+      resetInviteEditor()
+      await reloadInvites()
+    } catch (err) {
+      console.error(err)
+      setInviteError(err instanceof Error ? err.message : 'Could not save invite.')
+    } finally {
+      setInviteSaving(false)
+    }
+  }
+
+  const deleteInvite = async (invite: OwnedInvite) => {
+    if (!window.confirm(`Delete invite "${invite.code}"?`)) return
+    setInviteError(null)
+    setInviteStatus(null)
+    try {
+      const baseUrl = getApiBase()
+      const response = await authFetch(`${baseUrl}/auth/profile/invites/${invite.id}`, {
+        method: 'DELETE',
+      })
+      if (!response.ok) {
+        if (response.status === 401) {
+          clearToken()
+          router.push('/login')
+          return
+        }
+        const text = await response.text()
+        throw new Error(text || 'Invite delete failed')
+      }
+      if (inviteEditingId === invite.id) {
+        resetInviteEditor()
+      }
+      setInviteStatus(`Deleted invite ${invite.code}.`)
+      await reloadInvites()
+    } catch (err) {
+      console.error(err)
+      setInviteError(err instanceof Error ? err.message : 'Could not delete invite.')
+    }
+  }
+
+  const copyInviteLink = async (invite: OwnedInvite) => {
+    const url = `${signupBaseUrl}?code=${encodeURIComponent(invite.code)}`
+    try {
+      if (navigator.clipboard?.writeText) {
+        await navigator.clipboard.writeText(url)
+        setInviteStatus(`Copied invite link for ${invite.code}.`)
+      } else {
+        window.prompt('Copy invite link', url)
+      }
+    } catch (err) {
+      console.error(err)
+      window.prompt('Copy invite link', url)
+    }
+  }
+
+  const authProvider = profile?.auth_provider ?? 'local'
+  const canManageInvites = profile?.role === 'admin' || inviteAccessEnabled
+  const canChangePassword = authProvider === 'local' || authProvider === 'jellyfin'
+  const securityHelpText =
+    authProvider === 'jellyfin'
+      ? 'Changing your password here updates your Jellyfin account and refreshes Magent’s cached sign-in.'
+      : authProvider === 'local'
+        ? 'Change your Magent account password.'
+        : 'Password changes are not available for this sign-in provider.'
+
+  useEffect(() => {
+    if (activeTab === 'invites' && !canManageInvites) {
+      setActiveTab('overview')
+    }
+  }, [activeTab, canManageInvites])
+
   if (loading) {
     return <main className="card">Loading profile...</main>
   }
@@ -150,8 +415,51 @@ export default function ProfilePage() {
           {profile.auth_provider}.
         </div>
       )}
-      <div className="profile-grid">
-        <section className="profile-section">
+      <div className="profile-tabbar">
+        <div className="admin-segmented" role="tablist" aria-label="Profile sections">
+          <button
+            type="button"
+            role="tab"
+            aria-selected={activeTab === 'overview'}
+            className={activeTab === 'overview' ? 'is-active' : ''}
+            onClick={() => setActiveTab('overview')}
+          >
+            Overview
+          </button>
+          <button
+            type="button"
+            role="tab"
+            aria-selected={activeTab === 'activity'}
+            className={activeTab === 'activity' ? 'is-active' : ''}
+            onClick={() => setActiveTab('activity')}
+          >
+            Activity
+          </button>
+          {canManageInvites ? (
+            <button
+              type="button"
+              role="tab"
+              aria-selected={activeTab === 'invites'}
+              className={activeTab === 'invites' ? 'is-active' : ''}
+              onClick={() => setActiveTab('invites')}
+            >
+              My invites
+            </button>
+          ) : null}
+          <button
+            type="button"
+            role="tab"
+            aria-selected={activeTab === 'security'}
+            className={activeTab === 'security' ? 'is-active' : ''}
+            onClick={() => setActiveTab('security')}
+          >
+            Security
+          </button>
+        </div>
+      </div>
+
+      {activeTab === 'overview' && (
+        <section className="profile-section profile-tab-panel">
           <h2>Account stats</h2>
           <div className="stat-grid">
             <div className="stat-card">
@@ -174,6 +482,18 @@ export default function ProfilePage() {
               <div className="stat-label">Declined</div>
               <div className="stat-value">{stats?.declined ?? 0}</div>
             </div>
+            <div className="stat-card">
+              <div className="stat-label">Working</div>
+              <div className="stat-value">{stats?.working ?? 0}</div>
+            </div>
+            <div className="stat-card">
+              <div className="stat-label">Partial</div>
+              <div className="stat-value">{stats?.partial ?? 0}</div>
+            </div>
+            <div className="stat-card">
+              <div className="stat-label">Approved</div>
+              <div className="stat-value">{stats?.approved ?? 0}</div>
+            </div>
             <div className="stat-card">
               <div className="stat-label">Last request</div>
               <div className="stat-value stat-value--small">
@@ -188,6 +508,10 @@ export default function ProfilePage() {
                   : '0%'}
               </div>
             </div>
+            <div className="stat-card">
+              <div className="stat-label">Total requests (global)</div>
+              <div className="stat-value">{stats?.global_total ?? 0}</div>
+            </div>
             {profile?.role === 'admin' ? (
               <div className="stat-card">
                 <div className="stat-label">Most active user</div>
@@ -200,7 +524,10 @@ export default function ProfilePage() {
             ) : null}
           </div>
         </section>
-        <section className="profile-section">
+      )}
+
+      {activeTab === 'activity' && (
+        <section className="profile-section profile-tab-panel">
           <h2>Connection history</h2>
           <div className="status-banner">
             Last seen {formatDate(activity?.last_seen_at)} from {activity?.last_ip ?? 'Unknown'}.
@@ -211,6 +538,7 @@ export default function ProfilePage() {
                 <div>
                   <div className="connection-label">{parseBrowser(entry.user_agent)}</div>
                   <div className="meta">IP: {entry.ip}</div>
+                  <div className="meta">First seen: {formatDate(entry.first_seen_at)}</div>
                   <div className="meta">Last seen: {formatDate(entry.last_seen_at)}</div>
                 </div>
                 <div className="connection-count">{entry.hit_count} visits</div>
@@ -221,36 +549,305 @@ export default function ProfilePage() {
             ) : null}
           </div>
         </section>
-      </div>
-      {profile?.auth_provider !== 'local' ? (
-        <div className="status-banner">
-          Password changes are only available for local Magent accounts.
-        </div>
-      ) : (
-        <form onSubmit={submit} className="auth-form">
-          <label>
-            Current password
-            <input
-              type="password"
-              value={currentPassword}
-              onChange={(event) => setCurrentPassword(event.target.value)}
-              autoComplete="current-password"
-            />
-          </label>
-          <label>
-            New password
-            <input
-              type="password"
-              value={newPassword}
-              onChange={(event) => setNewPassword(event.target.value)}
-              autoComplete="new-password"
-            />
-          </label>
-          {status && <div className="status-banner">{status}</div>}
-          <div className="auth-actions">
-            <button type="submit">Update password</button>
+      )}
+
+      {activeTab === 'invites' && (
+        <section className="profile-section profile-invites-section profile-tab-panel">
+        <div className="user-directory-panel-header">
+          <div>
+            <h2>My invites</h2>
+            <p className="lede">
+              {inviteManagedByMaster
+                ? 'Create and manage invite links you’ve issued. New invites use the admin master invite rule.'
+                : 'Create and manage invite links you’ve issued. New invites use your account defaults.'}
+            </p>
           </div>
-        </form>
+        </div>
+        {inviteError && <div className="error-banner">{inviteError}</div>}
+        {inviteStatus && <div className="status-banner">{inviteStatus}</div>}
+        <div className="profile-invites-layout">
+          <div className="profile-invite-form-card">
+            <h3>{inviteEditingId == null ? 'Create invite' : 'Edit invite'}</h3>
+            <p className="meta profile-invite-form-lede">
+              Share the generated signup link with the person you want to invite.
+            </p>
+            {inviteManagedByMaster && masterInviteTemplate ? (
+              <div className="status-banner profile-invite-master-banner">
+                Using master invite rule <code>{masterInviteTemplate.code}</code>
+                {masterInviteTemplate.label ? ` (${masterInviteTemplate.label})` : ''}. Limits/status are managed by admin.
+              </div>
+            ) : null}
+            <form onSubmit={saveInvite} className="admin-form compact-form invite-form-layout">
+              <div className="invite-form-row">
+                <div className="invite-form-row-label">
+                  <span>Identity</span>
+                  <small>Optional code and label for easier tracking.</small>
+                </div>
+                <div className="invite-form-row-control invite-form-row-grid">
+                  <label>
+                    <span>Code (optional)</span>
+                    <input
+                      value={inviteForm.code}
+                      onChange={(event) =>
+                        setInviteForm((current) => ({ ...current, code: event.target.value }))
+                      }
+                      placeholder="Leave blank to auto-generate"
+                    />
+                  </label>
+                  <label>
+                    <span>Label</span>
+                    <input
+                      value={inviteForm.label}
+                      onChange={(event) =>
+                        setInviteForm((current) => ({ ...current, label: event.target.value }))
+                      }
+                      placeholder="Family invite"
+                    />
+                  </label>
+                </div>
+              </div>
+
+              <div className="invite-form-row">
+                <div className="invite-form-row-label">
+                  <span>Description</span>
+                  <small>Optional note shown on the signup page.</small>
+                </div>
+                <div className="invite-form-row-control">
+                  <textarea
+                    rows={3}
+                    value={inviteForm.description}
+                    onChange={(event) =>
+                      setInviteForm((current) => ({
+                        ...current,
+                        description: event.target.value,
+                      }))
+                    }
+                    placeholder="Optional note shown on the signup page"
+                  />
+                </div>
+              </div>
+
+              <div className="invite-form-row">
+                <div className="invite-form-row-label">
+                  <span>Delivery</span>
+                  <small>Save a recipient email and optionally send the invite immediately.</small>
+                </div>
+                <div className="invite-form-row-control invite-form-row-control--stacked">
+                  <label>
+                    <span>Recipient email</span>
+                    <input
+                      type="email"
+                      value={inviteForm.recipient_email}
+                      onChange={(event) =>
+                        setInviteForm((current) => ({
+                          ...current,
+                          recipient_email: event.target.value,
+                        }))
+                      }
+                      placeholder="friend@example.com"
+                    />
+                  </label>
+                  <label>
+                    <span>Delivery note</span>
+                    <textarea
+                      rows={3}
+                      value={inviteForm.message}
+                      onChange={(event) =>
+                        setInviteForm((current) => ({
+                          ...current,
+                          message: event.target.value,
+                        }))
+                      }
+                      placeholder="Optional note to include in the email"
+                    />
+                  </label>
+                  <label className="inline-checkbox">
+                    <input
+                      type="checkbox"
+                      checked={inviteForm.send_email}
+                      onChange={(event) =>
+                        setInviteForm((current) => ({
+                          ...current,
+                          send_email: event.target.checked,
+                        }))
+                      }
+                    />
+                    Send "You have been invited" email after saving
+                  </label>
+                </div>
+              </div>
+
+              <div className="invite-form-row">
+                <div className="invite-form-row-label">
+                  <span>Limits</span>
+                  <small>Usage cap and optional expiry date/time.</small>
+                </div>
+                <div className="invite-form-row-control invite-form-row-grid">
+                  <label>
+                    <span>Max uses</span>
+                    <input
+                      value={inviteForm.max_uses}
+                      onChange={(event) =>
+                        setInviteForm((current) => ({ ...current, max_uses: event.target.value }))
+                      }
+                      inputMode="numeric"
+                      placeholder="Blank = unlimited"
+                      disabled={inviteManagedByMaster}
+                    />
+                  </label>
+                  <label>
+                    <span>Invite expiry (ISO datetime)</span>
+                    <input
+                      value={inviteForm.expires_at}
+                      onChange={(event) =>
+                        setInviteForm((current) => ({ ...current, expires_at: event.target.value }))
+                      }
+                      placeholder="2026-03-01T12:00:00+00:00"
+                      disabled={inviteManagedByMaster}
+                    />
+                  </label>
+                </div>
+              </div>
+
+              <div className="invite-form-row">
+                <div className="invite-form-row-label">
+                  <span>Status</span>
+                  <small>Enable or disable this invite before sharing.</small>
+                </div>
+                <div className="invite-form-row-control invite-form-row-control--stacked">
+                  <label className="inline-checkbox">
+                    <input
+                      type="checkbox"
+                      checked={inviteForm.enabled}
+                      onChange={(event) =>
+                        setInviteForm((current) => ({
+                          ...current,
+                          enabled: event.target.checked,
+                        }))
+                      }
+                      disabled={inviteManagedByMaster}
+                    />
+                    Invite is enabled
+                  </label>
+                  <div className="admin-inline-actions">
+                    <button type="submit" disabled={inviteSaving}>
+                      {inviteSaving
+                        ? 'Saving…'
+                        : inviteEditingId == null
+                          ? 'Create invite'
+                          : 'Save invite'}
+                    </button>
+                    {inviteEditingId != null && (
+                      <button type="button" className="ghost-button" onClick={resetInviteEditor}>
+                        Cancel edit
+                      </button>
+                    )}
+                  </div>
+                </div>
+              </div>
+            </form>
+            <div className="meta profile-invite-hint">
+              Invite URL format: <code>{signupBaseUrl}?code=INVITECODE</code>
+            </div>
+          </div>
+          <div className="profile-invites-list">
+            {invites.length === 0 ? (
+              <div className="status-banner">You haven’t created any invites yet.</div>
+            ) : (
+              <div className="admin-list">
+                {invites.map((invite) => (
+                  <div key={invite.id} className="admin-list-item">
+                    <div className="admin-list-item-main">
+                      <div className="admin-list-item-title-row">
+                        <code className="invite-code">{invite.code}</code>
+                        <span className={`small-pill ${invite.is_usable ? '' : 'is-muted'}`}>
+                          {invite.is_usable ? 'Usable' : 'Unavailable'}
+                        </span>
+                        <span className="small-pill is-muted">
+                          {invite.remaining_uses == null ? 'Unlimited' : `${invite.remaining_uses} left`}
+                        </span>
+                      </div>
+                      {invite.label && <p className="admin-list-item-text">{invite.label}</p>}
+                      {invite.description && (
+                        <p className="admin-list-item-text admin-list-item-text--muted">
+                          {invite.description}
+                        </p>
+                      )}
+                      <div className="admin-meta-row">
+                        <span>Recipient: {invite.recipient_email || 'Not set'}</span>
+                        <span>
+                          Uses: {invite.use_count}
+                          {typeof invite.max_uses === 'number' ? ` / ${invite.max_uses}` : ''}
+                        </span>
+                        <span>Expires: {formatDate(invite.expires_at)}</span>
+                        <span>Created: {formatDate(invite.created_at)}</span>
+                      </div>
+                    </div>
+                    <div className="admin-inline-actions">
+                      <button
+                        type="button"
+                        className="ghost-button"
+                        onClick={() => copyInviteLink(invite)}
+                      >
+                        Copy link
+                      </button>
+                      <button
+                        type="button"
+                        className="ghost-button"
+                        onClick={() => editInvite(invite)}
+                      >
+                        Edit
+                      </button>
+                      <button type="button" onClick={() => deleteInvite(invite)}>
+                        Delete
+                      </button>
+                    </div>
+                  </div>
+                ))}
+              </div>
+            )}
+          </div>
+        </div>
+        </section>
+      )}
+
+      {activeTab === 'security' && (
+        <section className="profile-section profile-tab-panel">
+          <h2>Security</h2>
+          <div className="status-banner">{securityHelpText}</div>
+          {canChangePassword ? (
+            <form onSubmit={submit} className="auth-form profile-security-form">
+              <label>
+                Current password
+                <input
+                  type="password"
+                  value={currentPassword}
+                  onChange={(event) => setCurrentPassword(event.target.value)}
+                  autoComplete="current-password"
+                />
+              </label>
+              <label>
+                New password
+                <input
+                  type="password"
+                  value={newPassword}
+                  onChange={(event) => setNewPassword(event.target.value)}
+                  autoComplete="new-password"
+                />
+              </label>
+              {status && <div className="status-banner">{status}</div>}
+              <div className="auth-actions">
+                <button type="submit">
+                  {authProvider === 'jellyfin' ? 'Update Jellyfin password' : 'Update password'}
+                </button>
+              </div>
+            </form>
+          ) : (
+            <div className="status-banner">
+              Password changes are not available for {authProvider} sign-in accounts from Magent.
+            </div>
+          )}
+        </section>
       )}
     </main>
   )

frontend/app/requests/[id]/page.tsx

@@ -2,8 +2,8 @@
 
 import Image from 'next/image'
 import { useEffect, useState } from 'react'
-import { useRouter } from 'next/navigation'
-import { authFetch, clearToken, getApiBase, getToken } from '../../lib/auth'
+import { useParams, useRouter } from 'next/navigation'
+import { authFetch, clearToken, getApiBase, getEventStreamToken, getToken } from '../../lib/auth'
 
 type TimelineHop = {
   service: string
@@ -140,7 +140,7 @@ const friendlyState = (value: string) => {
 }
 
 const friendlyTimelineStatus = (service: string, status: string) => {
-  if (service === 'Jellyseerr') {
+  if (service === 'Seerr') {
     const map: Record<string, string> = {
       Pending: 'Waiting for approval',
       Approved: 'Approved',
@@ -195,7 +195,9 @@ const friendlyTimelineStatus = (service: string, status: string) => {
   return status
 }
 
-export default function RequestTimelinePage({ params }: { params: { id: string } }) {
+export default function RequestTimelinePage() {
+  const params = useParams<{ id: string | string[] }>()
+  const requestId = Array.isArray(params?.id) ? params.id[0] : params?.id
   const router = useRouter()
   const [snapshot, setSnapshot] = useState<Snapshot | null>(null)
   const [loading, setLoading] = useState(true)
@@ -208,6 +210,9 @@ export default function RequestTimelinePage({ params }: { params: { id: string }
   const [historyActions, setHistoryActions] = useState<ActionHistory[]>([])
 
   useEffect(() => {
+    if (!requestId) {
+      return
+    }
     const load = async () => {
       try {
         if (!getToken()) {
@@ -216,9 +221,9 @@ export default function RequestTimelinePage({ params }: { params: { id: string }
         }
         const baseUrl = getApiBase()
         const [snapshotResponse, historyResponse, actionsResponse] = await Promise.all([
-          authFetch(`${baseUrl}/requests/${params.id}/snapshot`),
-          authFetch(`${baseUrl}/requests/${params.id}/history?limit=5`),
-          authFetch(`${baseUrl}/requests/${params.id}/actions?limit=5`),
+          authFetch(`${baseUrl}/requests/${requestId}/snapshot`),
+          authFetch(`${baseUrl}/requests/${requestId}/history?limit=5`),
+          authFetch(`${baseUrl}/requests/${requestId}/actions?limit=5`),
         ])
 
         if (snapshotResponse.status === 401) {
@@ -252,7 +257,65 @@ export default function RequestTimelinePage({ params }: { params: { id: string }
     }
 
     load()
-  }, [params.id, router])
+  }, [requestId, router])
+
+  useEffect(() => {
+    if (!getToken() || !requestId) {
+      return
+    }
+    const baseUrl = getApiBase()
+    let closed = false
+    let source: EventSource | null = null
+
+    const connect = async () => {
+      try {
+        const streamToken = await getEventStreamToken()
+        if (closed) return
+        const streamUrl = `${baseUrl}/events/requests/${encodeURIComponent(
+          requestId
+        )}/stream?stream_token=${encodeURIComponent(streamToken)}`
+        source = new EventSource(streamUrl)
+
+        source.onmessage = (event) => {
+          if (closed) return
+          try {
+            const payload = JSON.parse(event.data)
+            if (!payload || typeof payload !== 'object' || payload.type !== 'request_live') {
+              return
+            }
+            if (String(payload.request_id ?? '') !== String(requestId)) {
+              return
+            }
+            if (payload.snapshot && typeof payload.snapshot === 'object') {
+              setSnapshot(payload.snapshot as Snapshot)
+            }
+            if (Array.isArray(payload.history)) {
+              setHistorySnapshots(payload.history as SnapshotHistory[])
+            }
+            if (Array.isArray(payload.actions)) {
+              setHistoryActions(payload.actions as ActionHistory[])
+            }
+          } catch (error) {
+            console.error(error)
+          }
+        }
+
+        source.onerror = () => {
+          if (closed) return
+        }
+      } catch (error) {
+        if (closed) return
+        console.error(error)
+      }
+    }
+
+    void connect()
+
+    return () => {
+      closed = true
+      source?.close()
+    }
+  }, [requestId])
 
   if (loading) {
     return (
@@ -279,7 +342,7 @@ export default function RequestTimelinePage({ params }: { params: { id: string }
   const arrStageLabel =
     snapshot.state === 'NEEDS_ADD' ? 'Push to Sonarr/Radarr' : 'Library queue'
   const pipelineSteps = [
-    { key: 'Jellyseerr', label: 'Jellyseerr' },
+    { key: 'Seerr', label: 'Seerr' },
     { key: 'Sonarr/Radarr', label: arrStageLabel },
     { key: 'Prowlarr', label: 'Search' },
     { key: 'qBittorrent', label: 'Download' },

frontend/app/signup/page.tsx

@@ -0,0 +1,223 @@
+'use client'
+
+import { Suspense, useEffect, useMemo, useState } from 'react'
+import { useRouter, useSearchParams } from 'next/navigation'
+import BrandingLogo from '../ui/BrandingLogo'
+import { clearToken, getApiBase, setToken } from '../lib/auth'
+
+type InviteInfo = {
+  code: string
+  label?: string | null
+  description?: string | null
+  enabled: boolean
+  is_expired?: boolean
+  is_usable?: boolean
+  expires_at?: string | null
+  max_uses?: number | null
+  use_count?: number | null
+  remaining_uses?: number | null
+  profile?: {
+    id: number
+    name: string
+    description?: string | null
+  } | null
+}
+
+const formatDate = (value?: string | null) => {
+  if (!value) return 'Never'
+  const date = new Date(value)
+  if (Number.isNaN(date.valueOf())) return value
+  return date.toLocaleString()
+}
+
+function SignupPageContent() {
+  const router = useRouter()
+  const searchParams = useSearchParams()
+  const [inviteCode, setInviteCode] = useState(searchParams.get('code') ?? '')
+  const [invite, setInvite] = useState<InviteInfo | null>(null)
+  const [inviteLoading, setInviteLoading] = useState(false)
+  const [loading, setLoading] = useState(false)
+  const [username, setUsername] = useState('')
+  const [password, setPassword] = useState('')
+  const [confirmPassword, setConfirmPassword] = useState('')
+  const [error, setError] = useState<string | null>(null)
+  const [status, setStatus] = useState<string | null>(null)
+
+  const canSubmit = useMemo(() => {
+    return Boolean(invite?.is_usable && username.trim() && password && !loading)
+  }, [invite, username, password, loading])
+
+  const lookupInvite = async (code: string) => {
+    const trimmed = code.trim()
+    if (!trimmed) {
+      setInvite(null)
+      return
+    }
+    setInviteLoading(true)
+    setError(null)
+    setStatus(null)
+    try {
+      const baseUrl = getApiBase()
+      const response = await fetch(`${baseUrl}/auth/invites/${encodeURIComponent(trimmed)}`)
+      if (!response.ok) {
+        const text = await response.text()
+        throw new Error(text || 'Invite not found')
+      }
+      const data = await response.json()
+      setInvite(data?.invite ?? null)
+      setStatus('Invite loaded.')
+    } catch (err) {
+      console.error(err)
+      setInvite(null)
+      setError('Invite code not found or unavailable.')
+    } finally {
+      setInviteLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    const initialCode = searchParams.get('code') ?? ''
+    if (initialCode) {
+      setInviteCode(initialCode)
+      void lookupInvite(initialCode)
+    }
+  }, [searchParams])
+
+  const submit = async (event: React.FormEvent) => {
+    event.preventDefault()
+    if (password !== confirmPassword) {
+      setError('Passwords do not match.')
+      return
+    }
+    if (!inviteCode.trim()) {
+      setError('Invite code is required.')
+      return
+    }
+    if (!invite?.is_usable) {
+      setError('Invite is not usable. Refresh invite details or ask an admin for a new code.')
+      return
+    }
+    setLoading(true)
+    setError(null)
+    setStatus(null)
+    try {
+      clearToken()
+      const baseUrl = getApiBase()
+      const response = await fetch(`${baseUrl}/auth/signup`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          invite_code: inviteCode,
+          username: username.trim(),
+          password,
+        }),
+      })
+      if (!response.ok) {
+        const text = await response.text()
+        throw new Error(text || 'Sign-up failed')
+      }
+      const data = await response.json()
+      if (data?.access_token) {
+        setToken(data.access_token)
+        window.location.href = '/'
+        return
+      }
+      throw new Error('Sign-up did not return a token')
+    } catch (err) {
+      console.error(err)
+      setError(err instanceof Error ? err.message : 'Unable to create account.')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  return (
+    <main className="card auth-card">
+      <BrandingLogo className="brand-logo brand-logo--login" />
+      <h1>Create account</h1>
+      <p className="lede">Use an invite code from your admin to create your Jellyfin-backed Magent account.</p>
+      <form onSubmit={submit} className="auth-form">
+        <label>
+          Invite code
+          <div className="invite-lookup-row">
+            <input
+              value={inviteCode}
+              onChange={(e) => setInviteCode(e.target.value)}
+              placeholder="Paste your invite code"
+              autoCapitalize="characters"
+            />
+            <button
+              type="button"
+              className="ghost-button"
+              disabled={inviteLoading}
+              onClick={() => void lookupInvite(inviteCode)}
+            >
+              {inviteLoading ? 'Checking…' : 'Check invite'}
+            </button>
+          </div>
+        </label>
+        {invite && (
+          <div className={`invite-summary ${invite.is_usable ? '' : 'is-disabled'}`}>
+            <div className="invite-summary-row">
+              <strong>{invite.label || invite.code}</strong>
+              <span className={`small-pill ${invite.is_usable ? '' : 'is-muted'}`}>
+                {invite.is_usable ? 'Usable' : 'Unavailable'}
+              </span>
+            </div>
+            {invite.description && <p>{invite.description}</p>}
+            <div className="admin-meta-row">
+              <span>Code: {invite.code}</span>
+              <span>Expires: {formatDate(invite.expires_at)}</span>
+              <span>Remaining uses: {invite.remaining_uses ?? 'Unlimited'}</span>
+              <span>Profile: {invite.profile?.name || 'None'}</span>
+            </div>
+          </div>
+        )}
+        <label>
+          Username
+          <input
+            value={username}
+            onChange={(e) => setUsername(e.target.value)}
+            autoComplete="username"
+          />
+        </label>
+        <label>
+          Password
+          <input
+            type="password"
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+            autoComplete="new-password"
+          />
+        </label>
+        <label>
+          Confirm password
+          <input
+            type="password"
+            value={confirmPassword}
+            onChange={(e) => setConfirmPassword(e.target.value)}
+            autoComplete="new-password"
+          />
+        </label>
+        {error && <div className="error-banner">{error}</div>}
+        {status && <div className="status-banner">{status}</div>}
+        <div className="auth-actions">
+          <button type="submit" disabled={!canSubmit}>
+            {loading ? 'Creating account…' : 'Create account (Jellyfin + Magent)'}
+          </button>
+        </div>
+        <button type="button" className="ghost-button" disabled={loading} onClick={() => router.push('/login')}>
+          Back to sign in
+        </button>
+      </form>
+    </main>
+  )
+}
+
+export default function SignupPage() {
+  return (
+    <Suspense fallback={<main className="card auth-card">Loading sign-up…</main>}>
+      <SignupPageContent />
+    </Suspense>
+  )
+}

frontend/app/ui/AdminDiagnosticsPanel.tsx

@@ -0,0 +1,417 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+import { useRouter } from 'next/navigation'
+import { authFetch, clearToken, getApiBase, getToken } from '../lib/auth'
+
+type DiagnosticCatalogItem = {
+  key: string
+  label: string
+  category: string
+  description: string
+  live_safe: boolean
+  target: string | null
+  configured: boolean
+  config_status: string
+  config_detail: string
+}
+
+type DiagnosticResult = {
+  key: string
+  label: string
+  category: string
+  description: string
+  target: string | null
+  live_safe: boolean
+  configured: boolean
+  status: string
+  message: string
+  detail?: unknown
+  checked_at?: string
+  duration_ms?: number
+}
+
+type DiagnosticsResponse = {
+  checks: DiagnosticCatalogItem[]
+  categories: string[]
+  generated_at: string
+}
+
+type RunDiagnosticsResponse = {
+  results: DiagnosticResult[]
+  summary: {
+    total: number
+    up: number
+    down: number
+    degraded: number
+    not_configured: number
+    disabled: number
+  }
+  checked_at: string
+}
+
+type RunMode = 'safe' | 'all' | 'single'
+
+type AdminDiagnosticsPanelProps = {
+  embedded?: boolean
+}
+
+const REFRESH_INTERVAL_MS = 30000
+
+const STATUS_LABELS: Record<string, string> = {
+  idle: 'Ready',
+  up: 'Up',
+  down: 'Down',
+  degraded: 'Degraded',
+  disabled: 'Disabled',
+  not_configured: 'Not configured',
+}
+
+function formatCheckedAt(value?: string) {
+  if (!value) return 'Not yet run'
+  const parsed = new Date(value)
+  if (Number.isNaN(parsed.getTime())) return value
+  return parsed.toLocaleString()
+}
+
+function formatDuration(value?: number) {
+  if (typeof value !== 'number' || Number.isNaN(value) || value <= 0) {
+    return 'Pending'
+  }
+  return `${value.toFixed(1)} ms`
+}
+
+function statusLabel(status: string) {
+  return STATUS_LABELS[status] ?? status
+}
+
+export default function AdminDiagnosticsPanel({ embedded = false }: AdminDiagnosticsPanelProps) {
+  const router = useRouter()
+  const [loading, setLoading] = useState(true)
+  const [authorized, setAuthorized] = useState(false)
+  const [checks, setChecks] = useState<DiagnosticCatalogItem[]>([])
+  const [resultsByKey, setResultsByKey] = useState<Record<string, DiagnosticResult>>({})
+  const [runningKeys, setRunningKeys] = useState<string[]>([])
+  const [autoRefresh, setAutoRefresh] = useState(true)
+  const [pageError, setPageError] = useState('')
+  const [lastRunAt, setLastRunAt] = useState<string | null>(null)
+  const [lastRunMode, setLastRunMode] = useState<RunMode | null>(null)
+  const [emailRecipient, setEmailRecipient] = useState('')
+
+  const liveSafeKeys = checks.filter((check) => check.live_safe).map((check) => check.key)
+
+  async function runDiagnostics(keys?: string[], mode: RunMode = 'single') {
+    const baseUrl = getApiBase()
+    const effectiveKeys = keys && keys.length > 0 ? keys : checks.map((check) => check.key)
+    if (effectiveKeys.length === 0) {
+      return
+    }
+    setRunningKeys((current) => Array.from(new Set([...current, ...effectiveKeys])))
+    setPageError('')
+    try {
+      const response = await authFetch(`${baseUrl}/admin/diagnostics/run`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          keys: effectiveKeys,
+          ...(emailRecipient.trim() ? { recipient_email: emailRecipient.trim() } : {}),
+        }),
+      })
+      if (response.status === 401) {
+        clearToken()
+        router.push('/login')
+        return
+      }
+      if (!response.ok) {
+        const text = await response.text()
+        throw new Error(text || `Diagnostics run failed: ${response.status}`)
+      }
+      const data = (await response.json()) as { status: string } & RunDiagnosticsResponse
+      const nextResults: Record<string, DiagnosticResult> = {}
+      for (const result of data.results ?? []) {
+        nextResults[result.key] = result
+      }
+      setResultsByKey((current) => ({ ...current, ...nextResults }))
+      setLastRunAt(data.checked_at ?? new Date().toISOString())
+      setLastRunMode(mode)
+    } catch (error) {
+      console.error(error)
+      setPageError(error instanceof Error ? error.message : 'Diagnostics run failed.')
+    } finally {
+      setRunningKeys((current) => current.filter((key) => !effectiveKeys.includes(key)))
+    }
+  }
+
+  useEffect(() => {
+    let active = true
+
+    const loadPage = async () => {
+      if (!getToken()) {
+        router.push('/login')
+        return
+      }
+      try {
+        const baseUrl = getApiBase()
+        const authResponse = await authFetch(`${baseUrl}/auth/me`)
+        if (!authResponse.ok) {
+          if (authResponse.status === 401) {
+            clearToken()
+            router.push('/login')
+            return
+          }
+          router.push('/')
+          return
+        }
+        const me = await authResponse.json()
+        if (!active) return
+        if (me?.role !== 'admin') {
+          router.push('/')
+          return
+        }
+
+        const diagnosticsResponse = await authFetch(`${baseUrl}/admin/diagnostics`)
+        if (!diagnosticsResponse.ok) {
+          const text = await diagnosticsResponse.text()
+          throw new Error(text || `Diagnostics load failed: ${diagnosticsResponse.status}`)
+        }
+        const data = (await diagnosticsResponse.json()) as { status: string } & DiagnosticsResponse
+        if (!active) return
+        setChecks(data.checks ?? [])
+        setAuthorized(true)
+        setLoading(false)
+        const safeKeys = (data.checks ?? []).filter((check) => check.live_safe).map((check) => check.key)
+        if (safeKeys.length > 0) {
+          void runDiagnostics(safeKeys, 'safe')
+        }
+      } catch (error) {
+        console.error(error)
+        if (!active) return
+        setPageError(error instanceof Error ? error.message : 'Unable to load diagnostics.')
+        setLoading(false)
+      }
+    }
+
+    void loadPage()
+
+    return () => {
+      active = false
+    }
+  }, [router])
+
+  useEffect(() => {
+    if (!authorized || !autoRefresh || liveSafeKeys.length === 0) {
+      return
+    }
+    const interval = window.setInterval(() => {
+      void runDiagnostics(liveSafeKeys, 'safe')
+    }, REFRESH_INTERVAL_MS)
+    return () => {
+      window.clearInterval(interval)
+    }
+  }, [authorized, autoRefresh, liveSafeKeys.join('|')])
+
+  if (loading) {
+    return <div className="admin-panel">Loading diagnostics...</div>
+  }
+
+  if (!authorized) {
+    return null
+  }
+
+  const orderedCategories: string[] = []
+  for (const check of checks) {
+    if (!orderedCategories.includes(check.category)) {
+      orderedCategories.push(check.category)
+    }
+  }
+
+  const mergedResults = checks.map((check) => {
+    const result = resultsByKey[check.key]
+    if (result) {
+      return result
+    }
+    return {
+      key: check.key,
+      label: check.label,
+      category: check.category,
+      description: check.description,
+      target: check.target,
+      live_safe: check.live_safe,
+      configured: check.configured,
+      status: check.configured ? 'idle' : check.config_status,
+      message: check.configured ? 'Ready to test.' : check.config_detail,
+      checked_at: undefined,
+      duration_ms: undefined,
+    } satisfies DiagnosticResult
+  })
+
+  const summary = {
+    total: mergedResults.length,
+    up: 0,
+    down: 0,
+    degraded: 0,
+    disabled: 0,
+    not_configured: 0,
+    idle: 0,
+  }
+  for (const result of mergedResults) {
+    const key = result.status as keyof typeof summary
+    if (key in summary) {
+      summary[key] += 1
+    }
+  }
+
+  return (
+    <div className={`diagnostics-page${embedded ? ' diagnostics-page-embedded' : ''}`}>
+      <div className="admin-panel diagnostics-control-panel">
+        <div className="diagnostics-control-copy">
+          <h2>{embedded ? 'Connectivity diagnostics' : 'Control center'}</h2>
+          <p className="lede">
+            Use live checks for Magent and service connectivity. Use run all when you want outbound notification
+            channels to send a real ping through the configured provider.
+          </p>
+        </div>
+        <div className="diagnostics-control-actions">
+          <label className="diagnostics-email-recipient">
+            <span>Test email recipient</span>
+            <input
+              type="email"
+              placeholder="Leave blank to use configured sender"
+              value={emailRecipient}
+              onChange={(event) => setEmailRecipient(event.target.value)}
+            />
+          </label>
+          <button
+            type="button"
+            className={autoRefresh ? 'is-active' : ''}
+            onClick={() => setAutoRefresh((current) => !current)}
+          >
+            {autoRefresh ? 'Disable auto refresh' : 'Enable auto refresh'}
+          </button>
+          <button
+            type="button"
+            onClick={() => {
+              void runDiagnostics(liveSafeKeys, 'safe')
+            }}
+            disabled={runningKeys.length > 0 || liveSafeKeys.length === 0}
+          >
+            Run live checks
+          </button>
+          <button
+            type="button"
+            onClick={() => {
+              void runDiagnostics(undefined, 'all')
+            }}
+            disabled={runningKeys.length > 0 || checks.length === 0}
+          >
+            Run all tests
+          </button>
+          <span className={`small-pill ${autoRefresh ? 'is-positive' : ''}`}>
+            {autoRefresh ? 'Auto refresh on' : 'Auto refresh off'}
+          </span>
+          <span className="small-pill">{lastRunMode ? `Last run: ${lastRunMode}` : 'No run yet'}</span>
+        </div>
+      </div>
+
+      <div className="admin-panel diagnostics-inline-summary">
+        <div className="diagnostics-inline-metric">
+          <span>Total</span>
+          <strong>{summary.total}</strong>
+        </div>
+        <div className="diagnostics-inline-metric">
+          <span>Up</span>
+          <strong>{summary.up}</strong>
+        </div>
+        <div className="diagnostics-inline-metric">
+          <span>Degraded</span>
+          <strong>{summary.degraded}</strong>
+        </div>
+        <div className="diagnostics-inline-metric">
+          <span>Down</span>
+          <strong>{summary.down}</strong>
+        </div>
+        <div className="diagnostics-inline-metric">
+          <span>Disabled</span>
+          <strong>{summary.disabled}</strong>
+        </div>
+        <div className="diagnostics-inline-metric">
+          <span>Not configured</span>
+          <strong>{summary.not_configured}</strong>
+        </div>
+        <div className="diagnostics-inline-last-run">
+          Last completed run: {formatCheckedAt(lastRunAt ?? undefined)}
+        </div>
+      </div>
+
+      {pageError ? <div className="admin-panel diagnostics-error">{pageError}</div> : null}
+
+      {orderedCategories.map((category) => {
+        const categoryChecks = mergedResults.filter((check) => check.category === category)
+        return (
+          <div key={category} className="admin-panel diagnostics-category-panel">
+            <div className="diagnostics-category-header">
+              <div>
+                <h2>{category}</h2>
+                <p>{category === 'Notifications' ? 'These tests can emit real messages.' : 'Safe live health checks.'}</p>
+              </div>
+              <span className="small-pill">{categoryChecks.length} checks</span>
+            </div>
+
+            <div className="diagnostics-grid">
+              {categoryChecks.map((check) => {
+                const isRunning = runningKeys.includes(check.key)
+                return (
+                  <article key={check.key} className={`diagnostic-card diagnostic-card-${check.status}`}>
+                    <div className="diagnostic-card-top">
+                      <div className="diagnostic-card-copy">
+                        <div className="diagnostic-card-title-row">
+                          <h3>{check.label}</h3>
+                          <span className={`system-pill system-pill-${check.status}`}>{statusLabel(check.status)}</span>
+                        </div>
+                        <p>{check.description}</p>
+                      </div>
+                      <button
+                        type="button"
+                        className="system-test"
+                        onClick={() => {
+                          void runDiagnostics([check.key], 'single')
+                        }}
+                        disabled={isRunning}
+                      >
+                        {check.live_safe ? 'Ping' : 'Send test'}
+                      </button>
+                    </div>
+
+                    <div className="diagnostic-meta-grid">
+                      <div className="diagnostic-meta-item">
+                        <span>Target</span>
+                        <strong>{check.target || 'Not set'}</strong>
+                      </div>
+                      <div className="diagnostic-meta-item">
+                        <span>Latency</span>
+                        <strong>{formatDuration(check.duration_ms)}</strong>
+                      </div>
+                      <div className="diagnostic-meta-item">
+                        <span>Mode</span>
+                        <strong>{check.live_safe ? 'Live safe' : 'Manual only'}</strong>
+                      </div>
+                      <div className="diagnostic-meta-item">
+                        <span>Last checked</span>
+                        <strong>{formatCheckedAt(check.checked_at)}</strong>
+                      </div>
+                    </div>
+
+                    <div className={`diagnostic-message diagnostic-message-${check.status}`}>
+                      <span className="system-dot" />
+                      <span>{isRunning ? 'Running diagnostic...' : check.message}</span>
+                    </div>
+                  </article>
+                )
+              })}
+            </div>
+          </div>
+        )
+      })}
+    </div>
+  )
+}

frontend/app/ui/AdminShell.tsx

@@ -7,10 +7,11 @@ type AdminShellProps = {
   title: string
   subtitle?: string
   actions?: ReactNode
+  rail?: ReactNode
   children: ReactNode
 }
 
-export default function AdminShell({ title, subtitle, actions, children }: AdminShellProps) {
+export default function AdminShell({ title, subtitle, actions, rail, children }: AdminShellProps) {
   return (
     <div className="admin-shell">
       <aside className="admin-shell-nav">
@@ -26,6 +27,16 @@ export default function AdminShell({ title, subtitle, actions, children }: Admin
         </div>
         {children}
       </main>
+      <aside className="admin-shell-rail">
+        {rail ?? (
+          <div className="admin-rail-card admin-rail-card--placeholder">
+            <span className="admin-rail-eyebrow">Insights</span>
+            <h2>Stats rail</h2>
+            <p>Use this column for counters, live status, and quick metrics for this page.</p>
+            <span className="small-pill">{title}</span>
+          </div>
+        )}
+      </aside>
     </div>
   )
 }

frontend/app/ui/AdminSidebar.tsx

@@ -6,7 +6,8 @@ const NAV_GROUPS = [
   {
     title: 'Services',
     items: [
-      { href: '/admin/jellyseerr', label: 'Jellyseerr' },
+      { href: '/admin/general', label: 'General' },
+      { href: '/admin/seerr', label: 'Seerr' },
       { href: '/admin/jellyfin', label: 'Jellyfin' },
       { href: '/admin/sonarr', label: 'Sonarr' },
       { href: '/admin/radarr', label: 'Radarr' },
@@ -17,16 +18,19 @@ const NAV_GROUPS = [
   {
     title: 'Requests',
     items: [
-      { href: '/admin/requests', label: 'Request syncing' },
-      { href: '/admin/artwork', label: 'Artwork' },
-      { href: '/admin/cache', label: 'Cache' },
+      { href: '/admin/requests', label: 'Request sync' },
+      { href: '/admin/requests-all', label: 'All requests' },
+      { href: '/admin/cache', label: 'Cache Control' },
     ],
   },
   {
     title: 'Admin',
     items: [
+      { href: '/admin/notifications', label: 'Notifications' },
+      { href: '/admin/system', label: 'System guide' },
       { href: '/admin/site', label: 'Site' },
       { href: '/users', label: 'Users' },
+      { href: '/admin/invites', label: 'Invite management' },
       { href: '/admin/logs', label: 'Activity log' },
       { href: '/admin/maintenance', label: 'Maintenance' },
     ],

frontend/app/users/[id]/page.tsx

@@ -0,0 +1,691 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+import { useParams, useRouter } from 'next/navigation'
+import { authFetch, clearToken, getApiBase, getToken } from '../../lib/auth'
+import AdminShell from '../../ui/AdminShell'
+
+type UserStats = {
+  total: number
+  ready: number
+  pending: number
+  approved: number
+  working: number
+  partial: number
+  declined: number
+  in_progress: number
+  last_request_at?: string | null
+}
+
+type AdminUser = {
+  id?: number
+  username: string
+  role: string
+  auth_provider?: string | null
+  last_login_at?: string | null
+  is_blocked?: boolean
+  auto_search_enabled?: boolean
+  invite_management_enabled?: boolean
+  jellyseerr_user_id?: number | null
+  profile_id?: number | null
+  expires_at?: string | null
+  is_expired?: boolean
+  invited_by_code?: string | null
+  invited_at?: string | null
+}
+
+type UserLineage = {
+  invite_code?: string | null
+  invited_by?: string | null
+  invite?: {
+    id?: number
+    code?: string
+    label?: string | null
+    created_by?: string | null
+    created_at?: string | null
+    enabled?: boolean
+    is_usable?: boolean
+  } | null
+} | null
+
+type UserProfileOption = {
+  id: number
+  name: string
+  is_active?: boolean
+}
+
+const formatDateTime = (value?: string | null) => {
+  if (!value) return 'Never'
+  const date = new Date(value)
+  if (Number.isNaN(date.valueOf())) return value
+  return date.toLocaleString()
+}
+
+const toLocalDateTimeInput = (value?: string | null) => {
+  if (!value) return ''
+  const date = new Date(value)
+  if (Number.isNaN(date.valueOf())) return ''
+  const offsetMs = date.getTimezoneOffset() * 60_000
+  const local = new Date(date.getTime() - offsetMs)
+  return local.toISOString().slice(0, 16)
+}
+
+const fromLocalDateTimeInput = (value: string) => {
+  if (!value.trim()) return null
+  const date = new Date(value)
+  if (Number.isNaN(date.valueOf())) return null
+  return date.toISOString()
+}
+
+const normalizeStats = (stats: any): UserStats => ({
+  total: Number(stats?.total ?? 0),
+  ready: Number(stats?.ready ?? 0),
+  pending: Number(stats?.pending ?? 0),
+  approved: Number(stats?.approved ?? 0),
+  working: Number(stats?.working ?? 0),
+  partial: Number(stats?.partial ?? 0),
+  declined: Number(stats?.declined ?? 0),
+  in_progress: Number(stats?.in_progress ?? 0),
+  last_request_at: stats?.last_request_at ?? null,
+})
+
+export default function UserDetailPage() {
+  const params = useParams()
+  const router = useRouter()
+  const idParam = Array.isArray(params?.id) ? params.id[0] : params?.id
+  const [user, setUser] = useState<AdminUser | null>(null)
+  const [stats, setStats] = useState<UserStats | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [profiles, setProfiles] = useState<UserProfileOption[]>([])
+  const [profileSelection, setProfileSelection] = useState('')
+  const [expiryInput, setExpiryInput] = useState('')
+  const [savingProfile, setSavingProfile] = useState(false)
+  const [savingExpiry, setSavingExpiry] = useState(false)
+  const [systemActionBusy, setSystemActionBusy] = useState(false)
+  const [actionStatus, setActionStatus] = useState<string | null>(null)
+  const [lineage, setLineage] = useState<UserLineage>(null)
+
+  const loadProfiles = async () => {
+    try {
+      const baseUrl = getApiBase()
+      const response = await authFetch(`${baseUrl}/admin/profiles`)
+      if (!response.ok) {
+        return
+      }
+      const data = await response.json()
+      if (!Array.isArray(data?.profiles)) {
+        setProfiles([])
+        return
+      }
+      setProfiles(
+        data.profiles.map((profile: any) => ({
+          id: Number(profile.id ?? 0),
+          name: String(profile.name ?? 'Unnamed profile'),
+          is_active: Boolean(profile.is_active ?? true),
+        }))
+      )
+    } catch (err) {
+      console.error(err)
+    }
+  }
+
+  const loadUser = async () => {
+    if (!idParam) return
+    try {
+      const baseUrl = getApiBase()
+      const response = await authFetch(
+        `${baseUrl}/admin/users/id/${encodeURIComponent(idParam)}`
+      )
+      if (!response.ok) {
+        if (response.status === 401) {
+          clearToken()
+          router.push('/login')
+          return
+        }
+        if (response.status === 403) {
+          router.push('/')
+          return
+        }
+        if (response.status === 404) {
+          setError('User not found.')
+          return
+        }
+        throw new Error('Could not load user.')
+      }
+      const data = await response.json()
+      const nextUser = data?.user ?? null
+      setUser(nextUser)
+      setStats(normalizeStats(data?.stats))
+      setLineage((data?.lineage ?? null) as UserLineage)
+      setProfileSelection(
+        nextUser?.profile_id == null || Number.isNaN(Number(nextUser?.profile_id))
+          ? ''
+          : String(nextUser.profile_id)
+      )
+      setExpiryInput(toLocalDateTimeInput(nextUser?.expires_at))
+      setError(null)
+    } catch (err) {
+      console.error(err)
+      setError('Could not load user.')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  const toggleUserBlock = async (blocked: boolean) => {
+    if (!user) return
+    try {
+      setActionStatus(null)
+      const baseUrl = getApiBase()
+      const response = await authFetch(
+        `${baseUrl}/admin/users/${encodeURIComponent(user.username)}/${blocked ? 'block' : 'unblock'}`,
+        { method: 'POST' }
+      )
+      if (!response.ok) {
+        throw new Error('Update failed')
+      }
+      await loadUser()
+      setActionStatus(blocked ? 'User blocked.' : 'User unblocked.')
+    } catch (err) {
+      console.error(err)
+      setError('Could not update user access.')
+    }
+  }
+
+  const updateUserRole = async (role: string) => {
+    if (!user) return
+    try {
+      setActionStatus(null)
+      const baseUrl = getApiBase()
+      const response = await authFetch(
+        `${baseUrl}/admin/users/${encodeURIComponent(user.username)}/role`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ role }),
+        }
+      )
+      if (!response.ok) {
+        throw new Error('Update failed')
+      }
+      await loadUser()
+      setActionStatus(`Role updated to ${role}.`)
+    } catch (err) {
+      console.error(err)
+      setError('Could not update user role.')
+    }
+  }
+
+  const updateAutoSearchEnabled = async (enabled: boolean) => {
+    if (!user) return
+    try {
+      setActionStatus(null)
+      const baseUrl = getApiBase()
+      const response = await authFetch(
+        `${baseUrl}/admin/users/${encodeURIComponent(user.username)}/auto-search`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ enabled }),
+        }
+      )
+      if (!response.ok) {
+        throw new Error('Update failed')
+      }
+      await loadUser()
+      setActionStatus(`Auto search/download ${enabled ? 'enabled' : 'disabled'}.`)
+    } catch (err) {
+      console.error(err)
+      setError('Could not update auto search access.')
+    }
+  }
+
+  const updateInviteManagementEnabled = async (enabled: boolean) => {
+    if (!user) return
+    try {
+      setActionStatus(null)
+      const baseUrl = getApiBase()
+      const response = await authFetch(
+        `${baseUrl}/admin/users/${encodeURIComponent(user.username)}/invite-access`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ enabled }),
+        }
+      )
+      if (!response.ok) {
+        throw new Error('Update failed')
+      }
+      await loadUser()
+      setActionStatus(`Invite management ${enabled ? 'enabled' : 'disabled'} for this user.`)
+    } catch (err) {
+      console.error(err)
+      setError('Could not update invite access.')
+    }
+  }
+
+  const applyProfileToUser = async (profileOverride?: string | null) => {
+    if (!user) return
+    const profileValue = profileOverride ?? profileSelection
+    setSavingProfile(true)
+    setError(null)
+    setActionStatus(null)
+    try {
+      const baseUrl = getApiBase()
+      const response = await authFetch(
+        `${baseUrl}/admin/users/${encodeURIComponent(user.username)}/profile`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ profile_id: profileValue || null }),
+        }
+      )
+      if (!response.ok) {
+        const text = await response.text()
+        throw new Error(text || 'Profile update failed')
+      }
+      await loadUser()
+      setActionStatus(profileValue ? 'Profile applied to user.' : 'Profile assignment cleared.')
+    } catch (err) {
+      console.error(err)
+      setError('Could not update user profile.')
+    } finally {
+      setSavingProfile(false)
+    }
+  }
+
+  const saveUserExpiry = async () => {
+    if (!user) return
+    const expiresAt = fromLocalDateTimeInput(expiryInput)
+    if (expiryInput.trim() && !expiresAt) {
+      setError('Invalid expiry date/time.')
+      return
+    }
+    setSavingExpiry(true)
+    setError(null)
+    setActionStatus(null)
+    try {
+      const baseUrl = getApiBase()
+      const response = await authFetch(
+        `${baseUrl}/admin/users/${encodeURIComponent(user.username)}/expiry`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ expires_at: expiresAt }),
+        }
+      )
+      if (!response.ok) {
+        const text = await response.text()
+        throw new Error(text || 'Expiry update failed')
+      }
+      await loadUser()
+      setActionStatus(expiresAt ? 'User expiry updated.' : 'User expiry cleared.')
+    } catch (err) {
+      console.error(err)
+      setError('Could not update user expiry.')
+    } finally {
+      setSavingExpiry(false)
+    }
+  }
+
+  const clearUserExpiry = async () => {
+    if (!user) return
+    setSavingExpiry(true)
+    setError(null)
+    setActionStatus(null)
+    try {
+      const baseUrl = getApiBase()
+      const response = await authFetch(
+        `${baseUrl}/admin/users/${encodeURIComponent(user.username)}/expiry`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ clear: true }),
+        }
+      )
+      if (!response.ok) {
+        const text = await response.text()
+        throw new Error(text || 'Expiry clear failed')
+      }
+      setExpiryInput('')
+      await loadUser()
+      setActionStatus('User expiry cleared.')
+    } catch (err) {
+      console.error(err)
+      setError('Could not clear user expiry.')
+    } finally {
+      setSavingExpiry(false)
+    }
+  }
+
+  const runSystemAction = async (action: 'ban' | 'unban' | 'remove') => {
+    if (!user) return
+    if (action === 'remove') {
+      const confirmed = window.confirm(
+        `Remove ${user.username} from Magent and external systems? This is destructive.`
+      )
+      if (!confirmed) return
+    }
+    if (action === 'ban') {
+      const confirmed = window.confirm(
+        `Ban ${user.username} across systems and disable invites they created?`
+      )
+      if (!confirmed) return
+    }
+    setSystemActionBusy(true)
+    setError(null)
+    setActionStatus(null)
+    try {
+      const baseUrl = getApiBase()
+      const response = await authFetch(
+        `${baseUrl}/admin/users/${encodeURIComponent(user.username)}/system-action`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ action }),
+        }
+      )
+      const text = await response.text()
+      let data: any = null
+      try {
+        data = text ? JSON.parse(text) : null
+      } catch {
+        data = null
+      }
+      if (!response.ok) {
+        throw new Error(data?.detail || text || 'Cross-system action failed')
+      }
+      const state = data?.status === 'partial' ? 'partial' : 'complete'
+      if (action === 'remove') {
+        setActionStatus(`User removed (${state}).`)
+        router.push('/users')
+        return
+      }
+      await loadUser()
+      setActionStatus(`${action === 'ban' ? 'Ban' : 'Unban'} completed (${state}).`)
+    } catch (err) {
+      console.error(err)
+      setError(err instanceof Error ? err.message : 'Could not run cross-system action.')
+    } finally {
+      setSystemActionBusy(false)
+    }
+  }
+
+  useEffect(() => {
+    if (!getToken()) {
+      router.push('/login')
+      return
+    }
+    void loadUser()
+    void loadProfiles()
+  }, [router, idParam])
+
+  if (loading) {
+    return <main className="card">Loading user...</main>
+  }
+
+  return (
+    <AdminShell
+      title={user?.username || 'User'}
+      subtitle="User overview and request stats."
+      actions={
+        <button type="button" onClick={() => router.push('/users')}>
+          Back to users
+        </button>
+      }
+    >
+      <section className="admin-section">
+        {error && <div className="error-banner">{error}</div>}
+        {actionStatus && <div className="status-banner">{actionStatus}</div>}
+        {!user ? (
+          <div className="status-banner">No user data found.</div>
+        ) : (
+          <div className="user-detail-page-grid">
+            <div className="user-detail-main-column">
+              <div className="admin-panel user-detail-panel">
+                <div className="user-detail-panel-header">
+                  <div className="user-detail-title-row">
+                    <strong className="user-detail-name">{user.username}</strong>
+                    <span className={`user-grid-pill ${user.is_blocked ? 'is-blocked' : ''}`}>
+                      {user.is_blocked ? 'Blocked' : 'Active'}
+                    </span>
+                    <span className={`user-grid-pill ${user.is_expired ? 'is-blocked' : ''}`}>
+                      {user.is_expired ? 'Expired' : user.expires_at ? 'Expiry set' : 'No expiry'}
+                    </span>
+                  </div>
+                  <p className="lede">
+                    User identity, access state, and request history for this account.
+                  </p>
+                </div>
+                <div className="user-detail-meta-grid">
+                  <div className="user-detail-meta-item">
+                    <span className="label">Seerr ID</span>
+                    <strong>{user.jellyseerr_user_id ?? user.id ?? 'Unknown'}</strong>
+                  </div>
+                  <div className="user-detail-meta-item">
+                    <span className="label">Role</span>
+                    <strong>{user.role}</strong>
+                  </div>
+                  <div className="user-detail-meta-item">
+                    <span className="label">Login type</span>
+                    <strong>{user.auth_provider || 'local'}</strong>
+                  </div>
+                  <div className="user-detail-meta-item">
+                    <span className="label">Assigned profile</span>
+                    <strong>{user.profile_id ?? 'None'}</strong>
+                  </div>
+                  <div className="user-detail-meta-item">
+                    <span className="label">Invited by</span>
+                    <strong>{lineage?.invited_by || 'Direct / unknown'}</strong>
+                  </div>
+                  <div className="user-detail-meta-item">
+                    <span className="label">Invite code used</span>
+                    <strong>{lineage?.invite_code || user.invited_by_code || 'None'}</strong>
+                  </div>
+                  <div className="user-detail-meta-item">
+                    <span className="label">Last login</span>
+                    <strong>{formatDateTime(user.last_login_at)}</strong>
+                  </div>
+                  <div className="user-detail-meta-item">
+                    <span className="label">Account expiry</span>
+                    <strong>{user.expires_at ? formatDateTime(user.expires_at) : 'Never'}</strong>
+                  </div>
+                </div>
+              </div>
+
+              <div className="admin-panel user-detail-panel">
+                <div className="user-detail-panel-header">
+                  <h2>Request statistics</h2>
+                  <p className="lede">Snapshot of request states and recent activity for this user.</p>
+                </div>
+                <div className="user-detail-grid">
+                  <div className="user-detail-stat">
+                    <span className="label">Total</span>
+                    <span className="value">{stats?.total ?? 0}</span>
+                  </div>
+                  <div className="user-detail-stat">
+                    <span className="label">Ready</span>
+                    <span className="value">{stats?.ready ?? 0}</span>
+                  </div>
+                  <div className="user-detail-stat">
+                    <span className="label">Pending</span>
+                    <span className="value">{stats?.pending ?? 0}</span>
+                  </div>
+                  <div className="user-detail-stat">
+                    <span className="label">Approved</span>
+                    <span className="value">{stats?.approved ?? 0}</span>
+                  </div>
+                  <div className="user-detail-stat">
+                    <span className="label">Working</span>
+                    <span className="value">{stats?.working ?? 0}</span>
+                  </div>
+                  <div className="user-detail-stat">
+                    <span className="label">Partial</span>
+                    <span className="value">{stats?.partial ?? 0}</span>
+                  </div>
+                  <div className="user-detail-stat">
+                    <span className="label">Declined</span>
+                    <span className="value">{stats?.declined ?? 0}</span>
+                  </div>
+                  <div className="user-detail-stat">
+                    <span className="label">In progress</span>
+                    <span className="value">{stats?.in_progress ?? 0}</span>
+                  </div>
+                  <div className="user-detail-stat user-detail-stat--wide">
+                    <span className="label">Last request</span>
+                    <span className="value">{formatDateTime(stats?.last_request_at)}</span>
+                  </div>
+                </div>
+              </div>
+            </div>
+
+            <div className="user-detail-side-column">
+              <div className="admin-panel user-detail-panel">
+                <div className="user-detail-panel-header">
+                  <h2>Access controls</h2>
+                  <p className="lede">Role, login access, and auto-download behavior.</p>
+                </div>
+                <div className="user-detail-control-stack">
+                  <label className="toggle">
+                    <input
+                      type="checkbox"
+                      checked={user.role === 'admin'}
+                      onChange={(event) => updateUserRole(event.target.checked ? 'admin' : 'user')}
+                    />
+                    <span>Make admin</span>
+                  </label>
+                  <label className="toggle">
+                    <input
+                      type="checkbox"
+                      checked={Boolean(user.auto_search_enabled ?? true)}
+                      disabled={user.role === 'admin'}
+                      onChange={(event) => updateAutoSearchEnabled(event.target.checked)}
+                    />
+                    <span>Allow auto search/download</span>
+                  </label>
+                  <label className="toggle">
+                    <input
+                      type="checkbox"
+                      checked={Boolean(user.invite_management_enabled ?? false)}
+                      disabled={user.role === 'admin'}
+                      onChange={(event) => updateInviteManagementEnabled(event.target.checked)}
+                    />
+                    <span>Allow self-service invites</span>
+                  </label>
+                  <button
+                    type="button"
+                    className="ghost-button"
+                    onClick={() => toggleUserBlock(!user.is_blocked)}
+                    disabled={systemActionBusy}
+                  >
+                    {user.is_blocked ? 'Allow access' : 'Block access'}
+                  </button>
+                  <div className="admin-inline-actions">
+                    <button
+                      type="button"
+                      className="ghost-button"
+                      onClick={() => void runSystemAction(user.is_blocked ? 'unban' : 'ban')}
+                      disabled={systemActionBusy}
+                    >
+                      {systemActionBusy
+                        ? 'Working...'
+                        : user.is_blocked
+                        ? 'Unban everywhere'
+                        : 'Ban everywhere'}
+                    </button>
+                    <button
+                      type="button"
+                      className="ghost-button"
+                      onClick={() => void runSystemAction('remove')}
+                      disabled={systemActionBusy}
+                    >
+                      Remove everywhere
+                    </button>
+                  </div>
+                  {user.role === 'admin' && (
+                    <div className="user-detail-helper">
+                      Admins always have auto search/download and invite-management access.
+                    </div>
+                  )}
+                </div>
+              </div>
+
+              <div className="admin-panel user-detail-panel">
+                <div className="user-detail-panel-header">
+                  <h2>Profile defaults</h2>
+                  <p className="lede">Assign or clear an invite profile for this user.</p>
+                </div>
+                <div className="user-detail-actions user-detail-actions--stacked">
+                  <label className="admin-select">
+                    <span>Assigned profile</span>
+                    <select
+                      value={profileSelection}
+                      onChange={(event) => setProfileSelection(event.target.value)}
+                      disabled={savingProfile}
+                    >
+                      <option value="">None</option>
+                      {profiles.map((profile) => (
+                        <option key={profile.id} value={profile.id}>
+                          {profile.name}
+                          {profile.is_active === false ? ' (disabled)' : ''}
+                        </option>
+                      ))}
+                    </select>
+                  </label>
+                  <div className="admin-inline-actions">
+                    <button type="button" onClick={() => void applyProfileToUser()} disabled={savingProfile}>
+                      {savingProfile ? 'Applying...' : 'Apply profile defaults'}
+                    </button>
+                    <button
+                      type="button"
+                      className="ghost-button"
+                      onClick={() => {
+                        setProfileSelection('')
+                        void applyProfileToUser('')
+                      }}
+                      disabled={savingProfile}
+                    >
+                      Clear profile
+                    </button>
+                  </div>
+                </div>
+              </div>
+
+              <div className="admin-panel user-detail-panel">
+                <div className="user-detail-panel-header">
+                  <h2>Account expiry</h2>
+                  <p className="lede">Set a specific expiry date/time for this user account.</p>
+                </div>
+                <div className="user-detail-actions user-detail-actions--stacked">
+                  <label>
+                    <span className="user-bulk-label">Account expiry</span>
+                    <input
+                      type="datetime-local"
+                      value={expiryInput}
+                      onChange={(event) => setExpiryInput(event.target.value)}
+                      disabled={savingExpiry}
+                    />
+                  </label>
+                  <div className="admin-inline-actions">
+                    <button type="button" onClick={saveUserExpiry} disabled={savingExpiry}>
+                      {savingExpiry ? 'Saving...' : 'Save expiry'}
+                    </button>
+                    <button
+                      type="button"
+                      className="ghost-button"
+                      onClick={clearUserExpiry}
+                      disabled={savingExpiry}
+                    >
+                      Clear expiry
+                    </button>
+                  </div>
+                </div>
+              </div>
+            </div>
+          </div>
+        )}
+      </section>
+    </AdminShell>
+  )
+}

frontend/app/users/page.tsx

@@ -2,15 +2,34 @@
 
 import { useEffect, useState } from 'react'
 import { useRouter } from 'next/navigation'
+import Link from 'next/link'
 import { authFetch, clearToken, getApiBase, getToken } from '../lib/auth'
 import AdminShell from '../ui/AdminShell'
 
 type AdminUser = {
+  id: number
   username: string
   role: string
   authProvider?: string | null
   lastLoginAt?: string | null
   isBlocked?: boolean
+  autoSearchEnabled?: boolean
+  profileId?: number | null
+  expiresAt?: string | null
+  isExpired?: boolean
+  stats?: UserStats
+}
+
+type UserStats = {
+  total: number
+  ready: number
+  pending: number
+  approved: number
+  working: number
+  partial: number
+  declined: number
+  in_progress: number
+  last_request_at?: string | null
 }
 
 const formatLastLogin = (value?: string | null) => {
@@ -20,16 +39,59 @@ const formatLastLogin = (value?: string | null) => {
   return date.toLocaleString()
 }
 
+const formatLastRequest = (value?: string | null) => {
+  if (!value) return '—'
+  const date = new Date(value)
+  if (Number.isNaN(date.valueOf())) return value
+  return date.toLocaleString()
+}
+
+const formatExpiry = (value?: string | null) => {
+  if (!value) return 'Never'
+  const date = new Date(value)
+  if (Number.isNaN(date.valueOf())) return value
+  return date.toLocaleString()
+}
+
+const emptyStats: UserStats = {
+  total: 0,
+  ready: 0,
+  pending: 0,
+  approved: 0,
+  working: 0,
+  partial: 0,
+  declined: 0,
+  in_progress: 0,
+  last_request_at: null,
+}
+
+const normalizeStats = (stats: any): UserStats => ({
+  total: Number(stats?.total ?? 0),
+  ready: Number(stats?.ready ?? 0),
+  pending: Number(stats?.pending ?? 0),
+  approved: Number(stats?.approved ?? 0),
+  working: Number(stats?.working ?? 0),
+  partial: Number(stats?.partial ?? 0),
+  declined: Number(stats?.declined ?? 0),
+  in_progress: Number(stats?.in_progress ?? 0),
+  last_request_at: stats?.last_request_at ?? null,
+})
+
 export default function UsersPage() {
   const router = useRouter()
   const [users, setUsers] = useState<AdminUser[]>([])
   const [error, setError] = useState<string | null>(null)
   const [loading, setLoading] = useState(true)
+  const [query, setQuery] = useState('')
+  const [jellyseerrSyncStatus, setJellyseerrSyncStatus] = useState<string | null>(null)
+  const [jellyseerrSyncBusy, setJellyseerrSyncBusy] = useState(false)
+  const [jellyseerrResyncBusy, setJellyseerrResyncBusy] = useState(false)
+  const [bulkAutoSearchBusy, setBulkAutoSearchBusy] = useState(false)
 
   const loadUsers = async () => {
     try {
       const baseUrl = getApiBase()
-      const response = await authFetch(`${baseUrl}/admin/users`)
+      const response = await authFetch(`${baseUrl}/admin/users/summary`)
       if (!response.ok) {
         if (response.status === 401) {
           clearToken()
@@ -51,6 +113,15 @@ export default function UsersPage() {
             authProvider: user.auth_provider ?? 'local',
             lastLoginAt: user.last_login_at ?? null,
             isBlocked: Boolean(user.is_blocked),
+            autoSearchEnabled: Boolean(user.auto_search_enabled ?? true),
+            profileId:
+              user.profile_id == null || Number.isNaN(Number(user.profile_id))
+                ? null
+                : Number(user.profile_id),
+            expiresAt: user.expires_at ?? null,
+            isExpired: Boolean(user.is_expired),
+            id: Number(user.id ?? 0),
+            stats: normalizeStats(user.stats ?? emptyStats),
           }))
         )
       } else {
@@ -65,44 +136,86 @@ export default function UsersPage() {
     }
   }
 
-  const toggleUserBlock = async (username: string, blocked: boolean) => {
+  const syncJellyseerrUsers = async () => {
+    setJellyseerrSyncStatus(null)
+    setJellyseerrSyncBusy(true)
     try {
       const baseUrl = getApiBase()
-      const response = await authFetch(
-        `${baseUrl}/admin/users/${encodeURIComponent(username)}/${blocked ? 'block' : 'unblock'}`,
-        { method: 'POST' }
-      )
+      const response = await authFetch(`${baseUrl}/admin/jellyseerr/users/sync`, {
+        method: 'POST',
+      })
       if (!response.ok) {
-        throw new Error('Update failed')
+        const text = await response.text()
+        throw new Error(text || 'Sync failed')
       }
+      const data = await response.json()
+      setJellyseerrSyncStatus(
+        `Matched ${data?.matched ?? 0} users. Skipped ${data?.skipped ?? 0}.`
+      )
       await loadUsers()
     } catch (err) {
       console.error(err)
-      setError('Could not update user access.')
+      setJellyseerrSyncStatus('Could not sync Seerr users.')
+    } finally {
+      setJellyseerrSyncBusy(false)
     }
   }
 
-  const updateUserRole = async (username: string, role: string) => {
+  const resyncJellyseerrUsers = async () => {
+    const confirmed = window.confirm(
+      'This will remove all non-admin users and re-import from Seerr. Continue?'
+    )
+    if (!confirmed) return
+    setJellyseerrSyncStatus(null)
+    setJellyseerrResyncBusy(true)
     try {
       const baseUrl = getApiBase()
-      const response = await authFetch(
-        `${baseUrl}/admin/users/${encodeURIComponent(username)}/role`,
-        {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ role }),
-        }
-      )
+      const response = await authFetch(`${baseUrl}/admin/jellyseerr/users/resync`, {
+        method: 'POST',
+      })
       if (!response.ok) {
-        throw new Error('Update failed')
+        const text = await response.text()
+        throw new Error(text || 'Resync failed')
       }
+      const data = await response.json()
+      setJellyseerrSyncStatus(
+        `Re-imported ${data?.imported ?? 0} users. Cleared ${data?.cleared ?? 0}.`
+      )
       await loadUsers()
     } catch (err) {
       console.error(err)
-      setError('Could not update user role.')
+      setJellyseerrSyncStatus('Could not resync Seerr users.')
+    } finally {
+      setJellyseerrResyncBusy(false)
     }
   }
 
+  const bulkUpdateAutoSearch = async (enabled: boolean) => {
+    setBulkAutoSearchBusy(true)
+    setJellyseerrSyncStatus(null)
+    try {
+      const baseUrl = getApiBase()
+      const response = await authFetch(`${baseUrl}/admin/users/auto-search/bulk`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ enabled }),
+      })
+      if (!response.ok) {
+        const text = await response.text()
+        throw new Error(text || 'Bulk update failed')
+      }
+      const data = await response.json()
+      setJellyseerrSyncStatus(
+        `${enabled ? 'Enabled' : 'Disabled'} auto search/download for ${data?.updated ?? 0} non-admin users.`
+      )
+      await loadUsers()
+    } catch (err) {
+      console.error(err)
+      setError('Could not update auto search/download for all users.')
+    } finally {
+      setBulkAutoSearchBusy(false)
+    }
+  }
 
   useEffect(() => {
     if (!getToken()) {
@@ -116,52 +229,238 @@ export default function UsersPage() {
     return <main className="card">Loading users...</main>
   }
 
+  const nonAdminUsers = users.filter((user) => user.role !== 'admin')
+  const autoSearchEnabledCount = nonAdminUsers.filter((user) => user.autoSearchEnabled !== false).length
+  const blockedCount = users.filter((user) => user.isBlocked).length
+  const expiredCount = users.filter((user) => user.isExpired).length
+  const adminCount = users.filter((user) => user.role === 'admin').length
+  const normalizedQuery = query.trim().toLowerCase()
+  const filteredUsers = normalizedQuery
+    ? users.filter((user) => {
+        const fields = [
+          user.username,
+          user.role,
+          user.authProvider || '',
+          user.profileId != null ? String(user.profileId) : '',
+        ]
+        return fields.some((field) => field.toLowerCase().includes(normalizedQuery))
+      })
+    : users
+  const filteredCountLabel =
+    filteredUsers.length === users.length
+      ? `${users.length} users`
+      : `${filteredUsers.length} of ${users.length} users`
+  const usersRail = (
+    <div className="admin-rail-stack">
+      <div className="admin-rail-card users-rail-summary">
+        <div className="user-directory-panel-header">
+          <div>
+            <h2>Directory summary</h2>
+            <p className="lede">A quick view of user access and account state.</p>
+          </div>
+        </div>
+        <div className="users-summary-grid">
+          <div className="users-summary-card">
+            <div className="users-summary-row">
+              <span className="users-summary-label">Total users</span>
+              <strong className="users-summary-value">{users.length}</strong>
+            </div>
+            <p className="users-summary-meta">{adminCount} admin accounts</p>
+          </div>
+          <div className="users-summary-card">
+            <div className="users-summary-row">
+              <span className="users-summary-label">Auto search</span>
+              <strong className="users-summary-value">{autoSearchEnabledCount}</strong>
+            </div>
+            <p className="users-summary-meta">of {nonAdminUsers.length} non-admin users enabled</p>
+          </div>
+          <div className="users-summary-card">
+            <div className="users-summary-row">
+              <span className="users-summary-label">Blocked</span>
+              <strong className="users-summary-value">{blockedCount}</strong>
+            </div>
+            <p className="users-summary-meta">
+              {blockedCount ? 'Accounts currently blocked' : 'No blocked users'}
+            </p>
+          </div>
+          <div className="users-summary-card">
+            <div className="users-summary-row">
+              <span className="users-summary-label">Expired</span>
+              <strong className="users-summary-value">{expiredCount}</strong>
+            </div>
+            <p className="users-summary-meta">
+              {expiredCount ? 'Accounts with expired access' : 'No expiries'}
+            </p>
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+
   return (
     <AdminShell
       title="Users"
-      subtitle="Manage who can use Magent."
-      actions={
-        <button type="button" onClick={loadUsers}>
-          Reload list
-        </button>
-      }
+      subtitle="Directory, access status, and request activity."
+      rail={usersRail}
     >
       <section className="admin-section">
+        <div className="admin-panel users-page-toolbar">
+          <div className="users-page-toolbar-grid">
+            <div className="users-page-toolbar-group">
+              <span className="users-page-toolbar-label">Directory actions</span>
+              <div className="users-page-toolbar-actions">
+                <button
+                  type="button"
+                  className="ghost-button"
+                  onClick={() => router.push('/admin/invites')}
+                >
+                  Invite management
+                </button>
+                <button type="button" onClick={loadUsers}>
+                  Reload list
+                </button>
+              </div>
+            </div>
+            <div className="users-page-toolbar-group">
+              <span className="users-page-toolbar-label">Seerr sync</span>
+              <div className="users-page-toolbar-actions">
+                <button type="button" onClick={syncJellyseerrUsers} disabled={jellyseerrSyncBusy}>
+                  {jellyseerrSyncBusy ? 'Syncing Seerr users...' : 'Sync Seerr users'}
+                </button>
+                <button
+                  type="button"
+                  onClick={resyncJellyseerrUsers}
+                  disabled={jellyseerrResyncBusy}
+                >
+                  {jellyseerrResyncBusy ? 'Resyncing Seerr users...' : 'Resync Seerr users'}
+                </button>
+              </div>
+            </div>
+          </div>
+        </div>
         {error && <div className="error-banner">{error}</div>}
-        {users.length === 0 ? (
+        {jellyseerrSyncStatus && <div className="status-banner">{jellyseerrSyncStatus}</div>}
+        <div className="admin-panel user-directory-bulk-panel">
+          <div className="user-directory-panel-header">
+            <div>
+              <h2>Bulk controls</h2>
+              <p className="lede">
+                Auto search/download can be enabled or disabled for all non-admin users.
+              </p>
+            </div>
+          </div>
+          <div className="user-bulk-toolbar">
+            <div className="user-bulk-summary">
+              <strong>Auto search/download</strong>
+              <span>
+                {autoSearchEnabledCount} of {nonAdminUsers.length} non-admin users enabled
+              </span>
+            </div>
+            <div className="user-bulk-actions">
+              <button
+                type="button"
+                onClick={() => bulkUpdateAutoSearch(true)}
+                disabled={bulkAutoSearchBusy}
+              >
+                {bulkAutoSearchBusy ? 'Working...' : 'Enable for all users'}
+              </button>
+              <button
+                type="button"
+                className="ghost-button"
+                onClick={() => bulkUpdateAutoSearch(false)}
+                disabled={bulkAutoSearchBusy}
+              >
+                {bulkAutoSearchBusy ? 'Working...' : 'Disable for all users'}
+              </button>
+            </div>
+          </div>
+        </div>
+        <div className="admin-panel user-directory-search-panel">
+          <div className="user-directory-panel-header">
+            <div>
+              <h2>Directory search</h2>
+              <p className="lede">
+                Filter by username, role, login provider, or assigned profile.
+              </p>
+            </div>
+            <span className="small-pill">{filteredCountLabel}</span>
+          </div>
+          <div className="user-directory-toolbar">
+            <div className="user-directory-search">
+              <label>
+                <span className="user-bulk-label">Search users</span>
+                <input
+                  value={query}
+                  onChange={(event) => setQuery(event.target.value)}
+                  placeholder="Search username, login type, role, profile…"
+                />
+              </label>
+            </div>
+          </div>
+        </div>
+        {filteredUsers.length === 0 ? (
           <div className="status-banner">No users found yet.</div>
         ) : (
-          <div className="admin-grid">
-            {users.map((user) => (
-              <div key={user.username} className="summary-card user-card">
-                <div>
-                  <strong>{user.username}</strong>
-                  <div className="user-meta">
-                    <span className="meta">Role: {user.role}</span>
-                    <span className="meta">Login type: {user.authProvider || 'local'}</span>
-                    <span className="meta">Last login: {formatLastLogin(user.lastLoginAt)}</span>
+          <div className="user-directory-list">
+            <div className="user-directory-header">
+              <span>User</span>
+              <span>Access</span>
+              <span>Requests</span>
+              <span>Activity</span>
+            </div>
+            {filteredUsers.map((user) => (
+              <Link
+                key={user.username}
+                className="user-directory-row"
+                href={`/users/${user.id}`}
+              >
+                <div className="user-directory-cell user-directory-cell--identity">
+                  <div className="user-directory-title-row">
+                    <strong>{user.username}</strong>
+                    <span className="user-grid-meta">{user.role}</span>
+                  </div>
+                  <div className="user-directory-subtext">
+                    Login: {user.authProvider || 'local'} • Profile: {user.profileId ?? 'None'}
                   </div>
                 </div>
-                <div className="user-actions">
-                  <label className="toggle">
-                    <input
-                      type="checkbox"
-                      checked={user.role === 'admin'}
-                      onChange={(event) =>
-                        updateUserRole(user.username, event.target.checked ? 'admin' : 'user')
-                      }
-                    />
-                    <span>Make admin</span>
-                  </label>
-                  <button
-                    type="button"
-                    className="ghost-button"
-                    onClick={() => toggleUserBlock(user.username, !user.isBlocked)}
-                  >
-                    {user.isBlocked ? 'Allow access' : 'Block access'}
-                  </button>
+                <div className="user-directory-cell">
+                  <div className="user-directory-pill-row">
+                    <span className={`user-grid-pill ${user.isBlocked ? 'is-blocked' : ''}`}>
+                      {user.isBlocked ? 'Blocked' : 'Active'}
+                    </span>
+                    <span
+                      className={`user-grid-pill ${user.autoSearchEnabled === false ? 'is-disabled' : ''}`}
+                    >
+                      Auto {user.autoSearchEnabled === false ? 'Off' : 'On'}
+                    </span>
+                    <span className={`user-grid-pill ${user.isExpired ? 'is-blocked' : ''}`}>
+                      {user.expiresAt ? (user.isExpired ? 'Expired' : 'Expiry set') : 'No expiry'}
+                    </span>
+                  </div>
+                  <div className="user-directory-subtext">
+                    {user.expiresAt ? `Expires: ${formatExpiry(user.expiresAt)}` : 'No account expiry'}
+                  </div>
                 </div>
-              </div>
+                <div className="user-directory-cell">
+                  <div className="user-directory-stats-inline">
+                    <span><strong>{user.stats?.total ?? 0}</strong> total</span>
+                    <span><strong>{user.stats?.ready ?? 0}</strong> ready</span>
+                    <span><strong>{user.stats?.pending ?? 0}</strong> pending</span>
+                    <span><strong>{user.stats?.in_progress ?? 0}</strong> in progress</span>
+                  </div>
+                </div>
+                <div className="user-directory-cell">
+                  <div className="user-directory-subtext">
+                    Last login: {formatLastLogin(user.lastLoginAt)}
+                  </div>
+                  <div className="user-directory-subtext">
+                    Last request: {formatLastRequest(user.stats?.last_request_at)}
+                  </div>
+                </div>
+                <div className="user-directory-row-chevron" aria-hidden="true">
+                  Open
+                </div>
+              </Link>
             ))}
           </div>
         )}

frontend/package-lock.json

@@ -0,0 +1,979 @@
+{
+  "name": "magent-frontend",
+  "version": "0103262231",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "magent-frontend",
+      "version": "0103262231",
+      "dependencies": {
+        "next": "16.1.6",
+        "react": "19.2.4",
+        "react-dom": "19.2.4"
+      },
+      "devDependencies": {
+        "@types/node": "24.11.0",
+        "@types/react": "19.2.14",
+        "@types/react-dom": "19.2.3",
+        "typescript": "5.9.3"
+      }
+    },
+    "node_modules/@emnapi/runtime": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.8.1.tgz",
+      "integrity": "sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@img/colour": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.0.0.tgz",
+      "integrity": "sha512-A5P/LfWGFSl6nsckYtjw9da+19jB8hkJ6ACTGcDfEJ0aE+l2n2El7dsVM7UVHZQ9s2lmYMWlrS21YLy2IR1LUw==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@img/sharp-darwin-arm64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.5.tgz",
+      "integrity": "sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-darwin-arm64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-darwin-x64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.5.tgz",
+      "integrity": "sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-darwin-x64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-libvips-darwin-arm64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.4.tgz",
+      "integrity": "sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-darwin-x64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.4.tgz",
+      "integrity": "sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-arm": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.4.tgz",
+      "integrity": "sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-arm64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.4.tgz",
+      "integrity": "sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-ppc64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.2.4.tgz",
+      "integrity": "sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-riscv64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.2.4.tgz",
+      "integrity": "sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-s390x": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.2.4.tgz",
+      "integrity": "sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-x64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.2.4.tgz",
+      "integrity": "sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.2.4.tgz",
+      "integrity": "sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linuxmusl-x64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.4.tgz",
+      "integrity": "sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-linux-arm": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.5.tgz",
+      "integrity": "sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-arm": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linux-arm64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.5.tgz",
+      "integrity": "sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-arm64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linux-ppc64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.34.5.tgz",
+      "integrity": "sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-ppc64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linux-riscv64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.34.5.tgz",
+      "integrity": "sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-riscv64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linux-s390x": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.5.tgz",
+      "integrity": "sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==",
+      "cpu": [
+        "s390x"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-s390x": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linux-x64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.5.tgz",
+      "integrity": "sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-x64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linuxmusl-arm64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.5.tgz",
+      "integrity": "sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linuxmusl-x64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.5.tgz",
+      "integrity": "sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linuxmusl-x64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-wasm32": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.34.5.tgz",
+      "integrity": "sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==",
+      "cpu": [
+        "wasm32"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/runtime": "^1.7.0"
+      },
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-arm64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.5.tgz",
+      "integrity": "sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-ia32": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.5.tgz",
+      "integrity": "sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-x64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.5.tgz",
+      "integrity": "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@next/env": {
+      "version": "16.1.6",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.1.6.tgz",
+      "integrity": "sha512-N1ySLuZjnAtN3kFnwhAwPvZah8RJxKasD7x1f8shFqhncnWZn4JMfg37diLNuoHsLAlrDfM3g4mawVdtAG8XLQ==",
+      "license": "MIT"
+    },
+    "node_modules/@next/swc-darwin-arm64": {
+      "version": "16.1.6",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.1.6.tgz",
+      "integrity": "sha512-wTzYulosJr/6nFnqGW7FrG3jfUUlEf8UjGA0/pyypJl42ExdVgC6xJgcXQ+V8QFn6niSG2Pb8+MIG1mZr2vczw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-darwin-x64": {
+      "version": "16.1.6",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.1.6.tgz",
+      "integrity": "sha512-BLFPYPDO+MNJsiDWbeVzqvYd4NyuRrEYVB5k2N3JfWncuHAy2IVwMAOlVQDFjj+krkWzhY2apvmekMkfQR0CUQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-arm64-gnu": {
+      "version": "16.1.6",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.1.6.tgz",
+      "integrity": "sha512-OJYkCd5pj/QloBvoEcJ2XiMnlJkRv9idWA/j0ugSuA34gMT6f5b7vOiCQHVRpvStoZUknhl6/UxOXL4OwtdaBw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-arm64-musl": {
+      "version": "16.1.6",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.1.6.tgz",
+      "integrity": "sha512-S4J2v+8tT3NIO9u2q+S0G5KdvNDjXfAv06OhfOzNDaBn5rw84DGXWndOEB7d5/x852A20sW1M56vhC/tRVbccQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-x64-gnu": {
+      "version": "16.1.6",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.1.6.tgz",
+      "integrity": "sha512-2eEBDkFlMMNQnkTyPBhQOAyn2qMxyG2eE7GPH2WIDGEpEILcBPI/jdSv4t6xupSP+ot/jkfrCShLAa7+ZUPcJQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-x64-musl": {
+      "version": "16.1.6",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.1.6.tgz",
+      "integrity": "sha512-oicJwRlyOoZXVlxmIMaTq7f8pN9QNbdes0q2FXfRsPhfCi8n8JmOZJm5oo1pwDaFbnnD421rVU409M3evFbIqg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-win32-arm64-msvc": {
+      "version": "16.1.6",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.1.6.tgz",
+      "integrity": "sha512-gQmm8izDTPgs+DCWH22kcDmuUp7NyiJgEl18bcr8irXA5N2m2O+JQIr6f3ct42GOs9c0h8QF3L5SzIxcYAAXXw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-win32-x64-msvc": {
+      "version": "16.1.6",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.1.6.tgz",
+      "integrity": "sha512-NRfO39AIrzBnixKbjuo2YiYhB6o9d8v/ymU9m/Xk8cyVk+k7XylniXkHwjs4s70wedVffc6bQNbufk5v0xEm0A==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@swc/helpers": {
+      "version": "0.5.15",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",
+      "integrity": "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.8.0"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "24.11.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.11.0.tgz",
+      "integrity": "sha512-fPxQqz4VTgPI/IQ+lj9r0h+fDR66bzoeMGHp8ASee+32OSGIkeASsoZuJixsQoVef1QJbeubcPBxKk22QVoWdw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~7.16.0"
+      }
+    },
+    "node_modules/@types/react": {
+      "version": "19.2.14",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.14.tgz",
+      "integrity": "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "csstype": "^3.2.2"
+      }
+    },
+    "node_modules/@types/react-dom": {
+      "version": "19.2.3",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz",
+      "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "^19.2.0"
+      }
+    },
+    "node_modules/baseline-browser-mapping": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.0.tgz",
+      "integrity": "sha512-lIyg0szRfYbiy67j9KN8IyeD7q7hcmqnJ1ddWmNt19ItGpNN64mnllmxUNFIOdOm6by97jlL6wfpTTJrmnjWAA==",
+      "license": "Apache-2.0",
+      "bin": {
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001766",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001766.tgz",
+      "integrity": "sha512-4C0lfJ0/YPjJQHagaE9x2Elb69CIqEPZeG0anQt9SIvIoOH4a4uaRl73IavyO+0qZh6MDLH//DrXThEYKHkmYA==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "CC-BY-4.0"
+    },
+    "node_modules/client-only": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
+      "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==",
+      "license": "MIT"
+    },
+    "node_modules/csstype": {
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
+      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.11",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
+      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/next": {
+      "version": "16.1.6",
+      "resolved": "https://registry.npmjs.org/next/-/next-16.1.6.tgz",
+      "integrity": "sha512-hkyRkcu5x/41KoqnROkfTm2pZVbKxvbZRuNvKXLRXxs3VfyO0WhY50TQS40EuKO9SW3rBj/sF3WbVwDACeMZyw==",
+      "license": "MIT",
+      "dependencies": {
+        "@next/env": "16.1.6",
+        "@swc/helpers": "0.5.15",
+        "baseline-browser-mapping": "^2.8.3",
+        "caniuse-lite": "^1.0.30001579",
+        "postcss": "8.4.31",
+        "styled-jsx": "5.1.6"
+      },
+      "bin": {
+        "next": "dist/bin/next"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "optionalDependencies": {
+        "@next/swc-darwin-arm64": "16.1.6",
+        "@next/swc-darwin-x64": "16.1.6",
+        "@next/swc-linux-arm64-gnu": "16.1.6",
+        "@next/swc-linux-arm64-musl": "16.1.6",
+        "@next/swc-linux-x64-gnu": "16.1.6",
+        "@next/swc-linux-x64-musl": "16.1.6",
+        "@next/swc-win32-arm64-msvc": "16.1.6",
+        "@next/swc-win32-x64-msvc": "16.1.6",
+        "sharp": "^0.34.4"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.1.0",
+        "@playwright/test": "^1.51.1",
+        "babel-plugin-react-compiler": "*",
+        "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0",
+        "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0",
+        "sass": "^1.3.0"
+      },
+      "peerDependenciesMeta": {
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@playwright/test": {
+          "optional": true
+        },
+        "babel-plugin-react-compiler": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "license": "ISC"
+    },
+    "node_modules/postcss": {
+      "version": "8.4.31",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz",
+      "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.6",
+        "picocolors": "^1.0.0",
+        "source-map-js": "^1.0.2"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/react": {
+      "version": "19.2.4",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.4.tgz",
+      "integrity": "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "19.2.4",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.4.tgz",
+      "integrity": "sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ==",
+      "license": "MIT",
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.4"
+      }
+    },
+    "node_modules/scheduler": {
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT"
+    },
+    "node_modules/semver": {
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "license": "ISC",
+      "optional": true,
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/sharp": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz",
+      "integrity": "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==",
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "@img/colour": "^1.0.0",
+        "detect-libc": "^2.1.2",
+        "semver": "^7.7.3"
+      },
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-darwin-arm64": "0.34.5",
+        "@img/sharp-darwin-x64": "0.34.5",
+        "@img/sharp-libvips-darwin-arm64": "1.2.4",
+        "@img/sharp-libvips-darwin-x64": "1.2.4",
+        "@img/sharp-libvips-linux-arm": "1.2.4",
+        "@img/sharp-libvips-linux-arm64": "1.2.4",
+        "@img/sharp-libvips-linux-ppc64": "1.2.4",
+        "@img/sharp-libvips-linux-riscv64": "1.2.4",
+        "@img/sharp-libvips-linux-s390x": "1.2.4",
+        "@img/sharp-libvips-linux-x64": "1.2.4",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4",
+        "@img/sharp-libvips-linuxmusl-x64": "1.2.4",
+        "@img/sharp-linux-arm": "0.34.5",
+        "@img/sharp-linux-arm64": "0.34.5",
+        "@img/sharp-linux-ppc64": "0.34.5",
+        "@img/sharp-linux-riscv64": "0.34.5",
+        "@img/sharp-linux-s390x": "0.34.5",
+        "@img/sharp-linux-x64": "0.34.5",
+        "@img/sharp-linuxmusl-arm64": "0.34.5",
+        "@img/sharp-linuxmusl-x64": "0.34.5",
+        "@img/sharp-wasm32": "0.34.5",
+        "@img/sharp-win32-arm64": "0.34.5",
+        "@img/sharp-win32-ia32": "0.34.5",
+        "@img/sharp-win32-x64": "0.34.5"
+      }
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/styled-jsx": {
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.6.tgz",
+      "integrity": "sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA==",
+      "license": "MIT",
+      "dependencies": {
+        "client-only": "0.0.1"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "peerDependencies": {
+        "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0 || ^19.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "@babel/core": {
+          "optional": true
+        },
+        "babel-plugin-macros": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
+      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
+      "dev": true,
+      "license": "MIT"
+    }
+  }
+}
+
+
+

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "magent-frontend",
   "private": true,
-  "version": "0.1.0",
+  "version": "0103262231",
   "scripts": {
     "dev": "next dev",
     "build": "next build",
@@ -9,14 +9,17 @@
     "lint": "next lint"
   },
   "dependencies": {
-    "next": "14.2.5",
-    "react": "18.3.1",
-    "react-dom": "18.3.1"
+    "next": "16.1.6",
+    "react": "19.2.4",
+    "react-dom": "19.2.4"
   },
   "devDependencies": {
-    "typescript": "5.5.4",
-    "@types/node": "20.14.10",
-    "@types/react": "18.3.3",
-    "@types/react-dom": "18.3.0"
+    "typescript": "5.9.3",
+    "@types/node": "24.11.0",
+    "@types/react": "19.2.14",
+    "@types/react-dom": "19.2.3"
   }
 }
+
+
+

frontend/tsconfig.json

@@ -11,9 +11,20 @@
     "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "jsx": "preserve",
-    "incremental": true
+    "jsx": "react-jsx",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ]
   },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx"],
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
   "exclude": ["node_modules"]
 }