fix(auth): accept configured public origin for sign-in

.env.beta.example

@@ -0,0 +1,20 @@
+# Provision this as .env on the beta host. Do not copy production secrets or data.
+APP_NAME=Magent Beta
+CORS_ALLOW_ORIGIN=https://beta.grizzlyflix.co.nz
+MAGENT_APPLICATION_URL=https://beta.grizzlyflix.co.nz
+MAGENT_API_URL=https://beta.grizzlyflix.co.nz/api
+SQLITE_PATH=/app/data/magent.db
+LOG_FILE=/app/data/magent.log
+LOG_FORMAT=json
+
+JWT_SECRET=replace-with-an-independent-beta-secret-of-at-least-32-characters
+SETTINGS_ENCRYPTION_KEY=replace-with-an-independent-valid-fernet-key
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD=replace-with-a-strong-beta-bootstrap-password
+
+AUTH_COOKIE_NAME=magent_beta_auth
+AUTH_STATE_COOKIE_NAME=magent_beta_logged_in
+AUTH_COOKIE_DOMAIN=beta.grizzlyflix.co.nz
+AUTH_COOKIE_SECURE=true
+AUTH_COOKIE_SAMESITE=strict
+API_DOCS_ENABLED=false

.env.example

@@ -0,0 +1,23 @@
+# Copy to .env for local development. Never reuse these example values in a deployed environment.
+APP_NAME=Magent
+CORS_ALLOW_ORIGIN=http://localhost:3000
+MAGENT_APPLICATION_URL=http://localhost:3000
+MAGENT_API_URL=http://localhost:8000
+SQLITE_PATH=/app/data/magent.db
+LOG_FILE=/app/data/magent.log
+LOG_FORMAT=text
+
+# Generate independent values as documented in README.md.
+JWT_SECRET=replace-with-at-least-32-random-characters
+SETTINGS_ENCRYPTION_KEY=replace-with-a-valid-fernet-key
+ADMIN_USERNAME=admin
+# Recommended fresh install: generate a separate random setup token. Open /setup
+# to create the administrator and connect your apps; remove this after finishing.
+SETUP_TOKEN=replace-with-a-separate-random-setup-token
+# Alternatively pre-create the first admin with a unique password (12+ chars).
+# Leave blank to create the account using the setup wizard and SETUP_TOKEN.
+ADMIN_PASSWORD=
+
+AUTH_COOKIE_SECURE=false
+AUTH_COOKIE_SAMESITE=strict
+API_DOCS_ENABLED=false

.gitea/workflows/ci-cd.yml

@@ -6,6 +6,10 @@ on:
       - beta
       - main
       - prod
+  pull_request:
+    branches:
+      - beta
+      - main
   workflow_dispatch:
 
 concurrency:
@@ -17,15 +21,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24"
           # Gitea cache restore/save stalls here; npm ci takes about 15 seconds.
@@ -37,40 +41,40 @@ jobs:
       - name: Run backend quality gate
         run: bash scripts/ci_backend_quality_gate.sh
 
+      - name: Verify generated build metadata
+        run: python scripts/verify_build_metadata.py
+
+      - name: Audit frontend production dependencies
+        working-directory: frontend
+        run: npm audit --omit=dev --package-lock-only --audit-level=high
+
+      - name: Lint frontend
+        working-directory: frontend
+        run: npm run lint
+
+      - name: Check frontend formatting
+        working-directory: frontend
+        run: npm run format:check
+
+      - name: Type-check frontend
+        working-directory: frontend
+        run: npm run typecheck
+
+      - name: Test frontend
+        working-directory: frontend
+        run: npm test
+
       - name: Build frontend
         working-directory: frontend
         run: npm run build
 
-  deploy-prod:
-    if: github.ref_name == 'prod'
-    needs: verify
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Configure SSH key
-        env:
-          PROD_SSH_PRIVATE_KEY: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
-          PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
+      - name: Validate Compose configuration
         run: |
-          set -euo pipefail
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          printf '%s' "$PROD_SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          if [ -n "${PROD_SSH_KNOWN_HOSTS:-}" ]; then
-            printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-            chmod 644 ~/.ssh/known_hosts
-          fi
+          cp .env.example .env
+          docker compose -f docker-compose.yml config --quiet
 
-      - name: Deploy to AMS-DEV01
-        env:
-          DEPLOY_HOST: ${{ secrets.PROD_SSH_HOST }}
-          DEPLOY_USER: ${{ secrets.PROD_SSH_USER }}
-          DEPLOY_PATH: ${{ secrets.PROD_DEPLOY_PATH }}
-          DEPLOY_SSH_OPTS: -o StrictHostKeyChecking=accept-new
-        run: bash scripts/deploy_ams_dev01.sh
+      - name: Build and smoke-test container
+        run: bash scripts/ci_container_smoke.sh
 
   deploy-beta:
     if: github.ref_name == 'beta'
@@ -78,7 +82,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Configure SSH key
         env:
@@ -86,19 +90,17 @@ jobs:
           PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
         run: |
           set -euo pipefail
+          : "${PROD_SSH_KNOWN_HOSTS:?PROD_SSH_KNOWN_HOSTS is required}"
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
           printf '%s' "$PROD_SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          if [ -n "${PROD_SSH_KNOWN_HOSTS:-}" ]; then
-            printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-            chmod 644 ~/.ssh/known_hosts
-          fi
+          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts
 
       - name: Deploy beta to AMS-DEV01
         env:
           DEPLOY_HOST: ${{ secrets.PROD_SSH_HOST }}
           DEPLOY_USER: ${{ secrets.PROD_SSH_USER }}
-          PROD_DEPLOY_PATH: ${{ secrets.PROD_DEPLOY_PATH }}
-          DEPLOY_SSH_OPTS: -o StrictHostKeyChecking=accept-new
+          DEPLOY_SSH_OPTS: -o StrictHostKeyChecking=yes
         run: bash scripts/deploy_beta_ams_dev01.sh

.gitignore

@@ -1,6 +1,7 @@
 .env
 bootstrap-admin.json
 .venv/
+.security-test-venv*/
 data/
 !data/branding/
 !data/branding/**
@@ -8,8 +9,12 @@ backend/__pycache__/
 **/__pycache__/
 *.pyc
 backend/.pytest_cache/
+.coverage
+coverage.xml
+htmlcov/
 frontend/node_modules/
 frontend/.next/
+*.tsbuildinfo
 *.log
 **/.pytest_cache/
 .env.*

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24-slim AS frontend-builder
+FROM node:24-slim@sha256:2fe369e969550cde8e867afc3fe370b260140cab4a23d467074295b42163d553 AS frontend-builder
 
 WORKDIR /frontend
 
@@ -13,11 +13,12 @@ COPY frontend/app ./app
 COPY frontend/public ./public
 COPY frontend/next-env.d.ts ./next-env.d.ts
 COPY frontend/next.config.js ./next.config.js
+COPY frontend/proxy.ts ./proxy.ts
 COPY frontend/tsconfig.json ./tsconfig.json
 
 RUN npm run build
 
-FROM python:3.14-slim
+FROM python:3.14-slim@sha256:cad9a2c871761c413caa6fdd6441c783451e740a48aaeba60ae62a8b53525ef6
 
 WORKDIR /app
 
@@ -32,22 +33,36 @@ RUN apt-get update \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
+ARG MAGENT_UID=1000
+ARG MAGENT_GID=1000
+RUN groupadd --gid ${MAGENT_GID} magent \
+    && useradd --uid ${MAGENT_UID} --gid magent --create-home --shell /usr/sbin/nologin magent
+
 COPY backend/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY backend/app ./app
-COPY data/branding /app/data/branding
+COPY --chown=magent:magent backend/app ./app
+COPY --chown=magent:magent data/branding /app/data/branding
 
-COPY --from=frontend-builder /frontend/.next /app/frontend/.next
-COPY --from=frontend-builder /frontend/public /app/frontend/public
-COPY --from=frontend-builder /frontend/node_modules /app/frontend/node_modules
-COPY --from=frontend-builder /frontend/package.json /app/frontend/package.json
-COPY --from=frontend-builder /frontend/next.config.js /app/frontend/next.config.js
-COPY --from=frontend-builder /frontend/next-env.d.ts /app/frontend/next-env.d.ts
-COPY --from=frontend-builder /frontend/tsconfig.json /app/frontend/tsconfig.json
+COPY --chown=magent:magent --from=frontend-builder /frontend/.next /app/frontend/.next
+COPY --chown=magent:magent --from=frontend-builder /frontend/public /app/frontend/public
+COPY --chown=magent:magent --from=frontend-builder /frontend/node_modules /app/frontend/node_modules
+COPY --chown=magent:magent --from=frontend-builder /frontend/package.json /app/frontend/package.json
+COPY --chown=magent:magent --from=frontend-builder /frontend/next.config.js /app/frontend/next.config.js
+COPY --chown=magent:magent --from=frontend-builder /frontend/proxy.ts /app/frontend/proxy.ts
+COPY --chown=magent:magent --from=frontend-builder /frontend/next-env.d.ts /app/frontend/next-env.d.ts
+COPY --chown=magent:magent --from=frontend-builder /frontend/tsconfig.json /app/frontend/tsconfig.json
 
-COPY docker/supervisord.conf /etc/supervisor/conf.d/magent.conf
+COPY --chown=magent:magent docker/supervisord.conf /etc/supervisor/conf.d/magent.conf
+
+RUN chown -R magent:magent /app
+USER magent:magent
 
 EXPOSE 3000 8000
 
+HEALTHCHECK --interval=30s --timeout=5s --start-period=45s --retries=3 \
+    CMD curl --fail --silent --show-error http://127.0.0.1:8000/health >/dev/null \
+        && curl --fail --silent --show-error http://127.0.0.1:3000/login >/dev/null \
+        || exit 1
+
 CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/magent.conf"]

PRODUCTION.md

@@ -18,6 +18,8 @@ from `main`; use `prod-<short-commit>` tags to identify an exact release.
 
 1. Run the backend tests and frontend production build. Review only the intended
    changes, then commit and push `main`.
+   The repository workflow verifies `main` but intentionally does not deploy it;
+   production changes require the remaining explicit release steps below.
 2. Build from a clean source export using the root Dockerfile. Never include
    `.env`, databases or bootstrap credentials in the build context.
 3. Publish `rephl3xnz/magent:prod-<short-commit>` and `:latest` to Docker Hub.
@@ -33,6 +35,14 @@ from `main`; use `prod-<short-commit>` tags to identify an exact release.
    feature, database integrity and account counts. Do not trigger bulk permission
    changes, email sends or user imports as a deployment smoke test.
 
+   Include browser-origin POST checks for both `/api/auth/login` and
+   `/api/auth/jellyfin/login`: an empty form with `Origin` set to the public URL
+   must reach input validation (422), while an unrelated origin must return 403.
+   GET-only login/health checks do not detect origin-policy lockouts. Set
+   `CORS_ALLOW_ORIGIN` to the exact public origin; the state-change guard also
+   accepts the explicitly configured Hosting & proxy public URL, never a URL
+   inferred from request Host or forwarded headers.
+
 For rollback, select the saved image and recreate only Magent. Restore data only
 if needed; doing so can discard activity since the backup. Never restore a whole
 shared Compose or Caddy file without checking for unrelated changes first.

README.md

@@ -26,6 +26,8 @@ Magent is a friendly, AI-assisted request tracker for Seerr + Arr services. It s
 - Personal viewing stats from Jellystat: minutes, movies, episodes, streaks, and recent plays alongside requests. See [Jellystat setup](docs/jellystat-integration.md).
 - Admin review and confirmation of account IDs across Jellyfin, Seerr, Jellystat and Magent. See [user identities](docs/user-identities.md).
 - Docker-first deployment for easy hosting.
+- Guided, resumable first-install setup with app connection tests.
+- Encrypted backups of configuration, database and optional artwork cache, with restart-only restore.
 
 ## Quick start (Docker - primary)
 
@@ -42,10 +44,17 @@ Then open:
 
 ### Docker setup steps
 
-1) Create `.env` with your service URLs and API keys.
-2) Run `docker compose up --build`.
-3) Log in at http://localhost:3000.
-4) Visit Settings to confirm service health.
+1) Copy `.env.example` to `.env`. Generate independent `JWT_SECRET`, `SETTINGS_ENCRYPTION_KEY` and `SETUP_TOKEN` values as described below. Do not use the example placeholders.
+2) Set `CORS_ALLOW_ORIGIN` and `MAGENT_APPLICATION_URL` to your browser-facing origin. For public deployments, use HTTPS and `AUTH_COOKIE_SECURE=true`.
+3) Run `docker compose up --build`.
+4) Open http://localhost:3000. A fresh database opens the setup wizard automatically. Use your `SETUP_TOKEN` to create a local administrator, then connect and test each app you use.
+5) Choose site, sign-in, request-sync and email preferences, review the connections, and finish setup. Remove `SETUP_TOKEN` from the deployment environment afterwards.
+
+Apps may be skipped and configured later. Progress is saved in SQLite. Background imports and automation remain paused until setup is complete; `BACKGROUND_TASKS_ENABLED=false` still takes precedence. Existing installations are automatically treated as configured and are not forced through the wizard. Administrators can reopen it at **Settings → Advanced tools → Setup wizard**.
+
+If you prefer to seed an administrator through deployment configuration, set a unique `ADMIN_USERNAME` and `ADMIN_PASSWORD` instead of `SETUP_TOKEN`. The wizard then asks you to sign in with that account. Environment credentials create only the first administrator; they do not add another account to a restored installation. Service URLs and API keys can still be supplied through the environment, and the wizard preloads these settings without exposing saved secrets.
+
+See [installation and recovery](docs/installation-and-recovery.md) for migration, backup limits and restore instructions.
 
 ### Docker environment variables (sample)
 
@@ -66,8 +75,9 @@ QBIT_URL="http://localhost:8080"
 QBIT_USERNAME="..."
 QBIT_PASSWORD="..."
 SQLITE_PATH="data/magent.db"
-JWT_SECRET="replace-with-a-long-random-secret"
-JWT_EXP_MINUTES="720"
+JWT_SECRET="replace-with-at-least-32-random-characters"
+SETTINGS_ENCRYPTION_KEY="replace-with-a-fernet-key"
+JWT_EXP_MINUTES="120"
 ADMIN_USERNAME="set-a-real-admin-username"
 ADMIN_PASSWORD="set-a-long-unique-admin-password"
 ```
@@ -114,8 +124,9 @@ $env:QBIT_URL="http://localhost:8080"
 $env:QBIT_USERNAME="..."
 $env:QBIT_PASSWORD="..."
 $env:SQLITE_PATH="data/magent.db"
-$env:JWT_SECRET="replace-with-a-long-random-secret"
-$env:JWT_EXP_MINUTES="720"
+$env:JWT_SECRET="replace-with-at-least-32-random-characters"
+$env:SETTINGS_ENCRYPTION_KEY="replace-with-a-fernet-key"
+$env:JWT_EXP_MINUTES="120"
 $env:ADMIN_USERNAME="set-a-real-admin-username"
 $env:ADMIN_PASSWORD="set-a-long-unique-admin-password"
 ```
@@ -134,6 +145,19 @@ Admin panel: http://localhost:3000/admin
 
 Login uses the admin credentials above (or any other local user you create in SQLite).
 
+### Local quality checks
+
+```bash
+bash scripts/ci_backend_quality_gate.sh
+cd frontend
+npm ci
+npm run lint
+npm run format:check
+npm run typecheck
+npm test
+npm run build
+```
+
 ## Public Hosting Notes
 
 The frontend proxies `/api/*` to the backend container. Set:
@@ -147,21 +171,43 @@ If you prefer the browser to call the backend directly, set `NEXT_PUBLIC_API_BAS
 
 This repo now includes a Gitea Actions workflow at `.gitea/workflows/ci-cd.yml`.
 
-- Push to `beta`: runs the backend unit-test quality gate and a production frontend build.
-- Push to `prod`: runs the same verification, then deploys to Docker on `AMS-DEV01`.
+- Push to `beta`: runs the complete quality gate and deploys the isolated beta environment to `AMS-DEV01`.
+- Push to `main` or `prod`: runs the same verification without automatically changing production.
+- Production releases are tagged from `main` and deployed to `GRZ-DKR01` using the checklist in `PRODUCTION.md`.
 
-The deploy step ships tracked repository files over SSH, preserves the server's `.env` and `data/`, rebuilds with `docker compose up -d --build`, and smoke-tests:
+The beta deploy step ships tracked repository files over SSH, preserves beta's own `.env` and `data/`, rebuilds with `docker compose up -d --build`, and smoke-tests:
 
 - `http://127.0.0.1:8000/health`
 - `http://127.0.0.1:3000/login`
 
 Configure these Gitea Actions secrets before enabling the deploy job:
 
+The existing `PROD_*` names are retained for compatibility, but this workflow uses them only for the isolated beta host deployment.
+
 - `PROD_SSH_PRIVATE_KEY`: private key for the deployment account.
 - `PROD_SSH_HOST`: target host, for example `AMS-DEV01`.
 - `PROD_SSH_USER`: target user, for example `zak`.
-- `PROD_DEPLOY_PATH`: target app path, for example `/home/zak/magent`.
-- `PROD_SSH_KNOWN_HOSTS`: optional pinned `known_hosts` entry for stricter host verification.
+- `PROD_SSH_KNOWN_HOSTS`: required pinned `known_hosts` entry. Deployments reject unknown or changed hosts.
+
+Beta always deploys to the isolated `/home/<deployment-user>/magent-beta` directory; the production path secret is intentionally ignored.
+
+## Security and data handling
+
+Generate independent signing and settings-encryption secrets before first startup:
+
+```bash
+python -c "import secrets; print(secrets.token_urlsafe(48))"
+python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+```
+
+- `JWT_SECRET` must contain at least 32 characters. Access sessions expire after 120 minutes by default and are revoked after logout, password, role, or blocked-state changes.
+- `SETUP_TOKEN` is a separate random value of at least 32 characters, generated using the first command above a second time. It only authorizes first-admin creation on an unfinished, fresh installation. Never put it in a URL or share it with ordinary users. After completion the public bootstrap endpoint remains disabled even if the token is retained.
+- `SETTINGS_ENCRYPTION_KEY` protects service API keys, SMTP credentials, webhooks, and private keys stored in SQLite. Keep it in `.env`, outside the database and its backups. If omitted, Magent derives a migration-compatible key from `JWT_SECRET`; a dedicated key is recommended.
+- Invite secrets are stored as one-way hashes. Existing invite links continue to work after migration, but the admin UI cannot reveal an old link. Copy a link when it is created, or generate a replacement link later; replacement immediately invalidates the prior link.
+- Magent encrypts sensitive settings, not the entire SQLite database. Request metadata, account records, logs, the `data/` volume, and backups should live on encrypted host storage with access restricted to the deployment account.
+- `REQUESTS_CLEANUP_DAYS` controls routine request-history retention (90 days by default). Account deletion removes authentication and subscription records and anonymizes retained request and portal history.
+- Production and beta cookies require HTTPS and use `SameSite=Strict`. Keep the backend port bound to loopback and publish the frontend only through the intended reverse proxy.
+- **View as user** is a per-tab interface preview: it hides configuration, user-management pages, diagnostics and moderation tools, including direct admin-page URLs. **Exit user view** restores the administrator interface. It does not impersonate another account or change backend permissions; the displayed data still belongs to the signed-in account. Test real permission boundaries with a separate non-admin account.
 
 ## History endpoints
 
@@ -172,7 +218,7 @@ Configure these Gitea Actions secrets before enabling the deploy job:
 
 ### Login fails
 
-- Make sure `ADMIN_USERNAME` and `ADMIN_PASSWORD` are set in `.env`.
+- For a fresh installation, open `/setup` and use `SETUP_TOKEN`, or sign in with the environment-seeded administrator. Existing installations use the accounts already in the database; changing `ADMIN_PASSWORD` does not reset an existing account.
 - Confirm the backend is reachable: `http://localhost:8000/health` (or see container logs).
 
 ### Services show as down

backend/app/api_models.py

@@ -0,0 +1,58 @@
+"""Shared HTTP request and error contracts."""
+
+from typing import Any, Optional
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class StrictRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+
+class ErrorResponse(BaseModel):
+    detail: str
+
+
+COMMON_ERROR_RESPONSES: dict[int, dict[str, Any]] = {
+    400: {"model": ErrorResponse, "description": "Invalid request"},
+    401: {"model": ErrorResponse, "description": "Authentication required"},
+    403: {"model": ErrorResponse, "description": "Permission denied"},
+    404: {"model": ErrorResponse, "description": "Resource not found"},
+    409: {"model": ErrorResponse, "description": "Request conflict"},
+    429: {"model": ErrorResponse, "description": "Rate limit exceeded"},
+    500: {"model": ErrorResponse, "description": "Unexpected server error"},
+    502: {"model": ErrorResponse, "description": "Upstream service error"},
+    503: {"model": ErrorResponse, "description": "Service unavailable"},
+}
+
+
+class SignupRequest(StrictRequest):
+    invite_code: str = Field(min_length=1, max_length=256)
+    username: str = Field(min_length=1, max_length=100)
+    password: str = Field(min_length=1, max_length=1024)
+    email: Optional[str] = Field(default=None, max_length=320)
+
+
+class ForgotPasswordRequest(StrictRequest):
+    identifier: Optional[str] = Field(default=None, max_length=320)
+    username: Optional[str] = Field(default=None, max_length=100)
+    email: Optional[str] = Field(default=None, max_length=320)
+
+
+class PasswordResetRequest(StrictRequest):
+    token: str = Field(min_length=1, max_length=512)
+    new_password: str = Field(min_length=1, max_length=1024)
+
+
+class ProfileEmailUpdateRequest(StrictRequest):
+    email: Optional[str] = Field(default=None, max_length=320)
+
+
+class ChangePasswordRequest(StrictRequest):
+    current_password: str = Field(min_length=1, max_length=1024)
+    new_password: str = Field(min_length=1, max_length=1024)
+
+
+def request_data(payload: BaseModel | dict[str, Any]) -> dict[str, Any]:
+    """Keep direct service-level tests compatible while FastAPI validates HTTP input."""
+    return payload if isinstance(payload, dict) else payload.model_dump()

backend/app/auth.py

@@ -159,6 +159,9 @@ def _load_current_user_from_token(
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User is blocked")
     if _is_expired(user.get("expires_at")):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User access has expired")
+    token_version = payload.get("ver")
+    if not isinstance(token_version, int) or token_version != int(user.get("auth_version") or 1):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Session has been revoked")
 
     user = normalize_user_auth_provider(user)
     from .feature_access import permissions
@@ -183,6 +186,7 @@ def _load_current_user_from_token(
         "is_expired": bool(user.get("is_expired", False)),
         "password_change_supported": bool(user.get("password_change_supported", False)),
         "password_provider": user.get("password_provider"),
+        "auth_version": int(user.get("auth_version") or 1),
     }
 
 

backend/app/clients/jellyfin.py

@@ -1,7 +1,6 @@
 import re
 from typing import Any, Dict, Optional
 import httpx
-import time
 from .base import ApiClient, _operation_error_message
 from ..services.operation_progress import finish_remote_call, start_remote_call
 
@@ -186,7 +185,6 @@ class JellyfinClient(ApiClient):
     ) -> Optional[Dict[str, Any]]:
         if not self.base_url or not self.api_key:
             return None
-        started_at = time.perf_counter()
         operation_event_id = start_remote_call("Jellyfin", "Checking whether the title is available in Jellyfin…")
         url = f"{self.base_url}/Items"
         params = {
@@ -214,7 +212,6 @@ class JellyfinClient(ApiClient):
                         if isinstance(item, dict) and item.get('Id'):
                             items[item['Id']] = item
                 result = {'Items': list(items.values()), 'TotalRecordCount': len(items)}
-            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
             finish_remote_call(
                 operation_event_id,
                 success=True,
@@ -223,7 +220,6 @@ class JellyfinClient(ApiClient):
             )
             return result
         except Exception as exc:
-            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
             status_code = exc.response.status_code if isinstance(exc, httpx.HTTPStatusError) else None
             finish_remote_call(
                 operation_event_id,
@@ -277,7 +273,6 @@ class JellyfinClient(ApiClient):
     async def refresh_library(self, recursive: bool = True) -> None:
         if not self.base_url or not self.api_key:
             return None
-        started_at = time.perf_counter()
         operation_event_id = start_remote_call("Jellyfin", "Asking Jellyfin to refresh its library…")
         url = f"{self.base_url}/Library/Refresh"
         headers = self._emby_headers()
@@ -286,7 +281,6 @@ class JellyfinClient(ApiClient):
             async with httpx.AsyncClient(timeout=10.0) as client:
                 response = await client.post(url, headers=headers, params=params)
                 response.raise_for_status()
-            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
             finish_remote_call(
                 operation_event_id,
                 success=True,
@@ -294,7 +288,6 @@ class JellyfinClient(ApiClient):
                 message="Jellyfin accepted the library refresh and is scanning for new media.",
             )
         except Exception as exc:
-            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
             status_code = exc.response.status_code if isinstance(exc, httpx.HTTPStatusError) else None
             finish_remote_call(
                 operation_event_id,

backend/app/clients/qbittorrent.py

@@ -1,7 +1,6 @@
 from typing import Any, Dict, Optional
 import httpx
 import logging
-import time
 from .base import ApiClient, _operation_error_message
 from ..services.operation_progress import finish_remote_call, start_remote_call
 
@@ -89,7 +88,6 @@ class QBittorrentClient(ApiClient):
     async def _get(self, path: str, params: Optional[Dict[str, Any]] = None) -> Optional[Any]:
         if not self.base_url:
             return None
-        started_at = time.perf_counter()
         operation_event_id = start_remote_call("qBittorrent", "Checking qBittorrent for matching downloads…")
         try:
             async with httpx.AsyncClient(timeout=10.0) as client:
@@ -97,7 +95,6 @@ class QBittorrentClient(ApiClient):
                 response = await client.get(f"{self.base_url}{path}", params=params)
                 response.raise_for_status()
                 result = response.json()
-            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
             finish_remote_call(
                 operation_event_id,
                 success=True,
@@ -106,7 +103,6 @@ class QBittorrentClient(ApiClient):
             )
             return result
         except Exception as exc:
-            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
             status_code = exc.response.status_code if isinstance(exc, httpx.HTTPStatusError) else None
             finish_remote_call(
                 operation_event_id,
@@ -119,7 +115,6 @@ class QBittorrentClient(ApiClient):
     async def _get_text(self, path: str, params: Optional[Dict[str, Any]] = None) -> Optional[str]:
         if not self.base_url:
             return None
-        started_at = time.perf_counter()
         operation_event_id = start_remote_call("qBittorrent")
         try:
             async with httpx.AsyncClient(timeout=10.0) as client:
@@ -127,7 +122,6 @@ class QBittorrentClient(ApiClient):
                 response = await client.get(f"{self.base_url}{path}", params=params)
                 response.raise_for_status()
                 result = response.text.strip()
-            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
             finish_remote_call(
                 operation_event_id,
                 success=True,
@@ -136,7 +130,6 @@ class QBittorrentClient(ApiClient):
             )
             return result
         except Exception as exc:
-            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
             status_code = exc.response.status_code if isinstance(exc, httpx.HTTPStatusError) else None
             finish_remote_call(
                 operation_event_id,
@@ -149,14 +142,12 @@ class QBittorrentClient(ApiClient):
     async def _post_form(self, path: str, data: Dict[str, Any]) -> None:
         if not self.base_url:
             return None
-        started_at = time.perf_counter()
         operation_event_id = start_remote_call("qBittorrent")
         try:
             async with httpx.AsyncClient(timeout=10.0) as client:
                 await self._login(client)
                 response = await client.post(f"{self.base_url}{path}", data=data)
                 response.raise_for_status()
-            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
             finish_remote_call(
                 operation_event_id,
                 success=True,
@@ -164,7 +155,6 @@ class QBittorrentClient(ApiClient):
                 message=_torrent_action_message(path),
             )
         except Exception as exc:
-            duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
             status_code = exc.response.status_code if isinstance(exc, httpx.HTTPStatusError) else None
             finish_remote_call(
                 operation_event_id,

backend/app/config.py

@@ -1,9 +1,20 @@
+import re
 from typing import Optional
+
 from pydantic import AliasChoices, Field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 from .build_info import BUILD_NUMBER, CHANGELOG
 
+
+_BANNER_COLOR_PATTERN = re.compile(r"^#[0-9a-f]{6}$")
+
+
+def normalize_banner_color(value: object) -> Optional[str]:
+    color = str(value or "").strip().lower()
+    return color if _BANNER_COLOR_PATTERN.fullmatch(color) else None
+
+
 class Settings(BaseSettings):
     model_config = SettingsConfigDict(env_prefix="")
     app_name: str = "Magent"
@@ -13,7 +24,12 @@ class Settings(BaseSettings):
         default="DELETE", validation_alias=AliasChoices("SQLITE_JOURNAL_MODE")
     )
     jwt_secret: str = Field(default="", validation_alias=AliasChoices("JWT_SECRET"))
-    jwt_exp_minutes: int = Field(default=720, validation_alias=AliasChoices("JWT_EXP_MINUTES"))
+    jwt_exp_minutes: int = Field(default=120, validation_alias=AliasChoices("JWT_EXP_MINUTES"))
+    jwt_issuer: str = Field(default="magent", validation_alias=AliasChoices("JWT_ISSUER"))
+    jwt_audience: str = Field(default="magent-web", validation_alias=AliasChoices("JWT_AUDIENCE"))
+    settings_encryption_key: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("SETTINGS_ENCRYPTION_KEY")
+    )
     api_docs_enabled: bool = Field(default=False, validation_alias=AliasChoices("API_DOCS_ENABLED"))
     auth_rate_limit_window_seconds: int = Field(
         default=60, validation_alias=AliasChoices("AUTH_RATE_LIMIT_WINDOW_SECONDS")
@@ -35,6 +51,7 @@ class Settings(BaseSettings):
     )
     admin_username: str = Field(default="admin", validation_alias=AliasChoices("ADMIN_USERNAME"))
     admin_password: str = Field(default="", validation_alias=AliasChoices("ADMIN_PASSWORD"))
+    setup_token: str = Field(default="", validation_alias=AliasChoices("SETUP_TOKEN"))
     auth_cookie_name: str = Field(
         default="magent_auth", validation_alias=AliasChoices("AUTH_COOKIE_NAME")
     )
@@ -42,7 +59,7 @@ class Settings(BaseSettings):
         default=False, validation_alias=AliasChoices("AUTH_COOKIE_SECURE")
     )
     auth_cookie_samesite: str = Field(
-        default="lax", validation_alias=AliasChoices("AUTH_COOKIE_SAMESITE")
+        default="strict", validation_alias=AliasChoices("AUTH_COOKIE_SAMESITE")
     )
     auth_cookie_domain: Optional[str] = Field(
         default=None, validation_alias=AliasChoices("AUTH_COOKIE_DOMAIN")
@@ -51,6 +68,7 @@ class Settings(BaseSettings):
         default="magent_logged_in", validation_alias=AliasChoices("AUTH_STATE_COOKIE_NAME")
     )
     log_level: str = Field(default="INFO", validation_alias=AliasChoices("LOG_LEVEL"))
+    log_format: str = Field(default="text", validation_alias=AliasChoices("LOG_FORMAT"))
     log_file: str = Field(default="data/magent.log", validation_alias=AliasChoices("LOG_FILE"))
     log_file_max_bytes: int = Field(
         default=20_000_000, validation_alias=AliasChoices("LOG_FILE_MAX_BYTES")
@@ -108,6 +126,15 @@ class Settings(BaseSettings):
     site_banner_tone: str = Field(
         default="info", validation_alias=AliasChoices("SITE_BANNER_TONE")
     )
+    site_banner_background_color: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("SITE_BANNER_BACKGROUND_COLOR")
+    )
+    site_banner_border_color: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("SITE_BANNER_BORDER_COLOR")
+    )
+    site_login_message: Optional[str] = Field(
+        default=None, validation_alias=AliasChoices("SITE_LOGIN_MESSAGE")
+    )
     site_login_show_jellyfin_login: bool = Field(
         default=True, validation_alias=AliasChoices("SITE_LOGIN_SHOW_JELLYFIN_LOGIN")
     )

backend/app/logging_config.py

@@ -2,6 +2,8 @@ import contextvars
 import json
 import logging
 import os
+import re
+from datetime import datetime, timezone
 from logging.handlers import RotatingFileHandler
 from typing import Any, Mapping, Optional
 from urllib.parse import parse_qs
@@ -27,6 +29,9 @@ _SENSITIVE_KEYWORDS = (
     "token",
 )
 _MAX_BODY_BYTES = 4096
+_SENSITIVE_PATH_PATTERNS = (
+    re.compile(r"(/auth/invites/)[^/]+", re.IGNORECASE),
+)
 
 
 class RequestContextFilter(logging.Filter):
@@ -35,6 +40,22 @@ class RequestContextFilter(logging.Filter):
         return True
 
 
+class JsonLogFormatter(logging.Formatter):
+    """Stable JSON output for production log collectors."""
+
+    def format(self, record: logging.LogRecord) -> str:
+        payload: dict[str, Any] = {
+            "timestamp": datetime.fromtimestamp(record.created, timezone.utc).isoformat(),
+            "level": record.levelname,
+            "logger": record.name,
+            "request_id": getattr(record, "request_id", "-"),
+            "message": record.getMessage(),
+        }
+        if record.exc_info:
+            payload["exception"] = self.formatException(record.exc_info)
+        return json.dumps(payload, ensure_ascii=False, separators=(",", ":"))
+
+
 def bind_request_id(request_id: str) -> contextvars.Token[str]:
     return REQUEST_ID_CONTEXT.set(request_id or "-")
 
@@ -47,6 +68,13 @@ def current_request_id() -> str:
     return REQUEST_ID_CONTEXT.get("-")
 
 
+def sanitize_path(path: str) -> str:
+    sanitized = str(path or "")
+    for pattern in _SENSITIVE_PATH_PATTERNS:
+        sanitized = pattern.sub(r"\1[REDACTED]", sanitized)
+    return sanitized
+
+
 def _is_sensitive_key(key: str) -> bool:
     lowered = key.strip().lower()
     return any(marker in lowered for marker in _SENSITIVE_KEYWORDS)
@@ -55,10 +83,7 @@ def _is_sensitive_key(key: str) -> bool:
 def _redact_scalar(value: Any) -> Any:
     if value is None or isinstance(value, (int, float, bool)):
         return value
-    text = str(value)
-    if len(text) <= 4:
-        return "***"
-    return f"{text[:2]}***{text[-2:]}"
+    return "[REDACTED]"
 
 
 def sanitize_value(value: Any, *, key_hint: Optional[str] = None, depth: int = 0) -> Any:
@@ -142,6 +167,7 @@ def configure_logging(
     log_file_backup_count: int = 10,
     log_http_client_level: Optional[str] = "INFO",
     log_background_sync_level: Optional[str] = "INFO",
+    log_format: Optional[str] = "text",
 ) -> None:
     level_name = (log_level or "INFO").upper()
     level = getattr(logging, level_name, logging.INFO)
@@ -161,13 +187,20 @@ def configure_logging(
             backupCount=max(1, int(log_file_backup_count or 10)),
             encoding="utf-8",
         )
+        try:
+            os.chmod(log_path, 0o600)
+        except OSError:
+            pass
         handlers.append(file_handler)
 
     context_filter = RequestContextFilter()
-    formatter = logging.Formatter(
-        fmt="%(asctime)s | %(levelname)s | %(name)s | request_id=%(request_id)s | %(message)s",
-        datefmt="%Y-%m-%d %H:%M:%S",
-    )
+    if str(log_format or "text").strip().lower() == "json":
+        formatter: logging.Formatter = JsonLogFormatter()
+    else:
+        formatter = logging.Formatter(
+            fmt="%(asctime)s | %(levelname)s | %(name)s | request_id=%(request_id)s | %(message)s",
+            datefmt="%Y-%m-%d %H:%M:%S",
+        )
     for handler in handlers:
         handler.addFilter(context_filter)
         handler.setFormatter(formatter)

backend/app/main.py

@@ -6,7 +6,10 @@ import uuid
 from typing import Awaitable, Callable
 
 from fastapi import FastAPI, Request
+from fastapi.exceptions import RequestValidationError
+from fastapi.exception_handlers import request_validation_exception_handler
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
 
 from .config import settings
 from .db import has_admin_user, init_db
@@ -32,6 +35,10 @@ from .routers.insights import router as insights_router
 from .routers.identities import router as identities_router
 from .routers.recaps import router as recaps_router
 from .routers.newsletters import router as newsletters_router
+from .routers.backups import router as backups_router
+from .routers.setup import router as setup_router
+from .services.backups import apply_pending_restore
+from .services.setup import initialize_setup_state, is_setup_required, setup_token_configured
 from .services.jellyfin_sync import run_daily_jellyfin_sync
 from .services.issue_resolution import run_issue_confirmation_loop
 from .services.email_recaps import run_email_recap_loop
@@ -47,14 +54,17 @@ from .logging_config import (
     configure_logging,
     reset_request_id,
     sanitize_headers,
-    sanitize_value,
-    summarize_http_body,
+    sanitize_path,
 )
 from .runtime import get_runtime_settings
 from .metrics import record_api, start_metrics
+from .request_limits import InstallationBodyLimitMiddleware
+from .secret_storage import validate_secret_storage_configuration
+from .services.request_origins import is_allowed_request_origin
 
 logger = logging.getLogger(__name__)
 _background_tasks: list[asyncio.Task[None]] = []
+_background_started = False
 
 app = FastAPI(
     title=settings.app_name,
@@ -70,6 +80,23 @@ app.add_middleware(
     allow_methods=["*"],
     allow_headers=["*"],
 )
+app.add_middleware(InstallationBodyLimitMiddleware)
+
+
+@app.exception_handler(RequestValidationError)
+async def installation_validation_error(request: Request, exc: RequestValidationError):
+    if request.url.path.rstrip("/") == "/setup/bootstrap" or request.url.path.startswith("/admin/backups"):
+        # Pydantic SecretStr masks parsed values, but FastAPI's default 422 body
+        # includes rejected raw input. Never echo tokens/passwords/passphrases.
+        return JSONResponse(
+            status_code=422,
+            content={"detail": [
+                {key: error[key] for key in ("type", "loc", "msg") if key in error}
+                for error in exc.errors()
+            ]},
+            headers={"Cache-Control": "no-store"},
+        )
+    return await request_validation_exception_handler(request, exc)
 
 
 @app.middleware("http")
@@ -82,22 +109,32 @@ async def log_requests_and_add_security_headers(request: Request, call_next):
         operation_token = begin_operation(
             operation_id,
             label=request.headers.get("X-Magent-Operation-Label"),
-            path=request.url.path,
+            path=sanitize_path(request.url.path),
         )
     request.state.request_id = request_id
+    if request.method.upper() not in {"GET", "HEAD", "OPTIONS"}:
+        origin = str(request.headers.get("origin") or "")
+        if origin and not is_allowed_request_origin(origin):
+            record_api(request, 403, 0.0)
+            if operation_id and operation_token is not None:
+                finish_operation(operation_id, success=False, status_code=403)
+                reset_operation(operation_token)
+            reset_request_id(token)
+            return JSONResponse(
+                status_code=403,
+                content={"detail": "Cross-origin state change rejected"},
+                headers={"X-Request-ID": request_id},
+            )
     started_at = time.perf_counter()
-    body = await request.body()
-    body_summary = summarize_http_body(body, request.headers.get("content-type"))
-
-    async def receive() -> dict:
-        return {"type": "http.request", "body": body, "more_body": False}
-
-    request._receive = receive
+    body_summary = {
+        "content_type": (request.headers.get("content-type") or "").split(";", 1)[0],
+        "declared_bytes": request.headers.get("content-length"),
+    }
     logger.info(
-        "request started method=%s path=%s query=%s client=%s headers=%s body=%s",
+        "request started method=%s path=%s query_keys=%s client=%s headers=%s body=%s",
         request.method,
-        request.url.path,
-        sanitize_value(dict(request.query_params)),
+        sanitize_path(request.url.path),
+        sorted(set(request.query_params.keys())),
         request.client.host if request.client else "-",
         sanitize_headers(
             {
@@ -124,7 +161,7 @@ async def log_requests_and_add_security_headers(request: Request, call_next):
         logger.exception(
             "request failed method=%s path=%s duration_ms=%s",
             request.method,
-            request.url.path,
+            sanitize_path(request.url.path),
             duration_ms,
         )
         if operation_id and operation_token is not None:
@@ -140,6 +177,7 @@ async def log_requests_and_add_security_headers(request: Request, call_next):
     response.headers.setdefault("X-Frame-Options", "DENY")
     response.headers.setdefault("Referrer-Policy", "no-referrer")
     response.headers.setdefault("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
+    response.headers.setdefault("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
     # Keep API responses non-executable and non-embeddable by default.
     if request.url.path not in {"/docs", "/redoc"} and not request.url.path.startswith("/openapi"):
         response.headers.setdefault(
@@ -149,7 +187,7 @@ async def log_requests_and_add_security_headers(request: Request, call_next):
     logger.info(
         "request completed method=%s path=%s status=%s duration_ms=%s response_headers=%s",
         request.method,
-        request.url.path,
+        sanitize_path(request.url.path),
         response.status_code,
         duration_ms,
         sanitize_headers(
@@ -203,14 +241,14 @@ def _launch_background_task(name: str, coroutine_factory: Callable[[], Awaitable
 
 def _log_security_configuration_warnings() -> None:
     jwt_secret = str(settings.jwt_secret or "").strip()
-    if not jwt_secret or jwt_secret == "change-me":
+    if len(jwt_secret) < 32 or jwt_secret == "change-me":
         logger.warning(
-            "security configuration warning: JWT_SECRET is unset or still set to the default value"
+            "security configuration warning: JWT_SECRET is missing, short, or still set to the default value"
         )
     admin_password = str(settings.admin_password or "")
-    if not admin_password or admin_password == "adminadmin":
+    if admin_password == "adminadmin":
         logger.warning(
-            "security configuration warning: ADMIN_PASSWORD is unset or still set to the bootstrap default"
+            "security configuration warning: ADMIN_PASSWORD is still set to the bootstrap default"
         )
     if bool(settings.api_docs_enabled):
         logger.warning(
@@ -218,14 +256,24 @@ def _log_security_configuration_warnings() -> None:
         )
 
 
-def _enforce_secure_startup_configuration() -> None:
+def _enforce_secret_configuration() -> None:
     jwt_secret = str(settings.jwt_secret or "").strip()
-    if not jwt_secret or jwt_secret == "change-me":
-        raise RuntimeError("JWT_SECRET must be set to a strong, non-default value before startup.")
+    if len(jwt_secret) < 32 or jwt_secret == "change-me":
+        raise RuntimeError(
+            "JWT_SECRET must be a strong, non-default value of at least 32 characters before startup."
+        )
+    validate_secret_storage_configuration()
+
+
+def _enforce_secure_startup_configuration() -> None:
+    _enforce_secret_configuration()
     admin_password = str(settings.admin_password or "")
     if not has_admin_user() and (not admin_password or admin_password == "adminadmin"):
+        if is_setup_required() and setup_token_configured():
+            return
         raise RuntimeError(
-            "A secure ADMIN_PASSWORD is required on first startup until an admin account exists."
+            "First startup requires a strong SETUP_TOKEN (at least 32 characters) for the setup wizard, "
+            "or a secure ADMIN_PASSWORD, until an admin account exists."
         )
 
 
@@ -239,9 +287,14 @@ async def startup() -> None:
         log_file_backup_count=settings.log_file_backup_count,
         log_http_client_level=settings.log_http_client_level,
         log_background_sync_level=settings.log_background_sync_level,
+        log_format=settings.log_format,
     )
     logger.info("startup begin app=%s build=%s", settings.app_name, settings.site_build_number)
     _log_security_configuration_warnings()
+    _enforce_secret_configuration()
+    # Restore offline, before any schema migration, database reader or worker.
+    apply_pending_restore()
+    initialize_setup_state()
     init_db()
     _enforce_secure_startup_configuration()
     runtime = get_runtime_settings()
@@ -252,6 +305,7 @@ async def startup() -> None:
         log_file_backup_count=runtime.log_file_backup_count,
         log_http_client_level=runtime.log_http_client_level,
         log_background_sync_level=runtime.log_background_sync_level,
+        log_format=runtime.log_format,
     )
     logger.info(
         "runtime settings applied log_level=%s log_file=%s log_file_max_bytes=%s log_file_backup_count=%s log_http_client_level=%s log_background_sync_level=%s request_source=%s",
@@ -263,9 +317,22 @@ async def startup() -> None:
         runtime.log_background_sync_level,
         runtime.requests_data_source,
     )
-    if os.environ.get("BACKGROUND_TASKS_ENABLED", "true").lower() == "false":
-        logger.info("Background imports and automation paused for initial setup")
+    app.state.on_setup_complete = _start_background_tasks
+    await _start_background_tasks()
+    logger.info("startup complete")
+
+
+async def _start_background_tasks() -> None:
+    global _background_started
+    if _background_started:
         return
+    if is_setup_required():
+        logger.info("Background imports and automation paused until setup is complete")
+        return
+    if os.environ.get("BACKGROUND_TASKS_ENABLED", "true").lower() == "false":
+        logger.info("Background imports and automation disabled by configuration")
+        return
+    _background_started = True
     _launch_background_task("jellyfin-sync", run_daily_jellyfin_sync)
     _launch_background_task("requests-warmup", startup_warmup_requests_cache)
     _launch_background_task("request-local-stages", run_local_request_stage_loop)
@@ -275,7 +342,17 @@ async def startup() -> None:
     _launch_background_task("issue-confirmation", run_issue_confirmation_loop)
     _launch_background_task("email-recaps", run_email_recap_loop)
     _launch_background_task("newsletters", run_newsletter_loop)
-    logger.info("startup complete")
+
+
+@app.on_event("shutdown")
+async def shutdown() -> None:
+    global _background_started
+    for task in _background_tasks:
+        task.cancel()
+    if _background_tasks:
+        await asyncio.gather(*_background_tasks, return_exceptions=True)
+    _background_tasks.clear()
+    _background_started = False
 
 
 app.include_router(requests_router)
@@ -294,3 +371,5 @@ app.include_router(insights_router)
 app.include_router(identities_router)
 app.include_router(recaps_router)
 app.include_router(newsletters_router)
+app.include_router(backups_router)
+app.include_router(setup_router)

backend/app/request_limits.py

@@ -0,0 +1,50 @@
+"""Bound security-sensitive request bodies before JSON/multipart parsing."""
+
+from starlette.exceptions import HTTPException
+from starlette.responses import JSONResponse
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+
+# Encrypted backup limit is 32 MiB. Allow a bounded margin for the multipart
+# envelope; count streamed chunks as well as checking the untrusted header.
+RESTORE_BODY_LIMIT = 34 * 1024 * 1024
+BOOTSTRAP_BODY_LIMIT = 16 * 1024
+
+
+class InstallationBodyLimitMiddleware:
+    def __init__(self, app: ASGIApp) -> None:
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http" or scope.get("method") != "POST":
+            await self.app(scope, receive, send)
+            return
+        path = scope.get("path", "").rstrip("/")
+        limit = {
+            "/admin/backups/restore": RESTORE_BODY_LIMIT,
+            "/admin/backups/export": BOOTSTRAP_BODY_LIMIT,
+            "/setup/bootstrap": BOOTSTRAP_BODY_LIMIT,
+        }.get(path)
+        if limit is None:
+            await self.app(scope, receive, send)
+            return
+        headers = dict(scope.get("headers", []))
+        try:
+            length = int(headers.get(b"content-length", b"0"))
+        except ValueError:
+            length = -1
+        if length < 0 or length > limit:
+            await JSONResponse({"detail": "Request body is too large or has an invalid length."}, status_code=413)(scope, receive, send)
+            return
+        received = 0
+
+        async def bounded_receive() -> Message:
+            nonlocal received
+            message = await receive()
+            if message["type"] == "http.request":
+                received += len(message.get("body", b""))
+                if received > limit:
+                    raise HTTPException(status_code=413, detail="Request body is too large.")
+            return message
+
+        await self.app(scope, bounded_receive, send)

backend/app/routers/admin.py

@@ -20,7 +20,8 @@ from ..auth import (
     normalize_user_auth_provider,
     resolve_user_auth_provider,
 )
-from ..config import settings as env_settings
+from ..config import normalize_banner_color, settings as env_settings
+from ..api_models import COMMON_ERROR_RESPONSES
 from ..network_security import validate_notification_target_url
 from ..db import (
     delete_setting,
@@ -35,12 +36,9 @@ from ..db import (
     get_user_by_id,
     get_user_by_username,
     get_user_request_stats,
-    create_user_if_missing,
-    set_user_jellyseerr_id,
     set_setting,
     set_user_blocked,
-    delete_user_by_username,
-    delete_user_activity_by_username,
+    delete_user_data_by_username,
     set_user_auto_search_enabled,
     set_auto_search_enabled_for_non_admin_users,
     set_user_email,
@@ -49,6 +47,7 @@ from ..db import (
     set_user_profile_id,
     set_user_expires_at,
     set_user_password,
+    increment_user_auth_version,
     sync_jellyfin_password_state,
     set_user_role,
     run_integrity_check,
@@ -59,7 +58,6 @@ from ..db import (
     cleanup_history,
     update_request_cache_title,
     repair_request_cache_titles,
-    delete_non_admin_users,
     list_user_profiles,
     get_user_profile,
     create_user_profile,
@@ -69,9 +67,11 @@ from ..db import (
     get_signup_invite_by_id,
     create_signup_invite,
     update_signup_invite,
+    rotate_signup_invite_code,
     delete_signup_invite,
     get_signup_invite_by_code,
     disable_signup_invites_by_creator,
+    delete_non_admin_users,  # noqa: F401 - retained for compatibility with maintenance tooling/tests
 )
 from ..runtime import get_runtime_settings
 from ..clients.sonarr import SonarrClient
@@ -80,12 +80,8 @@ from ..clients.jellyfin import JellyfinClient
 from ..clients.jellyseerr import JellyseerrClient
 from ..services.jellyfin_sync import sync_jellyfin_users
 from ..services.user_cache import (
-    build_jellyseerr_candidate_map,
-    extract_jellyseerr_user_email,
-    find_matching_jellyseerr_user,
     get_cached_jellyfin_users,
     get_cached_jellyseerr_users,
-    match_jellyseerr_user_id,
     save_jellyfin_users_cache,
     save_jellyseerr_users_cache,
     clear_user_import_caches,
@@ -108,7 +104,12 @@ from ..logging_config import configure_logging
 from ..routers import requests as requests_router
 from ..routers.branding import save_branding_image
 
-router = APIRouter(prefix="/admin", tags=["admin"], dependencies=[Depends(require_admin)])
+router = APIRouter(
+    prefix="/admin",
+    tags=["admin"],
+    dependencies=[Depends(require_admin)],
+    responses=COMMON_ERROR_RESPONSES,
+)
 events_router = APIRouter(prefix="/admin/events", tags=["admin"])
 logger = logging.getLogger(__name__)
 SELF_SERVICE_INVITE_MASTER_ID_KEY = "self_service_invite_master_id"
@@ -174,6 +175,11 @@ NOTIFICATION_URL_SETTING_KEYS = {
     "magent_notify_webhook_url",
 }
 
+BANNER_COLOR_SETTING_KEYS = {
+    "site_banner_background_color",
+    "site_banner_border_color",
+}
+
 SETTING_KEYS: List[str] = [
     "jellystat_base_url",
     "jellystat_api_key",
@@ -241,6 +247,7 @@ SETTING_KEYS: List[str] = [
     "qbittorrent_username",
     "qbittorrent_password",
     "log_level",
+    "log_format",
     "log_file",
     "log_file_max_bytes",
     "log_file_backup_count",
@@ -260,6 +267,9 @@ SETTING_KEYS: List[str] = [
     "site_banner_enabled",
     "site_banner_message",
     "site_banner_tone",
+    "site_banner_background_color",
+    "site_banner_border_color",
+    "site_login_message",
     "site_login_show_jellyfin_login",
     "site_login_show_local_login",
     "site_login_show_forgot_password",
@@ -712,6 +722,11 @@ async def update_settings(payload: Dict[str, Any]) -> Dict[str, Any]:
             value_to_store = value_to_store.lower()
             if value_to_store not in {"days", "weeks", "months"}:
                 raise HTTPException(status_code=400, detail="Confirmation interval unit must be days, weeks, or months")
+        if key in BANNER_COLOR_SETTING_KEYS:
+            normalized_color = normalize_banner_color(value_to_store)
+            if not normalized_color:
+                raise HTTPException(status_code=400, detail=f"{key.replace('_', ' ')} must be a six-digit hex colour such as #ffc857")
+            value_to_store = normalized_color
         if key in URL_SETTING_KEYS and value_to_store:
             try:
                 value_to_store = _normalize_service_url(value_to_store)
@@ -727,7 +742,7 @@ async def update_settings(payload: Dict[str, Any]) -> Dict[str, Any]:
         set_setting(key, value_to_store)
         updates += 1
         changed_keys.append(key)
-        if key in {"log_level", "log_file", "log_file_max_bytes", "log_file_backup_count", "log_http_client_level", "log_background_sync_level"}:
+        if key in {"log_level", "log_format", "log_file", "log_file_max_bytes", "log_file_backup_count", "log_http_client_level", "log_background_sync_level"}:
             touched_logging = True
     if touched_logging:
         runtime = get_runtime_settings()
@@ -738,6 +753,7 @@ async def update_settings(payload: Dict[str, Any]) -> Dict[str, Any]:
             log_file_backup_count=runtime.log_file_backup_count,
             log_http_client_level=runtime.log_http_client_level,
             log_background_sync_level=runtime.log_background_sync_level,
+            log_format=runtime.log_format,
         )
     logger.info("Admin updated settings: count=%s keys=%s", updates, changed_keys)
     return {"status": "ok", "updated": updates}
@@ -766,7 +782,7 @@ async def test_email_settings(request: Request) -> Dict[str, Any]:
         result = await send_test_email(recipient_email=recipient_email)
     except RuntimeError as exc:
         raise HTTPException(status_code=502, detail=str(exc)) from exc
-    logger.info("Admin triggered SMTP test: recipient=%s", result.get("recipient_email"))
+    logger.info("Admin triggered SMTP test")
     return {"status": "ok", **result}
 
 
@@ -1294,12 +1310,12 @@ async def user_system_action(username: str, payload: Dict[str, Any]) -> Dict[str
             result["jellyseerr"] = {"status": "error", "detail": _http_error_detail(exc)}
 
     if action == "remove":
-        deleted = delete_user_by_username(username)
-        activity_deleted = delete_user_activity_by_username(username)
+        deletion = delete_user_data_by_username(username)
+        deleted = bool(deletion.get("deleted"))
         result["local"] = {
             "status": "ok" if deleted else "not_found",
             "deleted": bool(deleted),
-            "activity_deleted": activity_deleted,
+            "data_cleanup": deletion,
         }
 
     if any(
@@ -1561,6 +1577,7 @@ async def update_user_password(username: str, payload: Dict[str, Any]) -> Dict[s
         except Exception as exc:
             raise HTTPException(status_code=502, detail=f"Jellyfin password update failed: {exc}") from exc
         sync_jellyfin_password_state(username, new_password_clean)
+        increment_user_auth_version(username)
         return {"status": "ok", "username": username, "provider": "jellyfin"}
     raise HTTPException(
         status_code=400,
@@ -1904,6 +1921,11 @@ async def send_invite_email(payload: Dict[str, Any]) -> Dict[str, Any]:
             role=invite.get('role'), max_uses=1, enabled=bool(invite.get('enabled')),
             expires_at=invite.get('expires_at'), recipient_email=recipient_email,
         )
+        if not invite:
+            raise HTTPException(status_code=404, detail='Invite not found')
+        invite = rotate_signup_invite_code(int(invite['id']), _generate_invite_code())
+        if not invite:
+            raise HTTPException(status_code=409, detail='Invite is unavailable')
 
     try:
         result = await send_templated_email(
@@ -1917,9 +1939,8 @@ async def send_invite_email(payload: Dict[str, Any]) -> Dict[str, Any]:
     except Exception as exc:
         raise HTTPException(status_code=502, detail=str(exc)) from exc
     logger.info(
-        "Admin sent invite email template: template=%s recipient=%s invite_id=%s username=%s",
+        "Admin sent invite email template: template=%s invite_id=%s username=%s",
         template_key,
-        result.get("recipient_email"),
         invite.get("id") if invite else None,
         user.get("username") if user else None,
     )
@@ -1985,15 +2006,14 @@ async def create_invite(payload: Dict[str, Any], current_user: Dict[str, Any] =
         except Exception as exc:
             email_error = str(exc)
     logger.info(
-        "Admin created invite: invite_id=%s code=%s label=%s profile_id=%s role=%s max_uses=%s enabled=%s recipient_email=%s send_email=%s",
+        "Admin created invite: invite_id=%s label=%s profile_id=%s role=%s max_uses=%s enabled=%s has_recipient=%s send_email=%s",
         invite.get("id"),
-        invite.get("code"),
         invite.get("label"),
         invite.get("profile_id"),
         invite.get("role"),
         invite.get("max_uses"),
         invite.get("enabled"),
-        invite.get("recipient_email"),
+        bool(invite.get("recipient_email")),
         send_email,
     )
     return {
@@ -2016,7 +2036,11 @@ async def edit_invite(invite_id: int, payload: Dict[str, Any]) -> Dict[str, Any]
     existing = get_signup_invite_by_id(invite_id)
     if not existing:
         raise HTTPException(status_code=404, detail="Invite not found")
-    code = _normalize_invite_code(_normalize_optional_text(payload.get("code")) or existing["code"])
+    requested_code = _normalize_optional_text(payload.get("code"))
+    if requested_code and not requested_code.startswith("••••") and requested_code != "Protected invite":
+        code = _normalize_invite_code(requested_code)
+    else:
+        code = str(existing.get("code") or "")
     profile_id = _parse_optional_profile_id(payload.get("profile_id"))
     enabled = payload.get("enabled")
     if not isinstance(enabled, bool):
@@ -2050,6 +2074,10 @@ async def edit_invite(invite_id: int, payload: Dict[str, Any]) -> Dict[str, Any]
     email_error = None
     if send_email:
         try:
+            rotated = rotate_signup_invite_code(invite_id, _generate_invite_code())
+            if not rotated:
+                raise ValueError("Invite is unavailable")
+            invite = rotated
             email_result = await send_templated_email(
                 "invited",
                 invite=invite,
@@ -2059,15 +2087,14 @@ async def edit_invite(invite_id: int, payload: Dict[str, Any]) -> Dict[str, Any]
         except Exception as exc:
             email_error = str(exc)
     logger.info(
-        "Admin updated invite: invite_id=%s code=%s label=%s profile_id=%s role=%s max_uses=%s enabled=%s recipient_email=%s send_email=%s",
+        "Admin updated invite: invite_id=%s label=%s profile_id=%s role=%s max_uses=%s enabled=%s has_recipient=%s send_email=%s",
         invite.get("id"),
-        invite.get("code"),
         invite.get("label"),
         invite.get("profile_id"),
         invite.get("role"),
         invite.get("max_uses"),
         invite.get("enabled"),
-        invite.get("recipient_email"),
+        bool(invite.get("recipient_email")),
         send_email,
     )
     return {
@@ -2083,6 +2110,22 @@ async def edit_invite(invite_id: int, payload: Dict[str, Any]) -> Dict[str, Any]
     }
 
 
+@router.post("/invites/{invite_id}/rotate")
+async def rotate_invite(
+    invite_id: int,
+    current_user: Dict[str, Any] = Depends(require_admin),
+) -> Dict[str, Any]:
+    invite = rotate_signup_invite_code(invite_id, _generate_invite_code())
+    if not invite:
+        raise HTTPException(status_code=409, detail="Invite is unavailable")
+    logger.info(
+        "Admin rotated invite: invite_id=%s actor=%s",
+        invite_id,
+        current_user.get("username"),
+    )
+    return {"status": "ok", "invite": invite}
+
+
 @router.delete("/invites/{invite_id}")
 async def remove_invite(invite_id: int) -> Dict[str, Any]:
     deleted = delete_signup_invite(invite_id)

backend/app/routers/auth.py

@@ -1,11 +1,8 @@
 from ..feature_guards import require_invites
 from datetime import datetime, timedelta, timezone
-from collections import defaultdict, deque
 import logging
 import secrets
 import string
-import time
-from threading import Lock
 
 import httpx
 from fastapi import APIRouter, HTTPException, status, Depends, Request, Response
@@ -28,6 +25,7 @@ from ..db import (
     list_signup_invites,
     create_signup_invite,
     update_signup_invite,
+    rotate_signup_invite_code,
     delete_signup_invite,
     reserve_signup_invite_use,
     release_signup_invite_use,
@@ -39,6 +37,10 @@ from ..db import (
     get_global_request_total,
     get_setting,
     sync_jellyfin_password_state,
+    increment_user_auth_version,
+    get_rate_limit_status,
+    record_rate_limit_event,
+    clear_rate_limit_events,
 )
 from ..runtime import get_runtime_settings
 from ..clients.jellyfin import JellyfinClient
@@ -58,6 +60,15 @@ from ..auth import (
     set_auth_cookies,
 )
 from ..config import settings
+from ..api_models import (
+    COMMON_ERROR_RESPONSES,
+    ChangePasswordRequest,
+    ForgotPasswordRequest,
+    PasswordResetRequest,
+    ProfileEmailUpdateRequest,
+    SignupRequest,
+    request_data,
+)
 from ..network_security import request_trusts_forwarded_headers
 from ..services.user_cache import (
     build_jellyseerr_candidate_map,
@@ -79,7 +90,7 @@ from ..services.password_reset import (
     verify_password_reset_token,
 )
 
-router = APIRouter(prefix="/auth", tags=["auth"])
+router = APIRouter(prefix="/auth", tags=["auth"], responses=COMMON_ERROR_RESPONSES)
 logger = logging.getLogger(__name__)
 SELF_SERVICE_INVITE_MASTER_ID_KEY = "self_service_invite_master_id"
 STREAM_TOKEN_TTL_SECONDS = 120
@@ -87,14 +98,6 @@ PASSWORD_RESET_GENERIC_MESSAGE = (
     "If an account exists for that username or email, a password reset link has been sent."
 )
 
-_LOGIN_RATE_LOCK = Lock()
-_LOGIN_ATTEMPTS_BY_IP: dict[str, deque[float]] = defaultdict(deque)
-_LOGIN_ATTEMPTS_BY_USER: dict[str, deque[float]] = defaultdict(deque)
-_RESET_RATE_LOCK = Lock()
-_RESET_ATTEMPTS_BY_IP: dict[str, deque[float]] = defaultdict(deque)
-_RESET_ATTEMPTS_BY_IDENTIFIER: dict[str, deque[float]] = defaultdict(deque)
-
-
 def _require_recipient_email(value: object) -> str:
     normalized = normalize_delivery_email(value)
     if normalized:
@@ -145,12 +148,6 @@ def _password_reset_rate_key_identifier(identifier: str) -> str:
     return (identifier or "").strip().lower()[:256] or "<empty>"
 
 
-def _prune_attempts(bucket: deque[float], now: float, window_seconds: int) -> None:
-    cutoff = now - window_seconds
-    while bucket and bucket[0] < cutoff:
-        bucket.popleft()
-
-
 def _pick_preferred_ci_user_match(users: list[dict], requested_username: str) -> dict | None:
     if not users:
         return None
@@ -172,56 +169,33 @@ def _pick_preferred_ci_user_match(users: list[dict], requested_username: str) ->
 
 
 def _record_login_failure(request: Request, username: str) -> None:
-    now = time.monotonic()
-    window = max(int(settings.auth_rate_limit_window_seconds or 60), 1)
     ip_key = _auth_client_ip(request)
     user_key = _login_rate_key_user(username)
-    with _LOGIN_RATE_LOCK:
-        ip_bucket = _LOGIN_ATTEMPTS_BY_IP[ip_key]
-        user_bucket = _LOGIN_ATTEMPTS_BY_USER[user_key]
-        _prune_attempts(ip_bucket, now, window)
-        _prune_attempts(user_bucket, now, window)
-        ip_bucket.append(now)
-        user_bucket.append(now)
-    logger.warning("login failure recorded username=%s client=%s", user_key, ip_key)
+    record_rate_limit_event("login-ip", ip_key)
+    record_rate_limit_event("login-user", user_key)
+    logger.warning("login failure recorded")
 
 
 def _clear_login_failures(request: Request, username: str) -> None:
     ip_key = _auth_client_ip(request)
     user_key = _login_rate_key_user(username)
-    with _LOGIN_RATE_LOCK:
-        _LOGIN_ATTEMPTS_BY_IP.pop(ip_key, None)
-        _LOGIN_ATTEMPTS_BY_USER.pop(user_key, None)
+    clear_rate_limit_events("login-ip", ip_key)
+    clear_rate_limit_events("login-user", user_key)
 
 
 def _enforce_login_rate_limit(request: Request, username: str) -> None:
-    now = time.monotonic()
     window = max(int(settings.auth_rate_limit_window_seconds or 60), 1)
     max_ip = max(int(settings.auth_rate_limit_max_attempts_ip or 20), 1)
     max_user = max(int(settings.auth_rate_limit_max_attempts_user or 10), 1)
     ip_key = _auth_client_ip(request)
     user_key = _login_rate_key_user(username)
-    with _LOGIN_RATE_LOCK:
-        ip_bucket = _LOGIN_ATTEMPTS_BY_IP[ip_key]
-        user_bucket = _LOGIN_ATTEMPTS_BY_USER[user_key]
-        _prune_attempts(ip_bucket, now, window)
-        _prune_attempts(user_bucket, now, window)
-        exceeded = len(ip_bucket) >= max_ip or len(user_bucket) >= max_user
-        retry_after = 1
-        if exceeded:
-            retry_candidates = []
-            if ip_bucket:
-                retry_candidates.append(max(1, int(window - (now - ip_bucket[0]))))
-            if user_bucket:
-                retry_candidates.append(max(1, int(window - (now - user_bucket[0]))))
-            if retry_candidates:
-                retry_after = max(retry_candidates)
+    ip_exceeded, ip_retry = get_rate_limit_status("login-ip", ip_key, window, max_ip)
+    user_exceeded, user_retry = get_rate_limit_status("login-user", user_key, window, max_user)
+    exceeded = ip_exceeded or user_exceeded
+    retry_after = max(ip_retry if ip_exceeded else 1, user_retry if user_exceeded else 1)
     if exceeded:
         logger.warning(
-            "login rate limit exceeded username=%s client=%s retry_after=%s",
-            user_key,
-            ip_key,
-            retry_after,
+            "login rate limit exceeded retry_after=%s", retry_after,
         )
         raise HTTPException(
             status_code=status.HTTP_429_TOO_MANY_REQUESTS,
@@ -231,48 +205,28 @@ def _enforce_login_rate_limit(request: Request, username: str) -> None:
 
 
 def _record_password_reset_attempt(request: Request, identifier: str) -> None:
-    now = time.monotonic()
-    window = max(int(settings.password_reset_rate_limit_window_seconds or 300), 1)
     ip_key = _auth_client_ip(request)
     identifier_key = _password_reset_rate_key_identifier(identifier)
-    with _RESET_RATE_LOCK:
-        ip_bucket = _RESET_ATTEMPTS_BY_IP[ip_key]
-        identifier_bucket = _RESET_ATTEMPTS_BY_IDENTIFIER[identifier_key]
-        _prune_attempts(ip_bucket, now, window)
-        _prune_attempts(identifier_bucket, now, window)
-        ip_bucket.append(now)
-        identifier_bucket.append(now)
-    logger.info("password reset rate event recorded identifier=%s client=%s", identifier_key, ip_key)
+    record_rate_limit_event("reset-ip", ip_key)
+    record_rate_limit_event("reset-identifier", identifier_key)
+    logger.info("password reset rate event recorded")
 
 
 def _enforce_password_reset_rate_limit(request: Request, identifier: str) -> None:
-    now = time.monotonic()
     window = max(int(settings.password_reset_rate_limit_window_seconds or 300), 1)
     max_ip = max(int(settings.password_reset_rate_limit_max_attempts_ip or 6), 1)
     max_identifier = max(int(settings.password_reset_rate_limit_max_attempts_identifier or 3), 1)
     ip_key = _auth_client_ip(request)
     identifier_key = _password_reset_rate_key_identifier(identifier)
-    with _RESET_RATE_LOCK:
-        ip_bucket = _RESET_ATTEMPTS_BY_IP[ip_key]
-        identifier_bucket = _RESET_ATTEMPTS_BY_IDENTIFIER[identifier_key]
-        _prune_attempts(ip_bucket, now, window)
-        _prune_attempts(identifier_bucket, now, window)
-        exceeded = len(ip_bucket) >= max_ip or len(identifier_bucket) >= max_identifier
-        retry_after = 1
-        if exceeded:
-            retry_candidates = []
-            if ip_bucket:
-                retry_candidates.append(max(1, int(window - (now - ip_bucket[0]))))
-            if identifier_bucket:
-                retry_candidates.append(max(1, int(window - (now - identifier_bucket[0]))))
-            if retry_candidates:
-                retry_after = max(retry_candidates)
+    ip_exceeded, ip_retry = get_rate_limit_status("reset-ip", ip_key, window, max_ip)
+    identifier_exceeded, identifier_retry = get_rate_limit_status(
+        "reset-identifier", identifier_key, window, max_identifier
+    )
+    exceeded = ip_exceeded or identifier_exceeded
+    retry_after = max(ip_retry if ip_exceeded else 1, identifier_retry if identifier_exceeded else 1)
     if exceeded:
         logger.warning(
-            "password reset rate limit exceeded identifier=%s client=%s retry_after=%s",
-            identifier_key,
-            ip_key,
-            retry_after,
+            "password reset rate limit exceeded retry_after=%s", retry_after,
         )
         raise HTTPException(
             status_code=status.HTTP_429_TOO_MANY_REQUESTS,
@@ -400,6 +354,7 @@ def _auth_success_response(response: Response, token: str, user_payload: dict) -
 def _public_invite_payload(invite: dict, profile: dict | None = None) -> dict:
     return {
         "code": invite.get("code"),
+        "code_available": bool(invite.get("code_available")),
         "email_bound": bool(invite.get("recipient_email")),
         "label": invite.get("label"),
         "description": invite.get("description"),
@@ -493,6 +448,7 @@ def _serialize_self_invite(invite: dict) -> dict:
     return {
         "id": invite.get("id"),
         "code": invite.get("code"),
+        "code_available": bool(invite.get("code_available")),
         "label": invite.get("label"),
         "description": invite.get("description"),
         "profile_id": invite.get("profile_id"),
@@ -576,6 +532,7 @@ def _serialize_self_service_master_invite(invite: dict | None) -> dict | None:
     return {
         "id": invite.get("id"),
         "code": invite.get("code"),
+        "code_available": bool(invite.get("code_available")),
         "label": invite.get("label"),
         "description": invite.get("description"),
         "profile_id": invite.get("profile_id"),
@@ -664,7 +621,9 @@ async def login(
             detail="This account uses external sign-in. Use the external sign-in option.",
         )
     _assert_user_can_login(user)
-    token = create_access_token(user["username"], user["role"])
+    token = create_access_token(
+        user["username"], user["role"], auth_version=int(user.get("auth_version") or 1)
+    )
     _clear_login_failures(request, form_data.username)
     set_last_login(user["username"])
     logger.info(
@@ -708,7 +667,9 @@ async def jellyfin_login(
     matched_email = extract_jellyseerr_user_email(matched_seerr_user)
     _assert_user_can_login(user)
     if user and _has_valid_jellyfin_cache(user, password):
-        token = create_access_token(canonical_username, "user")
+        token = create_access_token(
+            canonical_username, "user", auth_version=int(user.get("auth_version") or 1)
+        )
         _clear_login_failures(request, username)
         set_last_login(canonical_username)
         logger.info(
@@ -775,7 +736,10 @@ async def jellyfin_login(
         matched_id = match_jellyseerr_user_id(canonical_username, candidate_map)
         if matched_id is not None:
             set_user_jellyseerr_id(canonical_username, matched_id)
-    token = create_access_token(canonical_username, "user")
+    refreshed_user = get_user_by_username(canonical_username) or user or {}
+    token = create_access_token(
+        canonical_username, "user", auth_version=int(refreshed_user.get("auth_version") or 1)
+    )
     _clear_login_failures(request, username)
     set_last_login(canonical_username)
     logger.info(
@@ -851,7 +815,10 @@ async def jellyseerr_login(
         set_user_jellyseerr_id(canonical_username, jellyseerr_user_id)
     if jellyseerr_email:
         set_user_email(canonical_username, jellyseerr_email)
-    token = create_access_token(canonical_username, "user")
+    refreshed_user = get_user_by_username(canonical_username) or user or {}
+    token = create_access_token(
+        canonical_username, "user", auth_version=int(refreshed_user.get("auth_version") or 1)
+    )
     _clear_login_failures(request, form_data.username)
     set_last_login(canonical_username)
     logger.info(
@@ -873,7 +840,10 @@ async def me(current_user: dict = Depends(get_current_user)) -> dict:
 
 
 @router.post("/logout")
-async def logout(response: Response) -> dict:
+async def logout(
+    response: Response, current_user: dict = Depends(get_current_user)
+) -> dict:
+    increment_user_auth_version(str(current_user.get("username") or ""))
     clear_auth_cookies(response)
     return {"status": "ok"}
 
@@ -884,6 +854,7 @@ async def stream_token(current_user: dict = Depends(get_current_user)) -> dict:
         current_user["username"],
         current_user["role"],
         expires_seconds=STREAM_TOKEN_TTL_SECONDS,
+        auth_version=int(current_user.get("auth_version") or 1),
     )
     return {
         "stream_token": token,
@@ -907,7 +878,8 @@ async def invite_details(code: str) -> dict:
 
 
 @router.post("/signup")
-async def signup(payload: dict, response: Response) -> dict:
+async def signup(payload: SignupRequest, response: Response) -> dict:
+    payload = request_data(payload)
     if not isinstance(payload, dict):
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid payload")
     invite_code = str(payload.get("invite_code") or "").strip()
@@ -923,11 +895,7 @@ async def signup(payload: dict, response: Response) -> dict:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
     if get_user_by_username(username):
         raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="User already exists")
-    logger.info(
-        "signup attempt username=%s invite_code=%s",
-        username,
-        invite_code,
-    )
+    logger.info("signup attempt username=%s", username)
 
     invite = get_signup_invite_by_code(invite_code)
     if not invite:
@@ -1039,7 +1007,7 @@ async def signup(payload: dict, response: Response) -> dict:
                 auto_search_enabled=auto_search_enabled,
                 profile_id=int(profile_id) if profile_id is not None else None,
                 expires_at=expires_at,
-                invited_by_code=invite.get("code"),
+                invited_by_code=f"invite:{invite.get('id')}",
             )
         except Exception as exc:
             raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
@@ -1066,15 +1034,18 @@ async def signup(payload: dict, response: Response) -> dict:
                 # Welcome email delivery is best-effort and must not break signup.
                 logger.warning("Welcome email send skipped for %s: %s", username, exc)
         _assert_user_can_login(created_user)
-        token = create_access_token(username, role)
+        refreshed_user = get_user_by_username(username) or created_user or {}
+        token = create_access_token(
+            username, role, auth_version=int(refreshed_user.get("auth_version") or 1)
+        )
         set_last_login(username)
         logger.info(
-            "signup success username=%s role=%s auth_provider=%s profile_id=%s invite_code=%s",
+            "signup success username=%s role=%s auth_provider=%s profile_id=%s invite_id=%s",
             username,
             role,
             created_user.get("auth_provider") if created_user else auth_provider,
             created_user.get("profile_id") if created_user else None,
-            invite.get("code"),
+            invite.get("id"),
         )
         return _auth_success_response(
             response,
@@ -1093,7 +1064,8 @@ async def signup(payload: dict, response: Response) -> dict:
 
 
 @router.post("/password/forgot")
-async def forgot_password(payload: dict, request: Request) -> dict:
+async def forgot_password(payload: ForgotPasswordRequest, request: Request) -> dict:
+    payload = request_data(payload)
     if not isinstance(payload, dict):
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid payload")
     identifier = payload.get("identifier") or payload.get("username") or payload.get("email")
@@ -1110,8 +1082,7 @@ async def forgot_password(payload: dict, request: Request) -> dict:
         )
 
     client_ip = _auth_client_ip(request)
-    safe_identifier = identifier.strip().lower()[:256]
-    logger.info("password reset requested identifier=%s client=%s", safe_identifier, client_ip)
+    logger.info("password reset requested")
     try:
         reset_result = await request_password_reset(
             identifier,
@@ -1120,24 +1091,17 @@ async def forgot_password(payload: dict, request: Request) -> dict:
         )
         if reset_result.get("issued"):
             logger.info(
-                "password reset issued username=%s provider=%s recipient=%s client=%s",
+                "password reset issued username=%s provider=%s",
                 reset_result.get("username"),
                 reset_result.get("auth_provider"),
-                reset_result.get("recipient_email"),
-                client_ip,
             )
         else:
             logger.info(
-                "password reset request completed with no eligible account identifier=%s client=%s",
-                safe_identifier,
-                client_ip,
+                "password reset request completed with no eligible account",
             )
     except Exception as exc:
         logger.warning(
-            "password reset email dispatch failed identifier=%s client=%s detail=%s",
-            safe_identifier,
-            client_ip,
-            str(exc),
+            "password reset email dispatch failed detail=%s", type(exc).__name__,
         )
     return {"status": "ok", "message": PASSWORD_RESET_GENERIC_MESSAGE}
 
@@ -1153,7 +1117,8 @@ async def password_reset_verify(token: str) -> dict:
 
 
 @router.post("/password/reset")
-async def password_reset(payload: dict) -> dict:
+async def password_reset(payload: PasswordResetRequest) -> dict:
+    payload = request_data(payload)
     if not isinstance(payload, dict):
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid payload")
     token = payload.get("token")
@@ -1216,7 +1181,10 @@ async def profile(current_user: dict = Depends(get_current_user)) -> dict:
 
 
 @router.put("/profile/email")
-async def update_profile_email(payload: dict, current_user: dict = Depends(get_current_user)) -> dict:
+async def update_profile_email(
+    payload: ProfileEmailUpdateRequest, current_user: dict = Depends(get_current_user)
+) -> dict:
+    payload = request_data(payload)
     if not isinstance(payload, dict):
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid payload")
     username = str(current_user.get("username") or "").strip()
@@ -1371,8 +1339,13 @@ async def update_profile_invite(
     _require_self_service_invite_access(current_user)
     existing = _get_owned_invite(invite_id, current_user)
 
-    requested_code = payload.get("code", existing.get("code"))
-    if isinstance(requested_code, str) and requested_code.strip():
+    requested_code = payload.get("code")
+    if (
+        isinstance(requested_code, str)
+        and requested_code.strip()
+        and not requested_code.strip().startswith("••••")
+        and requested_code.strip() != "Protected invite"
+    ):
         code = _normalize_invite_code(requested_code)
     else:
         code = str(existing.get("code") or "").strip()
@@ -1427,6 +1400,10 @@ async def update_profile_invite(
     email_error = None
     if send_email:
         try:
+            rotated = rotate_signup_invite_code(invite_id, _generate_invite_code())
+            if not rotated:
+                raise ValueError("Invite is unavailable")
+            invite = rotated
             email_result = await send_templated_email(
                 "invited",
                 invite=invite,
@@ -1450,6 +1427,18 @@ async def update_profile_invite(
     }
 
 
+@router.post("/profile/invites/{invite_id}/rotate")
+async def rotate_profile_invite(
+    invite_id: int, current_user: dict = Depends(get_current_user)
+) -> dict:
+    _require_self_service_invite_access(current_user)
+    _get_owned_invite(invite_id, current_user)
+    invite = rotate_signup_invite_code(invite_id, _generate_invite_code())
+    if not invite:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Invite is unavailable")
+    return {"status": "ok", "invite": _serialize_self_invite(invite)}
+
+
 @router.delete("/profile/invites/{invite_id}")
 async def delete_profile_invite(invite_id: int, current_user: dict = Depends(get_current_user)) -> dict:
     _require_self_service_invite_access(current_user)
@@ -1461,7 +1450,10 @@ async def delete_profile_invite(invite_id: int, current_user: dict = Depends(get
 
 
 @router.post("/password")
-async def change_password(payload: dict, current_user: dict = Depends(get_current_user)) -> dict:
+async def change_password(
+    payload: ChangePasswordRequest, current_user: dict = Depends(get_current_user)
+) -> dict:
+    payload = request_data(payload)
     current_password = payload.get("current_password") if isinstance(payload, dict) else None
     new_password = payload.get("new_password") if isinstance(payload, dict) else None
     if not isinstance(current_password, str) or not isinstance(new_password, str):
@@ -1531,6 +1523,7 @@ async def change_password(payload: dict, current_user: dict = Depends(get_curren
 
         # Keep Magent's password hash and Jellyfin auth cache aligned with Jellyfin.
         sync_jellyfin_password_state(username, new_password_clean)
+        increment_user_auth_version(username)
         logger.info("password change completed username=%s provider=jellyfin", username)
         return {"status": "ok", "provider": "jellyfin"}
 

backend/app/routers/backups.py

@@ -0,0 +1,85 @@
+"""Administrator-only encrypted backup downloads and staged restores."""
+
+from typing import Literal
+
+from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile
+from fastapi.responses import Response
+from pydantic import BaseModel, ConfigDict, Field, SecretStr
+from starlette.concurrency import run_in_threadpool
+
+from ..auth import require_admin
+from ..db import get_rate_limit_status, record_rate_limit_event
+from ..services import backups
+
+def _no_store(response: Response) -> None:
+    response.headers["Cache-Control"] = "no-store"
+    response.headers["Pragma"] = "no-cache"
+
+
+router = APIRouter(
+    prefix="/admin/backups", tags=["backups"],
+    dependencies=[Depends(require_admin), Depends(_no_store)],
+)
+
+
+class ExportRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    passphrase: SecretStr = Field(min_length=12, max_length=1024)
+    include_cache: bool = False
+
+
+def _rate_limit(user: dict) -> None:
+    key = str(user["username"])
+    exceeded, retry = get_rate_limit_status("backups", key, 300, 3)
+    if exceeded:
+        raise HTTPException(429, "Too many backup operations; try again shortly", headers={"Retry-After": str(retry)})
+    record_rate_limit_event("backups", key)
+
+
+@router.get("")
+def status() -> dict:
+    return backups.backup_status()
+
+
+@router.post("/export")
+def export(payload: ExportRequest, user: dict = Depends(require_admin)) -> Response:
+    _rate_limit(user)
+    try:
+        content, filename = backups.create_backup(payload.passphrase.get_secret_value(), payload.include_cache)
+    except backups.BackupError as exc:
+        raise HTTPException(400, str(exc)) from exc
+    return Response(content, media_type="application/octet-stream", headers={
+        "Content-Disposition": f'attachment; filename="{filename}"',
+        "Cache-Control": "no-store", "Pragma": "no-cache",
+    })
+
+
+@router.post("/restore", status_code=202)
+async def restore(
+    file: UploadFile = File(...),
+    passphrase: str = Form(..., min_length=12, max_length=1024),
+    confirmation: Literal["RESTORE"] = Form(...),
+    user: dict = Depends(require_admin),
+) -> dict:
+    _rate_limit(user)
+    try:
+        if file.size is not None and file.size > backups.MAX_UPLOAD_BYTES:
+            raise HTTPException(413, "Backup exceeds the 32 MiB upload limit")
+        metadata = await run_in_threadpool(backups.stage_restore, file.file, passphrase)
+    except backups.BackupError as exc:
+        raise HTTPException(400, str(exc)) from exc
+    finally:
+        await file.close()
+    return {
+        "status": "staged", "restart_required": True, "backup": metadata,
+        "message": "Backup validated. Restart Magent to apply it. Current data remains active until restart.",
+    }
+
+
+@router.delete("/restore")
+def cancel() -> dict:
+    try:
+        backups.cancel_restore()
+    except backups.BackupError as exc:
+        raise HTTPException(409, str(exc)) from exc
+    return {"status": "cancelled"}

backend/app/routers/branding.py

@@ -1,8 +1,9 @@
 import os
+import warnings
 from io import BytesIO
 from typing import Any, Dict
 
-from fastapi import APIRouter, HTTPException, UploadFile, File
+from fastapi import APIRouter, HTTPException, UploadFile
 from fastapi.responses import FileResponse
 from PIL import Image, ImageDraw, ImageFont
 
@@ -15,6 +16,10 @@ _BUNDLED_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "as
 _BUNDLED_LOGO_PATH = os.path.join(_BUNDLED_DIR, "logo.png")
 _BUNDLED_FAVICON_PATH = os.path.join(_BUNDLED_DIR, "favicon.ico")
 _BRANDING_SOURCE = os.getenv("BRANDING_SOURCE", "bundled").lower()
+_MAX_UPLOAD_BYTES = 5 * 1024 * 1024
+_MAX_IMAGE_PIXELS = 25_000_000
+_ALLOWED_IMAGE_TYPES = {"image/png", "image/jpeg", "image/webp"}
+_ALLOWED_IMAGE_EXTENSIONS = {".png", ".jpg", ".jpeg", ".webp"}
 
 
 def _ensure_branding_dir() -> None:
@@ -110,14 +115,27 @@ async def branding_favicon() -> FileResponse:
 
 
 async def save_branding_image(file: UploadFile) -> Dict[str, Any]:
-    if not file.content_type or not file.content_type.startswith("image/"):
-        raise HTTPException(status_code=400, detail="Please upload an image file.")
-    content = await file.read()
+    content_type = str(file.content_type or "").lower()
+    extension = os.path.splitext(str(file.filename or ""))[1].lower()
+    if content_type not in _ALLOWED_IMAGE_TYPES or extension not in _ALLOWED_IMAGE_EXTENSIONS:
+        raise HTTPException(status_code=400, detail="Upload a PNG, JPEG, or WebP image.")
+    content = await file.read(_MAX_UPLOAD_BYTES + 1)
     if not content:
         raise HTTPException(status_code=400, detail="Uploaded file is empty.")
+    if len(content) > _MAX_UPLOAD_BYTES:
+        raise HTTPException(status_code=413, detail="Image is too large (maximum 5 MB).")
     try:
-        image = Image.open(BytesIO(content))
-    except OSError as exc:
+        with warnings.catch_warnings():
+            warnings.simplefilter("error", Image.DecompressionBombWarning)
+            candidate = Image.open(BytesIO(content))
+            if candidate.format not in {"PNG", "JPEG", "WEBP"}:
+                raise ValueError("Unsupported image format")
+            if candidate.width * candidate.height > _MAX_IMAGE_PIXELS:
+                raise Image.DecompressionBombError("Image pixel limit exceeded")
+            candidate.verify()
+            image = Image.open(BytesIO(content))
+            image.load()
+    except (OSError, ValueError, Image.DecompressionBombError, Image.DecompressionBombWarning) as exc:
         raise HTTPException(status_code=400, detail="Image file could not be read.") from exc
 
     _ensure_branding_dir()

backend/app/routers/images.py

@@ -3,7 +3,7 @@ import re
 import mimetypes
 import logging
 from typing import Optional
-from fastapi import APIRouter, HTTPException, Response
+from fastapi import APIRouter, HTTPException
 from fastapi.responses import FileResponse, RedirectResponse
 import httpx
 

backend/app/routers/portal.py

@@ -11,6 +11,7 @@ import httpx
 from fastapi import APIRouter, Depends, HTTPException, Query
 
 from ..auth import get_current_user
+from ..api_models import COMMON_ERROR_RESPONSES
 from ..clients.jellyfin import JellyfinClient
 from ..db import (
     add_portal_item_activity,
@@ -34,7 +35,12 @@ from ..services.issue_resolution import (
 from ..services.notifications import send_portal_notification
 from ..runtime import get_runtime_settings
 
-router = APIRouter(prefix="/portal", tags=["portal"], dependencies=[Depends(get_current_user), Depends(require_portal_access)])
+router = APIRouter(
+    prefix="/portal",
+    tags=["portal"],
+    dependencies=[Depends(get_current_user), Depends(require_portal_access)],
+    responses=COMMON_ERROR_RESPONSES,
+)
 logger = logging.getLogger(__name__)
 
 PORTAL_KINDS = {"request", "issue", "feature"}

backend/app/routers/recaps.py

@@ -7,7 +7,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, Response
 from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 from ..services.public_urls import magent_public_url
-from ..auth import get_current_user, require_admin
+from ..auth import require_admin
 from ..feature_guards import require_stats
 from ..services import email_recaps as recaps, recap_store as store
 

backend/app/routers/requests.py

@@ -20,6 +20,7 @@ from ..clients.sonarr import SonarrClient
 from ..clients.bazarr import BazarrClient
 from ..ai.triage import triage_snapshot
 from ..auth import get_current_user
+from ..api_models import COMMON_ERROR_RESPONSES
 from ..runtime import get_runtime_settings
 from .images import cache_tmdb_image, is_tmdb_cached
 from ..db import (
@@ -30,7 +31,6 @@ from ..db import (
     save_action,
     get_recent_actions,
     get_recent_snapshots,
-    get_cached_requests,
     get_cached_requests_since,
     get_cached_request_by_media_id,
     get_request_cache_lookup,
@@ -62,6 +62,7 @@ from ..db import (
 )
 from ..services.media_repair import current_cycle_torrents
 from ..services.download_labels import label_episode_downloads
+from ..services.arr import RootFolderNotFoundError, resolve_root_folder_path
 from ..models import Snapshot, TriageResult, RequestType
 from ..services.snapshot import (
     _summarize_qbit,
@@ -70,7 +71,12 @@ from ..services.snapshot import (
     jellyfin_item_matches_request,
 )
 
-router = APIRouter(prefix="/requests", tags=["requests"], dependencies=[Depends(get_current_user), Depends(require_request_access)])
+router = APIRouter(
+    prefix="/requests",
+    tags=["requests"],
+    dependencies=[Depends(get_current_user), Depends(require_request_access)],
+    responses=COMMON_ERROR_RESPONSES,
+)
 
 CACHE_TTL_SECONDS = 600
 _detail_cache: Dict[str, Tuple[float, Dict[str, Any]]] = {}
@@ -273,8 +279,14 @@ def _user_can_use_search_auto(user: Dict[str, Any]) -> bool:
 
 
 def _filter_snapshot_for_user(snapshot: Snapshot, user: Dict[str, Any]) -> Snapshot:
-    if not _user_can_use_search_auto(user):
+    can_add_seasons = _user_can_use_search_auto(user)
+    if not can_add_seasons:
         snapshot.actions = [action for action in snapshot.actions if action.id != "search_auto"]
+    pipeline = snapshot.presentation.get("pipeline")
+    if isinstance(pipeline, list):
+        for stage in pipeline:
+            if isinstance(stage, dict) and stage.get("id") == "library":
+                stage["canAddSeasons"] = can_add_seasons
     if user.get("role") != "admin":
         # The standard request view is intentionally collaborative, but service payloads can
         # contain requester identities, internal URLs, download hashes and diagnostic errors.
@@ -1587,11 +1599,54 @@ def get_requests_sync_state() -> Dict[str, Any]:
 
 
 async def _ensure_request_access(
-    client: JellyseerrClient, request_id: int, user: Dict[str, str]
-) -> None:
-    if user.get("role") == "admin" or user.get("username"):
-        return
-    raise HTTPException(status_code=403, detail="Request not accessible for this user")
+    client: JellyseerrClient,
+    request_id: int,
+    user: Dict[str, Any],
+    *,
+    require_owner: bool = False,
+) -> Optional[Dict[str, Any]]:
+    if user.get("role") == "admin":
+        return None
+    if not user.get("username"):
+        raise HTTPException(status_code=403, detail="Request not accessible for this user")
+    if not require_owner:
+        return None
+    request_data = await client.get_request(str(request_id))
+    if not isinstance(request_data, dict):
+        raise HTTPException(status_code=404, detail="Request not found")
+    requester_id = _extract_requested_by_id(request_data)
+    current_seerr_id = user.get("jellyseerr_user_id")
+    if isinstance(current_seerr_id, int) and requester_id == current_seerr_id:
+        return request_data
+    if _request_matches_user(request_data, str(user.get("username") or "")):
+        return request_data
+    email = str(user.get("email") or "").strip()
+    if email and _request_matches_user(request_data, email):
+        return request_data
+    raise HTTPException(
+        status_code=403,
+        detail="Only the original requester or an administrator can change this request",
+    )
+
+
+async def _ensure_request_mutation_access(
+    runtime: Any, request_id: int, user: Dict[str, Any]
+) -> Optional[Dict[str, Any]]:
+    """Fail closed when a non-admin request owner cannot be verified."""
+    if user.get("role") == "admin":
+        return None
+    client = JellyseerrClient(
+        getattr(runtime, "jellyseerr_base_url", None),
+        getattr(runtime, "jellyseerr_api_key", None),
+    )
+    if not client.configured():
+        raise HTTPException(
+            status_code=403,
+            detail="Request ownership cannot be verified while Seerr is unavailable",
+        )
+    return await _ensure_request_access(
+        client, request_id, user, require_owner=True
+    )
 
 
 def _build_recent_map(response: Dict[str, Any]) -> Dict[int, Dict[str, Any]]:
@@ -1704,7 +1759,6 @@ def _filter_arr_release_results(results: Any, include_rejected: bool = False) ->
                 "approved": accepted,
                 "rejected": item.get("rejected"),
                 "temporarilyRejected": item.get("temporarilyRejected"),
-                "rejections": item.get("rejections"),
                 "downloadAllowed": item.get("downloadAllowed"),
                 "fullSeason": item.get("fullSeason"),
                 "seasonNumber": item.get("seasonNumber"),
@@ -1922,16 +1976,10 @@ def _issue_season_payloads(episodes: List[Dict[str, Any]]) -> List[Dict[str, Any
 
 
 async def _resolve_root_folder_path(client: Any, root_folder: str, service_name: str) -> str:
-    if root_folder.isdigit():
-        folders = await client.get_root_folders()
-        if isinstance(folders, list):
-            for folder in folders:
-                if folder.get("id") == int(root_folder):
-                    path = folder.get("path")
-                    if isinstance(path, str) and path:
-                        return path
-        raise HTTPException(status_code=400, detail=f"{service_name} root folder id {root_folder} not found")
-    return root_folder
+    try:
+        return await resolve_root_folder_path(client, root_folder, service_name)
+    except RootFolderNotFoundError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
 
 
 @router.get("/{request_id}/issue-options")
@@ -1942,9 +1990,6 @@ async def issue_target_options(
     if not request_id.isdigit():
         raise HTTPException(status_code=400, detail="Invalid request id")
     runtime = get_runtime_settings()
-    seerr = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
-    if seerr.configured():
-        await _ensure_request_access(seerr, int(request_id), user)
     snapshot = await build_snapshot(request_id)
     arr_item = snapshot.raw.get("arr", {}).get("item")
     if not isinstance(arr_item, dict):
@@ -2130,9 +2175,7 @@ async def action_replace_media(
     )
 
     runtime = get_runtime_settings()
-    seerr = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
-    if seerr.configured():
-        await _ensure_request_access(seerr, int(request_id), user)
+    await _ensure_request_mutation_access(runtime, int(request_id), user)
     snapshot = await build_snapshot(request_id)
     arr_item = snapshot.raw.get("arr", {}).get("item")
     if not isinstance(arr_item, dict):
@@ -2354,6 +2397,7 @@ async def action_search_missing_media(
         payload.get("season_numbers"), field="season_numbers", maximum=100, minimum=0
     )
     runtime = get_runtime_settings()
+    await _ensure_request_mutation_access(runtime, int(request_id), user)
     snapshot = await build_snapshot(request_id)
     arr_item = snapshot.raw.get("arr", {}).get("item")
     if not isinstance(arr_item, dict) or not isinstance(arr_item.get("id"), int):
@@ -2474,6 +2518,135 @@ async def action_search_missing_media(
     return {"status": "ok", "message": message, "episode_ids": searched_ids}
 
 
+@router.post("/{request_id}/actions/add-seasons")
+async def action_add_seasons(
+    request_id: str,
+    payload: Dict[str, Any],
+    user: Dict[str, str] = Depends(get_current_user),
+) -> Dict[str, Any]:
+    if not request_id.isdigit():
+        raise HTTPException(status_code=400, detail="Invalid request id")
+    if not _user_can_use_search_auto(user):
+        raise HTTPException(status_code=403, detail="Adding seasons is disabled for this user")
+    season_numbers = _positive_id_list(
+        payload.get("season_numbers"), field="season_numbers", maximum=100
+    )
+    if not season_numbers:
+        raise HTTPException(status_code=400, detail="Choose at least one season")
+
+    runtime = get_runtime_settings()
+    await _ensure_request_mutation_access(runtime, int(request_id), user)
+    snapshot = await build_snapshot(request_id)
+    if snapshot.request_type != RequestType.tv:
+        raise HTTPException(status_code=400, detail="Additional seasons are only available for TV requests")
+    arr_item = snapshot.raw.get("arr", {}).get("item")
+    if not isinstance(arr_item, dict) or not isinstance(arr_item.get("id"), int):
+        raise HTTPException(status_code=404, detail="Series not found in Sonarr")
+
+    sonarr = SonarrClient(runtime.sonarr_base_url, runtime.sonarr_api_key)
+    if not sonarr.configured():
+        raise HTTPException(status_code=400, detail="Sonarr is not configured")
+    series_id = int(arr_item["id"])
+    label = "Add seasons"
+    try:
+        series = await sonarr.get_series(series_id)
+        if not isinstance(series, dict) or not isinstance(series.get("seasons"), list):
+            raise HTTPException(status_code=502, detail="Sonarr did not return the series seasons")
+        known_seasons = {
+            season.get("seasonNumber")
+            for season in series["seasons"]
+            if isinstance(season, dict)
+            and isinstance(season.get("seasonNumber"), int)
+            and season.get("seasonNumber") > 0
+        }
+        if any(season_number not in known_seasons for season_number in season_numbers):
+            raise HTTPException(status_code=409, detail="One or more selected seasons are no longer available in Sonarr")
+
+        updated_seasons = [
+            {**season, "monitored": True}
+            if isinstance(season, dict) and season.get("seasonNumber") in season_numbers
+            else season
+            for season in series["seasons"]
+        ]
+        if series.get("monitored") is not True or updated_seasons != series["seasons"]:
+            await sonarr.update_series({**series, "monitored": True, "seasons": updated_seasons})
+
+        episodes = await sonarr.get_episodes(series_id)
+        if not isinstance(episodes, list):
+            raise HTTPException(status_code=502, detail="Sonarr did not return an episode list")
+        selected_episodes = [
+            episode for episode in episodes
+            if isinstance(episode, dict)
+            and episode.get("seasonNumber") in season_numbers
+            and isinstance(episode.get("id"), int)
+        ]
+        episode_ids = [int(episode["id"]) for episode in selected_episodes]
+        if episode_ids:
+            await sonarr.monitor_episodes(episode_ids, True)
+        search_ids = [
+            int(episode["id"])
+            for episode in selected_episodes
+            if _released_episode(episode)
+            and episode.get("hasFile") is not True
+            and not (
+                isinstance(episode.get("episodeFileId"), int)
+                and episode.get("episodeFileId") > 0
+            )
+        ]
+        if search_ids:
+            await sonarr.search_episodes(search_ids)
+
+        verified_series = await sonarr.get_series(series_id)
+        verified_seasons = verified_series.get("seasons") if isinstance(verified_series, dict) else []
+        verified_season_map = {
+            season.get("seasonNumber"): season.get("monitored")
+            for season in verified_seasons
+            if isinstance(season, dict) and isinstance(season.get("seasonNumber"), int)
+        }
+        if (
+            not isinstance(verified_series, dict)
+            or verified_series.get("monitored") is not True
+            or any(verified_season_map.get(number) is not True for number in season_numbers)
+        ):
+            raise HTTPException(status_code=502, detail="Sonarr did not enable monitoring for every selected season")
+        if episode_ids:
+            verified_episodes = await sonarr.get_episodes(series_id)
+            if not isinstance(verified_episodes, list) or any(
+                isinstance(episode, dict)
+                and episode.get("id") in episode_ids
+                and episode.get("monitored") is not True
+                for episode in verified_episodes
+            ):
+                raise HTTPException(status_code=502, detail="Sonarr did not enable monitoring for every selected episode")
+    except HTTPException as exc:
+        detail = f"The seasons could not be added: {exc.detail}"
+        await asyncio.to_thread(save_action, request_id, "add_seasons", label, "failed", detail)
+        raise
+    except Exception as exc:
+        logger.exception("add seasons failed request_id=%s", request_id)
+        detail = "Sonarr could not add the selected seasons."
+        await asyncio.to_thread(save_action, request_id, "add_seasons", label, "failed", detail)
+        raise HTTPException(status_code=502, detail=detail) from exc
+
+    season_label = ", ".join(str(number) for number in season_numbers)
+    message = f"Season{'s' if len(season_numbers) != 1 else ''} {season_label} added to Sonarr."
+    if search_ids:
+        message += f" Searching for {len(search_ids)} released missing episode{'s' if len(search_ids) != 1 else ''}."
+    elif episode_ids:
+        message += " All known episodes are already collected or have not aired yet."
+    else:
+        message += " New episodes will be monitored when Sonarr discovers them."
+    await asyncio.to_thread(save_action, request_id, "add_seasons", label, "ok", message)
+    fresh_snapshot = _filter_snapshot_for_user(await build_snapshot(request_id), user)
+    return {
+        "status": "ok",
+        "message": message,
+        "season_numbers": season_numbers,
+        "searched_episode_count": len(search_ids),
+        "snapshot": fresh_snapshot,
+    }
+
+
 @router.post("/{request_id}/actions/repair-subtitles")
 async def action_repair_subtitles(
     request_id: str,
@@ -2490,6 +2663,7 @@ async def action_repair_subtitles(
     episode_ids = _positive_id_list(payload.get("episode_ids"), field="episode_ids", maximum=100)
     forced = payload.get("forced") is True
     runtime = get_runtime_settings()
+    await _ensure_request_mutation_access(runtime, int(request_id), user)
     bazarr = BazarrClient(runtime.bazarr_base_url, runtime.bazarr_api_key)
     if not bazarr.configured() or not runtime.bazarr_api_key:
         raise HTTPException(status_code=400, detail="Bazarr is not configured")
@@ -2578,6 +2752,54 @@ async def get_snapshot(request_id: str, user: Dict[str, str] = Depends(get_curre
     return _filter_snapshot_for_user(snapshot, user)
 
 
+async def _restore_request_monitoring(snapshot: Snapshot, request: dict) -> bool:
+    # Pending or declined requests must not gain collection access via Recheck.
+    if request.get('status') != 2:
+        return False
+    item = (snapshot.raw.get('arr') or {}).get('item')
+    if not isinstance(item, dict) or not isinstance(item.get('id'), int):
+        return False
+    runtime = get_runtime_settings()
+    if snapshot.request_type == RequestType.movie:
+        client = RadarrClient(runtime.radarr_base_url, runtime.radarr_api_key)
+        fresh = await client.get_movie(item['id'])
+        if not isinstance(fresh, dict):
+            raise ValueError('Radarr did not return the requested movie')
+        if fresh.get('monitored') is True:
+            return False
+        await client.update_movie({**fresh, 'monitored': True})
+        verified = await client.get_movie(item['id'])
+        if not isinstance(verified, dict) or verified.get('monitored') is not True:
+            raise ValueError('Radarr did not enable monitoring')
+        return True
+    client = SonarrClient(runtime.sonarr_base_url, runtime.sonarr_api_key)
+    fresh = await client.get_series(item['id'])
+    if not isinstance(fresh, dict):
+        raise ValueError('Sonarr did not return the requested series')
+    requested = {season['seasonNumber'] for season in (request.get('seasons') or [])
+                 if isinstance(season, dict) and isinstance(season.get('seasonNumber'), int)}
+    seasons = [{**season, 'monitored': True} if season.get('seasonNumber') in requested else season
+               for season in (fresh.get('seasons') or [])]
+    changed = fresh.get('monitored') is not True or seasons != fresh.get('seasons', [])
+    if changed:
+        await client.update_series({**fresh, 'monitored': True, 'seasons': seasons})
+    episodes = await client.get_episodes(item['id']) if requested else []
+    ids = [episode['id'] for episode in episodes if episode.get('seasonNumber') in requested
+           and episode.get('monitored') is not True and isinstance(episode.get('id'), int)]
+    if ids:
+        await client.monitor_episodes(ids, True)
+        verified_episodes = await client.get_episodes(item['id'])
+        if any(e.get('id') in ids and e.get('monitored') is not True for e in verified_episodes):
+            raise ValueError('Sonarr did not enable episode monitoring')
+    if changed:
+        verified = await client.get_series(item['id'])
+        if not isinstance(verified, dict) or verified.get('monitored') is not True or any(
+            season.get('seasonNumber') in requested and season.get('monitored') is not True
+            for season in verified.get('seasons', [])):
+            raise ValueError('Sonarr did not enable monitoring')
+    return changed or bool(ids)
+
+
 @router.post("/{request_id}/actions/recheck")
 async def action_recheck(request_id: str, user: Dict[str, str] = Depends(get_current_user)) -> dict:
     if not request_id.isdigit():
@@ -2587,33 +2809,36 @@ async def action_recheck(request_id: str, user: Dict[str, str] = Depends(get_cur
     seerr = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
     if not seerr.configured():
         raise HTTPException(status_code=400, detail="Seerr is not configured")
-    await _ensure_request_access(seerr, int(request_id), user)
+    fresh_request = await _ensure_request_access(
+        seerr, int(request_id), user, require_owner=True
+    )
 
-    try:
-        fresh_request = await seerr.get_request(request_id)
-    except httpx.HTTPStatusError as exc:
-        detail = _format_upstream_error("Seerr", exc)
-        await asyncio.to_thread(
-            save_action,
-            request_id,
-            "recheck_pipeline",
-            "Recheck request status",
-            "failed",
-            detail,
-        )
-        raise HTTPException(status_code=502, detail=detail) from exc
-    except Exception as exc:
-        logger.warning("Request recheck failed while reading Seerr: request_id=%s error=%s", request_id, exc)
-        detail = "Magent could not reach Seerr to recheck this request."
-        await asyncio.to_thread(
-            save_action,
-            request_id,
-            "recheck_pipeline",
-            "Recheck request status",
-            "failed",
-            detail,
-        )
-        raise HTTPException(status_code=502, detail=detail) from exc
+    if fresh_request is None:
+        try:
+            fresh_request = await seerr.get_request(request_id)
+        except httpx.HTTPStatusError as exc:
+            detail = _format_upstream_error("Seerr", exc)
+            await asyncio.to_thread(
+                save_action,
+                request_id,
+                "recheck_pipeline",
+                "Recheck request status",
+                "failed",
+                detail,
+            )
+            raise HTTPException(status_code=502, detail=detail) from exc
+        except Exception as exc:
+            logger.warning("Request recheck failed while reading Seerr: request_id=%s error=%s", request_id, exc)
+            detail = "Magent could not reach Seerr to recheck this request."
+            await asyncio.to_thread(
+                save_action,
+                request_id,
+                "recheck_pipeline",
+                "Recheck request status",
+                "failed",
+                detail,
+            )
+            raise HTTPException(status_code=502, detail=detail) from exc
 
     if not isinstance(fresh_request, dict):
         raise HTTPException(status_code=404, detail="Request not found in Seerr")
@@ -2634,9 +2859,17 @@ async def action_recheck(request_id: str, user: Dict[str, str] = Depends(get_cur
     _cache_set(f"request:{request_id}", fresh_request)
     _refresh_recent_cache_from_db()
 
-    snapshot = _filter_snapshot_for_user(await build_snapshot(request_id), user)
+    snapshot = await build_snapshot(request_id)
+    try:
+        restored = await _restore_request_monitoring(snapshot, fresh_request)
+    except Exception as exc:
+        logger.warning('Recheck monitoring failed request_id=%s: %s', request_id, exc)
+        raise HTTPException(502, 'Could not restore monitoring in Sonarr/Radarr. Please try Recheck again.') from exc
+    if restored:
+        snapshot = await build_snapshot(request_id)
+    snapshot = _filter_snapshot_for_user(snapshot, user)
     status_label = str((snapshot.presentation.get("status") or {}).get("label") or "Status updated")
-    message = f"Recheck complete. {status_label}."
+    message = ("Monitoring restored. " if restored else "") + f"Recheck complete. {status_label}."
     await asyncio.to_thread(
         save_action,
         request_id,
@@ -2745,7 +2978,6 @@ async def recent_requests(
 ) -> dict:
     runtime = get_runtime_settings()
     client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
-    mode = (runtime.requests_data_source or "prefer_cache").lower()
     # Browsing is always local. Synchronization is owned by background workers.
     allow_remote = False
     username_norm = _normalize_username(user.get("username", ""))
@@ -2773,8 +3005,6 @@ async def recent_requests(
     allow_title_hydrate = False
     allow_artwork_hydrate = False
     stage_cache = await asyncio.to_thread(get_request_stage_cache)
-    jellyfin = JellyfinClient(runtime.jellyfin_base_url, runtime.jellyfin_api_key)
-    jellyfin_cache: Dict[str, bool] = {}
     results = []
     for row in rows:
         status = row.get("status")
@@ -3251,11 +3481,14 @@ async def ai_triage(request_id: str, user: Dict[str, str] = Depends(get_current_
     return triage_snapshot(snapshot)
 
 
-async def _request_language_context(request_id, user):
+async def _request_language_context(request_id, user, *, require_owner: bool = False):
     runtime = get_runtime_settings()
     seerr = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
-    await _ensure_request_access(seerr, int(request_id), user)
-    request = await seerr.get_request(request_id)
+    request = await _ensure_request_access(
+        seerr, int(request_id), user, require_owner=require_owner
+    )
+    if request is None:
+        request = await seerr.get_request(request_id)
     if not isinstance(request, dict) or request.get('type') != 'movie':
         return runtime, None, None
     tmdb_id = (request.get('media') or {}).get('tmdbId')
@@ -3286,7 +3519,9 @@ async def accept_request_language(request_id: str, payload: dict, user: dict = D
         raise HTTPException(403, 'Search and download changes are disabled for this account.')
     if payload.get('acceptOriginalLanguage') is not True:
         raise HTTPException(400, 'Explicitly accept original-language audio before continuing.')
-    runtime, tmdb_id, language = await _request_language_context(request_id, user)
+    runtime, tmdb_id, language = await _request_language_context(
+        request_id, user, require_owner=True
+    )
     if not language:
         raise HTTPException(409, 'This request has no verified non-English original language.')
     if payload.get('languageCode') != language['code']:
@@ -3309,9 +3544,7 @@ async def action_search(request_id: str, user: Dict[str, str] = Depends(get_curr
     total_missing = 0
     next_offset = None
     runtime = get_runtime_settings()
-    client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
-    if client.configured():
-        await _ensure_request_access(client, int(request_id), user)
+    await _ensure_request_mutation_access(runtime, int(request_id), user)
     snapshot = await build_snapshot(request_id)
     arr_item = snapshot.raw.get("arr", {}).get("item")
     if not isinstance(arr_item, dict) or not isinstance(arr_item.get("id"), int):
@@ -3340,7 +3573,7 @@ async def action_search(request_id: str, user: Dict[str, str] = Depends(get_curr
                 return {"status": "ok", "message": message, "collector": collector, "releases": []}
             missing_ids = [identity for season in season_numbers for identity in missing_by_season[season]]
             total_missing = len(missing_ids)
-            batch = missing_ids[offset:offset + 20]
+            batch = missing_ids[offset:offset + 3]
             next_offset = offset + len(batch) if offset + len(batch) < total_missing else None
             semaphore = asyncio.Semaphore(3)
             async def search_episode(identity):
@@ -3406,7 +3639,7 @@ async def action_search(request_id: str, user: Dict[str, str] = Depends(get_curr
     if len(results) > len(releases):
         message += ' Duplicate results are combined; up to 200 ranked releases are shown.'
     if total_missing:
-        message += f' Searched {min(20, max(0, total_missing - offset))} of {total_missing} missing monitored episodes.'
+        message += f' Searched {min(3, max(0, total_missing - offset))} of {total_missing} missing monitored episodes.'
     await asyncio.to_thread(save_action, request_id, 'search_releases', 'Search and choose a download', 'ok', message)
     return {'status': 'ok', 'collector': collector, 'qualityFiltered': False, 'message': message,
             'outcome': 'matches' if approved else 'attention', 'rejectionReasons': rejection_reasons,
@@ -3419,9 +3652,7 @@ async def action_search_auto(request_id: str, user: Dict[str, str] = Depends(get
     if not _user_can_use_search_auto(user):
         raise HTTPException(status_code=403, detail="Auto search and download is disabled for this user")
     runtime = get_runtime_settings()
-    client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
-    if client.configured():
-        await _ensure_request_access(client, int(request_id), user)
+    await _ensure_request_mutation_access(runtime, int(request_id), user)
     snapshot = await build_snapshot(request_id)
     arr_item = snapshot.raw.get("arr", {}).get("item")
     if not isinstance(arr_item, dict):
@@ -3471,9 +3702,7 @@ async def action_search_auto(request_id: str, user: Dict[str, str] = Depends(get
 @router.post("/{request_id}/actions/qbit/resume")
 async def action_resume(request_id: str, user: Dict[str, str] = Depends(get_current_user)) -> dict:
     runtime = get_runtime_settings()
-    client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
-    if client.configured():
-        await _ensure_request_access(client, int(request_id), user)
+    await _ensure_request_mutation_access(runtime, int(request_id), user)
     snapshot = await build_snapshot(request_id)
     queue = snapshot.raw.get("arr", {}).get("queue")
     download_ids = _download_ids(_queue_records(queue))
@@ -3518,9 +3747,7 @@ async def action_resume(request_id: str, user: Dict[str, str] = Depends(get_curr
 @router.post("/{request_id}/actions/readd")
 async def action_readd(request_id: str, user: Dict[str, str] = Depends(get_current_user)) -> dict:
     runtime = get_runtime_settings()
-    client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
-    if client.configured():
-        await _ensure_request_access(client, int(request_id), user)
+    await _ensure_request_mutation_access(runtime, int(request_id), user)
     snapshot = await build_snapshot(request_id)
     jelly = snapshot.raw.get("jellyseerr") or {}
     media = jelly.get("media") or {}
@@ -3677,9 +3904,7 @@ async def action_grab(
     request_id: str, payload: Dict[str, Any], user: Dict[str, str] = Depends(get_current_user)
 ) -> dict:
     runtime = get_runtime_settings()
-    client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
-    if client.configured():
-        await _ensure_request_access(client, int(request_id), user)
+    await _ensure_request_mutation_access(runtime, int(request_id), user)
     snapshot = await build_snapshot(request_id)
     guid = payload.get("guid")
     indexer_id = payload.get("indexerId")
@@ -3717,7 +3942,7 @@ async def action_grab(
     release_title = receipt.get('title')
     arr_error: Optional[str] = None
     try:
-        response = await arr_client.grab_release(str(guid), arr_indexer_id)
+        await arr_client.grab_release(str(guid), arr_indexer_id)
         action_message = (
             f"{release_title or 'Selected release'} was sent through {service_label} for download and import."
             + (' Profile limits explicitly overridden: ' + '; '.join(receipt['rejections']) if receipt['override'] else '')

backend/app/routers/setup.py

@@ -0,0 +1,80 @@
+"""Initial install bootstrap and authenticated setup wizard endpoints."""
+
+from inspect import isawaitable
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from pydantic import Field, SecretStr
+
+from ..api_models import COMMON_ERROR_RESPONSES, StrictRequest
+from ..auth import _extract_client_ip, require_admin
+from ..services import setup as setup_service
+
+
+router = APIRouter(prefix="/setup", tags=["setup"], responses=COMMON_ERROR_RESPONSES)
+
+
+class BootstrapRequest(StrictRequest):
+    setup_token: SecretStr = Field(min_length=1, max_length=1024)
+    username: str = Field(min_length=1, max_length=100)
+    password: SecretStr = Field(min_length=1, max_length=1024)
+
+
+class SetupProgress(StrictRequest):
+    step: setup_service.SetupStep
+
+
+@router.get("/status")
+def public_status(response: Response) -> dict:
+    response.headers["Cache-Control"] = "no-store"
+    return setup_service.get_public_setup_status()
+
+
+@router.post("/bootstrap", status_code=201)
+def bootstrap(payload: BootstrapRequest, request: Request) -> dict:
+    status = setup_service.get_public_setup_status()
+    if not status["needs_admin"]:
+        raise HTTPException(status_code=409, detail="Initial administrator setup is no longer available.")
+    retry_after = setup_service.consume_bootstrap_attempt(_extract_client_ip(request))
+    if retry_after is not None:
+        raise HTTPException(
+            status_code=429,
+            detail="Too many setup attempts. Try again later.",
+            headers={"Retry-After": str(retry_after)},
+        )
+    try:
+        setup_service.bootstrap_administrator(
+            payload.setup_token.get_secret_value(), payload.username, payload.password.get_secret_value()
+        )
+    except setup_service.InvalidSetupTokenError as exc:
+        raise HTTPException(status_code=403, detail=str(exc)) from exc
+    except setup_service.SetupUnavailableError as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    return {"status": "created", "username": payload.username.strip()}
+
+
+@router.get("/state", dependencies=[Depends(require_admin)])
+def get_state() -> dict:
+    return setup_service.get_setup_state()
+
+
+@router.put("/state", dependencies=[Depends(require_admin)])
+def update_state(payload: SetupProgress) -> dict:
+    return setup_service.update_setup_step(payload.step)
+
+
+@router.post("/complete", dependencies=[Depends(require_admin)])
+async def finish_setup(request: Request) -> dict:
+    try:
+        state = setup_service.complete_setup()
+    except setup_service.SetupUnavailableError as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
+    # Startup owns worker lifecycle. Its callback must be idempotent so retries
+    # after a network interruption cannot start duplicate import/automation jobs.
+    callback = getattr(request.app.state, "on_setup_complete", None)
+    if callback is not None:
+        result = callback()
+        if isawaitable(result):
+            await result
+    return state

backend/app/routers/site.py

@@ -5,6 +5,7 @@ from fastapi import APIRouter, Depends
 
 from ..auth import get_current_user
 from ..build_info import BUILD_NUMBER, CHANGELOG
+from ..config import normalize_banner_color
 from ..runtime import get_runtime_settings
 
 router = APIRouter(prefix="/site", tags=["site"])
@@ -15,6 +16,7 @@ _BANNER_TONES = {"info", "warning", "error", "maintenance"}
 def _build_site_info(include_changelog: bool) -> Dict[str, Any]:
     runtime = get_runtime_settings()
     banner_message = (runtime.site_banner_message or "").strip()
+    login_message = (runtime.site_login_message or "").strip()
     tone = (runtime.site_banner_tone or "info").strip().lower()
     if tone not in _BANNER_TONES:
         tone = "info"
@@ -24,8 +26,11 @@ def _build_site_info(include_changelog: bool) -> Dict[str, Any]:
             "enabled": bool(runtime.site_banner_enabled and banner_message),
             "message": banner_message,
             "tone": tone,
+            "backgroundColor": normalize_banner_color(runtime.site_banner_background_color),
+            "borderColor": normalize_banner_color(runtime.site_banner_border_color),
         },
         "login": {
+            "message": login_message,
             "showJellyfinLogin": bool(runtime.site_login_show_jellyfin_login),
             "showLocalLogin": bool(runtime.site_login_show_local_login),
             "showForgotPassword": bool(runtime.site_login_show_forgot_password),

backend/app/schema_migrations.py

@@ -0,0 +1,116 @@
+"""Transactional, versioned SQLite schema migrations for Magent."""
+
+from __future__ import annotations
+
+import sqlite3
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Callable
+
+
+MigrationStep = Callable[[sqlite3.Connection], None]
+
+
+@dataclass(frozen=True)
+class Migration:
+    version: int
+    name: str
+    apply: MigrationStep
+
+
+def _column_names(conn: sqlite3.Connection, table: str) -> set[str]:
+    return {str(row[1]) for row in conn.execute(f'PRAGMA table_info("{table}")').fetchall()}
+
+
+def _add_column(conn: sqlite3.Connection, table: str, definition: str) -> None:
+    column = definition.split(maxsplit=1)[0].strip('"')
+    if column not in _column_names(conn, table):
+        conn.execute(f'ALTER TABLE "{table}" ADD COLUMN {definition}')
+
+
+def _migration_001_legacy_columns_and_indexes(conn: sqlite3.Connection) -> None:
+    for definition in (
+        "email TEXT",
+        "last_login_at TEXT",
+        "is_blocked INTEGER NOT NULL DEFAULT 0",
+        "auth_provider TEXT NOT NULL DEFAULT 'local'",
+        "jellyfin_password_hash TEXT",
+        "last_jellyfin_auth_at TEXT",
+        "jellyseerr_user_id INTEGER",
+        "auto_search_enabled INTEGER NOT NULL DEFAULT 1",
+        "invite_management_enabled INTEGER NOT NULL DEFAULT 0",
+        "profile_id INTEGER",
+        "expires_at TEXT",
+        "invited_by_code TEXT",
+        "invited_at TEXT",
+        "auth_version INTEGER NOT NULL DEFAULT 1",
+    ):
+        _add_column(conn, "users", definition)
+
+    for definition in ("recipient_email TEXT", "code_hint TEXT"):
+        _add_column(conn, "signup_invites", definition)
+
+    for definition in (
+        "related_item_id INTEGER",
+        "workflow_request_status TEXT",
+        "workflow_media_status TEXT",
+        "issue_type TEXT",
+        "issue_resolved_at TEXT",
+        "metadata_json TEXT",
+    ):
+        _add_column(conn, "portal_items", definition)
+
+    _add_column(conn, "requests_cache", "requested_by_id INTEGER")
+
+    statements = (
+        "CREATE INDEX IF NOT EXISTS idx_portal_items_workflow ON portal_items "
+        "(kind, workflow_request_status, workflow_media_status, updated_at DESC, id DESC)",
+        "CREATE INDEX IF NOT EXISTS idx_portal_items_related_item ON portal_items "
+        "(related_item_id, updated_at DESC, id DESC)",
+        "CREATE INDEX IF NOT EXISTS idx_users_profile_id ON users (profile_id)",
+        "CREATE INDEX IF NOT EXISTS idx_users_expires_at ON users (expires_at)",
+        "CREATE INDEX IF NOT EXISTS idx_users_username_nocase ON users (username COLLATE NOCASE)",
+        "CREATE INDEX IF NOT EXISTS idx_users_email_nocase ON users (email COLLATE NOCASE)",
+        "CREATE INDEX IF NOT EXISTS idx_requests_cache_requested_by_id ON requests_cache (requested_by_id)",
+        "CREATE INDEX IF NOT EXISTS idx_requests_cache_requested_by_id_created_at ON requests_cache "
+        "(requested_by_id, created_at DESC, request_id DESC)",
+    )
+    for statement in statements:
+        conn.execute(statement)
+
+
+MIGRATIONS = (
+    Migration(1, "legacy_columns_and_indexes", _migration_001_legacy_columns_and_indexes),
+)
+
+
+def run_schema_migrations(conn: sqlite3.Connection) -> list[int]:
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS schema_migrations (
+            version INTEGER PRIMARY KEY,
+            name TEXT NOT NULL UNIQUE,
+            applied_at TEXT NOT NULL
+        )
+        """
+    )
+    applied = {int(row[0]) for row in conn.execute("SELECT version FROM schema_migrations")}
+    completed: list[int] = []
+    for migration in MIGRATIONS:
+        if migration.version in applied:
+            continue
+        savepoint = f"magent_migration_{migration.version}"
+        conn.execute(f"SAVEPOINT {savepoint}")
+        try:
+            migration.apply(conn)
+            conn.execute(
+                "INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)",
+                (migration.version, migration.name, datetime.now(timezone.utc).isoformat()),
+            )
+            conn.execute(f"RELEASE SAVEPOINT {savepoint}")
+        except Exception:
+            conn.execute(f"ROLLBACK TO SAVEPOINT {savepoint}")
+            conn.execute(f"RELEASE SAVEPOINT {savepoint}")
+            raise
+        completed.append(migration.version)
+    return completed

backend/app/secret_storage.py

@@ -0,0 +1,74 @@
+import base64
+import hashlib
+from typing import Optional
+
+from cryptography.fernet import Fernet, InvalidToken
+
+from .config import settings
+
+
+ENCRYPTED_PREFIX = "enc:v1:"
+SENSITIVE_SETTING_KEYS = frozenset(
+    {
+        "jellystat_api_key", "magent_ssl_certificate_pem", "magent_ssl_private_key_pem",
+        "magent_notify_email_smtp_password", "magent_notify_discord_webhook_url",
+        "magent_notify_telegram_bot_token", "magent_notify_push_token",
+        "magent_notify_push_user_key", "magent_notify_webhook_url", "jellyseerr_api_key",
+        "jellyfin_api_key", "sonarr_api_key", "radarr_api_key", "bazarr_api_key",
+        "prowlarr_api_key", "qbittorrent_password", "discord_webhook_url",
+    }
+)
+
+
+def _fernet_key() -> bytes:
+    configured = str(settings.settings_encryption_key or "").strip()
+    if configured:
+        try:
+            decoded = base64.urlsafe_b64decode(configured.encode("ascii"))
+        except Exception as exc:
+            raise RuntimeError("SETTINGS_ENCRYPTION_KEY must be a valid Fernet key") from exc
+        if len(decoded) != 32:
+            raise RuntimeError("SETTINGS_ENCRYPTION_KEY must decode to exactly 32 bytes")
+        return configured.encode("ascii")
+    jwt_secret = str(settings.jwt_secret or "").strip()
+    if len(jwt_secret) < 32 or jwt_secret == "change-me":
+        raise RuntimeError(
+            "SETTINGS_ENCRYPTION_KEY is required when JWT_SECRET is not a strong migration key"
+        )
+    derived = hashlib.sha256(("magent-settings-v1:" + jwt_secret).encode("utf-8")).digest()
+    return base64.urlsafe_b64encode(derived)
+
+
+def is_sensitive_setting(key: str) -> bool:
+    return str(key or "").strip().lower() in SENSITIVE_SETTING_KEYS
+
+
+def validate_secret_storage_configuration() -> None:
+    """Validate the configured or JWT-derived Fernet key without touching stored data."""
+    Fernet(_fernet_key())
+
+
+def encrypt_setting_value(key: str, value: Optional[str]) -> Optional[str]:
+    if value is None or not is_sensitive_setting(key):
+        return value
+    text = str(value)
+    if text.startswith(ENCRYPTED_PREFIX):
+        return text
+    token = Fernet(_fernet_key()).encrypt(text.encode("utf-8")).decode("ascii")
+    return ENCRYPTED_PREFIX + token
+
+
+def decrypt_setting_value(key: str, value: Optional[str]) -> Optional[str]:
+    if value is None or not is_sensitive_setting(key):
+        return value
+    text = str(value)
+    if not text.startswith(ENCRYPTED_PREFIX):
+        return text
+    try:
+        return Fernet(_fernet_key()).decrypt(
+            text[len(ENCRYPTED_PREFIX) :].encode("ascii")
+        ).decode("utf-8")
+    except InvalidToken as exc:
+        raise RuntimeError(
+            f"Stored secret '{key}' cannot be decrypted with the configured key"
+        ) from exc

backend/app/security.py

@@ -1,4 +1,5 @@
 from datetime import datetime, timedelta, timezone
+import uuid
 from typing import Any, Dict, Optional
 
 from passlib.context import CryptContext
@@ -7,9 +8,15 @@ from jwt import InvalidTokenError
 
 from .config import settings
 
-_pwd_context = CryptContext(schemes=["pbkdf2_sha256"], deprecated="auto")
+_pwd_context = CryptContext(
+    schemes=["argon2", "pbkdf2_sha256"],
+    deprecated=["pbkdf2_sha256"],
+    argon2__memory_cost=65536,
+    argon2__time_cost=3,
+    argon2__parallelism=4,
+)
 _ALGORITHM = "HS256"
-MIN_PASSWORD_LENGTH = 8
+MIN_PASSWORD_LENGTH = 12
 PASSWORD_POLICY_MESSAGE = f"Password must be at least {MIN_PASSWORD_LENGTH} characters."
 
 
@@ -18,7 +25,17 @@ def hash_password(password: str) -> str:
 
 
 def verify_password(plain_password: str, hashed_password: str) -> bool:
-    return _pwd_context.verify(plain_password, hashed_password)
+    try:
+        return _pwd_context.verify(plain_password, hashed_password)
+    except (TypeError, ValueError):
+        return False
+
+
+def verify_and_update_password(plain_password: str, hashed_password: str) -> tuple[bool, Optional[str]]:
+    try:
+        return _pwd_context.verify_and_update(plain_password, hashed_password)
+    except (TypeError, ValueError):
+        return False, None
 
 
 def validate_password_policy(password: str) -> str:
@@ -34,32 +51,58 @@ def _create_token(
     *,
     expires_at: datetime,
     token_type: str = "access",
+    auth_version: int = 1,
 ) -> str:
+    issued_at = datetime.now(timezone.utc)
     payload: Dict[str, Any] = {
         "sub": subject,
         "role": role,
         "typ": token_type,
         "exp": expires_at,
+        "iat": issued_at,
+        "jti": uuid.uuid4().hex,
+        "iss": settings.jwt_issuer,
+        "aud": settings.jwt_audience,
+        "ver": max(1, int(auth_version or 1)),
     }
     return jwt.encode(payload, settings.jwt_secret, algorithm=_ALGORITHM)
 
-def create_access_token(subject: str, role: str, expires_minutes: Optional[int] = None) -> str:
+def create_access_token(
+    subject: str,
+    role: str,
+    expires_minutes: Optional[int] = None,
+    *,
+    auth_version: int = 1,
+) -> str:
     if not settings.jwt_secret:
         raise ValueError("JWT_SECRET is not configured")
     minutes = expires_minutes or settings.jwt_exp_minutes
     expires = datetime.now(timezone.utc) + timedelta(minutes=minutes)
-    return _create_token(subject, role, expires_at=expires, token_type="access")
+    return _create_token(subject, role, expires_at=expires, token_type="access", auth_version=auth_version)
 
 
-def create_stream_token(subject: str, role: str, expires_seconds: int = 120) -> str:
+def create_stream_token(
+    subject: str,
+    role: str,
+    expires_seconds: int = 120,
+    *,
+    auth_version: int = 1,
+) -> str:
     expires = datetime.now(timezone.utc) + timedelta(seconds=max(30, int(expires_seconds or 120)))
-    return _create_token(subject, role, expires_at=expires, token_type="sse")
+    return _create_token(subject, role, expires_at=expires, token_type="sse", auth_version=auth_version)
 
 
 def decode_token(token: str) -> Dict[str, Any]:
     if not settings.jwt_secret:
         raise ValueError("JWT_SECRET is not configured")
-    return jwt.decode(token, settings.jwt_secret, algorithms=[_ALGORITHM])
+    return jwt.decode(
+        token,
+        settings.jwt_secret,
+        algorithms=[_ALGORITHM],
+        audience=settings.jwt_audience,
+        issuer=settings.jwt_issuer,
+        options={"require": ["exp", "iat", "jti", "iss", "aud", "sub", "typ", "ver"]},
+    )
 
 
 class TokenError(Exception):

backend/app/services/arr.py

@@ -0,0 +1,21 @@
+"""Shared Sonarr/Radarr configuration helpers."""
+
+from typing import Any
+
+
+class RootFolderNotFoundError(ValueError):
+    pass
+
+
+async def resolve_root_folder_path(client: Any, root_folder: str, service_name: str) -> str:
+    configured = str(root_folder or "").strip()
+    if not configured.isdigit():
+        return configured
+    folders = await client.get_root_folders()
+    if isinstance(folders, list):
+        for folder in folders:
+            if isinstance(folder, dict) and folder.get("id") == int(configured):
+                path = str(folder.get("path") or "").strip()
+                if path:
+                    return path
+    raise RootFolderNotFoundError(f"{service_name} root folder id {configured} not found")

backend/app/services/backups.py

@@ -0,0 +1,631 @@
+"""Encrypted, portable backups and restart-only SQLite restores.
+
+Restore is deliberately a two-step operation: the authenticated request validates
+and stages it, then a single backend process applies it before opening the DB.
+A durable journal and a private rollback copy protect interrupted installations.
+"""
+
+from __future__ import annotations
+
+from contextlib import closing, contextmanager
+from datetime import datetime, timezone
+import hashlib
+import io
+import json
+import os
+from pathlib import Path, PurePosixPath
+import re
+import secrets
+import shutil
+import sqlite3
+import stat
+import tempfile
+import threading
+import time
+from typing import Any, BinaryIO, Iterator
+import uuid
+import zipfile
+import zlib
+
+from cryptography.exceptions import InvalidTag
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography.hazmat.primitives.kdf.scrypt import Scrypt
+from pydantic import TypeAdapter
+
+from ..config import Settings, settings
+from ..db import _db_path
+from ..schema_migrations import MIGRATIONS
+from ..secret_storage import SENSITIVE_SETTING_KEYS, decrypt_setting_value, encrypt_setting_value
+
+FORMAT_VERSION = 1
+MAX_UPLOAD_BYTES = 32 * 1024 * 1024
+MAX_EXPANDED_BYTES = 128 * 1024 * 1024
+MAX_ENTRIES = 20_000
+MAGIC = b"MAGENT-BACKUP\x00\x01"
+_LOCK = threading.Lock()
+_ASSET_NAME = re.compile(r"^[A-Za-z0-9_.-]+$")
+_TMDB_SIZES = {"w92", "w154", "w185", "w342", "w500", "w780", "original"}
+# Host identity, process controls and local file locations belong to the target.
+_LOCAL_FIELDS = {
+    "sqlite_path", "sqlite_journal_mode", "jwt_secret", "settings_encryption_key",
+    "admin_username", "admin_password", "setup_token", "app_name", "cors_allow_origin",
+    "auth_cookie_name", "auth_cookie_secure", "auth_cookie_samesite", "auth_cookie_domain",
+    "auth_state_cookie_name", "jwt_issuer", "jwt_audience", "api_docs_enabled",
+    "log_file", "magent_application_port", "magent_api_port", "magent_bind_host",
+    "magent_proxy_trusted_proxies", "magent_proxy_trust_forwarded_headers",
+    "magent_ssl_bind_enabled", "magent_ssl_certificate_path", "magent_ssl_private_key_path",
+    "magent_ssl_certificate_pem", "magent_ssl_private_key_pem",
+    "site_build_number", "site_changelog", "magent_allow_private_notification_targets",
+}
+
+
+class BackupError(ValueError):
+    """A safe-to-display backup validation or state error."""
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _assets_root() -> Path:
+    # Matches the image and branding routers, independently of SQLITE_PATH.
+    return Path.cwd() / "data"
+
+
+def _control_root() -> Path:
+    return Path(_db_path()).absolute().parent / "backups"
+
+
+def _private_dir(path: Path) -> None:
+    if path.is_symlink():
+        raise BackupError("Backup directories must not be symbolic links")
+    path.mkdir(parents=True, exist_ok=True, mode=0o700)
+    path.chmod(0o700)
+
+
+def _write_private(path: Path, content: bytes) -> None:
+    with path.open("xb") as handle:
+        path.chmod(0o600)
+        handle.write(content)
+        handle.flush()
+        os.fsync(handle.fileno())
+
+
+def _write_json(path: Path, data: dict) -> None:
+    temporary = path.with_name(path.name + ".tmp-" + uuid.uuid4().hex)
+    try:
+        _write_private(temporary, json.dumps(data, separators=(",", ":")).encode())
+        os.replace(temporary, path)
+        _sync_directory(path.parent)
+    finally:
+        temporary.unlink(missing_ok=True)
+
+
+def _sync_directory(path: Path) -> None:
+    if os.name != "nt":
+        descriptor = os.open(path, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(descriptor)
+        finally:
+            os.close(descriptor)
+
+
+def _sync_tree(path: Path) -> None:
+    for parent, _directories, files in os.walk(path, topdown=False):
+        for filename in files:
+            with (Path(parent) / filename).open("r+b") as handle:
+                os.fsync(handle.fileno())
+        _sync_directory(Path(parent))
+
+
+@contextmanager
+def _exclusive_operation() -> Iterator[None]:
+    if not _LOCK.acquire(blocking=False):
+        raise BackupError("Another backup or restore operation is in progress")
+    handle = None
+    locked = False
+    try:
+        root = _control_root()
+        _private_dir(root)
+        handle = (root / "operation.lock").open("a+b")
+        os.chmod(handle.name, 0o600)
+        # OS locks are released even if a process crashes; support the dev host too.
+        if os.name == "nt":
+            import msvcrt
+            handle.seek(0)
+            if not handle.read(1):
+                handle.write(b"0")
+                handle.flush()
+            handle.seek(0)
+            try:
+                msvcrt.locking(handle.fileno(), msvcrt.LK_NBLCK, 1)
+            except OSError as exc:
+                raise BackupError("Another backup or restore operation is in progress") from exc
+        else:
+            import fcntl
+            try:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except OSError as exc:
+                raise BackupError("Another backup or restore operation is in progress") from exc
+        locked = True
+        yield
+    finally:
+        if handle is not None:
+            if locked:
+                if os.name == "nt":
+                    import msvcrt
+                    handle.seek(0)
+                    msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+                else:
+                    import fcntl
+                    fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+            handle.close()
+        _LOCK.release()
+
+
+def validate_passphrase(passphrase: str) -> None:
+    if not isinstance(passphrase, str) or not 12 <= len(passphrase) <= 1024:
+        raise BackupError("Use a backup passphrase between 12 and 1024 characters")
+
+
+def _key(passphrase: str, salt: bytes) -> bytes:
+    validate_passphrase(passphrase)
+    return Scrypt(salt=salt, length=32, n=2**15, r=8, p=1).derive(passphrase.encode("utf-8"))
+
+
+def _encrypt(content: bytes, passphrase: str) -> bytes:
+    salt, nonce = os.urandom(16), os.urandom(12)
+    header = MAGIC + salt + nonce
+    return header + AESGCM(_key(passphrase, salt)).encrypt(nonce, content, header)
+
+
+def _decrypt(content: bytes, passphrase: str) -> bytes:
+    header_size = len(MAGIC) + 28
+    if len(content) > MAX_UPLOAD_BYTES:
+        raise BackupError("Backup exceeds the 32 MiB upload limit")
+    if len(content) < header_size + 16 or not content.startswith(MAGIC):
+        raise BackupError("This is not a supported encrypted Magent backup")
+    salt = content[len(MAGIC):len(MAGIC) + 16]
+    nonce = content[len(MAGIC) + 16:header_size]
+    try:
+        return AESGCM(_key(passphrase, salt)).decrypt(nonce, content[header_size:], content[:header_size])
+    except InvalidTag as exc:
+        raise BackupError("Incorrect passphrase or damaged backup") from exc
+
+
+def _database_copy(source: Path, destination: Path) -> None:
+    if not source.is_file() or source.is_symlink():
+        raise BackupError("The configured database is unavailable or is a symbolic link")
+    deadline = time.monotonic() + 60
+
+    def progress(_status: int, _remaining: int, _total: int) -> None:
+        if time.monotonic() > deadline:
+            raise BackupError("Database is too busy to back up; try again shortly")
+
+    with closing(sqlite3.connect(source.as_uri() + "?mode=ro", uri=True)) as src:
+        with closing(sqlite3.connect(destination)) as dst:
+            destination.chmod(0o600)
+            src.backup(dst, pages=256, progress=progress, sleep=0.05)
+            dst.execute("PRAGMA journal_mode=DELETE")
+
+
+def _portable_database(path: Path) -> None:
+    """Materialize env-backed settings and remove source-specific encryption."""
+    with closing(sqlite3.connect(path)) as conn, conn:
+        conn.execute("PRAGMA secure_delete=ON")
+        # init_db recreates application-owned triggers after restoration; never
+        # distribute executable schema objects in a data backup.
+        for (trigger,) in conn.execute("SELECT name FROM sqlite_master WHERE type='trigger'").fetchall():
+            quoted = str(trigger).replace('"', '""')
+            conn.execute(f'DROP TRIGGER "{quoted}"')
+        overrides = dict(conn.execute("SELECT key, value FROM settings"))
+        for key, default in settings.model_dump().items():
+            if key in _LOCAL_FIELDS:
+                continue
+            value = overrides.get(key)
+            value = default if value is None else decrypt_setting_value(key, value)
+            conn.execute(
+                "INSERT INTO settings(key,value,updated_at) VALUES (?,?,?) "
+                "ON CONFLICT(key) DO UPDATE SET value=excluded.value,updated_at=excluded.updated_at",
+                (key, "" if value is None else str(value), _now()),
+            )
+        for key in _LOCAL_FIELDS:
+            conn.execute("DELETE FROM settings WHERE key=?", (key,))
+        # Future secret keys may not yet be exposed through Settings.
+        for key, value in conn.execute("SELECT key,value FROM settings").fetchall():
+            if key in SENSITIVE_SETTING_KEYS:
+                conn.execute("UPDATE settings SET value=? WHERE key=?", (decrypt_setting_value(key, value), key))
+        conn.commit()
+        conn.execute("VACUUM")
+
+
+def _asset_allowed(name: str, include_cache: bool) -> bool:
+    parts = PurePosixPath(name).parts
+    if name in {"files/branding/logo.png", "files/branding/favicon.ico"}:
+        return True
+    return bool(
+        include_cache and len(parts) == 5 and parts[:3] == ("files", "artwork", "tmdb")
+        and parts[3] in _TMDB_SIZES and _ASSET_NAME.fullmatch(parts[4])
+        and parts[4] not in {".", ".."}
+    )
+
+
+def _asset_files(include_cache: bool) -> Iterator[tuple[Path, str]]:
+    root = _assets_root()
+    for directory in ("branding", "artwork") if include_cache else ("branding",):
+        base = root / directory
+        if not base.exists():
+            continue
+        if base.is_symlink() or root.is_symlink():
+            raise BackupError("Asset directories must not be symbolic links")
+        for parent, directories, files in os.walk(base, followlinks=False):
+            if any((Path(parent) / name).is_symlink() for name in directories + files):
+                raise BackupError("Symbolic links are not supported in backup assets")
+            for filename in files:
+                path = Path(parent) / filename
+                archive_name = "files/" + path.relative_to(root).as_posix()
+                if _asset_allowed(archive_name, include_cache):
+                    yield path, archive_name
+
+
+def create_backup(passphrase: str, include_cache: bool = False) -> tuple[bytes, str]:
+    validate_passphrase(passphrase)
+    with _exclusive_operation(), tempfile.TemporaryDirectory(prefix="export-", dir=_control_root()) as temporary:
+        directory = Path(temporary)
+        directory.chmod(0o700)
+        database = directory / "database.sqlite3"
+        _database_copy(Path(_db_path()).absolute(), database)
+        _portable_database(database)
+        files = [(database, "database.sqlite3"), *_asset_files(include_cache)]
+        if len(files) > MAX_ENTRIES - 1 or sum(path.stat().st_size for path, _ in files) > MAX_EXPANDED_BYTES:
+            raise BackupError("Backup is too large; retry without the artwork cache")
+        archive_path = directory / "payload.zip"
+        manifest = {
+            "format_version": FORMAT_VERSION, "created_at": _now(),
+            "build": str(settings.site_build_number or "unknown"), "include_cache": include_cache,
+            "files": {},
+        }
+        with zipfile.ZipFile(archive_path, "w", compression=zipfile.ZIP_DEFLATED, compresslevel=6) as archive:
+            archive_path.chmod(0o600)
+            total = 0
+            for path, name in files:
+                digest = hashlib.sha256()
+                size = 0
+                with path.open("rb") as source, archive.open(name, "w") as destination:
+                    while chunk := source.read(1024 * 1024):
+                        total += len(chunk)
+                        size += len(chunk)
+                        if total > MAX_EXPANDED_BYTES:
+                            raise BackupError("Backup is too large; retry without the artwork cache")
+                        digest.update(chunk)
+                        destination.write(chunk)
+                manifest["files"][name] = {"bytes": size, "sha256": digest.hexdigest()}
+            archive.writestr("manifest.json", json.dumps(manifest))
+        if archive_path.stat().st_size > MAX_UPLOAD_BYTES - 128:
+            raise BackupError("Backup exceeds the 32 MiB limit; retry without the artwork cache")
+        encrypted = _encrypt(archive_path.read_bytes(), passphrase)
+    stamp = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%SZ")
+    return encrypted, f"magent-backup-{stamp}.magent-backup"
+
+
+def _validate_database(path: Path, *, verify_settings_encryption: bool = False) -> None:
+    try:
+        with closing(sqlite3.connect(path.as_uri() + "?mode=ro", uri=True)) as conn:
+            conn.execute("PRAGMA trusted_schema=OFF")
+            deadline = time.monotonic() + 30
+            conn.set_progress_handler(lambda: int(time.monotonic() > deadline), 10_000)
+            if conn.execute("PRAGMA integrity_check").fetchall() != [("ok",)]:
+                raise BackupError("Backup database failed its integrity check")
+            schema = conn.execute("SELECT type,name,sql FROM sqlite_master").fetchall()
+            if len(schema) > 500 or any(
+                kind in {"trigger", "view"} or "VIRTUAL TABLE" in str(sql).upper()
+                for kind, _name, sql in schema
+            ):
+                raise BackupError("Backup contains an unsupported database schema")
+            if conn.execute("PRAGMA foreign_key_check").fetchone() is not None:
+                raise BackupError("Backup database contains broken references")
+            required = {
+                "settings": {"key", "value", "updated_at"},
+                "users": {"id", "username", "password_hash", "role", "is_blocked", "auth_version"},
+                "signup_invites": {"id", "code", "enabled"},
+                "requests_cache": {"request_id", "payload_json"},
+                "schema_migrations": {"version", "name", "applied_at"},
+                "password_reset_tokens": {"id", "token_hash"},
+            }
+            for table, fields in required.items():
+                columns = {row[1] for row in conn.execute(f'PRAGMA table_info("{table}")')}
+                if not fields <= columns:
+                    raise BackupError("Backup does not contain a compatible Magent database")
+            optional = {
+                "installation_setup": {"id", "completed", "step", "completed_at"},
+                "installation_setup_attempts": {"scope", "key_hash", "occurred_at"},
+            }
+            table_names = {name for kind, name, _sql in schema if kind == "table"}
+            for table, fields in optional.items():
+                if table in table_names:
+                    columns = {row[1] for row in conn.execute(f'PRAGMA table_info("{table}")')}
+                    if not fields <= columns:
+                        raise BackupError("Backup setup state has an incompatible schema")
+            # An admin can stage a restore only after target initialization. Its
+            # schema is a trusted reference for *all* runtime columns, including
+            # versioned migrations that init_db will not rerun on a restored DB.
+            target = Path(_db_path()).absolute()
+            if target.is_file() and target != path:
+                with closing(sqlite3.connect(target.as_uri() + "?mode=ro", uri=True)) as reference:
+                    tables = [row[0] for row in reference.execute("SELECT name FROM sqlite_master WHERE type='table'")]
+                    for table in tables:
+                        if table.startswith("sqlite_") or table in {"installation_setup", "installation_setup_attempts"}:
+                            continue
+                        quoted = str(table).replace('"', '""')
+                        expected = {
+                            row[1]: (row[2].upper(), bool(row[3]), row[5])
+                            for row in reference.execute(f'PRAGMA table_info("{quoted}")')
+                        }
+                        actual = {
+                            row[1]: (row[2].upper(), bool(row[3]), row[5])
+                            for row in conn.execute(f'PRAGMA table_info("{quoted}")')
+                        }
+                        if expected != actual:
+                            raise BackupError("Backup is missing database columns required by this installation")
+            versions = {int(row[0]) for row in conn.execute("SELECT version FROM schema_migrations")}
+            if versions != {migration.version for migration in MIGRATIONS}:
+                raise BackupError("Backup schema is incompatible; restore using the same Magent version")
+            if not conn.execute(
+                "SELECT 1 FROM users WHERE role='admin' AND is_blocked=0 AND password_hash IS NOT NULL LIMIT 1"
+            ).fetchone():
+                raise BackupError("Backup must contain an active administrator account")
+            values = dict(conn.execute("SELECT key,value FROM settings"))
+            if _LOCAL_FIELDS.intersection(values):
+                raise BackupError("Backup contains host-specific configuration")
+            # Pydantic checks the types of portable settings without reading env values.
+            for key, value in values.items():
+                if verify_settings_encryption and key in SENSITIVE_SETTING_KEYS:
+                    value = decrypt_setting_value(key, value)
+                if key in Settings.model_fields and value not in {None, ""}:
+                    field = Settings.model_fields[key]
+                    TypeAdapter(field.rebuild_annotation()).validate_python(value)
+    except (sqlite3.DatabaseError, TypeError, ValueError, RuntimeError) as exc:
+        if isinstance(exc, BackupError):
+            raise
+        raise BackupError("Backup database or configuration is invalid") from exc
+
+
+def _extract_archive(payload: bytes, directory: Path) -> dict[str, Any]:
+    try:
+        with zipfile.ZipFile(io.BytesIO(payload)) as archive:
+            entries = archive.infolist()
+            if not entries or len(entries) > MAX_ENTRIES:
+                raise BackupError("Backup contains too many files")
+            names = [entry.filename for entry in entries]
+            if len(set(names)) != len(names) or "manifest.json" not in names or "database.sqlite3" not in names:
+                raise BackupError("Backup manifest is missing or contains duplicate files")
+            if sum(entry.file_size for entry in entries) > MAX_EXPANDED_BYTES:
+                raise BackupError("Expanded backup exceeds the 128 MiB limit")
+            for entry in entries:
+                parts = PurePosixPath(entry.filename).parts
+                mode = entry.external_attr >> 16
+                if (
+                    entry.is_dir() or entry.filename.startswith("/") or "\\" in entry.filename
+                    or str(PurePosixPath(entry.filename)) != entry.filename
+                    or ":" in entry.filename or any(part in {".", ".."} for part in parts)
+                    or (stat.S_IFMT(mode) not in {0, stat.S_IFREG}) or entry.flag_bits & 1
+                    or entry.compress_type not in {zipfile.ZIP_STORED, zipfile.ZIP_DEFLATED}
+                ):
+                    raise BackupError("Backup contains an unsafe archive entry")
+            if archive.getinfo("manifest.json").file_size > 4 * 1024 * 1024:
+                raise BackupError("Backup manifest is too large")
+            manifest = json.loads(archive.read("manifest.json"))
+            if (
+                not isinstance(manifest, dict) or manifest.get("format_version") != FORMAT_VERSION
+                or not isinstance(manifest.get("include_cache"), bool)
+                or not isinstance(manifest.get("created_at"), str) or len(manifest["created_at"]) > 64
+                or not isinstance(manifest.get("build"), str) or len(manifest["build"]) > 100
+                or not isinstance(manifest.get("files"), dict)
+                or set(manifest["files"]) != set(names) - {"manifest.json"}
+            ):
+                raise BackupError("Backup manifest is invalid or unsupported")
+            extracted_bytes = 0
+            for entry in entries:
+                name = entry.filename
+                if name == "manifest.json":
+                    continue
+                if name != "database.sqlite3" and not _asset_allowed(name, manifest["include_cache"]):
+                    raise BackupError("Backup contains an unsupported file")
+                expected = manifest["files"][name]
+                if not isinstance(expected, dict) or expected.get("bytes") != entry.file_size:
+                    raise BackupError("Backup file does not match its manifest")
+                target = directory.joinpath(*PurePosixPath(name).parts)
+                _private_dir(target.parent)
+                digest = hashlib.sha256()
+                with archive.open(entry) as source, target.open("xb") as destination:
+                    target.chmod(0o600)
+                    while chunk := source.read(1024 * 1024):
+                        extracted_bytes += len(chunk)
+                        if extracted_bytes > MAX_EXPANDED_BYTES:
+                            raise BackupError("Expanded backup exceeds the 128 MiB limit")
+                        digest.update(chunk)
+                        destination.write(chunk)
+                    destination.flush()
+                    os.fsync(destination.fileno())
+                if digest.hexdigest() != expected.get("sha256"):
+                    raise BackupError("Backup file failed its checksum")
+            _validate_database(directory / "database.sqlite3")
+            return manifest
+    except (zipfile.BadZipFile, KeyError, TypeError, ValueError, RuntimeError, zlib.error) as exc:
+        if isinstance(exc, BackupError):
+            raise
+        raise BackupError("Backup archive is invalid or damaged") from exc
+
+
+def stage_restore(source: BinaryIO, passphrase: str) -> dict[str, Any]:
+    validate_passphrase(passphrase)
+    with _exclusive_operation():
+        root = _control_root()
+        pending = root / "pending"
+        if pending.exists():
+            raise BackupError("A restore is already staged; cancel it before uploading another")
+        payload = _decrypt(source.read(MAX_UPLOAD_BYTES + 1), passphrase)
+        with tempfile.TemporaryDirectory(prefix="validate-", dir=root) as temporary:
+            stage = Path(temporary)
+            stage.chmod(0o700)
+            manifest = _extract_archive(payload, stage)
+            with closing(sqlite3.connect(stage / "database.sqlite3")) as conn, conn:
+                conn.execute("PRAGMA secure_delete=ON")
+                for key, value in conn.execute("SELECT key,value FROM settings").fetchall():
+                    if key in SENSITIVE_SETTING_KEYS:
+                        if value and str(value).startswith("enc:v1:"):
+                            raise BackupError("Backup settings are not portable")
+                        conn.execute("UPDATE settings SET value=? WHERE key=?", (encrypt_setting_value(key, value), key))
+                # Do not revive reset links or existing browser sessions. Invites remain intact.
+                conn.execute("DELETE FROM password_reset_tokens")
+                conn.execute("UPDATE users SET auth_version=?", (secrets.randbelow(2**52) + 1_000_000,))
+                if not manifest["include_cache"]:
+                    conn.execute("UPDATE artwork_cache_status SET poster_cached=0,backdrop_cached=0")
+                conn.commit()
+                # Remove plaintext secret remnants from replaced/free SQLite pages.
+                conn.execute("VACUUM")
+            metadata = {key: manifest[key] for key in ("created_at", "build", "include_cache")}
+            metadata["staged_at"] = _now()
+            _write_json(stage / "metadata.json", metadata)
+            # Stage survives reboot; it contains only secrets encrypted for this installation.
+            os.replace(stage, pending)
+            _sync_directory(root)
+        return metadata
+
+
+def backup_status() -> dict[str, Any]:
+    root = _control_root()
+    pending_path = root / "pending" / "metadata.json"
+    last_path = root / "last-restore.json"
+    return {
+        "format_version": FORMAT_VERSION, "max_upload_bytes": MAX_UPLOAD_BYTES,
+        "max_expanded_bytes": MAX_EXPANDED_BYTES,
+        "include_cache_default": False,
+        "pending_restore": json.loads(pending_path.read_text()) if pending_path.is_file() else None,
+        "last_restore": json.loads(last_path.read_text()) if last_path.is_file() else None,
+    }
+
+
+def cancel_restore() -> None:
+    with _exclusive_operation():
+        pending = _control_root() / "pending"
+        if pending.is_symlink():
+            raise BackupError("Invalid staged restore directory")
+        if pending.exists():
+            shutil.rmtree(pending)
+
+
+def _replace_file(source: Path, target: Path) -> None:
+    _private_dir(target.parent)
+    temporary = target.with_name(target.name + ".restore-" + uuid.uuid4().hex)
+    try:
+        shutil.copyfile(source, temporary)
+        temporary.chmod(0o600)
+        with temporary.open("r+b") as handle:
+            os.fsync(handle.fileno())
+        os.replace(temporary, target)
+        _sync_directory(target.parent)
+    finally:
+        temporary.unlink(missing_ok=True)
+
+
+def _replace_assets(source: Path, target: Path) -> None:
+    if target.is_symlink():
+        raise BackupError("Asset directories must not be symbolic links")
+    if target.exists():
+        shutil.rmtree(target)
+    if source.exists():
+        shutil.copytree(source, target, copy_function=shutil.copyfile)
+        for parent, _directories, files in os.walk(target):
+            Path(parent).chmod(0o700)
+            for filename in files:
+                (Path(parent) / filename).chmod(0o600)
+        _sync_tree(target)
+    if target.parent.exists():
+        _sync_directory(target.parent)
+
+
+def _recover(journal: dict, root: Path) -> None:
+    rollback_name = journal.get("rollback_directory", "")
+    if not re.fullmatch(r"rollback-[0-9a-f]{32}", rollback_name):
+        raise BackupError("Restore recovery journal is invalid")
+    rollback = root / rollback_name
+    database = Path(_db_path()).absolute()
+    if journal["had_database"]:
+        _replace_file(rollback / "database.sqlite3", database)
+    else:
+        database.unlink(missing_ok=True)
+    for suffix in ("-wal", "-shm", "-journal"):
+        Path(str(database) + suffix).unlink(missing_ok=True)
+    for name in journal["asset_roots"]:
+        if name not in {"branding", "artwork"}:
+            raise BackupError("Restore recovery journal is invalid")
+        _replace_assets(rollback / "files" / name, _assets_root() / name)
+    _write_json(root / "last-restore.json", {
+        "status": "rolled_back", "restored_at": _now(), "rollback_directory": rollback.name,
+        "message": "An interrupted or failed restore was rolled back automatically.",
+    })
+    _write_json(root / "restore-journal.json", {**journal, "phase": "rolled_back"})
+    pending = root / "pending"
+    if pending.exists():
+        shutil.rmtree(pending)
+    (root / "restore-journal.json").unlink()
+    _sync_directory(root)
+
+
+def apply_pending_restore() -> bool:
+    """Call once before init_db, with no other backend processes using the DB."""
+    with _exclusive_operation():
+        root = _control_root()
+        journal_path = root / "restore-journal.json"
+        if journal_path.exists():
+            journal = json.loads(journal_path.read_text())
+            if journal.get("phase") in {"complete", "rolled_back"}:
+                if (root / "pending").exists():
+                    shutil.rmtree(root / "pending")
+                journal_path.unlink()
+                _sync_directory(root)
+                return journal["phase"] == "complete"
+            _recover(journal, root)
+            return False
+        pending = root / "pending"
+        if not pending.exists():
+            return False
+        if pending.is_symlink():
+            raise BackupError("Invalid staged restore directory")
+        metadata = json.loads((pending / "metadata.json").read_text())
+        _validate_database(pending / "database.sqlite3", verify_settings_encryption=True)
+        database = Path(_db_path()).absolute()
+        rollback = root / ("rollback-" + uuid.uuid4().hex)
+        _private_dir(rollback)
+        # Ensure all disk-space/permission failures in backup happen before replacement.
+        if database.exists():
+            _database_copy(database, rollback / "database.sqlite3")
+        names = ["branding", "artwork"] if metadata["include_cache"] else ["branding"]
+        # Reject links anywhere before copying or deleting the controlled asset trees.
+        list(_asset_files(metadata["include_cache"]))
+        for name in names:
+            source = _assets_root() / name
+            if source.exists():
+                shutil.copytree(source, rollback / "files" / name)
+        _sync_tree(rollback)
+        journal = {"rollback_directory": rollback.name, "had_database": database.exists(), "asset_roots": names}
+        _write_json(journal_path, journal)
+        try:
+            for suffix in ("-wal", "-shm", "-journal"):
+                Path(str(database) + suffix).unlink(missing_ok=True)
+            _replace_file(pending / "database.sqlite3", database)
+            for name in names:
+                _replace_assets(pending / "files" / name, _assets_root() / name)
+            _write_json(root / "last-restore.json", {
+                "status": "restored", "restored_at": _now(), "rollback_directory": rollback.name,
+                "backup_created_at": metadata["created_at"],
+            })
+            _write_json(journal_path, {**journal, "phase": "complete"})
+        except Exception:
+            _recover(journal, root)
+            raise
+        shutil.rmtree(pending)
+        journal_path.unlink()
+        _sync_directory(root)
+        return True

backend/app/services/email_recaps.py

@@ -142,6 +142,34 @@ def completed_month(month: str | None) -> str:
     return period["month"]
 
 
+async def illustrated_recap(report, account, public_url, unsubscribe_url, *, preview=False, **kwargs):
+    """Embed only signed artwork from this account's report; missing art is optional."""
+    import base64
+    import re
+    from .insights_artwork import get_artwork
+    runtime = get_runtime_settings()
+    images = []
+    report = {**report, "top_titles": [dict(row) for row in report.get("top_titles", [])]}
+
+    async def picture(index, row):
+        match = re.fullmatch(r"/insights/artwork/([a-f0-9]{32})\?token=([0-9]+\.[a-f0-9]{64})", row.get("artwork_url") or "")
+        if not match:
+            return
+        try:
+            data, mime = await get_artwork(account, runtime, *match.groups())
+            cid = f"recap-title-{index}@magent"
+            row["email_artwork"] = f"data:{mime};base64,{base64.b64encode(data).decode()}" if preview else f"cid:{cid}"
+            images.append({"cid": cid, "data": data, "subtype": mime.split("/")[1]})
+        except Exception:
+            pass  # An unavailable poster must never prevent a personal report.
+
+    await asyncio.gather(*(picture(i, row) for i, row in enumerate(report["top_titles"][:3])))
+    rendered = mail.render_recap(report, account["username"], public_url, unsubscribe_url, **kwargs)
+    if not preview:
+        rendered["inline_images"] = images
+    return rendered
+
+
 async def preview(user: dict, month: str | None) -> dict:
     account = current_account(user)
     selected = completed_month(month)
@@ -156,8 +184,8 @@ async def preview(user: dict, month: str | None) -> dict:
         raise RecapError("Your report is temporarily unavailable. Please try again shortly.", 502) from exc
     if report["state"] != "ready":
         raise RecapError("Connect Jellystat and link your Jellyfin account to preview your recap.")
-    return {"month": selected, "email": account.get("email"), **mail.render_recap(
-        report, account["username"], config["public_url"], config["public_url"] + "/profile#monthly-recaps")}
+    return {"month": selected, "email": account.get("email"), **await illustrated_recap(
+        report, account, config["public_url"], config["public_url"] + "/profile#monthly-recaps", preview=True)}
 
 
 def queue_test(user: dict, month: str | None, request_id: str) -> dict:
@@ -200,7 +228,7 @@ async def process_delivery(delivery: dict) -> None:
         if report["state"] != "ready" or (report["is_partial"] and delivery["kind"] != "on_demand"):
             raise mail.DeliveryError("failed", "A complete personal report is not available.")
         unsubscribe = f"{delivery['public_url']}/email-recaps#" + urlencode({"action": "unsubscribe", "token": sub["unsubscribe_token"]})
-        rendered = mail.render_recap(report, account["username"], delivery["public_url"], unsubscribe, test=delivery["kind"] == "test", requested=delivery["kind"] == "on_demand")
+        rendered = await illustrated_recap(report, account, delivery["public_url"], unsubscribe, test=delivery["kind"] == "test", requested=delivery["kind"] == "on_demand")
 
         def before_data():
             eligible_delivery(delivery)

backend/app/services/insights.py

@@ -125,6 +125,9 @@ def request_summary(user: dict, start: datetime, end: datetime, *, end_exclusive
 def summarize(history: list, libraries: list, start: datetime, end: datetime, *, end_exclusive: bool = False) -> dict:
     library_types = {str(row.get("Id")): str(row.get("CollectionType") or "").lower() for row in libraries}
     daily_seconds = defaultdict(float)
+    weekdays = [0.0] * 7
+    media_minutes = defaultdict(float)
+    longest_play = 0.0
     clients = defaultdict(float)
     methods = defaultdict(float)
     transcoding = dict.fromkeys(("video_minutes", "audio_minutes", "hardware_video_minutes", "software_video_minutes",
@@ -157,6 +160,9 @@ def summarize(history: list, libraries: list, start: datetime, end: datetime, *,
             episode_ids.add(str(episode_id))
         elif media_type == "movie":
             movie_ids.add(item_id)
+        weekdays[date.weekday()] += duration / 60
+        media_minutes[media_type] += duration / 60
+        longest_play = max(longest_play, duration / 60)
         seconds += duration
         daily_seconds[date.date().isoformat()] += duration
         client = str(row.get("Client") or "Unknown player")[:200]
@@ -166,7 +172,7 @@ def summarize(history: list, libraries: list, start: datetime, end: datetime, *,
         methods[method] += duration
         name = str(row.get("NowPlayingItemName") or "Untitled")[:500]
         series = str(row.get("SeriesName") or "")[:500]
-        title = titles.setdefault(item_id, {"title": series or name, "type": "series" if episode_id else media_type, "minutes": 0, "plays": 0})
+        title = titles.setdefault(item_id, {"title": series or name, "type": "series" if episode_id else media_type, "minutes": 0, "plays": 0, "artwork_item_id": artwork_item_id(row.get("NowPlayingItemId"))})
         title["minutes"] += duration / 60
         title["plays"] += 1
         recent.append({"id": row_id, "title": name, "series": series, "type": media_type,
@@ -193,6 +199,11 @@ def summarize(history: list, libraries: list, start: datetime, end: datetime, *,
     return {"summary": {"minutes": round(seconds / 60, 1), "plays": len(recent), "movies": len(movie_ids),
                         "episodes": len(episode_ids), "active_days": len(active_days),
                         "current_streak": current, "longest_streak": longest},
+            "patterns": {"average_play_minutes": round(seconds / 60 / len(recent), 1) if recent else 0,
+                         "longest_play_minutes": round(longest_play, 1),
+                         "weekend_percent": round(sum(weekdays[5:]) / (seconds / 60) * 100, 1) if seconds else 0,
+                         "weekdays": [{"name": name, "minutes": round(weekdays[i], 1)} for i, name in enumerate(("Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday"))],
+                         "media": [{"name": name, "minutes": round(media_minutes[key], 1)} for key, name in (("movie", "Movies"), ("episode", "TV episodes"), ("other", "Other media"))]},
             "daily": daily, "top_titles": top,
             "clients": [{"name": name, "minutes": round(value / 60, 1)} for name, value in sorted(clients.items(), key=lambda pair: -pair[1])[:6]],
             "methods": [{"name": name, "minutes": round(value / 60, 1)} for name, value in sorted(methods.items(), key=lambda pair: -pair[1])],

backend/app/services/insights_artwork.py

@@ -35,16 +35,19 @@ def signature(user, runtime, media_id, expires):
 
 def with_artwork(data, user, runtime):
     expires = int(time.time()) + TOKEN_SECONDS
-    recent = []
-    for play in data.get("recent", []):
-        row = {**play}
-        media_id = row.pop("artwork_item_id", None)
-        row["artwork_url"] = None
-        if item_id(media_id) and settings.jwt_secret and runtime.jellyfin_base_url and runtime.jellyfin_api_key:
-            token = f"{expires}.{signature(user, runtime, media_id, expires)}"
-            row["artwork_url"] = f"/insights/artwork/{media_id}?token={token}"
-        recent.append(row)
-    return {**data, "recent": recent}
+    result = {**data}
+    for field in ("recent", "top_titles"):
+        rows = []
+        for play in data.get(field, []):
+            row = {**play}
+            media_id = row.pop("artwork_item_id", None)
+            row["artwork_url"] = None
+            if item_id(media_id) and settings.jwt_secret and runtime.jellyfin_base_url and runtime.jellyfin_api_key:
+                token = f"{expires}.{signature(user, runtime, media_id, expires)}"
+                row["artwork_url"] = f"/insights/artwork/{media_id}?token={token}"
+            rows.append(row)
+        result[field] = rows
+    return result
 
 
 def verify_artwork_token(user, runtime, media_id, token):

backend/app/services/invite_email.py

@@ -1025,16 +1025,12 @@ def _send_email_sync(*, recipient_email: str, subject: str, body_text: str, body
         raise RuntimeError("SMTP email settings are incomplete.")
     local_hostname = _derive_mail_hostname(from_address=from_address)
     logger.info(
-        "smtp send started recipient=%s from=%s host=%s port=%s tls=%s ssl=%s auth=%s subject=%s ehlo=%s",
-        recipient_email,
-        from_address,
+        "smtp send started host=%s port=%s tls=%s ssl=%s auth=%s",
         host,
         port,
         use_tls,
         use_ssl,
         bool(username and password),
-        subject,
-        local_hostname,
     )
     if delivery_warning:
         logger.warning("smtp delivery warning host=%s detail=%s", host, delivery_warning)
@@ -1083,11 +1079,7 @@ def _send_email_sync(*, recipient_email: str, subject: str, body_text: str, body
                 message=message,
             )
             logger.info(
-                "smtp send accepted recipient=%s host=%s mode=ssl provider_message_id=%s provider_internal_id=%s",
-                recipient_email,
-                host,
-                receipt.get("provider_message_id"),
-                receipt.get("provider_internal_id"),
+                "smtp send accepted host=%s mode=ssl", host,
             )
         return receipt
 
@@ -1100,7 +1092,7 @@ def _send_email_sync(*, recipient_email: str, subject: str, body_text: str, body
             logger.debug("smtp starttls negotiated host=%s port=%s", host, port)
         if username and password:
             smtp.login(username, password)
-            logger.debug("smtp login succeeded host=%s username=%s", host, username)
+            logger.debug("smtp login succeeded host=%s", host)
         receipt = _send_via_smtp_session(
             smtp,
             from_address=from_address,
@@ -1108,11 +1100,7 @@ def _send_email_sync(*, recipient_email: str, subject: str, body_text: str, body
             message=message,
         )
         logger.info(
-            "smtp send accepted recipient=%s host=%s mode=plain provider_message_id=%s provider_internal_id=%s",
-            recipient_email,
-            host,
-            receipt.get("provider_message_id"),
-            receipt.get("provider_internal_id"),
+            "smtp send accepted host=%s mode=plain", host,
         )
         return receipt
 
@@ -1153,7 +1141,7 @@ async def send_templated_email(
         body_text=rendered["body_text"],
         body_html=rendered["body_html"],
     )
-    logger.info("Email template sent: template=%s recipient=%s", template_key, resolved_email)
+    logger.info("Email template sent: template=%s", template_key)
     return {
         "recipient_email": resolved_email,
         "subject": rendered["subject"],
@@ -1185,7 +1173,7 @@ async def send_generic_email(
         body_text=body_text.strip(),
         body_html=body_html.strip(),
     )
-    logger.info("Generic email sent recipient=%s subject=%s", resolved_email, subject)
+    logger.info("Generic email sent")
     return {
         "recipient_email": resolved_email,
         "subject": subject.strip() or f"{env_settings.app_name} notification",
@@ -1284,7 +1272,7 @@ async def send_test_email(recipient_email: Optional[str] = None) -> Dict[str, st
         body_text=body_text,
         body_html=body_html,
     )
-    logger.info("SMTP test email sent: recipient=%s", resolved_email)
+    logger.info("SMTP test email sent")
     result = {"recipient_email": resolved_email, "subject": subject}
     result.update(
         {
@@ -1383,9 +1371,8 @@ async def send_password_reset_email(
         body_html=body_html,
     )
     logger.info(
-        "Password reset email sent: username=%s recipient=%s provider=%s",
+        "Password reset email sent: username=%s provider=%s",
         username,
-        resolved_email,
         auth_provider,
     )
     result = {

backend/app/services/newsletter_store.py

@@ -1,4 +1,3 @@
-from .public_urls import magent_public_url
 """Independent newsletter consent and immutable edition snapshots using the shared email queue."""
 
 import hashlib
@@ -11,6 +10,7 @@ from datetime import datetime, timedelta, timezone
 from .. import db
 from . import email_queue
 from .recap_store import read_one, transaction
+from .public_urls import magent_public_url
 
 
 class Conflict(ValueError):

backend/app/services/password_reset.py

@@ -18,6 +18,7 @@ from ..db import (
     mark_password_reset_token_used,
     set_user_auth_provider,
     set_user_password,
+    increment_user_auth_version,
     sync_jellyfin_password_state,
 )
 from ..runtime import get_runtime_settings
@@ -243,7 +244,7 @@ async def request_password_reset(
     delete_expired_password_reset_tokens()
     target = await _resolve_reset_target(identifier)
     if not target:
-        logger.info("password reset requested with no eligible match identifier=%s", identifier.strip().lower()[:256])
+        logger.info("password reset requested with no eligible match")
         return {"status": "ok", "issued": False}
 
     token = secrets.token_urlsafe(32)
@@ -324,6 +325,7 @@ async def apply_password_reset(token: str, new_password: str) -> Dict[str, Any]:
             raise ValueError("Password reset link is invalid or has expired.")
         await client.set_user_password(user_id, new_password)
         sync_jellyfin_password_state(username, new_password)
+        increment_user_auth_version(username)
         if str(stored_user.get("auth_provider") or "").strip().lower() != "jellyfin":
             set_user_auth_provider(username, "jellyfin")
         mark_password_reset_token_used(token)

backend/app/services/recap_email.py

@@ -88,10 +88,26 @@ def render_recap(report: dict, username: str, public_url: str, unsubscribe_url:
     content = '<table role="presentation" class="email-metrics" width="100%" cellpadding="0" cellspacing="0" style="table-layout:fixed"><tr>' + ''.join(cells[:2]) + '</tr><tr>' + ''.join(cells[2:]) + '</tr></table>'
     habit = f"{number(summary['active_days'])} days watched · {number(summary['longest_streak'])}-day longest run"
     content += f'<p style="color:#e5e1e4;font-size:14px;line-height:1.7;margin:24px 0">{esc(habit)}</p>'
+    patterns = report.get("patterns", {})
+    if patterns:
+        detail = f"Average play: {number(patterns['average_play_minutes'])} min. Longest play: {number(patterns['longest_play_minutes'])} min. Weekend viewing: {number(patterns['weekend_percent'])}%."
+        lines.append(detail)
+        content += f'<p style="padding:18px;background:#242334;border-radius:12px;color:#d8cfff;line-height:1.8">{esc(detail)}</p>'
+        for heading, rows in (("Your week in viewing (UTC)", patterns["weekdays"]), ("Movies, TV and more", patterns["media"])):
+            peak = max(1, *(row["minutes"] for row in rows))
+            content += f'<h2 style="font-size:18px;color:#e5e1e4">{heading}</h2><table role="presentation" width="100%" cellspacing="0" cellpadding="0">'
+            for row in rows:
+                width = round(row["minutes"] / peak * 100)
+                content += f'<tr><td style="padding:8px 0;color:#bdb6c3;font-size:12px;width:100px">{esc(row["name"])}</td><td style="padding:8px"><table role="presentation" width="{width}%" cellspacing="0" cellpadding="0"><tr><td height="8" style="background:{"#8cdbdd" if width else "transparent"};border-radius:4px;font-size:0">&nbsp;</td></tr></table></td><td style="width:65px;color:#e0d8ff;font-size:12px;text-align:right">{number(row["minutes"])} min</td></tr>'
+                lines.append(f"{row['name']}: {number(row['minutes'])} minutes")
+            content += '</table>'
     top = report.get("top_titles", [])[:3]
     if top:
         content += '<h2 style="font-size:18px;color:#e5e1e4;margin:24px 0 8px">Your most watched</h2>'
         for item in top:
+            artwork = item.get("email_artwork", "")
+            if artwork.startswith(("cid:", "data:image/")):
+                content += f'<img src="{esc(artwork, quote=True)}" alt="{esc(item["title"], quote=True)}" width="80" style="display:block;border-radius:10px;margin-top:20px" />'
             content += f'<p style="font-size:14px;line-height:1.6;color:#e5e1e4;margin:12px 0;overflow-wrap:anywhere">{esc(item["title"])}<br><span style="font-size:12px;color:#a69fac">{number(item["minutes"])} minutes · {number(item["plays"])} plays</span></p>'
     else:
         content += '<p style="font-size:14px;color:#bdb6c3;line-height:1.7">No viewing was recorded this month. Your requests are still included.</p>'
@@ -130,8 +146,8 @@ def send_email(recipient: str, rendered: dict, message_id: str, before_data=lamb
     html_part = message.get_payload()[-1]
     for attachment in rendered.get('inline_images', []):
         html_part.add_related(
-            attachment['data'], maintype='image', subtype='jpeg', cid=f"<{attachment['cid']}>",
-            filename=attachment['cid'].split('@')[0] + '.jpg', disposition='inline')
+            attachment['data'], maintype='image', subtype=attachment.get('subtype', 'jpeg'), cid=f"<{attachment['cid']}>",
+            filename=attachment['cid'].split('@')[0] + '.' + attachment.get('subtype', 'jpeg'), disposition='inline')
     payload = message.as_bytes()
     smtp, stage = None, "connect"
     try:

backend/app/services/recap_store.py

@@ -1,4 +1,3 @@
-from .public_urls import magent_public_url
 """Durable consent, schedule and delivery records for personal email recaps."""
 
 import hashlib
@@ -11,6 +10,7 @@ from datetime import datetime
 from .. import db
 from .monthly_reports import shift_month
 from . import email_queue
+from .public_urls import magent_public_url
 
 
 def init_schema(conn: sqlite3.Connection) -> None:

backend/app/services/request_language.py

@@ -100,10 +100,11 @@ async def movie_search_outcome(client, movie_id, command, attempts=12, delay=2):
             movie = await client.get_movie(movie_id)
             if (movie or {}).get('hasFile'):
                 return {'status': 'complete', 'message': 'Radarr already has the movie file. Recheck the request for Jellyfin availability.'}
-            return {'status': 'attention', 'message': 'Search finished, but no download appeared in Radarr. Use Search and choose a download to see matching releases and rejection reasons. For a foreign-language title, review the audio choice above.'}
+            # Command completion precedes download-client queue refresh. Keep polling.
+            pass
         if attempt + 1 < attempts:
             await asyncio.sleep(delay)
-    return {'status': 'searching', 'message': 'Radarr is still searching. No download is confirmed yet; the pipeline will keep checking. You can close this window.'}
+    return {'status': 'pending', 'message': 'The search was submitted, but a download is not confirmed yet. The download queue may still be updating. Close this window and recheck the request shortly.'}
 
 
 async def series_search_outcome(client, series_id, commands, attempts=12, delay=2):
@@ -122,8 +123,7 @@ async def series_search_outcome(client, series_id, commands, attempts=12, delay=
         statuses = {str((state or {}).get('status', '')).lower() for state in states}
         if statuses & {'failed', 'aborted', 'cancelled'}:
             return {'status': 'attention', 'message': 'A Sonarr search failed. Check the service or try Search and choose a download.'}
-        if statuses == {'completed'}:
-            return {'status': 'attention', 'message': 'Sonarr finished searching, but no download is visible yet. Use Search and choose a download to review available releases and rejection reasons.'}
+        # Even completed commands can precede Sonarr's download queue refresh.
         if attempt + 1 < attempts:
             await asyncio.sleep(delay)
-    return {'status': 'searching', 'message': 'Sonarr is still searching. No download is confirmed yet; you can close this window and follow the pipeline.'}
+    return {'status': 'pending', 'message': 'The search was submitted, but a download is not confirmed yet. The download queue may still be updating. Close this window and recheck the request shortly.'}

backend/app/services/request_origins.py

@@ -0,0 +1,41 @@
+"""State-changing requests may originate only from explicitly configured sites.
+
+The public Hosting & proxy URL can be stored in the database, while the CORS
+environment setting still has its localhost default on an upgraded install.
+Never infer a trusted origin from request Host or forwarded headers.
+"""
+
+from urllib.parse import urlsplit
+
+from ..config import settings
+from .public_urls import magent_public_url, valid_public_url
+
+
+def _origin(value: str, *, configured_url: bool = False) -> tuple[str, str, int] | None:
+    value = str(value or "")
+    if any(character.isspace() or ord(character) < 33 or ord(character) == 127 for character in value):
+        return None
+    if "?" in value or "#" in value:
+        return None
+    validated = valid_public_url(value)
+    if not validated:
+        return None
+    parsed = urlsplit(value)
+    if parsed.username is not None or parsed.password is not None:
+        return None
+    if not configured_url and parsed.path:
+        return None
+    return (
+        parsed.scheme.lower(),
+        parsed.hostname.lower(),
+        parsed.port or (443 if parsed.scheme == "https" else 80),
+    )
+
+
+def is_allowed_request_origin(origin: str) -> bool:
+    candidate = _origin(origin)
+    if candidate is None:
+        return False
+    if candidate == _origin(str(settings.cors_allow_origin or "").rstrip("/")):
+        return True
+    return candidate == _origin(magent_public_url(), configured_url=True)

backend/app/services/setup.py

@@ -0,0 +1,197 @@
+"""Persistent, operator-authorized first-install setup.
+
+Initialize the marker before the main schema: an existing users table identifies
+an upgraded installation, while a new database must finish the setup wizard.
+The marker and first administrator are protected by SQLite write transactions.
+"""
+
+from datetime import datetime, timezone
+import hmac
+from math import ceil
+from time import time
+from typing import Literal
+
+from .. import db
+from ..config import settings
+from ..security import hash_password, validate_password_policy
+
+
+SetupStep = Literal["administrator", "apps", "preferences", "review"]
+SETUP_STEPS = ("administrator", "apps", "preferences", "review")
+BOOTSTRAP_WINDOW_SECONDS = 15 * 60
+BOOTSTRAP_IP_ATTEMPTS = 5
+BOOTSTRAP_GLOBAL_ATTEMPTS = 30
+
+
+class SetupUnavailableError(ValueError):
+    """Setup has finished, or another administrator already exists."""
+
+
+class InvalidSetupTokenError(ValueError):
+    """The operator's setup token was absent or did not match."""
+
+
+def initialize_setup_state() -> None:
+    """Run once before init_db; subsequent calls preserve progress."""
+    with db._connect() as conn:
+        conn.execute("BEGIN IMMEDIATE")
+        existing_install = conn.execute(
+            "SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'users'"
+        ).fetchone() is not None
+        conn.execute(
+            """CREATE TABLE IF NOT EXISTS installation_setup (
+                id INTEGER PRIMARY KEY CHECK (id = 1),
+                completed INTEGER NOT NULL CHECK (completed IN (0, 1)),
+                step TEXT NOT NULL,
+                completed_at TEXT
+            )"""
+        )
+        conn.execute(
+            """CREATE TABLE IF NOT EXISTS installation_setup_attempts (
+                scope TEXT NOT NULL,
+                key_hash TEXT NOT NULL,
+                occurred_at REAL NOT NULL
+            )"""
+        )
+        conn.execute(
+            """INSERT OR IGNORE INTO installation_setup (id, completed, step, completed_at)
+               VALUES (1, ?, ?, ?)""",
+            (
+                int(existing_install),
+                "review" if existing_install else "administrator",
+                datetime.now(timezone.utc).isoformat() if existing_install else None,
+            ),
+        )
+
+
+def get_setup_state() -> dict:
+    with db._connect() as conn:
+        # Old databases and isolated callers without startup initialization are
+        # already installed. A missing marker must never open public bootstrap.
+        table = conn.execute(
+            "SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'installation_setup'"
+        ).fetchone()
+        row = conn.execute(
+            "SELECT completed, step, completed_at FROM installation_setup WHERE id = 1"
+        ).fetchone() if table else None
+    if row is None:
+        return {"completed": True, "step": "review", "completed_at": None}
+    return {"completed": bool(row[0]), "step": row[1], "completed_at": row[2]}
+
+
+def is_setup_required() -> bool:
+    return not get_setup_state()["completed"]
+
+
+def get_public_setup_status() -> dict:
+    required = is_setup_required()
+    return {"setup_required": required, "needs_admin": required and not db.has_admin_user()}
+
+
+def setup_token_configured() -> bool:
+    """Reject missing values and obvious examples, without claiming to measure entropy."""
+    token = str(getattr(settings, "setup_token", "") or "").strip()
+    placeholder = token.casefold().replace("_", "-")
+    return (
+        len(token) >= 32
+        and len(set(token)) > 1
+        and not placeholder.startswith(("replace-with-", "replace-me", "change-me", "changeme", "your-setup-token"))
+    )
+
+
+def consume_bootstrap_attempt(client_ip: str) -> int | None:
+    """Atomically reserve one attempt; return Retry-After when limited.
+
+    The IP is keyed using the existing HMAC helper, never stored in clear text.
+    A shared cap limits distributed attempts and expensive password hashing.
+    """
+    now = time()
+    cutoff = now - BOOTSTRAP_WINDOW_SECONDS
+    limits = (
+        ("setup-ip", db._rate_limit_key_hash(client_ip), BOOTSTRAP_IP_ATTEMPTS),
+        ("setup-global", db._rate_limit_key_hash("bootstrap"), BOOTSTRAP_GLOBAL_ATTEMPTS),
+    )
+    with db._connect() as conn:
+        conn.execute("BEGIN IMMEDIATE")
+        conn.execute(
+            "DELETE FROM installation_setup_attempts WHERE occurred_at < ?",
+            (cutoff,),
+        )
+        retry_after = 0
+        for scope, key, maximum in limits:
+            count, oldest = conn.execute(
+                """SELECT COUNT(*), MIN(occurred_at) FROM installation_setup_attempts
+                   WHERE scope = ? AND key_hash = ? AND occurred_at >= ?""",
+                (scope, key, cutoff),
+            ).fetchone()
+            if count >= maximum:
+                retry_after = max(retry_after, ceil(BOOTSTRAP_WINDOW_SECONDS - (now - oldest)), 1)
+        if retry_after:
+            return retry_after
+        conn.executemany(
+            "INSERT INTO installation_setup_attempts (scope, key_hash, occurred_at) VALUES (?, ?, ?)",
+            [(scope, key, now) for scope, key, _ in limits],
+        )
+    return None
+
+
+def bootstrap_administrator(setup_token: str, username: str, password: str) -> None:
+    """Claim fresh setup exactly once using the deployment's setup token."""
+    expected = str(getattr(settings, "setup_token", "") or "")
+    if not setup_token_configured() or not hmac.compare_digest(
+        setup_token.encode("utf-8"), expected.encode("utf-8")
+    ):
+        raise InvalidSetupTokenError("Invalid setup token.")
+    username = username.strip()
+    if not username or len(username) > 100 or any(
+        character.isspace() or ord(character) < 32 or ord(character) == 127 for character in username
+    ):
+        raise ValueError("Username must contain 1 to 100 characters without spaces or control characters.")
+    if len(password) > 1024:
+        raise ValueError("Password must contain no more than 1024 characters.")
+    password = validate_password_policy(password)
+    if not is_setup_required() or db.has_admin_user():
+        raise SetupUnavailableError("Initial administrator setup is no longer available.")
+
+    password_hash = hash_password(password)
+    with db._connect() as conn:
+        conn.execute("BEGIN IMMEDIATE")
+        setup = conn.execute("SELECT completed FROM installation_setup WHERE id = 1").fetchone()
+        admin = conn.execute("SELECT 1 FROM users WHERE LOWER(role) = 'admin' LIMIT 1").fetchone()
+        if setup is None or setup[0] or admin:
+            raise SetupUnavailableError("Initial administrator setup is no longer available.")
+        if any(str(row[0]).strip().casefold() == username.casefold() for row in conn.execute("SELECT username FROM users")):
+            raise SetupUnavailableError("That username already exists.")
+        conn.execute(
+            """INSERT INTO users (username, password_hash, role, auth_provider, created_at)
+               VALUES (?, ?, 'admin', 'local', ?)""",
+            (username, password_hash, datetime.now(timezone.utc).isoformat()),
+        )
+        conn.execute("UPDATE installation_setup SET step = 'apps' WHERE id = 1")
+
+
+def update_setup_step(step: SetupStep) -> dict:
+    if step not in SETUP_STEPS:
+        raise ValueError("Invalid setup step.")
+    if not is_setup_required():
+        return get_setup_state()
+    with db._connect() as conn:
+        conn.execute(
+            "UPDATE installation_setup SET step = ? WHERE id = 1 AND completed = 0", (step,)
+        )
+    return get_setup_state()
+
+
+def complete_setup() -> dict:
+    if not is_setup_required():
+        return get_setup_state()
+    with db._connect() as conn:
+        conn.execute("BEGIN IMMEDIATE")
+        if not conn.execute("SELECT 1 FROM users WHERE LOWER(role) = 'admin' LIMIT 1").fetchone():
+            raise SetupUnavailableError("Create an administrator before completing setup.")
+        conn.execute(
+            """UPDATE installation_setup SET completed = 1, step = 'review', completed_at = ?
+               WHERE id = 1 AND completed = 0""",
+            (datetime.now(timezone.utc).isoformat(),),
+        )
+    return get_setup_state()

backend/app/services/snapshot.py

@@ -32,6 +32,7 @@ from ..models import ActionOption, NormalizedState, RequestType, Snapshot, Timel
 from .collector_search import read_search_status
 from .media_repair import current_cycle_torrents, evaluate_media_repair
 from .download_labels import label_episode_downloads
+from .arr import RootFolderNotFoundError, resolve_root_folder_path
 
 logger = logging.getLogger(__name__)
 
@@ -369,6 +370,38 @@ def _episode_availability(episodes: Any) -> Dict[str, Any]:
     }
 
 
+def _unmonitored_season_options(series: Any, episodes: Any) -> List[Dict[str, int]]:
+    """Describe regular Sonarr seasons that can be added to an existing request."""
+    if not isinstance(series, dict) or not isinstance(series.get("seasons"), list):
+        return []
+    episode_rows = [episode for episode in episodes if isinstance(episode, dict)] if isinstance(episodes, list) else []
+    options: List[Dict[str, int]] = []
+    for season in series["seasons"]:
+        if not isinstance(season, dict) or season.get("monitored") is not False:
+            continue
+        season_number = season.get("seasonNumber")
+        if not isinstance(season_number, int) or season_number <= 0:
+            continue
+        matching = [episode for episode in episode_rows if episode.get("seasonNumber") == season_number]
+        statistics = season.get("statistics") if isinstance(season.get("statistics"), dict) else {}
+        episode_count = statistics.get("totalEpisodeCount")
+        if not isinstance(episode_count, int):
+            episode_count = statistics.get("episodeCount")
+        if not isinstance(episode_count, int):
+            episode_count = len(matching)
+        available = statistics.get("episodeFileCount")
+        if not isinstance(available, int):
+            available = sum(1 for episode in matching if episode.get("hasFile") is True)
+        options.append(
+            {
+                "seasonNumber": season_number,
+                "episodeCount": max(0, episode_count),
+                "available": max(0, available),
+            }
+        )
+    return sorted(options, key=lambda item: item["seasonNumber"])
+
+
 def _summarize_qbit(torrents: List[Dict[str, Any]]) -> Dict[str, Any]:
     if not torrents:
         return {"state": "idle", "message": "0 active downloads."}
@@ -939,6 +972,7 @@ def _build_presentation(
                 "missing": missing,
                 "total": total,
                 "seasons": availability.get("seasons") or [],
+                "unmonitoredSeasons": arr_details.get("unmonitoredSeasons") or [],
                 "missingEpisodes": arr_details.get("missingEpisodes") or {},
             },
             {
@@ -1201,11 +1235,6 @@ async def build_snapshot(request_id: str) -> Snapshot:
     arr_item = None
     arr_queue = None
     episodes = None
-    media_status = jelly_request.get("media", {}).get("status")
-    try:
-        media_status_code = int(media_status) if media_status is not None else None
-    except (TypeError, ValueError):
-        media_status_code = None
     if snapshot.request_type == RequestType.tv:
         tvdb_id = jelly_request.get("media", {}).get("tvdbId")
         if tvdb_id:
@@ -1240,6 +1269,7 @@ async def build_snapshot(request_id: str) -> Snapshot:
                         "state": await read_search_status(sonarr, RequestType.tv, series_id, episodes)
                     }
                     arr_details["availability"] = _episode_availability(episodes)
+                    arr_details["unmonitoredSeasons"] = _unmonitored_season_options(arr_item, episodes)
                     counts = arr_details["availability"]
                     arr_state = "available" if counts.get("total", 0) > 0 and not counts.get("missing") else "added"
                     missing_by_season = _missing_episode_numbers_by_season(episodes)
@@ -1356,11 +1386,15 @@ async def build_snapshot(request_id: str) -> Snapshot:
             if runtime.radarr_quality_profile_id and runtime.radarr_root_folder:
                 radarr_client = RadarrClient(runtime.radarr_base_url, runtime.radarr_api_key)
                 if radarr_client.configured():
-                    root_folder = await _resolve_root_folder_path(
-                        radarr_client, runtime.radarr_root_folder, "Radarr"
-                    )
+                    try:
+                        root_folder = await resolve_root_folder_path(
+                            radarr_client, runtime.radarr_root_folder, "Radarr"
+                        )
+                    except RootFolderNotFoundError as exc:
+                        logger.warning("Skipping Jellyfin-to-Radarr sync: %s", exc)
+                        root_folder = ""
                     tmdb_id = jelly_request.get("media", {}).get("tmdbId")
-                    if tmdb_id:
+                    if tmdb_id and root_folder:
                         try:
                             await radarr_client.add_movie(
                                 int(tmdb_id),
@@ -1375,11 +1409,15 @@ async def build_snapshot(request_id: str) -> Snapshot:
             if runtime.sonarr_quality_profile_id and runtime.sonarr_root_folder:
                 sonarr_client = SonarrClient(runtime.sonarr_base_url, runtime.sonarr_api_key)
                 if sonarr_client.configured():
-                    root_folder = await _resolve_root_folder_path(
-                        sonarr_client, runtime.sonarr_root_folder, "Sonarr"
-                    )
+                    try:
+                        root_folder = await resolve_root_folder_path(
+                            sonarr_client, runtime.sonarr_root_folder, "Sonarr"
+                        )
+                    except RootFolderNotFoundError as exc:
+                        logger.warning("Skipping Jellyfin-to-Sonarr sync: %s", exc)
+                        root_folder = ""
                     tvdb_id = jelly_request.get("media", {}).get("tvdbId")
-                    if tvdb_id:
+                    if tvdb_id and root_folder:
                         try:
                             await sonarr_client.add_series(
                                 int(tvdb_id),

backend/requirements-dev.txt

@@ -0,0 +1,4 @@
+-r requirements.txt
+coverage==7.16.1
+pip-audit==2.10.1
+ruff==0.16.8

backend/requirements.txt

@@ -5,6 +5,8 @@ pydantic==2.12.5
 pydantic-settings==2.14.2
 PyJWT==2.13.0
 passlib==1.7.4
+argon2-cffi==25.1.0
+cryptography==50.0.1
 python-multipart==0.0.31
 Pillow==12.3.0
 prometheus-client==0.22.1

backend/tests/test_api_models.py

@@ -0,0 +1,24 @@
+import unittest
+
+from pydantic import ValidationError
+
+from backend.app.api_models import PasswordResetRequest, SignupRequest
+
+
+class ApiRequestModelTests(unittest.TestCase):
+    def test_signup_rejects_unknown_fields(self) -> None:
+        with self.assertRaises(ValidationError):
+            SignupRequest(
+                invite_code="invite",
+                username="viewer",
+                password="strong password",
+                unexpected="value",
+            )
+
+    def test_password_reset_preserves_password_whitespace_for_policy_validation(self) -> None:
+        request = PasswordResetRequest(token="token", new_password=" leading and trailing ")
+        self.assertEqual(request.new_password, " leading and trailing ")
+
+
+if __name__ == "__main__":
+    unittest.main()

backend/tests/test_arr_helpers.py

@@ -0,0 +1,24 @@
+import unittest
+
+from backend.app.services.arr import RootFolderNotFoundError, resolve_root_folder_path
+
+
+class _ArrClient:
+    async def get_root_folders(self):
+        return [{"id": 7, "path": "/media/tv"}]
+
+
+class ArrHelperTests(unittest.IsolatedAsyncioTestCase):
+    async def test_resolves_numeric_root_folder_id(self) -> None:
+        self.assertEqual(await resolve_root_folder_path(_ArrClient(), "7", "Sonarr"), "/media/tv")
+
+    async def test_preserves_configured_path(self) -> None:
+        self.assertEqual(await resolve_root_folder_path(_ArrClient(), "/media/movies", "Radarr"), "/media/movies")
+
+    async def test_rejects_missing_root_folder_id(self) -> None:
+        with self.assertRaises(RootFolderNotFoundError):
+            await resolve_root_folder_path(_ArrClient(), "8", "Sonarr")
+
+
+if __name__ == "__main__":
+    unittest.main()

backend/tests/test_backend_quality.py

@@ -2,27 +2,29 @@ import os
 from types import SimpleNamespace
 import tempfile
 import unittest
-from unittest.mock import AsyncMock, patch
+from unittest.mock import AsyncMock, call, patch
 
 import httpx
 from fastapi import HTTPException
+from passlib.context import CryptContext
 from starlette.requests import Request
 
 from backend.app import db
 from backend.app.clients.base import _operation_error_message, _operation_result_message
 from backend.app.clients.jellyfin import _availability_message
 from backend.app.clients.qbittorrent import _torrent_result_message
-from backend.app.auth import require_admin
+from backend.app.auth import _load_current_user_from_token, require_admin
 from backend.app.config import settings
 from backend.app.network_security import request_trusts_forwarded_headers, validate_notification_target_url
 from backend.app.models import ActionOption, NormalizedState, RequestType, Snapshot, TimelineHop
 from backend.app.routers import auth as auth_router
 from backend.app.routers import admin as admin_router
+from backend.app.routers import branding as branding_router
 from backend.app.routers import portal as portal_router
 from backend.app.routers import requests as requests_router
 from backend.app.routers import site as site_router
 from backend.app.routers import status as status_router
-from backend.app.security import PASSWORD_POLICY_MESSAGE, validate_password_policy
+from backend.app.security import PASSWORD_POLICY_MESSAGE, create_access_token, validate_password_policy
 from backend.app.services import password_reset
 from backend.app.services import issue_resolution
 from backend.app.services.operation_progress import (
@@ -39,6 +41,7 @@ from backend.app.services.snapshot import (
     _build_repair_activity,
     _episode_availability,
     _torrent_progress,
+    _unmonitored_season_options,
 )
 
 
@@ -70,21 +73,16 @@ class TempDatabaseMixin:
         self._tempdir = tempfile.TemporaryDirectory(ignore_cleanup_errors=True)
         self._original_sqlite_path = settings.sqlite_path
         self._original_journal_mode = getattr(settings, "sqlite_journal_mode", "DELETE")
+        self._original_settings_encryption_key = settings.settings_encryption_key
         settings.sqlite_path = os.path.join(self._tempdir.name, "test.db")
         settings.sqlite_journal_mode = "DELETE"
-        auth_router._LOGIN_ATTEMPTS_BY_IP.clear()
-        auth_router._LOGIN_ATTEMPTS_BY_USER.clear()
-        auth_router._RESET_ATTEMPTS_BY_IP.clear()
-        auth_router._RESET_ATTEMPTS_BY_IDENTIFIER.clear()
+        settings.settings_encryption_key = "bWFnZW50LXNlY3VyaXR5LXRlc3Qta2V5LTMyLWJ5dGU="
         db.init_db()
 
     def tearDown(self) -> None:
         settings.sqlite_path = self._original_sqlite_path
         settings.sqlite_journal_mode = self._original_journal_mode
-        auth_router._LOGIN_ATTEMPTS_BY_IP.clear()
-        auth_router._LOGIN_ATTEMPTS_BY_USER.clear()
-        auth_router._RESET_ATTEMPTS_BY_IP.clear()
-        auth_router._RESET_ATTEMPTS_BY_IDENTIFIER.clear()
+        settings.settings_encryption_key = self._original_settings_encryption_key
         self._tempdir.cleanup()
         super_method = getattr(super(), "tearDown", None)
         if callable(super_method):
@@ -97,7 +95,204 @@ class PasswordPolicyTests(unittest.TestCase):
             validate_password_policy("short")
 
     def test_validate_password_policy_trims_whitespace(self) -> None:
-        self.assertEqual(validate_password_policy("  password123  "), "password123")
+        self.assertEqual(validate_password_policy("  password1234  "), "password1234")
+
+
+class SecurityHardeningTests(TempDatabaseMixin, unittest.IsolatedAsyncioTestCase):
+    def setUp(self) -> None:
+        super().setUp()
+        self._jwt_secret = patch.object(
+            settings, "jwt_secret", "security-hardening-tests-secret-123456789"
+        )
+        self._jwt_secret.start()
+        self.addCleanup(self._jwt_secret.stop)
+
+    def test_sensitive_settings_are_encrypted_at_rest(self) -> None:
+        db.set_setting("jellyfin_api_key", "private-api-key")
+
+        with db._connect() as conn:
+            stored = conn.execute(
+                "SELECT value FROM settings WHERE key = ?", ("jellyfin_api_key",)
+            ).fetchone()[0]
+
+        self.assertTrue(stored.startswith("enc:v1:"))
+        self.assertNotIn("private-api-key", stored)
+        self.assertEqual(db.get_setting("jellyfin_api_key"), "private-api-key")
+
+    def test_invites_are_hashed_and_rotation_invalidates_old_link(self) -> None:
+        created = db.create_signup_invite(code="TopSecretInvite42")
+        invite_id = int(created["id"])
+
+        with db._connect() as conn:
+            stored = conn.execute(
+                "SELECT code FROM signup_invites WHERE id = ?", (invite_id,)
+            ).fetchone()[0]
+
+        self.assertTrue(stored.startswith("sha256:"))
+        self.assertNotIn("TOPSECRETINVITE42", stored.upper())
+        self.assertFalse(db.get_signup_invite_by_id(invite_id)["code_available"])
+        self.assertIsNotNone(db.get_signup_invite_by_code("TopSecretInvite42"))
+
+        rotated = db.rotate_signup_invite_code(invite_id, "ReplacementInvite99")
+        self.assertTrue(rotated["code_available"])
+        self.assertIsNone(db.get_signup_invite_by_code("TopSecretInvite42"))
+        self.assertIsNotNone(db.get_signup_invite_by_code("ReplacementInvite99"))
+
+    def test_legacy_invites_and_plaintext_settings_migrate_in_place(self) -> None:
+        created = db.create_signup_invite(code="TemporaryInvite77")
+        with db._connect() as conn:
+            conn.execute(
+                "UPDATE signup_invites SET code = ?, code_hint = NULL WHERE id = ?",
+                ("Legacy-Code-77", int(created["id"])),
+            )
+            conn.execute(
+                "INSERT OR REPLACE INTO settings (key, value, updated_at) VALUES (?, ?, ?)",
+                ("radarr_api_key", "legacy-plaintext-key", "2026-09-17T00:00:00+00:00"),
+            )
+
+        db.init_db()
+
+        migrated = db.get_signup_invite_by_code("Legacy-Code-77")
+        self.assertEqual(migrated["id"], created["id"])
+        self.assertEqual(db.get_setting("radarr_api_key"), "legacy-plaintext-key")
+        with db._connect() as conn:
+            invite_code = conn.execute(
+                "SELECT code FROM signup_invites WHERE id = ?", (int(created["id"]),)
+            ).fetchone()[0]
+            stored_setting = conn.execute(
+                "SELECT value FROM settings WHERE key = 'radarr_api_key'"
+            ).fetchone()[0]
+        self.assertTrue(invite_code.startswith("sha256:"))
+        self.assertTrue(stored_setting.startswith("enc:v1:"))
+
+    def test_legacy_password_hash_is_replaced_with_argon2(self) -> None:
+        password = "Example-password123!"
+        db.create_user("legacy", password)
+        legacy_hash = CryptContext(schemes=["pbkdf2_sha256"]).hash(password)
+        with db._connect() as conn:
+            conn.execute(
+                "UPDATE users SET password_hash = ? WHERE username = ?",
+                (legacy_hash, "legacy"),
+            )
+
+        self.assertIsNotNone(db.verify_user_password("legacy", password))
+        self.assertTrue(db.get_user_by_username("legacy")["password_hash"].startswith("$argon2"))
+
+    def test_auth_version_revokes_existing_token(self) -> None:
+        db.create_user("viewer", "Example-password123!")
+        user = db.get_user_by_username("viewer")
+        token = create_access_token(
+            "viewer", "user", auth_version=int(user["auth_version"])
+        )
+        self.assertEqual(_load_current_user_from_token(token)["username"], "viewer")
+
+        db.increment_user_auth_version("viewer")
+        with self.assertRaises(HTTPException) as context:
+            _load_current_user_from_token(token)
+        self.assertEqual(context.exception.status_code, 401)
+
+    async def test_request_mutations_require_owner_or_admin(self) -> None:
+        runtime = SimpleNamespace(
+            jellyseerr_base_url="http://seerr.test", jellyseerr_api_key="secret"
+        )
+        client = SimpleNamespace(
+            configured=lambda: True,
+            get_request=AsyncMock(
+                return_value={"id": 42, "requestedBy": {"username": "owner"}}
+            ),
+        )
+        with patch.object(requests_router, "JellyseerrClient", return_value=client):
+            with self.assertRaises(HTTPException) as context:
+                await requests_router._ensure_request_mutation_access(
+                    runtime, 42, {"username": "someone-else", "role": "user"}
+                )
+            self.assertEqual(context.exception.status_code, 403)
+            owned = await requests_router._ensure_request_mutation_access(
+                runtime, 42, {"username": "owner", "role": "user"}
+            )
+            self.assertEqual(owned["id"], 42)
+
+        self.assertIsNone(
+            await requests_router._ensure_request_mutation_access(
+                SimpleNamespace(), 42, {"username": "admin", "role": "admin"}
+            )
+        )
+
+    def test_account_deletion_removes_or_anonymizes_personal_data(self) -> None:
+        db.create_user(
+            "viewer", "Example-password123!", email="viewer@example.test"
+        )
+        user = db.get_user_by_username("viewer")
+        now = "2026-09-17T00:00:00+00:00"
+        db.upsert_request_cache(
+            42,
+            99,
+            "movie",
+            2,
+            "Example",
+            2026,
+            "viewer",
+            "viewer",
+            int(user["id"]),
+            now,
+            now,
+            '{"requestedBy":{"username":"viewer","email":"viewer@example.test"}}',
+        )
+        with db._connect() as conn:
+            conn.execute(
+                "INSERT INTO snapshots (request_id, state, created_at, payload_json) VALUES (?, ?, ?, ?)",
+                (
+                    "42",
+                    "available",
+                    now,
+                    '{"requestedBy":{"username":"viewer","email":"viewer@example.test"}}',
+                ),
+            )
+        db.save_action("42", "created", "Created", "ok", "Created by viewer")
+        item = db.create_portal_item(
+            kind="issue",
+            title="Example",
+            description="Example",
+            created_by_username="viewer",
+            created_by_id=int(user["id"]),
+        )
+
+        result = db.delete_user_data_by_username("viewer")
+
+        self.assertTrue(result["deleted"])
+        self.assertIsNone(db.get_user_by_username("viewer"))
+        with db._connect() as conn:
+            request_row = conn.execute(
+                "SELECT requested_by, requested_by_id, payload_json FROM requests_cache WHERE request_id = 42"
+            ).fetchone()
+            snapshot_json = conn.execute(
+                "SELECT payload_json FROM snapshots WHERE request_id = '42'"
+            ).fetchone()[0]
+            action_message = conn.execute(
+                "SELECT message FROM actions WHERE request_id = '42'"
+            ).fetchone()[0]
+            portal_owner = conn.execute(
+                "SELECT created_by_username, created_by_id FROM portal_items WHERE id = ?",
+                (item["id"],),
+            ).fetchone()
+        self.assertEqual(request_row[0], "Deleted user")
+        self.assertIsNone(request_row[1])
+        self.assertNotIn("viewer", request_row[2].lower())
+        self.assertNotIn("viewer", snapshot_json.lower())
+        self.assertNotIn("viewer", action_message.lower())
+        self.assertTrue(portal_owner[0].startswith("deleted-user-"))
+        self.assertIsNone(portal_owner[1])
+
+    async def test_branding_upload_rejects_oversized_images_before_decode(self) -> None:
+        upload = SimpleNamespace(
+            filename="logo.png",
+            content_type="image/png",
+            read=AsyncMock(return_value=b"x" * (5 * 1024 * 1024 + 1)),
+        )
+        with self.assertRaises(HTTPException) as context:
+            await branding_router.save_branding_image(upload)
+        self.assertEqual(context.exception.status_code, 413)
+        upload.read.assert_awaited_once_with(5 * 1024 * 1024 + 1)
 
 
 class NetworkSecurityTests(unittest.TestCase):
@@ -298,6 +493,9 @@ class SiteInfoTests(unittest.TestCase):
             site_banner_enabled=False,
             site_banner_message="",
             site_banner_tone="info",
+            site_banner_background_color=None,
+            site_banner_border_color=None,
+            site_login_message="",
             site_login_show_jellyfin_login=True,
             site_login_show_local_login=True,
             site_login_show_forgot_password=True,
@@ -310,6 +508,49 @@ class SiteInfoTests(unittest.TestCase):
 
         self.assertEqual(info["navigation"], {"showRequests": False})
 
+    def test_site_public_exposes_safe_banner_colours_and_login_message(self) -> None:
+        runtime = settings.model_copy(update={
+            "site_banner_enabled": True,
+            "site_banner_message": "Planned maintenance",
+            "site_banner_tone": "warning",
+            "site_banner_background_color": "#123ABC",
+            "site_banner_border_color": "red",
+            "site_login_message": "Use your Grizzlyflix account to sign in.",
+        })
+
+        with patch.object(site_router, "get_runtime_settings", return_value=runtime):
+            info = site_router._build_site_info(False)
+
+        self.assertEqual(info["banner"]["backgroundColor"], "#123abc")
+        self.assertIsNone(info["banner"]["borderColor"])
+        self.assertEqual(info["login"]["message"], "Use your Grizzlyflix account to sign in.")
+
+
+class SiteSettingValidationTests(unittest.IsolatedAsyncioTestCase):
+    async def test_banner_colours_are_normalized_before_saving(self) -> None:
+        with patch.object(admin_router, "set_setting") as save:
+            result = await admin_router.update_settings({
+                "site_banner_background_color": "#A1B2C3",
+                "site_banner_border_color": "#010203",
+            })
+
+        self.assertEqual(result, {"status": "ok", "updated": 2})
+        self.assertEqual(
+            save.call_args_list,
+            [
+                call("site_banner_background_color", "#a1b2c3"),
+                call("site_banner_border_color", "#010203"),
+            ],
+        )
+
+    async def test_banner_colours_reject_unsafe_css_values(self) -> None:
+        with self.assertRaises(HTTPException) as raised:
+            await admin_router.update_settings({
+                "site_banner_border_color": "red; background: url(example)",
+            })
+
+        self.assertEqual(raised.exception.status_code, 400)
+
 
 class RequestCacheTests(unittest.TestCase):
     def tearDown(self) -> None:
@@ -521,6 +762,34 @@ class RequestPresentationTests(unittest.TestCase):
         self.assertEqual(availability["missing"], 1)
         self.assertEqual(availability["total"], 2)
 
+    def test_unmonitored_seasons_are_offered_separately_from_collection_progress(self) -> None:
+        series = {
+            "seasons": [
+                {"seasonNumber": 0, "monitored": False},
+                {"seasonNumber": 7, "monitored": True},
+                {
+                    "seasonNumber": 8,
+                    "monitored": False,
+                    "statistics": {"episodeCount": 16, "episodeFileCount": 2},
+                },
+                {"seasonNumber": 9, "monitored": False},
+            ]
+        }
+        episodes = [
+            {"seasonNumber": 9, "episodeNumber": 1, "hasFile": True},
+            {"seasonNumber": 9, "episodeNumber": 2, "hasFile": False},
+        ]
+
+        options = _unmonitored_season_options(series, episodes)
+
+        self.assertEqual(
+            options,
+            [
+                {"seasonNumber": 8, "episodeCount": 16, "available": 2},
+                {"seasonNumber": 9, "episodeCount": 2, "available": 1},
+            ],
+        )
+
     def test_presentation_hides_download_without_download_evidence(self) -> None:
         snapshot = Snapshot(
             request_id="3909",
@@ -1133,6 +1402,13 @@ class CollectorManualDownloadTests(unittest.IsolatedAsyncioTestCase):
         secret = patch.object(settings, 'jwt_secret', 'manual-release-tests-secret-1234567890123456')
         secret.start()
         self.addCleanup(secret.stop)
+        access = patch.object(
+            requests_router,
+            "_ensure_request_mutation_access",
+            new=AsyncMock(return_value=None),
+        )
+        access.start()
+        self.addCleanup(access.stop)
 
     def selection(self, payload, request_id, source):
         payload['selectionToken'] = requests_router.manual_releases.issue_selection(
@@ -1553,6 +1829,16 @@ class AuthFlowTests(TempDatabaseMixin, unittest.IsolatedAsyncioTestCase):
 
 
 class MediaReplacementTests(TempDatabaseMixin, unittest.IsolatedAsyncioTestCase):
+    def setUp(self) -> None:
+        super().setUp()
+        access = patch.object(
+            requests_router,
+            "_ensure_request_mutation_access",
+            new=AsyncMock(return_value=None),
+        )
+        access.start()
+        self.addCleanup(access.stop)
+
     def test_failed_repair_marks_linked_issue_as_blocked(self) -> None:
         issue = {"id": 12, "status": "in_progress"}
         with (
@@ -1846,6 +2132,103 @@ class MediaReplacementTests(TempDatabaseMixin, unittest.IsolatedAsyncioTestCase)
         sonarr.search_episodes.assert_awaited_once_with([36899])
         sonarr.search.assert_not_awaited()
 
+    async def test_add_seasons_monitors_series_and_searches_released_missing_episodes(self) -> None:
+        snapshot = Snapshot(
+            request_id="3580",
+            title="Suits",
+            request_type=RequestType.tv,
+            state=NormalizedState.available,
+            raw={"arr": {"item": {"id": 540}}},
+        )
+        refreshed = Snapshot(
+            request_id="3580",
+            title="Suits",
+            request_type=RequestType.tv,
+            state=NormalizedState.importing,
+            presentation={"pipeline": [{"id": "library", "unmonitoredSeasons": []}]},
+        )
+        original_series = {
+            "id": 540,
+            "monitored": True,
+            "qualityProfileId": 7,
+            "seasons": [
+                {"seasonNumber": 7, "monitored": True},
+                {"seasonNumber": 8, "monitored": False},
+                {"seasonNumber": 9, "monitored": False},
+            ],
+        }
+        updated_series = {
+            **original_series,
+            "seasons": [
+                {"seasonNumber": 7, "monitored": True},
+                {"seasonNumber": 8, "monitored": True},
+                {"seasonNumber": 9, "monitored": True},
+            ],
+        }
+        episodes = [
+            {
+                "id": 801,
+                "seasonNumber": 8,
+                "episodeNumber": 1,
+                "monitored": False,
+                "hasFile": False,
+                "airDateUtc": "2018-07-18T00:00:00Z",
+            },
+            {
+                "id": 802,
+                "seasonNumber": 8,
+                "episodeNumber": 2,
+                "monitored": False,
+                "hasFile": True,
+                "episodeFileId": 88,
+            },
+            {
+                "id": 901,
+                "seasonNumber": 9,
+                "episodeNumber": 1,
+                "monitored": False,
+                "hasFile": False,
+                "airDateUtc": "2019-07-17T00:00:00Z",
+            },
+        ]
+        verified_episodes = [{**episode, "monitored": True} for episode in episodes]
+        sonarr = SimpleNamespace(
+            configured=lambda: True,
+            get_series=AsyncMock(side_effect=[original_series, updated_series]),
+            update_series=AsyncMock(return_value=updated_series),
+            get_episodes=AsyncMock(side_effect=[episodes, verified_episodes]),
+            monitor_episodes=AsyncMock(return_value={"monitored": True}),
+            search_episodes=AsyncMock(return_value={"id": 9001}),
+        )
+        runtime = SimpleNamespace(
+            jellyseerr_base_url=None,
+            jellyseerr_api_key=None,
+            sonarr_base_url="http://sonarr",
+            sonarr_api_key="secret",
+        )
+        with (
+            patch.object(requests_router, "get_runtime_settings", return_value=runtime),
+            patch.object(
+                requests_router,
+                "build_snapshot",
+                new=AsyncMock(side_effect=[snapshot, refreshed]),
+            ),
+            patch.object(requests_router, "SonarrClient", return_value=sonarr),
+            patch.object(requests_router, "save_action"),
+        ):
+            result = await requests_router.action_add_seasons(
+                "3580",
+                {"season_numbers": [8, 9]},
+                {"username": "viewer", "role": "user", "auto_search_enabled": True},
+            )
+
+        self.assertEqual(result["season_numbers"], [8, 9])
+        self.assertEqual(result["searched_episode_count"], 2)
+        self.assertTrue(result["snapshot"].presentation["pipeline"][0]["canAddSeasons"])
+        sonarr.update_series.assert_awaited_once_with(updated_series)
+        sonarr.monitor_episodes.assert_awaited_once_with([801, 802, 901], True)
+        sonarr.search_episodes.assert_awaited_once_with([801, 901])
+
     async def test_missing_movie_search_monitors_movie_before_search(self) -> None:
         snapshot = Snapshot(
             request_id="3914",
@@ -1900,6 +2283,11 @@ class MediaReplacementTests(TempDatabaseMixin, unittest.IsolatedAsyncioTestCase)
             patch.object(requests_router, "get_runtime_settings", return_value=runtime),
             patch.object(requests_router, "build_snapshot", new=AsyncMock(return_value=snapshot)),
             patch.object(requests_router, "BazarrClient", return_value=bazarr),
+            patch.object(
+                requests_router,
+                "_ensure_request_mutation_access",
+                new=AsyncMock(return_value=None),
+            ),
             patch.object(requests_router, "save_action"),
             patch.object(requests_router, "get_portal_item", return_value={
                 "id": 12,
@@ -2012,28 +2400,28 @@ class InviteOperationalStateTests(TempDatabaseMixin, unittest.IsolatedAsyncioTes
 
     async def test_invite_list_reports_automatic_operational_states(self) -> None:
         ready = db.create_signup_invite(code="READY", recipient_email="ready@example.com")
-        db.create_signup_invite(code="DISABLED", enabled=False, recipient_email="off@example.com")
+        disabled = db.create_signup_invite(code="DISABLED", enabled=False, recipient_email="off@example.com")
         used = db.create_signup_invite(code="USED", max_uses=1, recipient_email="used@example.com")
         db.increment_signup_invite_use(int(used["id"]))
-        db.create_signup_invite(
+        expired = db.create_signup_invite(
             code="EXPIRED",
             expires_at="2000-01-01T00:00:00+00:00",
             recipient_email="expired@example.com",
         )
-        db.create_signup_invite(
+        no_profile = db.create_signup_invite(
             code="NO-PROFILE",
             profile_id=999,
             recipient_email="profile@example.com",
         )
 
         payload = await admin_router.get_invites()
-        states = {invite["code"]: invite["operational_state"] for invite in payload["invites"]}
+        states = {invite["id"]: invite["operational_state"] for invite in payload["invites"]}
 
-        self.assertEqual(states[ready["code"]], "ready")
-        self.assertEqual(states["DISABLED"], "disabled")
-        self.assertEqual(states["USED"], "exhausted")
-        self.assertEqual(states["EXPIRED"], "expired")
-        self.assertEqual(states["NO-PROFILE"], "profile_unavailable")
+        self.assertEqual(states[ready["id"]], "ready")
+        self.assertEqual(states[disabled["id"]], "disabled")
+        self.assertEqual(states[used["id"]], "exhausted")
+        self.assertEqual(states[expired["id"]], "expired")
+        self.assertEqual(states[no_profile["id"]], "profile_unavailable")
         self.assertEqual(payload["summary"]["total"], 5)
         self.assertEqual(payload["summary"]["ready"], 1)
         self.assertEqual(payload["summary"]["attention"], 4)

backend/tests/test_backups.py

@@ -0,0 +1,310 @@
+from contextlib import closing
+import io
+import json
+from pathlib import Path
+import sqlite3
+import tempfile
+import unittest
+from unittest.mock import patch
+import zipfile
+
+from cryptography.fernet import Fernet
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from backend.app import db
+from backend.app.auth import get_current_user
+from backend.app.config import settings
+from backend.app.routers import backups as backup_router
+from backend.app.services import backups
+
+
+PASSPHRASE = "test backup passphrase with spaces"
+
+
+class BackupTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.database = self.root / "magent.db"
+        for key, value in {
+            "sqlite_path": str(self.database), "sqlite_journal_mode": "DELETE",
+            "settings_encryption_key": Fernet.generate_key().decode(),
+            "jwt_secret": "source-installation-signing-secret-for-backup-tests",
+            "admin_username": "backup-admin", "admin_password": "a secure initial password",
+            "jellyfin_api_key": "environment-integration-secret", "setup_token": "local-setup-token",
+            "discord_webhook_url": "https://discord.example.invalid/api/webhooks/legacy-private-token",
+        }.items():
+            context = patch.object(settings, key, value)
+            context.start()
+            self.addCleanup(context.stop)
+        context = patch.object(backups, "_assets_root", return_value=self.root / "assets")
+        context.start()
+        self.addCleanup(context.stop)
+        db.init_db()
+        db.set_setting("sonarr_api_key", "database-integration-secret")
+        db.set_setting("site_login_message", "Restored configuration")
+        db.set_setting("installation_setup", "complete")
+        with closing(sqlite3.connect(self.database)) as conn, conn:
+            conn.execute("INSERT INTO requests_cache(request_id,title,payload_json) VALUES (3580,'Suits','{}')")
+            conn.execute(
+                "INSERT INTO signup_invites(code,enabled,created_at,updated_at) VALUES ('sha256:existing-invite',1,'now','now')"
+            )
+        self.assets = self.root / "assets"
+        (self.assets / "branding").mkdir(parents=True)
+        (self.assets / "branding" / "logo.png").write_bytes(b"branding fixture")
+        (self.assets / "artwork" / "tmdb" / "w342").mkdir(parents=True)
+        (self.assets / "artwork" / "tmdb" / "w342" / "poster.jpg").write_bytes(b"cached fixture")
+
+    def export(self, include_cache=True):
+        content, filename = backups.create_backup(PASSPHRASE, include_cache)
+        self.assertTrue(filename.endswith(".magent-backup"))
+        return content
+
+    def rewrite_archive(self, content, change):
+        decrypted = backups._decrypt(content, PASSPHRASE)
+        with zipfile.ZipFile(io.BytesIO(decrypted)) as archive:
+            files = {entry.filename: archive.read(entry) for entry in archive.infolist()}
+        change(files)
+        output = io.BytesIO()
+        with zipfile.ZipFile(output, "w") as archive:
+            for name, value in files.items():
+                archive.writestr(name, value)
+        return backups._encrypt(output.getvalue(), PASSPHRASE)
+
+    def test_round_trip_reencrypts_secrets_preserves_invites_and_restores_cache_on_restart(self):
+        content = self.export()
+        self.assertNotIn(b"database-integration-secret", content)
+        self.assertNotIn(b"environment-integration-secret", content)
+        original_auth_version = db.get_user_by_username("backup-admin")["auth_version"]
+        db.set_setting("site_login_message", "Live data before restart")
+        settings.settings_encryption_key = Fernet.generate_key().decode()
+        settings.jwt_secret = "destination-installation-signing-secret-for-backup-tests"
+        # Simulate a different host with different env-backed integration settings.
+        settings.jellyfin_api_key = "destination-env-value"
+        metadata = backups.stage_restore(io.BytesIO(content), PASSPHRASE)
+        self.assertTrue(metadata["include_cache"])
+        self.assertEqual(db.get_setting("site_login_message"), "Live data before restart")
+        self.assertIsNotNone(backups.backup_status()["pending_restore"])
+        staged_bytes = (self.database.parent / "backups" / "pending" / "database.sqlite3").read_bytes()
+        self.assertNotIn(b"database-integration-secret", staged_bytes)
+        self.assertNotIn(b"environment-integration-secret", staged_bytes)
+        self.assertNotIn(b"legacy-private-token", staged_bytes)
+        (self.assets / "branding" / "logo.png").write_bytes(b"changed logo")
+        (self.assets / "artwork" / "tmdb" / "w342" / "poster.jpg").unlink()
+        self.assertTrue(backups.apply_pending_restore())
+        self.assertEqual(db.get_setting("site_login_message"), "Restored configuration")
+        self.assertEqual(db.get_setting("sonarr_api_key"), "database-integration-secret")
+        self.assertEqual(db.get_setting("jellyfin_api_key"), "environment-integration-secret")
+        self.assertEqual(db.get_setting("discord_webhook_url"), "https://discord.example.invalid/api/webhooks/legacy-private-token")
+        self.assertEqual(db.get_setting("installation_setup"), "complete")
+        self.assertIsNone(db.get_setting("setup_token"))
+        self.assertEqual((self.assets / "branding" / "logo.png").read_bytes(), b"branding fixture")
+        self.assertEqual((self.assets / "artwork" / "tmdb" / "w342" / "poster.jpg").read_bytes(), b"cached fixture")
+        self.assertGreater(db.get_user_by_username("backup-admin")["auth_version"], original_auth_version)
+        with closing(sqlite3.connect(self.database)) as conn, conn:
+            self.assertEqual(conn.execute("SELECT title FROM requests_cache WHERE request_id=3580").fetchone(), ("Suits",))
+            self.assertEqual(conn.execute("SELECT code FROM signup_invites").fetchone(), ("sha256:existing-invite",))
+            self.assertTrue(conn.execute("SELECT value FROM settings WHERE key='sonarr_api_key'").fetchone()[0].startswith("enc:v1:"))
+        status = backups.backup_status()
+        self.assertIsNone(status["pending_restore"])
+        self.assertEqual(status["last_restore"]["status"], "restored")
+        self.assertTrue((self.database.parent / "backups" / status["last_restore"]["rollback_directory"] / "database.sqlite3").is_file())
+        self.assertFalse(backups.apply_pending_restore())
+
+    def test_wal_snapshot_contains_committed_uncheckpointed_rows(self):
+        with closing(sqlite3.connect(self.database)) as writer:
+            writer.execute("PRAGMA journal_mode=WAL")
+            writer.execute("PRAGMA wal_autocheckpoint=0")
+            writer.execute("UPDATE requests_cache SET title='Written in WAL' WHERE request_id=3580")
+            writer.commit()
+            self.assertTrue(Path(str(self.database) + "-wal").exists())
+            content = self.export()
+        backups.stage_restore(io.BytesIO(content), PASSPHRASE)
+        self.assertTrue(backups.apply_pending_restore())
+        with closing(sqlite3.connect(self.database)) as restored:
+            self.assertEqual(restored.execute("SELECT title FROM requests_cache").fetchone()[0], "Written in WAL")
+
+    def test_process_interruption_is_recovered_on_next_startup(self):
+        class ProcessStopped(BaseException):
+            pass
+
+        content = self.export()
+        db.set_setting("site_login_message", "Value before interrupted restart")
+        backups.stage_restore(io.BytesIO(content), PASSPHRASE)
+        with patch.object(backups, "_replace_assets", side_effect=ProcessStopped):
+            with self.assertRaises(ProcessStopped):
+                backups.apply_pending_restore()
+        self.assertTrue((self.database.parent / "backups" / "restore-journal.json").exists())
+        self.assertEqual(db.get_setting("site_login_message"), "Restored configuration")
+        self.assertFalse(backups.apply_pending_restore())
+        self.assertEqual(db.get_setting("site_login_message"), "Value before interrupted restart")
+        self.assertEqual(backups.backup_status()["last_restore"]["status"], "rolled_back")
+        self.assertIsNone(backups.backup_status()["pending_restore"])
+
+    def test_crash_after_rollback_does_not_reapply_pending_restore(self):
+        class ProcessStopped(BaseException):
+            pass
+
+        content = self.export()
+        db.set_setting("site_login_message", "Value to retain")
+        backups.stage_restore(io.BytesIO(content), PASSPHRASE)
+        replace_assets = backups._replace_assets
+        remove_tree = backups.shutil.rmtree
+        calls = 0
+
+        def fail_first_copy(source, target):
+            nonlocal calls
+            calls += 1
+            if calls == 1:
+                raise OSError("failed apply")
+            return replace_assets(source, target)
+
+        def interrupt_cleanup(path, *args, **kwargs):
+            if Path(path).name == "pending":
+                raise ProcessStopped()
+            return remove_tree(path, *args, **kwargs)
+
+        with patch.object(backups, "_replace_assets", side_effect=fail_first_copy), \
+                patch.object(backups.shutil, "rmtree", side_effect=interrupt_cleanup):
+            with self.assertRaises(ProcessStopped):
+                backups.apply_pending_restore()
+        journal = json.loads((self.root / "backups" / "restore-journal.json").read_text())
+        self.assertEqual(journal["phase"], "rolled_back")
+        self.assertFalse(backups.apply_pending_restore())
+        self.assertEqual(db.get_setting("site_login_message"), "Value to retain")
+        self.assertIsNone(backups.backup_status()["pending_restore"])
+
+    def test_missing_runtime_column_is_rejected_even_with_current_migration_version(self):
+        directory = self.root / "schema-test"
+        directory.mkdir()
+        backups._extract_archive(backups._decrypt(self.export(), PASSPHRASE), directory)
+        source = directory / "database.sqlite3"
+        with closing(sqlite3.connect(source)) as conn, conn:
+            conn.execute("ALTER TABLE users DROP COLUMN auto_search_enabled")
+        with self.assertRaisesRegex(backups.BackupError, "missing database columns"):
+            backups._validate_database(source)
+
+    def test_changed_encryption_key_since_staging_leaves_live_database_untouched(self):
+        content = self.export()
+        db.set_setting("site_login_message", "Current data")
+        backups.stage_restore(io.BytesIO(content), PASSPHRASE)
+        settings.settings_encryption_key = Fernet.generate_key().decode()
+        with self.assertRaisesRegex(backups.BackupError, "configuration is invalid"):
+            backups.apply_pending_restore()
+        self.assertEqual(db.get_setting("site_login_message"), "Current data")
+        self.assertIsNotNone(backups.backup_status()["pending_restore"])
+
+    def test_excluding_disk_cache_keeps_database_cache_and_branding(self):
+        with zipfile.ZipFile(io.BytesIO(backups._decrypt(self.export(False), PASSPHRASE))) as archive:
+            self.assertIn("database.sqlite3", archive.namelist())
+            self.assertIn("files/branding/logo.png", archive.namelist())
+            self.assertFalse(any("artwork" in name for name in archive.namelist()))
+
+    def test_wrong_password_and_tampering_never_stage_or_touch_live_database(self):
+        content = self.export()
+        for bad_content, password in ((content, "incorrect password value"), (content[:-1] + bytes([content[-1] ^ 1]), PASSPHRASE)):
+            with self.subTest(password=password):
+                with self.assertRaisesRegex(backups.BackupError, "Incorrect passphrase or damaged"):
+                    backups.stage_restore(io.BytesIO(bad_content), password)
+                self.assertIsNone(backups.backup_status()["pending_restore"])
+        self.assertEqual(db.get_setting("sonarr_api_key"), "database-integration-secret")
+
+    def test_path_traversal_unknown_files_and_checksum_failures_rejected(self):
+        content = self.export()
+        for name in ("../outside.txt", "/absolute.txt", "files/branding/../../../escape", "files/branding/script.py"):
+            with self.subTest(name=name):
+                malformed = self.rewrite_archive(content, lambda files: files.update({name: b"bad"}))
+                with self.assertRaises(backups.BackupError):
+                    backups.stage_restore(io.BytesIO(malformed), PASSPHRASE)
+        malformed = self.rewrite_archive(content, lambda files: files.update({"files/branding/logo.png": b"tampered"}))
+        with self.assertRaises(backups.BackupError):
+            backups.stage_restore(io.BytesIO(malformed), PASSPHRASE)
+        self.assertFalse((self.root / "outside.txt").exists())
+
+    def test_size_limit_and_unsupported_schema_rejected(self):
+        content = self.export()
+        with patch.object(backups, "MAX_UPLOAD_BYTES", 16):
+            with self.assertRaisesRegex(backups.BackupError, "upload limit"):
+                backups.stage_restore(io.BytesIO(content), PASSPHRASE)
+        with patch.object(backups, "MAX_EXPANDED_BYTES", 16):
+            with self.assertRaisesRegex(backups.BackupError, "Expanded backup"):
+                backups.stage_restore(io.BytesIO(content), PASSPHRASE)
+        with closing(sqlite3.connect(self.database)) as conn, conn:
+            conn.execute("CREATE TRIGGER unsafe AFTER INSERT ON settings BEGIN DELETE FROM users; END")
+        # Validate the original fixture to avoid executing the malicious trigger in export.
+        with self.assertRaisesRegex(backups.BackupError, "unsupported database schema"):
+            backups._validate_database(self.database)
+
+    def test_unsupported_compression_is_rejected_before_expansion(self):
+        content = self.export()
+        rewritten = io.BytesIO()
+        with zipfile.ZipFile(io.BytesIO(backups._decrypt(content, PASSPHRASE))) as original:
+            with zipfile.ZipFile(rewritten, "w", compression=zipfile.ZIP_BZIP2) as target:
+                for entry in original.infolist():
+                    target.writestr(entry.filename, original.read(entry))
+        with self.assertRaisesRegex(backups.BackupError, "unsafe archive entry"):
+            backups.stage_restore(io.BytesIO(backups._encrypt(rewritten.getvalue(), PASSPHRASE)), PASSPHRASE)
+
+    def test_cancel_is_idempotent_and_does_not_change_database(self):
+        content = self.export()
+        backups.stage_restore(io.BytesIO(content), PASSPHRASE)
+        with self.assertRaisesRegex(backups.BackupError, "already staged"):
+            backups.stage_restore(io.BytesIO(content), PASSPHRASE)
+        backups.cancel_restore()
+        backups.cancel_restore()
+        self.assertIsNone(backups.backup_status()["pending_restore"])
+        self.assertEqual(db.get_setting("sonarr_api_key"), "database-integration-secret")
+
+    def test_failure_after_database_replacement_rolls_back_both_database_and_files(self):
+        content = self.export()
+        db.set_setting("site_login_message", "Keep this current value")
+        (self.assets / "branding" / "logo.png").write_bytes(b"current logo")
+        backups.stage_restore(io.BytesIO(content), PASSPHRASE)
+        original = backups._replace_assets
+        calls = 0
+
+        def fail_once(source, target):
+            nonlocal calls
+            calls += 1
+            if calls == 1:
+                raise OSError("simulated interrupted copy")
+            return original(source, target)
+
+        with patch.object(backups, "_replace_assets", side_effect=fail_once):
+            with self.assertRaisesRegex(OSError, "interrupted copy"):
+                backups.apply_pending_restore()
+        self.assertEqual(db.get_setting("site_login_message"), "Keep this current value")
+        self.assertEqual((self.assets / "branding" / "logo.png").read_bytes(), b"current logo")
+        self.assertEqual(backups.backup_status()["last_restore"]["status"], "rolled_back")
+        self.assertFalse(backups.apply_pending_restore())
+
+    def test_api_requires_admin_and_restore_confirmation(self):
+        app = FastAPI()
+        app.include_router(backup_router.router)
+        with TestClient(app) as client:
+            self.assertEqual(client.get("/admin/backups").status_code, 401)
+            app.dependency_overrides[get_current_user] = lambda: {"username": "member", "role": "user"}
+            self.assertEqual(client.get("/admin/backups").status_code, 403)
+            self.assertEqual(client.post("/admin/backups/export", json={"passphrase": PASSPHRASE}).status_code, 403)
+            app.dependency_overrides[get_current_user] = lambda: {"username": "backup-admin", "role": "admin"}
+            status = client.get("/admin/backups")
+            self.assertEqual(status.status_code, 200)
+            self.assertEqual(status.headers["cache-control"], "no-store")
+            self.assertEqual(status.json()["max_expanded_bytes"], backups.MAX_EXPANDED_BYTES)
+            response = client.post("/admin/backups/export", json={"passphrase": PASSPHRASE})
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(response.headers["cache-control"], "no-store")
+            rejected = client.post("/admin/backups/restore", files={"file": ("test.magent-backup", response.content)},
+                data={"passphrase": PASSPHRASE, "confirmation": "wrong"})
+            self.assertEqual(rejected.status_code, 422)
+            restored = client.post("/admin/backups/restore", files={"file": ("test.magent-backup", response.content)},
+                data={"passphrase": PASSPHRASE, "confirmation": "RESTORE"})
+            self.assertEqual(restored.status_code, 202)
+            self.assertTrue(restored.json()["restart_required"])
+            self.assertEqual(client.delete("/admin/backups/restore").status_code, 200)
+
+
+if __name__ == "__main__":
+    unittest.main()

backend/tests/test_feature_access.py

@@ -1,5 +1,5 @@
 import unittest
-from unittest.mock import patch
+from unittest.mock import AsyncMock, patch
 from backend.app.config import settings
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
@@ -16,6 +16,13 @@ class FeatureAccessTests(TempDatabaseMixin, unittest.TestCase):
         secret = patch.object(settings, "jwt_secret", "feature-access-tests-only-secret-123456789")
         secret.start()
         self.addCleanup(secret.stop)
+        access = patch.object(
+            requests,
+            "_ensure_request_mutation_access",
+            new=AsyncMock(return_value=None),
+        )
+        access.start()
+        self.addCleanup(access.stop)
         db.create_user('feature-viewer', 'Example-password123!', role='user')
         db.create_user('feature-admin', 'Example-password123!', role='admin')
         self.user = db.get_user_by_username('feature-viewer')

backend/tests/test_installation_http.py

@@ -0,0 +1,175 @@
+"""Real application HTTP checks for installation, cookies, and backup controls.
+
+All persistence and artwork paths are isolated in temporary directories; workers,
+logging file handlers, and the metrics listener are disabled for these tests.
+"""
+
+import io
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+
+from fastapi.testclient import TestClient
+
+from backend.app import db, main
+from backend.app.config import settings
+from backend.app.services import backups
+
+
+OPERATOR_TOKEN = "installation-http-operator-token-test-123456789"
+OWNER_PASSWORD = "installation-http-owner-password-123456789"
+BACKUP_PASSPHRASE = "installation-http-backup-passphrase-123456789"
+
+
+class InstallationHttpTests(unittest.TestCase):
+    def setUp(self):
+        self.temporary = tempfile.TemporaryDirectory(ignore_cleanup_errors=True)
+        self.addCleanup(self.temporary.cleanup)
+        self.root = Path(self.temporary.name)
+        for key, value in {
+            "sqlite_path": str(self.root / "magent.db"),
+            "sqlite_journal_mode": "DELETE",
+            "jwt_secret": "installation-http-test-jwt-secret-1234567890",
+            "settings_encryption_key": None,
+            "admin_username": "unused-environment-admin",
+            "admin_password": "",
+            "setup_token": OPERATOR_TOKEN,
+            "auth_cookie_secure": True,
+            "auth_cookie_domain": None,
+            "auth_cookie_samesite": "strict",
+        }.items():
+            context = patch.object(settings, key, value)
+            context.start()
+            self.addCleanup(context.stop)
+        for context in (
+            patch.object(main, "configure_logging"),
+            patch.object(main, "start_metrics"),
+            patch.object(main, "_background_tasks", []),
+            patch.object(main, "_background_started", False),
+            patch.object(backups, "_assets_root", return_value=self.root / "assets"),
+            patch.dict("os.environ", {"BACKGROUND_TASKS_ENABLED": "false"}),
+        ):
+            context.start()
+            self.addCleanup(context.stop)
+        self.origin = str(settings.cors_allow_origin).rstrip("/")
+        self.client = self.enterContext(TestClient(main.app, base_url="https://magent.test"))
+        self.client.headers["Origin"] = self.origin
+
+    def create_owner(self):
+        response = self.client.post("/setup/bootstrap", json={
+            "setup_token": OPERATOR_TOKEN, "username": "owner", "password": OWNER_PASSWORD,
+        })
+        self.assertEqual(response.status_code, 201, response.text)
+        return response
+
+    def sign_in(self):
+        response = self.client.post("/auth/login", data={"username": "owner", "password": OWNER_PASSWORD})
+        self.assertEqual(response.status_code, 200, response.text)
+        self.assertIn(settings.auth_cookie_name, self.client.cookies)
+        auth_cookie = next(value for value in response.headers.get_list("set-cookie") if value.startswith(settings.auth_cookie_name + "="))
+        self.assertIn("HttpOnly", auth_cookie)
+        self.assertIn("Secure", auth_cookie)
+        self.assertIn("SameSite=strict", auth_cookie)
+        self.assertNotIn("Authorization", self.client.headers)
+
+    def test_fresh_setup_cookie_settings_completion_and_backup_round_trip(self):
+        status = self.client.get("/setup/status")
+        self.assertEqual(status.json(), {"setup_required": True, "needs_admin": True})
+        self.assertEqual(status.headers["cache-control"], "no-store")
+        self.assertIn("default-src 'none'", status.headers["content-security-policy"])
+        self.assertEqual(self.client.get("/setup/state").status_code, 401)
+        self.assertEqual(self.client.get("/admin/backups").status_code, 401)
+
+        self.create_owner()
+        self.sign_in()
+        self.assertEqual(self.client.get("/setup/state").json()["step"], "apps")
+        response = self.client.put("/admin/settings", json={
+            "jellyfin_base_url": "http://jellyfin.test:8096",
+            "jellyfin_api_key": "test-integration-key-for-setup",
+            "site_login_message": "Welcome to this installation",
+        })
+        self.assertEqual(response.status_code, 200, response.text)
+        self.assertEqual(response.json()["updated"], 3)
+        values = {row["key"]: row for row in self.client.get("/admin/settings").json()["settings"]}
+        self.assertEqual(values["jellyfin_base_url"]["value"], "http://jellyfin.test:8096")
+        self.assertIsNone(values["jellyfin_api_key"]["value"])
+        self.assertTrue(values["jellyfin_api_key"]["isSet"])
+        response = self.client.put("/setup/state", json={"step": "review"})
+        self.assertEqual(response.status_code, 200, response.text)
+        completed = self.client.post("/setup/complete")
+        self.assertEqual(completed.status_code, 200, completed.text)
+        self.assertTrue(completed.json()["completed"])
+        self.assertEqual(self.client.get("/setup/status").json(), {"setup_required": False, "needs_admin": False})
+        self.assertEqual(main._background_tasks, [])
+
+        exported = self.client.post("/admin/backups/export", json={
+            "passphrase": BACKUP_PASSPHRASE, "include_cache": False,
+        })
+        self.assertEqual(exported.status_code, 200, exported.text[:100])
+        self.assertTrue(exported.content.startswith(backups.MAGIC))
+        self.assertEqual(exported.headers["cache-control"], "no-store")
+        self.assertNotIn(b"test-integration-key-for-setup", exported.content)
+        restored = self.client.post("/admin/backups/restore", files={
+            "file": ("restore.magent-backup", io.BytesIO(exported.content), "application/octet-stream"),
+        }, data={"passphrase": BACKUP_PASSPHRASE, "confirmation": "RESTORE"})
+        self.assertEqual(restored.status_code, 202, restored.text)
+        self.assertTrue(restored.json()["restart_required"])
+        self.assertEqual(db.get_setting("site_login_message"), "Welcome to this installation")
+        self.assertIsNotNone(self.client.get("/admin/backups").json()["pending_restore"])
+        cancelled = self.client.delete("/admin/backups/restore")
+        self.assertEqual(cancelled.status_code, 200, cancelled.text)
+        self.assertIsNone(self.client.get("/admin/backups").json()["pending_restore"])
+
+    def test_cross_origin_bootstrap_and_authenticated_changes_are_rejected(self):
+        response = self.client.post("/setup/bootstrap", headers={"Origin": "https://unrelated.invalid"}, json={
+            "setup_token": OPERATOR_TOKEN, "username": "owner", "password": OWNER_PASSWORD,
+        })
+        self.assertEqual(response.status_code, 403)
+        self.assertFalse(db.has_admin_user())
+        self.create_owner()
+        self.sign_in()
+        response = self.client.put("/setup/state", headers={"Origin": "https://unrelated.invalid"}, json={"step": "review"})
+        self.assertEqual(response.status_code, 403)
+        response = self.client.post("/admin/backups/export", headers={"Origin": "https://unrelated.invalid"}, json={"passphrase": BACKUP_PASSPHRASE})
+        self.assertEqual(response.status_code, 403)
+        self.assertEqual(self.client.get("/setup/state").json()["step"], "apps")
+
+    def test_setup_validation_errors_do_not_echo_password_or_token(self):
+        secret_password = "private-password-marker-" + "p" * 1024
+        secret_token = "private-token-marker-" + "t" * 1024
+        for payload, secret in (
+            ({"setup_token": OPERATOR_TOKEN, "username": "owner", "password": secret_password}, secret_password),
+            ({"setup_token": secret_token, "username": "owner", "password": OWNER_PASSWORD}, secret_token),
+            ({"setup_token": OPERATOR_TOKEN, "password": OWNER_PASSWORD}, OWNER_PASSWORD),
+        ):
+            with self.subTest(secret=secret[:22]):
+                response = self.client.post("/setup/bootstrap", json=payload)
+                self.assertEqual(response.status_code, 422, response.text)
+                self.assertNotIn(secret, response.text)
+                self.assertNotIn(OPERATOR_TOKEN, response.text)
+                for error in response.json()["detail"]:
+                    self.assertNotIn("input", error)
+
+    def test_backup_validation_errors_do_not_echo_passphrases(self):
+        self.create_owner()
+        self.sign_in()
+        passphrase = "private-backup-passphrase-marker-" + "p" * 1024
+        response = self.client.post("/admin/backups/export", json={"passphrase": passphrase})
+        self.assertEqual(response.status_code, 422)
+        self.assertNotIn(passphrase, response.text)
+        response = self.client.post("/admin/backups/restore", files={"file": ("archive", b"data")}, data={
+            "passphrase": passphrase, "confirmation": "RESTORE",
+        })
+        self.assertEqual(response.status_code, 422)
+        self.assertNotIn(passphrase, response.text)
+        self.assertIsNone(self.client.get("/admin/backups").json()["pending_restore"])
+
+    def test_real_middleware_rejects_oversized_bootstrap_before_creation(self):
+        response = self.client.post("/setup/bootstrap", content=b"x" * (17 * 1024), headers={"Content-Type": "application/json"})
+        self.assertEqual(response.status_code, 413, response.text)
+        self.assertFalse(db.has_admin_user())
+
+
+if __name__ == "__main__":
+    unittest.main()

backend/tests/test_installation_lifecycle.py

@@ -0,0 +1,162 @@
+import asyncio
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import Mock, patch
+
+import httpx
+from fastapi import FastAPI, File, Request, UploadFile
+
+from backend.app import db, main
+from backend.app.config import settings
+from backend.app.request_limits import InstallationBodyLimitMiddleware
+from backend.app.services import setup
+
+
+class InstallationLifecycleTests(unittest.IsolatedAsyncioTestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory(ignore_cleanup_errors=True)
+        self.addCleanup(temporary.cleanup)
+        patches = [
+            patch.object(settings, "sqlite_path", str(Path(temporary.name) / "magent.db")),
+            patch.object(settings, "jwt_secret", "installation-lifecycle-secret-1234567890"),
+            patch.object(settings, "settings_encryption_key", None),
+            patch.object(settings, "admin_password", ""),
+            patch.object(settings, "setup_token", "operator-setup-token-at-least-32-characters"),
+            patch.object(main, "_background_started", False),
+            patch.object(main, "_background_tasks", []),
+            patch.object(main, "start_metrics"),
+            patch.object(main, "configure_logging"),
+            patch.dict("os.environ", {"BACKGROUND_TASKS_ENABLED": "true"}),
+        ]
+        for item in patches:
+            item.start()
+            self.addCleanup(item.stop)
+
+    async def test_fresh_start_waits_for_admin_and_completion_then_starts_workers_once(self):
+        with patch.object(main, "_launch_background_task") as launch:
+            await main.startup()
+            self.assertEqual(setup.get_public_setup_status(), {"setup_required": True, "needs_admin": True})
+            launch.assert_not_called()
+            setup.bootstrap_administrator(settings.setup_token, "owner", "new-password-12345")
+            await main._start_background_tasks()
+            launch.assert_not_called()
+            setup.complete_setup()
+            await main.app.state.on_setup_complete()
+            await main.app.state.on_setup_complete()
+            self.assertEqual(launch.call_count, 9)
+
+    async def test_upgraded_install_starts_normally_without_setup_token(self):
+        db.init_db()
+        db.create_user("owner", "existing-password-12345", role="admin")
+        settings.setup_token = ""
+        with patch.object(main, "_launch_background_task") as launch:
+            await main.startup()
+            self.assertFalse(setup.is_setup_required())
+            self.assertEqual(launch.call_count, 9)
+
+    async def test_disabled_workers_stay_disabled_after_setup(self):
+        setup.initialize_setup_state()
+        db.init_db()
+        setup.bootstrap_administrator(settings.setup_token, "owner", "new-password-12345")
+        setup.complete_setup()
+        with patch.dict("os.environ", {"BACKGROUND_TASKS_ENABLED": "false"}), patch.object(main, "_launch_background_task") as launch:
+            await main._start_background_tasks()
+            launch.assert_not_called()
+
+    async def test_bad_secret_stops_before_restore_or_database_initialization(self):
+        settings.jwt_secret = "short"
+        with patch.object(main, "apply_pending_restore") as restore, patch.object(main, "init_db") as initialize:
+            with self.assertRaisesRegex(RuntimeError, "JWT_SECRET"):
+                await main.startup()
+            restore.assert_not_called()
+            initialize.assert_not_called()
+
+    async def test_restore_failure_stops_before_initialization_and_workers(self):
+        with patch.object(main, "apply_pending_restore", side_effect=RuntimeError("restore failed")), patch.object(main, "init_db") as initialize, patch.object(main, "_launch_background_task") as launch:
+            with self.assertRaisesRegex(RuntimeError, "restore failed"):
+                await main.startup()
+            initialize.assert_not_called()
+            launch.assert_not_called()
+
+    async def test_startup_order_is_restore_then_setup_marker_then_schema(self):
+        calls = Mock()
+        calls.attach_mock(Mock(wraps=main.apply_pending_restore), "restore")
+        calls.attach_mock(Mock(wraps=main.initialize_setup_state), "setup")
+        calls.attach_mock(Mock(wraps=main.init_db), "schema")
+        with patch.object(main, "apply_pending_restore", calls.restore), patch.object(main, "initialize_setup_state", calls.setup), patch.object(main, "init_db", calls.schema):
+            await main.startup()
+        self.assertEqual([call[0] for call in calls.mock_calls], ["restore", "setup", "schema"])
+
+    def test_missing_token_does_not_allow_fresh_bootstrap(self):
+        setup.initialize_setup_state()
+        db.init_db()
+        settings.setup_token = ""
+        with self.assertRaisesRegex(RuntimeError, "SETUP_TOKEN"):
+            main._enforce_secure_startup_configuration()
+
+    def test_destination_environment_does_not_add_an_admin_to_restored_accounts(self):
+        db.init_db()
+        db.create_user("restored-owner", "existing-password-12345", role="admin")
+        with patch.object(settings, "admin_username", "host-bootstrap"), patch.object(settings, "admin_password", "new-host-password-12345"):
+            db.init_db()
+        self.assertIsNone(db.get_user_by_username("host-bootstrap"))
+
+    async def test_shutdown_cancels_workers_and_allows_next_start(self):
+        task = asyncio.create_task(asyncio.Event().wait())
+        main._background_tasks.append(task)
+        main._background_started = True
+        await main.shutdown()
+        self.assertTrue(task.cancelled())
+        self.assertEqual(main._background_tasks, [])
+        self.assertFalse(main._background_started)
+
+
+class InstallationRequestLimitsTests(unittest.IsolatedAsyncioTestCase):
+    async def test_rejects_oversized_declared_body_before_parser(self):
+        app = FastAPI()
+        app.add_middleware(InstallationBodyLimitMiddleware)
+
+        @app.post("/setup/bootstrap")
+        async def bootstrap(request: Request):
+            self.fail("Body must be rejected before the endpoint")
+
+        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url="http://test") as client:
+            response = await client.post("/setup/bootstrap", content=b"{}", headers={"Content-Length": "999999"})
+        self.assertEqual(response.status_code, 413)
+
+    async def test_counts_chunks_with_missing_or_forged_content_length(self):
+        app = FastAPI()
+        app.add_middleware(InstallationBodyLimitMiddleware)
+
+        @app.post("/setup/bootstrap")
+        async def bootstrap(request: Request):
+            return await request.json()
+
+        async def chunks():
+            yield b'{"token":"'
+            yield b"a" * 17000
+            yield b'"}'
+
+        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url="http://test") as client:
+            for headers in ({}, {"Content-Length": "1"}):
+                response = await client.post("/setup/bootstrap", content=chunks(), headers=headers)
+                self.assertEqual(response.status_code, 413)
+
+    async def test_multipart_stream_limit_is_413_not_parser_500(self):
+        app = FastAPI()
+        app.add_middleware(InstallationBodyLimitMiddleware)
+
+        @app.post("/admin/backups/restore")
+        async def restore(file: UploadFile = File(...)):
+            return {"size": file.size}
+
+        async def chunks():
+            yield b'--boundary\r\nContent-Disposition: form-data; name="file"; filename="backup"\r\n\r\n'
+            yield b"a" * 2048
+            yield b"\r\n--boundary--\r\n"
+
+        with patch("backend.app.request_limits.RESTORE_BODY_LIMIT", 1024):
+            async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url="http://test") as client:
+                response = await client.post("/admin/backups/restore", content=chunks(), headers={"Content-Type": "multipart/form-data; boundary=boundary"})
+        self.assertEqual(response.status_code, 413)

backend/tests/test_logging_config.py

@@ -0,0 +1,25 @@
+import json
+import logging
+import unittest
+
+from backend.app.logging_config import JsonLogFormatter, RequestContextFilter, bind_request_id, reset_request_id
+
+
+class JsonLoggingTests(unittest.TestCase):
+    def test_json_formatter_includes_request_context(self) -> None:
+        token = bind_request_id("request-123")
+        try:
+            record = logging.LogRecord("magent.test", logging.INFO, __file__, 1, "hello %s", ("world",), None)
+            RequestContextFilter().filter(record)
+            payload = json.loads(JsonLogFormatter().format(record))
+        finally:
+            reset_request_id(token)
+
+        self.assertEqual(payload["level"], "INFO")
+        self.assertEqual(payload["logger"], "magent.test")
+        self.assertEqual(payload["request_id"], "request-123")
+        self.assertEqual(payload["message"], "hello world")
+
+
+if __name__ == "__main__":
+    unittest.main()

backend/tests/test_manual_selection.py

@@ -61,6 +61,15 @@ class ManualPermissionTests(TempDatabaseMixin, unittest.TestCase):
 
 
 class ManualEpisodeSearchTests(unittest.IsolatedAsyncioTestCase):
+    def setUp(self):
+        access = patch.object(
+            requests,
+            '_ensure_request_mutation_access',
+            new=AsyncMock(return_value=None),
+        )
+        access.start()
+        self.addCleanup(access.stop)
+
     async def test_episode_batch_is_bounded_and_exposes_next_page(self):
         episodes = [{'id': i, 'seasonNumber': 1, 'monitored': True, 'hasFile': False} for i in range(1, 26)]
         episodes += [{'id': 26, 'seasonNumber': 1, 'monitored': True, 'hasFile': True}]
@@ -75,9 +84,9 @@ class ManualEpisodeSearchTests(unittest.IsolatedAsyncioTestCase):
         snapshot = Snapshot(request_id='42',request_type=RequestType.tv,title='Example',raw={'arr':{'item':{'id':55,'qualityProfileId':9}}})
         with patch.object(requests, 'get_runtime_settings', return_value=runtime), patch.object(requests, 'build_snapshot', new=AsyncMock(return_value=snapshot)), patch.object(requests,'SonarrClient',return_value=sonarr), patch.object(requests,'save_action'):
             first = await requests.action_search('42', {'username':'viewer','role':'user'})
-            second = await requests.action_search('42', {'username':'viewer','role':'user'}, offset=20)
-        self.assertEqual(first['nextOffset'],20); self.assertIsNone(second['nextOffset'])
-        self.assertEqual(sonarr.search_episode_releases.await_count,25)
+            second = await requests.action_search('42', {'username':'viewer','role':'user'}, offset=24)
+        self.assertEqual(first['nextOffset'],3); self.assertIsNone(second['nextOffset'])
+        self.assertEqual(sonarr.search_episode_releases.await_count,4)
         self.assertLessEqual(peak,3)
         self.assertEqual(first['totalMissingEpisodes'],25)
 

backend/tests/test_recheck_monitoring.py

@@ -0,0 +1,27 @@
+import unittest
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, patch
+from backend.app.routers import requests
+from backend.app.models import Snapshot, RequestType
+
+class RecheckMonitoringTests(unittest.IsolatedAsyncioTestCase):
+    async def test_series_restores_only_requested_seasons_and_episodes(self):
+        original={'id':10,'monitored':False,'qualityProfileId':7,'seasons':[{'seasonNumber':1,'monitored':False},{'seasonNumber':2,'monitored':False}]}
+        restored={**original,'monitored':True,'seasons':[{'seasonNumber':1,'monitored':True},{'seasonNumber':2,'monitored':False}]}
+        client=SimpleNamespace(get_series=AsyncMock(side_effect=[original,restored]),update_series=AsyncMock(),get_episodes=AsyncMock(side_effect=[[{'id':1,'seasonNumber':1,'monitored':False},{'id':2,'seasonNumber':2,'monitored':False}],[{'id':1,'seasonNumber':1,'monitored':True},{'id':2,'seasonNumber':2,'monitored':False}]]),monitor_episodes=AsyncMock())
+        snapshot=Snapshot(request_id='42',title='Test',request_type=RequestType.tv,raw={'arr':{'item':{'id':10}}})
+        runtime=SimpleNamespace(sonarr_base_url='http://sonarr',sonarr_api_key='test')
+        with patch.object(requests,'get_runtime_settings',return_value=runtime),patch.object(requests,'SonarrClient',return_value=client):
+            self.assertTrue(await requests._restore_request_monitoring(snapshot,{'status':2,'seasons':[{'seasonNumber':1}]}))
+        client.update_series.assert_awaited_once_with(restored)
+        client.monitor_episodes.assert_awaited_once_with([1],True)
+
+    async def test_movie_monitoring_preserves_profile_and_pending_is_noop(self):
+        movie={'id':10,'monitored':False,'qualityProfileId':7}
+        client=SimpleNamespace(get_movie=AsyncMock(side_effect=[movie,{**movie,'monitored':True}]),update_movie=AsyncMock())
+        snapshot=Snapshot(request_id='42',title='Test',request_type=RequestType.movie,raw={'arr':{'item':{'id':10}}})
+        runtime=SimpleNamespace(radarr_base_url='http://radarr',radarr_api_key='test')
+        with patch.object(requests,'get_runtime_settings',return_value=runtime),patch.object(requests,'RadarrClient',return_value=client):
+            self.assertFalse(await requests._restore_request_monitoring(snapshot,{'status':1}))
+            self.assertTrue(await requests._restore_request_monitoring(snapshot,{'status':2}))
+        client.update_movie.assert_awaited_once_with({**movie,'monitored':True})

backend/tests/test_report_graphics.py

@@ -0,0 +1,34 @@
+import unittest
+from datetime import timedelta
+from unittest.mock import AsyncMock, patch
+from backend.tests.test_insights import play, NOW, LIBRARIES
+from backend.tests.test_email_recaps import fixture_report
+from backend.app.services.insights import summarize
+from backend.app.services.email_recaps import illustrated_recap
+
+class ReportGraphicsTests(unittest.IsolatedAsyncioTestCase):
+    def test_patterns_deduplicate_and_handle_empty_history(self):
+        first = play()
+        second = play("second", PlaybackDuration=1800, EpisodeId="episode", ActivityDateInserted=(NOW-timedelta(days=1)).isoformat())
+        report = summarize([first, first, second], LIBRARIES, NOW-timedelta(days=7), NOW)
+        self.assertEqual(report["patterns"]["average_play_minutes"], 45)
+        self.assertEqual(report["patterns"]["longest_play_minutes"], 60)
+        self.assertEqual(report["patterns"]["weekend_percent"], 33.3)
+        self.assertEqual(sum(r["minutes"] for r in report["patterns"]["media"]), 90)
+        empty = summarize([], [], NOW-timedelta(days=7), NOW)
+        self.assertEqual(empty["patterns"]["average_play_minutes"], 0)
+
+    async def test_artwork_embedded_without_private_links_and_optional_on_failure(self):
+        report = fixture_report()
+        report["top_titles"][0]["artwork_url"] = "/insights/artwork/" + "a"*32 + "?token=123." + "b"*64
+        with patch("backend.app.services.email_recaps.get_runtime_settings"), patch("backend.app.services.insights_artwork.get_artwork", new=AsyncMock(return_value=(b"picture", "image/webp"))):
+            rendered = await illustrated_recap(report, {"username":"viewer"}, "https://example.test", "https://example.test/unsubscribe")
+            self.assertIn("cid:recap-title-0@magent", rendered["body_html"])
+            self.assertNotIn("?token=", rendered["body_html"])
+            self.assertEqual(rendered["inline_images"][0]["subtype"], "webp")
+            preview = await illustrated_recap(report, {"username":"viewer"}, "https://example.test", "https://example.test/unsubscribe", preview=True)
+            self.assertIn("data:image/webp;base64,", preview["body_html"])
+            self.assertNotIn("inline_images", preview)
+        with patch("backend.app.services.email_recaps.get_runtime_settings"), patch("backend.app.services.insights_artwork.get_artwork", new=AsyncMock(side_effect=RuntimeError())):
+            rendered = await illustrated_recap(report, {"username":"viewer"}, "https://example.test", "https://example.test/unsubscribe")
+            self.assertEqual(rendered["inline_images"], [])

backend/tests/test_request_language.py

@@ -85,8 +85,8 @@ class RequestLanguageTests(unittest.IsolatedAsyncioTestCase):
                 await apply_original_to_movie(client, 613)
 
     async def test_search_reports_real_outcomes(self):
-        for command_status, queue, expected in [('completed', [], 'attention'), ('failed', [], 'attention'),
-                                               ('started', [], 'searching'), ('completed', [{'movieId': 6940}], 'downloading')]:
+        for command_status, queue, expected in [('completed', [], 'pending'), ('failed', [], 'attention'),
+                                               ('started', [], 'pending'), ('completed', [{'movieId': 6940}], 'downloading')]:
             client = SimpleNamespace(get=AsyncMock(return_value={'status': command_status}),
                 get_queue=AsyncMock(return_value={'records': queue}), get_movie=AsyncMock(return_value={'hasFile': False}))
             result = await movie_search_outcome(client, 6940, {'id': 1}, attempts=1, delay=0)
@@ -114,6 +114,23 @@ class RequestLanguageTests(unittest.IsolatedAsyncioTestCase):
     async def test_tv_search_distinguishes_no_download_and_queue(self):
         from backend.app.services.request_language import series_search_outcome
         client = SimpleNamespace(get=AsyncMock(return_value={'status': 'completed'}), get_queue=AsyncMock(return_value={'records': []}))
-        self.assertEqual((await series_search_outcome(client, 50, [{'id': 1}], attempts=1))['status'], 'attention')
+        self.assertEqual((await series_search_outcome(client, 50, [{'id': 1}], attempts=1))['status'], 'pending')
         client.get_queue.return_value = {'records': [{'seriesId': 50}]}
         self.assertEqual((await series_search_outcome(client, 50, [{'id': 1}], attempts=1))['status'], 'downloading')
+
+
+class SearchHandoffTests(unittest.IsolatedAsyncioTestCase):
+    async def test_radarr_completed_before_queue_refresh(self):
+        client = SimpleNamespace(get=AsyncMock(return_value={'status':'completed'}),
+            get_queue=AsyncMock(side_effect=[{'records':[]}, {'records':[]}, {'records':[{'movieId':2206}]}]),
+            get_movie=AsyncMock(return_value={'hasFile':False}))
+        result = await movie_search_outcome(client, 2206, {'id':1}, attempts=3, delay=0)
+        self.assertEqual(result['status'], 'downloading')
+        self.assertEqual(client.get_queue.await_count, 3)
+
+    async def test_sonarr_completed_before_queue_refresh(self):
+        from backend.app.services.request_language import series_search_outcome
+        client = SimpleNamespace(get=AsyncMock(return_value={'status':'completed'}),
+            get_queue=AsyncMock(side_effect=[{'records':[{'seriesId':999}]}, {'records':[{'seriesId':50}]}]))
+        result = await series_search_outcome(client, 50, [{'id':1}], attempts=2, delay=0)
+        self.assertEqual(result['status'], 'downloading')

backend/tests/test_request_origins.py

@@ -0,0 +1,187 @@
+"""Origin checks use operator configuration, never caller-controlled routing headers."""
+
+from pathlib import Path
+import tempfile
+from types import SimpleNamespace
+import unittest
+from unittest.mock import AsyncMock, patch
+
+from fastapi.testclient import TestClient
+
+from backend.app import db, main
+from backend.app.config import settings
+from backend.app.routers import auth as auth_router
+from backend.app.services import public_urls
+from backend.app.services.request_origins import is_allowed_request_origin
+
+
+PUBLIC_ORIGIN = "https://watch.example.test"
+LOCAL_ORIGIN = "http://localhost:3000"
+
+
+class RequestOriginTests(unittest.TestCase):
+    def setUp(self):
+        self.runtime = SimpleNamespace(
+            magent_proxy_enabled=False,
+            magent_proxy_base_url=None,
+            magent_application_url=PUBLIC_ORIGIN,
+        )
+        self.enterContext(patch.object(settings, "cors_allow_origin", LOCAL_ORIGIN))
+        self.enterContext(patch.object(public_urls, "get_runtime_settings", return_value=self.runtime))
+
+    def test_explicit_cors_and_configured_public_url_are_both_allowed(self):
+        self.assertTrue(is_allowed_request_origin(LOCAL_ORIGIN))
+        self.assertTrue(is_allowed_request_origin(PUBLIC_ORIGIN))
+        self.assertFalse(is_allowed_request_origin("https://unrelated.example.test"))
+
+    def test_scheme_hostname_case_and_default_ports_are_canonicalized(self):
+        for origin in (PUBLIC_ORIGIN, "HTTPS://WATCH.EXAMPLE.TEST", "https://watch.example.test:443"):
+            with self.subTest(origin=origin):
+                self.assertTrue(is_allowed_request_origin(origin))
+        self.runtime.magent_application_url = "http://watch.example.test:80"
+        self.assertTrue(is_allowed_request_origin("http://WATCH.example.test"))
+        self.assertFalse(is_allowed_request_origin("https://watch.example.test"))
+        self.assertFalse(is_allowed_request_origin("http://watch.example.test:8080"))
+
+    def test_nondefault_ports_must_match(self):
+        self.runtime.magent_application_url = "https://watch.example.test:8443/magent"
+        self.assertTrue(is_allowed_request_origin("https://watch.example.test:8443"))
+        self.assertFalse(is_allowed_request_origin("https://watch.example.test"))
+        self.assertFalse(is_allowed_request_origin("https://watch.example.test:443"))
+
+    def test_configured_subpath_does_not_become_part_of_origin(self):
+        self.runtime.magent_application_url = PUBLIC_ORIGIN + "/magent/"
+        self.assertTrue(is_allowed_request_origin(PUBLIC_ORIGIN))
+        self.assertFalse(is_allowed_request_origin(PUBLIC_ORIGIN + "/magent"))
+
+    def test_enabled_proxy_uses_configured_proxy_public_url(self):
+        self.runtime.magent_proxy_enabled = True
+        self.runtime.magent_proxy_base_url = "https://proxy.example.test/magent"
+        self.assertTrue(is_allowed_request_origin("https://proxy.example.test"))
+        self.assertTrue(is_allowed_request_origin(LOCAL_ORIGIN))
+        self.assertFalse(is_allowed_request_origin(PUBLIC_ORIGIN))
+
+    def test_unconfigured_public_url_only_allows_explicit_cors(self):
+        self.runtime.magent_application_url = None
+        self.assertTrue(is_allowed_request_origin(LOCAL_ORIGIN))
+        self.assertFalse(is_allowed_request_origin(PUBLIC_ORIGIN))
+
+    def test_invalid_or_non_origin_inputs_are_rejected(self):
+        for origin in (
+            "", "null", "*", "watch.example.test", "//watch.example.test",
+            "ftp://watch.example.test", "javascript:alert(1)",
+            PUBLIC_ORIGIN + "/", PUBLIC_ORIGIN + "/path",
+            PUBLIC_ORIGIN + "?query=true", PUBLIC_ORIGIN + "#fragment",
+            PUBLIC_ORIGIN + "?", PUBLIC_ORIGIN + "#",
+            "https://user@watch.example.test", "https://user:password@watch.example.test",
+            "https://watch.example.test@evil.example.test", "https://watch.example.test.evil.example.test",
+            "https://watch.example.test:0", "https://watch.example.test:65536",
+            "https://watch.example.test:invalid", "https://[invalid",
+            PUBLIC_ORIGIN + " https://evil.example.test", PUBLIC_ORIGIN + ",https://evil.example.test",
+            "https://watch.example.test\\@evil.example.test", PUBLIC_ORIGIN + "\n",
+        ):
+            with self.subTest(origin=repr(origin)):
+                self.assertFalse(is_allowed_request_origin(origin))
+
+    def test_invalid_configured_public_url_does_not_authorize_an_origin(self):
+        for configured in (
+            "https://user:password@watch.example.test", PUBLIC_ORIGIN + "?token=private",
+            PUBLIC_ORIGIN + "#fragment", "javascript:alert(1)", "https://watch.example.test:65536",
+        ):
+            with self.subTest(configured=configured):
+                self.runtime.magent_application_url = configured
+                self.assertFalse(is_allowed_request_origin(PUBLIC_ORIGIN))
+                self.assertTrue(is_allowed_request_origin(LOCAL_ORIGIN))
+
+
+class RequestOriginHttpTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory(ignore_cleanup_errors=True)
+        self.addCleanup(temporary.cleanup)
+        self.runtime = SimpleNamespace(
+            magent_proxy_enabled=False,
+            magent_proxy_base_url=None,
+            magent_application_url=PUBLIC_ORIGIN,
+        )
+        for name, value in {
+            "sqlite_path": str(Path(temporary.name) / "origin-tests.db"),
+            "sqlite_journal_mode": "DELETE",
+            "jwt_secret": "request-origin-tests-jwt-secret-at-least-32-characters",
+            "settings_encryption_key": None,
+            "admin_username": "unused-environment-admin",
+            "admin_password": "",
+            "cors_allow_origin": LOCAL_ORIGIN,
+            "auth_cookie_domain": None,
+            "auth_cookie_secure": True,
+        }.items():
+            self.enterContext(patch.object(settings, name, value))
+        self.enterContext(patch.object(public_urls, "get_runtime_settings", return_value=self.runtime))
+        # Constructing without a context deliberately skips production startup:
+        # no migrations/workers/listeners/log files outside this temporary DB.
+        db.init_db()
+        self.client = TestClient(main.app, base_url=PUBLIC_ORIGIN)
+        self.addCleanup(self.client.close)
+
+    def test_public_origin_reaches_both_auth_handlers_with_localhost_cors_default(self):
+        for path in ("/auth/login", "/auth/jellyfin/login"):
+            with self.subTest(path=path):
+                response = self.client.post(path, data={}, headers={"Origin": PUBLIC_ORIGIN})
+                self.assertEqual(response.status_code, 422, response.text)
+                self.assertNotEqual(response.json().get("detail"), "Cross-origin state change rejected")
+
+    def test_explicit_cors_origin_remains_allowed(self):
+        response = self.client.post("/auth/login", data={}, headers={"Origin": LOCAL_ORIGIN})
+        self.assertEqual(response.status_code, 422, response.text)
+
+    def test_no_origin_keeps_existing_nonbrowser_behavior(self):
+        response = self.client.post("/auth/login", data={})
+        self.assertEqual(response.status_code, 422, response.text)
+
+    def test_caller_controlled_host_forwarding_and_fetch_headers_cannot_authorize_evil_origin(self):
+        for path in ("/auth/login", "/auth/jellyfin/login"):
+            for routing_headers in (
+                {},
+                {"Host": "evil.example.test"},
+                {"X-Forwarded-Host": "evil.example.test", "X-Forwarded-Proto": "https"},
+                {"Host": "evil.example.test", "X-Forwarded-Host": "evil.example.test", "Sec-Fetch-Site": "same-origin"},
+                {"Host": "watch.example.test", "X-Forwarded-Host": "watch.example.test", "Sec-Fetch-Site": "same-origin"},
+            ):
+                with self.subTest(path=path, routing_headers=routing_headers):
+                    response = self.client.post(path, data={}, headers={"Origin": "https://evil.example.test", **routing_headers})
+                    self.assertEqual(response.status_code, 403, response.text)
+                    self.assertEqual(response.json()["detail"], "Cross-origin state change rejected")
+
+    def test_null_path_query_and_userinfo_origins_are_rejected_before_login(self):
+        for origin in ("null", PUBLIC_ORIGIN + "/", PUBLIC_ORIGIN + "/path", PUBLIC_ORIGIN + "?query=1", "https://user@watch.example.test"):
+            with self.subTest(origin=origin):
+                response = self.client.post("/auth/login", data={}, headers={"Origin": origin})
+                self.assertEqual(response.status_code, 403, response.text)
+
+    def test_valid_local_login_works_from_configured_public_origin(self):
+        password = "origin-tests-valid-local-password"
+        db.create_user("origin-owner", password, role="admin")
+        response = self.client.post("/auth/login", data={"username": "origin-owner", "password": password}, headers={"Origin": PUBLIC_ORIGIN})
+        self.assertEqual(response.status_code, 200, response.text)
+        self.assertIn(settings.auth_cookie_name, self.client.cookies)
+        profile = self.client.get("/auth/profile")
+        self.assertEqual(profile.status_code, 200, profile.text)
+        self.assertEqual(profile.json()["user"]["username"], "origin-owner")
+
+    def test_valid_mocked_jellyfin_login_works_from_configured_public_origin(self):
+        jellyfin_runtime = SimpleNamespace(jellyfin_base_url="http://jellyfin.test:8096", jellyfin_api_key="test-api-key")
+        upstream = SimpleNamespace(
+            configured=lambda: True,
+            authenticate_by_name=AsyncMock(return_value={"User": {"Id": "test-jellyfin-id", "Name": "origin-viewer"}}),
+            get_users=AsyncMock(return_value=[]),
+            _extract_user_id=lambda _response: "test-jellyfin-id",
+        )
+        with patch.object(auth_router, "get_runtime_settings", return_value=jellyfin_runtime), patch.object(auth_router, "JellyfinClient", return_value=upstream), patch.object(auth_router, "get_cached_jellyseerr_users", return_value=[]):
+            response = self.client.post("/auth/jellyfin/login", data={"username": "origin-viewer", "password": "origin-tests-jellyfin-password"}, headers={"Origin": PUBLIC_ORIGIN})
+        self.assertEqual(response.status_code, 200, response.text)
+        upstream.authenticate_by_name.assert_awaited_once_with("origin-viewer", "origin-tests-jellyfin-password")
+        self.assertIn(settings.auth_cookie_name, self.client.cookies)
+        self.assertEqual(db.get_user_by_username("origin-viewer")["auth_provider"], "jellyfin")
+
+
+if __name__ == "__main__":
+    unittest.main()

backend/tests/test_schema_migrations.py

@@ -0,0 +1,36 @@
+import sqlite3
+import unittest
+
+from backend.app.schema_migrations import run_schema_migrations
+
+
+class SchemaMigrationTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.conn = sqlite3.connect(":memory:")
+        self.conn.execute(
+            "CREATE TABLE users (id INTEGER PRIMARY KEY, username TEXT NOT NULL UNIQUE, password_hash TEXT, role TEXT, created_at TEXT)"
+        )
+        self.conn.execute(
+            "CREATE TABLE signup_invites (id INTEGER PRIMARY KEY, code TEXT NOT NULL UNIQUE, created_at TEXT, updated_at TEXT)"
+        )
+        self.conn.execute("CREATE TABLE portal_items (id INTEGER PRIMARY KEY, kind TEXT, updated_at TEXT)")
+        self.conn.execute("CREATE TABLE requests_cache (request_id INTEGER PRIMARY KEY, created_at TEXT)")
+
+    def tearDown(self) -> None:
+        self.conn.close()
+
+    def test_migrations_are_versioned_and_idempotent(self) -> None:
+        self.assertEqual(run_schema_migrations(self.conn), [1])
+        self.assertEqual(run_schema_migrations(self.conn), [])
+
+        user_columns = {row[1] for row in self.conn.execute("PRAGMA table_info(users)")}
+        self.assertIn("auth_version", user_columns)
+        self.assertIn("email", user_columns)
+        request_columns = {row[1] for row in self.conn.execute("PRAGMA table_info(requests_cache)")}
+        self.assertIn("requested_by_id", request_columns)
+        applied = self.conn.execute("SELECT version, name FROM schema_migrations").fetchall()
+        self.assertEqual(applied, [(1, "legacy_columns_and_indexes")])
+
+
+if __name__ == "__main__":
+    unittest.main()

backend/tests/test_setup.py

@@ -0,0 +1,267 @@
+from concurrent.futures import ThreadPoolExecutor
+import os
+import tempfile
+from threading import Barrier
+from types import SimpleNamespace
+import unittest
+from unittest.mock import AsyncMock, patch
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from backend.app import db
+from backend.app.config import settings
+from backend.app.routers import setup as setup_router
+from backend.app.security import create_access_token
+from backend.app.services import setup
+
+
+SETUP_TOKEN = "operator-setup-token-for-tests-only-1234567890"
+ADMIN_PASSWORD = "A-long-admin-password!123"
+
+
+class SetupTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp = tempfile.TemporaryDirectory(ignore_cleanup_errors=True)
+        self.addCleanup(self.temp.cleanup)
+        for field, value in {
+            "sqlite_path": os.path.join(self.temp.name, "test.db"),
+            "sqlite_journal_mode": "DELETE",
+            "admin_username": "environment-admin",
+            "admin_password": "",
+            "jwt_secret": "setup-test-jwt-secret-only-1234567890",
+            "settings_encryption_key": "bWFnZW50LXNlY3VyaXR5LXRlc3Qta2V5LTMyLWJ5dGU=",
+        }.items():
+            context = patch.object(settings, field, value)
+            context.start()
+            self.addCleanup(context.stop)
+        context = patch.object(setup, "settings", SimpleNamespace(setup_token=SETUP_TOKEN))
+        context.start()
+        self.addCleanup(context.stop)
+        setup.initialize_setup_state()
+        db.init_db()
+        self.app = FastAPI()
+        self.app.include_router(setup_router.router)
+        self.client = TestClient(self.app)
+        self.addCleanup(self.client.close)
+
+    def bootstrap(self, **changes):
+        return self.client.post("/setup/bootstrap", json={
+            "setup_token": SETUP_TOKEN,
+            "username": "first-admin",
+            "password": ADMIN_PASSWORD,
+            **changes,
+        })
+
+    def admin_headers(self):
+        return {"Authorization": f"Bearer {create_access_token('first-admin', 'admin')}"}
+
+    def test_fresh_install_requires_setup_and_exposes_no_configuration(self):
+        response = self.client.get("/setup/status")
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json(), {"setup_required": True, "needs_admin": True})
+        self.assertEqual(response.headers["cache-control"], "no-store")
+        self.assertEqual(self.client.get("/setup/state").status_code, 401)
+
+    def test_existing_install_migrates_as_completed_without_reopening_bootstrap(self):
+        with db._connect() as conn:
+            conn.execute("DROP TABLE installation_setup")
+        setup.initialize_setup_state()
+        self.assertEqual(setup.get_public_setup_status(), {"setup_required": False, "needs_admin": False})
+        self.assertIsNotNone(setup.get_setup_state()["completed_at"])
+        self.assertEqual(self.bootstrap().status_code, 409)
+
+    def test_missing_marker_fails_closed(self):
+        with db._connect() as conn:
+            conn.execute("DROP TABLE installation_setup")
+        self.assertFalse(setup.is_setup_required())
+        self.assertEqual(self.bootstrap().status_code, 409)
+
+    def test_marker_survives_restart_before_schema_initialization(self):
+        new_path = os.path.join(self.temp.name, "interrupted.db")
+        with patch.object(settings, "sqlite_path", new_path):
+            setup.initialize_setup_state()
+            setup.initialize_setup_state()
+            db.init_db()
+            self.assertTrue(setup.is_setup_required())
+
+    def test_empty_precreated_database_is_a_fresh_install(self):
+        new_path = os.path.join(self.temp.name, "empty.db")
+        with open(new_path, "wb"):
+            pass
+        with patch.object(settings, "sqlite_path", new_path):
+            setup.initialize_setup_state()
+            db.init_db()
+            self.assertTrue(setup.is_setup_required())
+
+    def test_environment_admin_uses_wizard_without_public_bootstrap(self):
+        with patch.object(settings, "admin_password", ADMIN_PASSWORD):
+            db.ensure_admin_user()
+        self.assertEqual(setup.get_public_setup_status(), {"setup_required": True, "needs_admin": False})
+        self.assertEqual(self.bootstrap().status_code, 409)
+
+    def test_valid_token_creates_local_admin_once_and_uses_password_hash(self):
+        response = self.bootstrap()
+        self.assertEqual(response.status_code, 201, response.text)
+        self.assertEqual(response.json(), {"status": "created", "username": "first-admin"})
+        user = db.verify_user_password("first-admin", ADMIN_PASSWORD)
+        self.assertIsNotNone(user)
+        self.assertEqual(user["role"], "admin")
+        self.assertEqual(user["auth_provider"], "local")
+        self.assertNotEqual(user["password_hash"], ADMIN_PASSWORD)
+        self.assertEqual(setup.get_setup_state()["step"], "apps")
+        self.assertEqual(self.bootstrap(username="second-admin").status_code, 409)
+        self.assertEqual(len(db.get_all_users()), 1)
+
+    def test_invalid_and_missing_operator_tokens_never_create_admin(self):
+        self.assertEqual(self.bootstrap(setup_token="incorrect").status_code, 403)
+        with patch.object(setup.settings, "setup_token", ""):
+            self.assertEqual(self.bootstrap().status_code, 403)
+        with patch.object(setup.settings, "setup_token", "too-short"):
+            self.assertEqual(self.bootstrap(setup_token="too-short").status_code, 403)
+        self.assertFalse(db.has_admin_user())
+
+    def test_non_ascii_token_fails_cleanly(self):
+        self.assertEqual(self.bootstrap(setup_token="invalid-\N{SNOWMAN}").status_code, 403)
+        self.assertFalse(db.has_admin_user())
+
+    def test_example_and_repeated_character_setup_tokens_are_rejected(self):
+        for token in (
+            "replace-with-a-separate-random-setup-token",
+            "CHANGE_ME_before_starting_this_installation",
+            "your-setup-token-goes-here-at-least-32-characters",
+            "a" * 64,
+            "0" * 64,
+            " " * 64,
+        ):
+            with self.subTest(token=token), patch.object(setup.settings, "setup_token", token):
+                self.assertFalse(setup.setup_token_configured())
+                with self.assertRaises(setup.InvalidSetupTokenError):
+                    setup.bootstrap_administrator(token, "owner", ADMIN_PASSWORD)
+        self.assertFalse(db.has_admin_user())
+        self.assertTrue(setup.setup_token_configured())
+
+    def test_password_policy_and_username_validation(self):
+        for username in ("   ", "admin user", "admin\x7f", "admin\nname"):
+            with self.subTest(username=repr(username)):
+                self.assertEqual(self.bootstrap(username=username).status_code, 400)
+        self.assertEqual(self.bootstrap(password="short").status_code, 400)
+        self.assertFalse(db.has_admin_user())
+
+    def test_oversized_fields_and_unexpected_privileges_are_rejected(self):
+        self.assertEqual(self.bootstrap(password="x" * 1025).status_code, 422)
+        self.assertEqual(self.bootstrap(username="x" * 101).status_code, 422)
+        self.assertEqual(self.bootstrap(role="admin").status_code, 422)
+        self.assertFalse(db.has_admin_user())
+
+    def test_existing_normalized_username_is_not_replaced(self):
+        db.create_user("Taken", ADMIN_PASSWORD)
+        self.assertEqual(self.bootstrap(username="taken").status_code, 409)
+        self.assertFalse(db.has_admin_user())
+        self.assertEqual(len(db.get_all_users()), 1)
+
+    def test_bootstrap_attempts_are_persistently_limited(self):
+        for _ in range(setup.BOOTSTRAP_IP_ATTEMPTS):
+            self.assertEqual(self.bootstrap(setup_token="incorrect").status_code, 403)
+        setup.initialize_setup_state()
+        response = self.bootstrap()
+        self.assertEqual(response.status_code, 429)
+        self.assertGreater(int(response.headers["retry-after"]), 0)
+        self.assertFalse(db.has_admin_user())
+        with db._connect() as conn:
+            keys = [row[0] for row in conn.execute("SELECT key_hash FROM installation_setup_attempts")]
+        self.assertNotIn("testclient", keys)
+
+    def test_rate_limit_global_cap_and_expiry(self):
+        with patch.object(setup, "time", return_value=1000):
+            for number in range(setup.BOOTSTRAP_GLOBAL_ATTEMPTS):
+                self.assertIsNone(setup.consume_bootstrap_attempt(f"192.0.2.{number}"))
+            self.assertEqual(setup.consume_bootstrap_attempt("198.51.100.1"), 900)
+        with patch.object(setup, "time", return_value=1901):
+            self.assertIsNone(setup.consume_bootstrap_attempt("198.51.100.1"))
+
+    def test_concurrent_attempts_cannot_bypass_rate_limit(self):
+        with ThreadPoolExecutor(max_workers=8) as executor:
+            results = list(executor.map(lambda _: setup.consume_bootstrap_attempt("192.0.2.1"), range(12)))
+        self.assertEqual(results.count(None), setup.BOOTSTRAP_IP_ATTEMPTS)
+
+    def test_concurrent_bootstraps_create_only_one_admin(self):
+        barrier = Barrier(4)
+
+        def synchronized_hash(_):
+            barrier.wait(timeout=10)
+            return "test-only-precomputed-hash"
+
+        def create(number):
+            try:
+                setup.bootstrap_administrator(SETUP_TOKEN, f"admin-{number}", ADMIN_PASSWORD)
+                return True
+            except setup.SetupUnavailableError:
+                return False
+
+        with patch.object(setup, "hash_password", side_effect=synchronized_hash):
+            with ThreadPoolExecutor(max_workers=4) as executor:
+                results = list(executor.map(create, range(4)))
+        self.assertEqual(results.count(True), 1)
+        self.assertEqual(len(db.get_all_users()), 1)
+
+    def test_state_mutations_require_admin_and_progress_resumes(self):
+        self.assertEqual(self.bootstrap().status_code, 201)
+        db.create_user("viewer", ADMIN_PASSWORD)
+        user_headers = {"Authorization": f"Bearer {create_access_token('viewer', 'user')}"}
+        for path, method, kwargs in (
+            ("/setup/state", "get", {}),
+            ("/setup/state", "put", {"json": {"step": "review"}}),
+            ("/setup/complete", "post", {}),
+        ):
+            with self.subTest(path=path, method=method):
+                call = getattr(self.client, method)
+                self.assertEqual(call(path, **kwargs).status_code, 401)
+                self.assertEqual(call(path, headers=user_headers, **kwargs).status_code, 403)
+        response = self.client.put("/setup/state", json={"step": "preferences"}, headers=self.admin_headers())
+        self.assertEqual(response.status_code, 200)
+        setup.initialize_setup_state()
+        db.init_db()
+        self.assertEqual(setup.get_setup_state()["step"], "preferences")
+        self.assertTrue(setup.is_setup_required())
+        self.assertEqual(self.client.put(
+            "/setup/state", json={"step": "invalid"}, headers=self.admin_headers()
+        ).status_code, 422)
+
+    def test_completion_invokes_worker_callback_and_cannot_reopen_bootstrap(self):
+        self.assertEqual(self.bootstrap().status_code, 201)
+        callback = AsyncMock()
+        self.app.state.on_setup_complete = callback
+        response = self.client.post("/setup/complete", headers=self.admin_headers())
+        self.assertEqual(response.status_code, 200, response.text)
+        self.assertTrue(response.json()["completed"])
+        self.assertIsNotNone(response.json()["completed_at"])
+        callback.assert_awaited_once()
+        self.assertFalse(setup.is_setup_required())
+        # A retry can restart an idempotent callback if the first response was
+        # interrupted, while keeping the original completion timestamp.
+        retry = self.client.post("/setup/complete", headers=self.admin_headers())
+        self.assertEqual(retry.json(), response.json())
+        self.assertEqual(callback.await_count, 2)
+        self.client.put("/setup/state", json={"step": "administrator"}, headers=self.admin_headers())
+        with db._connect() as conn:
+            conn.execute("DELETE FROM users")
+        self.assertEqual(self.bootstrap().status_code, 409)
+        self.assertEqual(setup.get_setup_state()["step"], "review")
+
+    def test_completion_requires_an_administrator(self):
+        with self.assertRaises(setup.SetupUnavailableError):
+            setup.complete_setup()
+        self.assertTrue(setup.is_setup_required())
+
+    def test_sync_callback_is_supported(self):
+        self.assertEqual(self.bootstrap().status_code, 201)
+        called = []
+        self.app.state.on_setup_complete = lambda: called.append(True)
+        response = self.client.post("/setup/complete", headers=self.admin_headers())
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(called, [True])
+
+
+if __name__ == "__main__":
+    unittest.main()

docker-compose.beta.yml

@@ -15,6 +15,8 @@ services:
       AUTH_COOKIE_NAME: magent_beta_auth
       AUTH_STATE_COOKIE_NAME: magent_beta_logged_in
       AUTH_COOKIE_DOMAIN: beta.grizzlyflix.co.nz
+      AUTH_COOKIE_SECURE: "true"
+      AUTH_COOKIE_SAMESITE: strict
       SQLITE_PATH: /app/data/magent.db
       LOG_FILE: /app/data/magent.log
       SITE_BANNER_ENABLED: "true"
@@ -26,3 +28,10 @@ services:
     volumes:
       - ./data:/app/data
     restart: unless-stopped
+    read_only: true
+    cap_drop: ["ALL"]
+    security_opt: ["no-new-privileges:true"]
+    init: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m,uid=1000,gid=1000
+      - /app/frontend/.next/cache:rw,noexec,nosuid,size=128m,uid=1000,gid=1000

docker-compose.hub.yml

@@ -5,6 +5,13 @@ services:
       - ./.env
     ports:
       - "3000:3000"
-      - "8000:8000"
+      - "127.0.0.1:8000:8000"
     volumes:
       - ./data:/app/data
+    read_only: true
+    cap_drop: ["ALL"]
+    security_opt: ["no-new-privileges:true"]
+    init: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m,uid=1000,gid=1000
+      - /app/frontend/.next/cache:rw,noexec,nosuid,size=128m,uid=1000,gid=1000

docker-compose.production.yml

@@ -5,9 +5,19 @@ services:
     build: .
     env_file:
       - ./.env
+    environment:
+      AUTH_COOKIE_SECURE: "true"
+      AUTH_COOKIE_SAMESITE: strict
     ports:
       - "10.30.1.32:3200:3000"
       - "127.0.0.1:8200:8000"
     volumes:
       - ./data:/app/data
     restart: unless-stopped
+    read_only: true
+    cap_drop: ["ALL"]
+    security_opt: ["no-new-privileges:true"]
+    init: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m,uid=1000,gid=1000
+      - /app/frontend/.next/cache:rw,noexec,nosuid,size=128m,uid=1000,gid=1000

docker-compose.yml

@@ -7,6 +7,13 @@ services:
       - ./.env
     ports:
       - "3000:3000"
-      - "8000:8000"
+      - "127.0.0.1:8000:8000"
     volumes:
       - ./data:/app/data
+    read_only: true
+    cap_drop: ["ALL"]
+    security_opt: ["no-new-privileges:true"]
+    init: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m,uid=1000,gid=1000
+      - /app/frontend/.next/cache:rw,noexec,nosuid,size=128m,uid=1000,gid=1000

docs/installation-and-recovery.md

@@ -0,0 +1,63 @@
+# Installation, backup and recovery
+
+## Fresh installation
+
+Start with `.env.example`. Generate independent random values for `JWT_SECRET` and `SETUP_TOKEN` (at least 32 characters each), plus a Fernet `SETTINGS_ENCRYPTION_KEY`. Never deploy the example placeholders. Keep the environment file private.
+
+```bash
+python -c "import secrets; print(secrets.token_urlsafe(48))"
+python -c "import secrets; print(secrets.token_urlsafe(48))"
+python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+```
+
+The first two commands produce the JWT secret and setup token respectively. The third requires the backend dependencies. Alternatively generate the Fernet key using Python's standard library: `python -c "import base64, secrets; print(base64.urlsafe_b64encode(secrets.token_bytes(32)).decode())"`.
+
+Set the correct browser-facing `CORS_ALLOW_ORIGIN`, `MAGENT_APPLICATION_URL`, cookie HTTPS settings and host paths before starting. These deployment settings are deliberately not editable through public setup. Changing the public application URL in the wizard does not change CORS or reverse-proxy configuration.
+
+After `docker compose up -d --build`, visit the frontend. A new database redirects to `/setup`:
+
+1. Enter `SETUP_TOKEN` and create a local administrator with a unique password of at least 12 characters. Alternatively, set `ADMIN_USERNAME` and `ADMIN_PASSWORD` in the environment before the first start, then sign in with that account.
+2. Expand each app you use: Jellyfin, Seerr/Jellyseerr, Sonarr, Radarr, Prowlarr, qBittorrent, Bazarr and Jellystat. Enter its internal address and credentials, then **Save & test**. For Sonarr/Radarr, a successful check loads quality profiles and root folders.
+3. Set site access, request refresh/retention and optional SMTP preferences. Invite signup remains invite-only.
+4. Review and finish. Magent starts its configured background jobs, unless `BACKGROUND_TASKS_ENABLED=false`.
+
+Use server-reachable addresses: `localhost` in a container refers to that container. Optional apps can be skipped. Each successful save persists; closing the tab leaves setup resumable. Unsaved form fields are not retained. Remove `SETUP_TOKEN` after finishing. Bootstrap is permanently disabled after setup, and cannot replace an existing administrator. Administrators can revisit the wizard from Settings without resetting the installation.
+
+Upgrades with an existing users table are marked configured automatically. Setup status reveals only whether setup is needed and whether the first administrator is missing. Configuration and wizard progress require administrator authentication. First-admin creation uses a constant-time token comparison, persistent rate limits and a database transaction to prevent concurrent claims.
+
+## Create a backup
+
+Open **Settings → Advanced tools → Backup & restore** (`/admin/backups`). Choose a unique backup passphrase of 12–1024 characters, confirm it, optionally include the filesystem artwork cache, and download the `.magent-backup` file.
+
+Every backup includes:
+
+- A consistent SQLite snapshot: users, password hashes, invite records, requests, issues, settings, saved statistics, subscriptions and database-backed caches.
+- Portable runtime configuration, including environment-provided app credentials. Secrets are decrypted only inside the private export staging area and encrypted archive; they are re-encrypted with the destination installation key when restoring.
+- Custom branding (`data/branding/logo.png` and `favicon.ico`).
+
+The optional cache adds supported TMDB artwork from `data/artwork/tmdb`. In-memory caches are rebuilt, not backed up. Media files, the connected apps' databases, log files, `.env`, TLS private keys, host paths, signing/encryption keys and deployment/network controls are not included. Keep a separate secure record of the deployment configuration and backup passphrase.
+
+Backups use authenticated AES-256-GCM encryption with a per-backup salt and scrypt-derived key. The passphrase is never stored by Magent and cannot be recovered. Keep backups and their passphrases separately, off the Magent host. Treat backups as sensitive even though encrypted.
+
+Current limits: **32 MiB encrypted archive**, **128 MiB expanded data**, and **20,000 entries**. These bound memory and disk use; including a large artwork cache can exceed them. Retry without artwork if necessary. For larger installations, use a separate operator-managed offline volume/database backup; this UI does not silently omit oversized data. Automatic scheduled backups and media-server backups are not part of this feature.
+
+The frontend and backend accept up to 34 MiB for the whole multipart request, including the 32 MiB file. Configure any external reverse proxy's upload limit accordingly (for example `client_max_body_size 34m` in nginx); otherwise it may reject valid files before they reach Magent.
+
+## Restore safely
+
+1. Make a fresh backup of the destination. Stop external writes/other backend processes sharing its SQLite file. The supplied deployment uses one backend worker; do not run restore against a multi-worker/shared-database deployment.
+2. Sign in as an administrator, select a `.magent-backup`, enter its passphrase and type `RESTORE`. A fresh replacement installation must first create its temporary administrator through `/setup`; then use the **Restore it here** link before connecting apps.
+3. Upload and stage the restore. Magent checks authentication, encrypted integrity, archive paths and sizes, checksums, SQLite integrity, schema compatibility and an active restored administrator. Live data is unchanged at this point. A pending restore can be cancelled from the same page.
+4. Restart the application using your normal deployment process, for example `docker compose restart magent`. Beta: `docker compose -p magent-beta -f docker-compose.beta.yml restart magent`. The UI never restarts a server automatically.
+5. On startup, before schema initialization or workers, Magent creates a private rollback copy, replaces the database/selected assets and records the result. Failed or interrupted replacement is rolled back using a durable journal. Review the backend logs if startup stops.
+6. Sign in with an account from the restored backup, verify Settings/service checks, requests, issues and invite policy, then create a new backup. Old sessions and password-reset tokens are invalidated. Existing invite records and links are retained, with their original expiry and usage state.
+
+Restore **replaces** the destination database; it does not merge changes made after the backup. After staging, pause normal usage until the restart so new writes are not mistaken for restored data. Do not change the destination encryption key between staging and restart. Restoring earlier invite state can also restore its remaining uses: review active invitations after recovery.
+
+Use the same Magent version for restore, then upgrade normally. Portable settings follow the backup, but destination host identity, JWT/encryption keys, local paths, TLS/cookie/proxy controls and ports remain destination-owned. Review public URLs and service addresses when moving hosts. Without the optional artwork cache, database artwork flags are reset and missing artwork can be fetched again; the existing destination artwork directory is left in place.
+
+## Recovery files
+
+The `backups/` directory beside the configured SQLite database contains private staging, lock/journal/status files and `rollback-<id>/` copies. It is not a library of exported encrypted downloads. Rollback copies contain the old database and assets; protect the data volume with host encryption and restrictive access. Magent does not automatically delete rollback copies after success. After validating the restored installation and saving a separate backup, an operator may archive or remove the specific old rollback directories during maintenance. Never remove an active `pending/` directory or `restore-journal.json` during a restore.
+
+Insufficient disk space or invalid input stops the operation rather than partially accepting a backup. Allow room for the upload, extracted staging database/assets, live data and a rollback copy. The supplied Docker image's unprivileged user must have write access to the persistent data volume. Do not delete the data volume or replace `.env` to retry setup or recovery.

frontend/app/MyRequests.tsx

@@ -1,298 +1,263 @@
-'use client'
+"use client";
 
-import PageHeading from './ui/PageHeading'
-
-import { useRouter } from 'next/navigation'
-import { useEffect, useState } from 'react'
-import { authFetch, getApiBase, getToken, clearToken, getEventStreamToken } from './lib/auth'
-
-const normalizeRecentResults = (items: any[]) =>
-  items
-    .filter((item: any) => item?.id)
-    .map((item: any) => {
-      const id = item.id
-      const rawTitle = item.title
-      const placeholder =
-        typeof rawTitle === 'string' && rawTitle.trim().toLowerCase() === `request ${id}`
-      return {
-        id,
-        title: !rawTitle || placeholder ? `Request #${id}` : rawTitle,
-        year: item.year,
-        type: item.type,
-        statusLabel: item.statusLabel,
-        artwork: item.artwork,
-        createdAt: item.createdAt ?? null,
-      }
-    })
-
-const REQUEST_STAGE_OPTIONS = [
-  { value: 'all', label: 'All stages' },
-  { value: 'pending', label: 'Waiting' },
-  { value: 'approved', label: 'Approved' },
-  { value: 'in_progress', label: 'In progress' },
-  { value: 'working', label: 'Working' },
-  { value: 'partial', label: 'Partial' },
-  { value: 'ready', label: 'Ready' },
-  { value: 'declined', label: 'Declined' },
-]
+import { useRouter } from "next/navigation";
+import { useEffect, useState } from "react";
+import { authFetch, clearToken, getApiBase, getEventStreamToken, getToken } from "./lib/auth";
+import {
+  normalizeRecentResults,
+  normalizeSearchResults,
+  type RecentRequest,
+  type RequestSearchResult,
+} from "./lib/request-results";
+import { useEffectiveRole } from "./lib/viewMode";
+import PageHeading from "./ui/PageHeading";
+import RequestStageFilter, { type RequestStage } from "./ui/RequestStageFilter";
 
 export default function HomePage() {
-  const router = useRouter()
-  const [query, setQuery] = useState('')
-  const [recent, setRecent] = useState<
-    {
-      id: number
-      title: string
-      year?: number
-      type?: string
-      statusLabel?: string
-      artwork?: { poster_url?: string; backdrop_url?: string }
-      createdAt?: string | null
-    }[]
-  >([])
-  const [recentError, setRecentError] = useState<string | null>(null)
-  const [recentLoading, setRecentLoading] = useState(false)
-  const [searchResults, setSearchResults] = useState<
-    {
-      title: string
-      year?: number
-      type?: string
-      requestId?: number
-      statusLabel?: string
-      requestedBy?: string | null
-      accessible?: boolean
-    }[]
-  >([])
-  const [searchError, setSearchError] = useState<string | null>(null)
-  const [role, setRole] = useState<string | null>(null)
-  const [recentDays, setRecentDays] = useState(90)
-  const [recentStage, setRecentStage] = useState('all')
-  const [authReady, setAuthReady] = useState(false)
+  const router = useRouter();
+  const [query, setQuery] = useState("");
+  const [recent, setRecent] = useState<RecentRequest[]>([]);
+  const [recentError, setRecentError] = useState<string | null>(null);
+  const [recentLoading, setRecentLoading] = useState(false);
+  const [searchResults, setSearchResults] = useState<RequestSearchResult[]>([]);
+  const [searchError, setSearchError] = useState<string | null>(null);
+  const [role, setRole] = useState<string | null>(null);
+  const effectiveRole = useEffectiveRole(role);
+  const isAdmin = effectiveRole === "admin";
+  const [recentDays, setRecentDays] = useState(90);
+  const [recentStage, setRecentStage] = useState<RequestStage>("all");
+  const [authReady, setAuthReady] = useState(false);
 
   const submit = (event: React.FormEvent) => {
-    event.preventDefault()
-    const trimmed = query.trim()
-    if (!trimmed) return
+    event.preventDefault();
+    const trimmed = query.trim();
+    if (!trimmed) return;
     if (/^\d+$/.test(trimmed)) {
-      router.push(`/requests/${encodeURIComponent(trimmed)}`)
-      return
+      router.push(`/requests/${encodeURIComponent(trimmed)}`);
+      return;
     }
-    void runSearch(trimmed)
-  }
+    void runSearch(trimmed);
+  };
 
   useEffect(() => {
     if (!getToken()) {
-      router.push('/login')
-      return
+      router.push("/login");
+      return;
     }
-    let cancelled = false
+    let cancelled = false;
     const load = async () => {
-      setRecentLoading(true)
-      setRecentError(null)
+      setRecentLoading(true);
+      setRecentError(null);
       try {
-        const baseUrl = getApiBase()
-        const meResponse = await authFetch(`${baseUrl}/auth/me`)
+        const baseUrl = getApiBase();
+        const meResponse = await authFetch(`${baseUrl}/auth/me`);
         if (!meResponse.ok) {
           if (meResponse.status === 401) {
-            clearToken()
-            router.push('/login')
-            return
+            clearToken();
+            router.push("/login");
+            return;
           }
-          throw new Error(`Auth failed: ${meResponse.status}`)
+          throw new Error(`Auth failed: ${meResponse.status}`);
         }
-        const me = await meResponse.json()
-        if (cancelled) return
-        const userRole = me?.role ?? null
-        setRole(userRole)
-        setAuthReady(true)
-        const take = userRole === 'admin' ? 50 : 6
+        const me = await meResponse.json();
+        if (cancelled) return;
+        const userRole = me?.role ?? null;
+        setRole(userRole);
+        setAuthReady(true);
+        const take = isAdmin ? 50 : 6;
         const params = new URLSearchParams({
           take: String(take),
           days: String(recentDays),
-        })
-        if (recentStage !== 'all') {
-          params.set('stage', recentStage)
+        });
+        if (recentStage !== "all") {
+          params.set("stage", recentStage);
         }
-        const response = await authFetch(`${baseUrl}/requests/recent?${params.toString()}`)
+        const response = await authFetch(`${baseUrl}/requests/recent?${params.toString()}`);
         if (!response.ok) {
           if (response.status === 401) {
-            clearToken()
-            router.push('/login')
-            return
+            clearToken();
+            router.push("/login");
+            return;
           }
-          throw new Error(`Recent requests failed: ${response.status}`)
+          throw new Error(`Recent requests failed: ${response.status}`);
         }
-        const data = await response.json()
-        if (cancelled) return
+        const data = await response.json();
+        if (cancelled) return;
         if (Array.isArray(data?.results)) {
-          setRecent(normalizeRecentResults(data.results))
+          setRecent(normalizeRecentResults(data.results));
         }
       } catch (error) {
-        console.error(error)
-        if (!cancelled) setRecentError('Recent requests are not available right now.')
+        console.error(error);
+        if (!cancelled) setRecentError("Recent requests are not available right now.");
       } finally {
-        if (!cancelled) setRecentLoading(false)
+        if (!cancelled) setRecentLoading(false);
       }
-    }
+    };
 
-    void load()
-    return () => { cancelled = true }
-  }, [recentDays, recentStage])
+    void load();
+    return () => {
+      cancelled = true;
+    };
+  }, [isAdmin, recentDays, recentStage, router]);
 
   useEffect(() => {
     if (!authReady) {
-      return
+      return;
     }
     if (!getToken()) {
-      return
+      return;
     }
-    const baseUrl = getApiBase()
-    let closed = false
-    let source: EventSource | null = null
+    const baseUrl = getApiBase();
+    let closed = false;
+    let source: EventSource | null = null;
 
     const connect = async () => {
       try {
-        const streamToken = await getEventStreamToken()
-        if (closed) return
+        const streamToken = await getEventStreamToken();
+        if (closed) return;
         const params = new URLSearchParams({
           stream_token: streamToken,
           recent_days: String(recentDays),
-        })
-        if (recentStage !== 'all') {
-          params.set('recent_stage', recentStage)
+        });
+        if (recentStage !== "all") {
+          params.set("recent_stage", recentStage);
         }
-        const streamUrl = `${baseUrl}/events/stream?${params.toString()}`
-        source = new EventSource(streamUrl)
+        const streamUrl = `${baseUrl}/events/stream?${params.toString()}`;
+        source = new EventSource(streamUrl);
 
         source.onmessage = (event) => {
-          if (closed) return
+          if (closed) return;
           try {
-            const payload = JSON.parse(event.data)
-            if (!payload || typeof payload !== 'object') {
-              return
+            const payload = JSON.parse(event.data);
+            if (!payload || typeof payload !== "object") {
+              return;
             }
-            if (payload.type === 'home_recent') {
+            if (payload.type === "home_recent") {
               if (Array.isArray(payload.results)) {
-                setRecent(normalizeRecentResults(payload.results))
-                setRecentError(null)
-                setRecentLoading(false)
-              } else if (typeof payload.error === 'string' && payload.error.trim()) {
-                setRecentError('Recent requests are not available right now.')
-                setRecentLoading(false)
+                setRecent(normalizeRecentResults(payload.results));
+                setRecentError(null);
+                setRecentLoading(false);
+              } else if (typeof payload.error === "string" && payload.error.trim()) {
+                setRecentError("Recent requests are not available right now.");
+                setRecentLoading(false);
               }
-              return
+              return;
             }
           } catch (error) {
-            console.error(error)
+            console.error(error);
           }
-        }
-
+        };
       } catch (error) {
-        if (closed) return
-        console.error(error)
+        if (closed) return;
+        console.error(error);
       }
-    }
+    };
 
-    void connect()
+    void connect();
 
     return () => {
-      closed = true
-      source?.close()
-    }
-  }, [authReady, recentDays, recentStage])
+      closed = true;
+      source?.close();
+    };
+  }, [authReady, recentDays, recentStage]);
 
   const runSearch = async (term: string) => {
     try {
-      const baseUrl = getApiBase()
-      const response = await authFetch(`${baseUrl}/requests/search?query=${encodeURIComponent(term)}`)
+      const baseUrl = getApiBase();
+      const response = await authFetch(`${baseUrl}/requests/search?query=${encodeURIComponent(term)}`);
       if (!response.ok) {
         if (response.status === 401) {
-          clearToken()
-          router.push('/login')
-          return
+          clearToken();
+          router.push("/login");
+          return;
         }
-        throw new Error(`Search failed: ${response.status}`)
+        throw new Error(`Search failed: ${response.status}`);
       }
-      const data = await response.json()
+      const data = await response.json();
       if (Array.isArray(data?.results)) {
-        setSearchResults(
-            data.results.map((item: any) => ({
-              title: item.title,
-              year: item.year,
-              type: item.type,
-              requestId: item.requestId,
-              statusLabel: item.statusLabel,
-              requestedBy: item.requestedBy ?? null,
-              accessible: Boolean(item.accessible),
-            }))
-          )
-        setSearchError(null)
+        setSearchResults(normalizeSearchResults(data.results));
+        setSearchError(null);
       }
     } catch (error) {
-      console.error(error)
-      setSearchError('Search failed. Try a request ID instead.')
-      setSearchResults([])
+      console.error(error);
+      setSearchError("Search failed. Try a request ID instead.");
+      setSearchResults([]);
     }
-  }
+  };
 
   const resolveArtworkUrl = (url?: string | null) => {
-    if (!url) return null
-    return url.startsWith('http') ? url : `${getApiBase()}${url}`
-  }
+    if (!url) return null;
+    return url.startsWith("http") ? url : `${getApiBase()}${url}`;
+  };
 
   const formatRequestTime = (value?: string | null) => {
-    if (!value) return null
-    const date = new Date(value)
-    if (Number.isNaN(date.valueOf())) return value
-    return date.toLocaleString()
-  }
+    if (!value) return null;
+    const date = new Date(value);
+    if (Number.isNaN(date.valueOf())) return value;
+    return date.toLocaleString();
+  };
 
   const activeRecentCount = recent.filter((item) => {
-    const label = String(item.statusLabel ?? '').toLowerCase()
-    return !label.includes('ready') && !label.includes('available') && !label.includes('declined')
-  }).length
+    const label = String(item.statusLabel ?? "").toLowerCase();
+    return !label.includes("ready") && !label.includes("available") && !label.includes("declined");
+  }).length;
   const readyRecentCount = recent.filter((item) => {
-    const label = String(item.statusLabel ?? '').toLowerCase()
-    return label.includes('ready') || label.includes('available')
-  }).length
+    const label = String(item.statusLabel ?? "").toLowerCase();
+    return label.includes("ready") || label.includes("available");
+  }).length;
 
   const requestCardState = (value?: string) => {
-    const label = String(value ?? '').toLowerCase()
-    if (label.includes('partial')) return { key: 'attention', label: value || 'Partially ready', progress: 65 }
-    if (!/not |unavailable|waiting/.test(label) && (label.includes('ready') || label.includes('available'))) return { key: 'ready', label: value || 'Ready', progress: 100 }
-    if (label.includes('declined') || label.includes('failed') || label.includes('error')) return { key: 'attention', label: value || 'Needs attention', progress: 12 }
-    if (label.includes('working') || label.includes('progress') || label.includes('download')) return { key: 'processing', label: value || 'In progress', progress: 58 }
-    return { key: 'waiting', label: value || 'Waiting', progress: 4 }
-  }
+    const label = String(value ?? "").toLowerCase();
+    if (label.includes("partial")) return { key: "attention", label: value || "Partially ready", progress: 65 };
+    if (!/not |unavailable|waiting/.test(label) && (label.includes("ready") || label.includes("available")))
+      return { key: "ready", label: value || "Ready", progress: 100 };
+    if (label.includes("declined") || label.includes("failed") || label.includes("error"))
+      return { key: "attention", label: value || "Needs attention", progress: 12 };
+    if (label.includes("working") || label.includes("progress") || label.includes("download"))
+      return { key: "processing", label: value || "In progress", progress: 58 };
+    return { key: "waiting", label: value || "Waiting", progress: 4 };
+  };
 
   return (
     <main className="card home-page">
-      <PageHeading title="My requests" description="Follow your requests from collection to ready to watch." actions={
-        <form onSubmit={submit} className="home-search">
-          <label htmlFor="request-search">Title, year, or request number</label>
-          <div className="home-search-row">
-            <input
-              id="request-search"
-              value={query}
-              onChange={(event) => setQuery(event.target.value)}
-              placeholder="Dune 2021 or 1289"
-            />
-            <button type="submit">Find request</button>
-          </div>
-        </form>
-      } />
+      <PageHeading
+        title="My requests"
+        description="Follow your requests from collection to ready to watch."
+        actions={
+          <form onSubmit={submit} className="home-search">
+            <label htmlFor="request-search">Title, year, or request number</label>
+            <div className="home-search-row">
+              <input
+                id="request-search"
+                value={query}
+                onChange={(event) => setQuery(event.target.value)}
+                placeholder="Dune 2021 or 1289"
+              />
+              <button type="submit">Find request</button>
+            </div>
+          </form>
+        }
+      />
 
       {(searchError || searchResults.length > 0) && (
         <section className="home-search-results" aria-live="polite">
           <div className="home-section-heading">
             <div>
               <span className="section-kicker">Search results</span>
-              <h2>{searchError ? 'Search unavailable' : `${searchResults.length} match${searchResults.length === 1 ? '' : 'es'} found`}</h2>
+              <h2>
+                {searchError
+                  ? "Search unavailable"
+                  : `${searchResults.length} match${searchResults.length === 1 ? "" : "es"} found`}
+              </h2>
             </div>
-            <button type="button" className="ghost-button" onClick={() => {
-              setSearchResults([])
-              setSearchError(null)
-            }}>
+            <button
+              type="button"
+              className="ghost-button"
+              onClick={() => {
+                setSearchResults([]);
+                setSearchError(null);
+              }}
+            >
               Clear
             </button>
           </div>
@@ -302,17 +267,20 @@ export default function HomePage() {
             <div className="home-result-grid">
               {searchResults.map((item, index) => (
                 <button
-                  key={`${item.title || 'Untitled'}-${index}`}
+                  key={`${item.title || "Untitled"}-${index}`}
                   type="button"
                   className="home-result-card"
                   disabled={!item.requestId}
                   onClick={() => item.requestId && router.push(`/requests/${item.requestId}`)}
                 >
                   <span>
-                    <strong>{item.title || 'Untitled'}{item.year ? ` (${item.year})` : ''}</strong>
-                    <small>{item.type?.toUpperCase() || 'MEDIA'}</small>
+                    <strong>
+                      {item.title || "Untitled"}
+                      {item.year ? ` (${item.year})` : ""}
+                    </strong>
+                    <small>{item.type?.toUpperCase() || "MEDIA"}</small>
                   </span>
-                  <span>{!item.requestId ? 'Not requested' : item.statusLabel || 'Already requested'}</span>
+                  <span>{!item.requestId ? "Not requested" : item.statusLabel || "Already requested"}</span>
                 </button>
               ))}
             </div>
@@ -321,16 +289,25 @@ export default function HomePage() {
       )}
 
       <section className="home-metric-strip" aria-label="Request summary">
-        <div><span>In view</span><strong>{recent.length}</strong></div>
-        <div><span>In progress</span><strong>{activeRecentCount}</strong></div>
-        <div><span>Ready</span><strong>{readyRecentCount}</strong></div>
+        <div>
+          <span>In view</span>
+          <strong>{recent.length}</strong>
+        </div>
+        <div>
+          <span>In progress</span>
+          <strong>{activeRecentCount}</strong>
+        </div>
+        <div>
+          <span>Ready</span>
+          <strong>{readyRecentCount}</strong>
+        </div>
       </section>
 
       <section className="recent home-recent">
         <div className="recent-header home-section-heading">
           <div>
             <span className="section-kicker">Request activity</span>
-            <h2>{role === 'admin' ? 'Recent requests' : 'My recent requests'}</h2>
+            <h2>{isAdmin ? "Recent requests" : "My recent requests"}</h2>
           </div>
           {authReady && (
             <div className="recent-filter-group">
@@ -347,21 +324,7 @@ export default function HomePage() {
             </div>
           )}
         </div>
-        {authReady && (
-          <div className="request-filter-chips" aria-label="Filter requests by stage">
-            {REQUEST_STAGE_OPTIONS.filter((option) => ['all', 'pending', 'in_progress', 'working', 'ready'].includes(option.value)).map((option) => (
-              <button
-                type="button"
-                key={option.value}
-                className={recentStage === option.value ? 'is-active' : undefined}
-                onClick={() => setRecentStage(option.value)}
-              >
-                {option.value === 'working' ? <i aria-hidden="true" /> : null}
-                {option.value === 'all' ? 'All' : option.label}
-              </button>
-            ))}
-          </div>
-        )}
+        {authReady && <RequestStageFilter value={recentStage} onChange={setRecentStage} />}
         <div className="recent-grid home-recent-grid">
           {recentLoading ? (
             <div className="loading-center">
@@ -376,7 +339,7 @@ export default function HomePage() {
               <span>Try a wider period or a different stage.</span>
             </div>
           ) : (
-            recent.map((item) => (
+            (isAdmin ? recent : recent.slice(0, 6)).map((item) => (
               <button
                 key={item.id}
                 type="button"
@@ -386,30 +349,43 @@ export default function HomePage() {
                 {item.artwork?.poster_url ? (
                   <img
                     className="recent-poster"
-                    src={resolveArtworkUrl(item.artwork.poster_url) ?? ''}
+                    src={resolveArtworkUrl(item.artwork.poster_url) ?? ""}
                     alt=""
                     loading="lazy"
                   />
                 ) : (
-                  <span className="recent-poster recent-poster-placeholder" aria-hidden="true">#{item.id}</span>
+                  <span className="recent-poster recent-poster-placeholder" aria-hidden="true">
+                    #{item.id}
+                  </span>
                 )}
                 <span className="recent-info">
-                  <span className="recent-title">{item.title || 'Untitled'}{item.year ? ` (${item.year})` : ''}</span>
+                  <span className="recent-title">
+                    {item.title || "Untitled"}
+                    {item.year ? ` (${item.year})` : ""}
+                  </span>
                   <span className="recent-status-badge">
-                    <span aria-hidden="true">{({ ready: '✓', processing: '↻', attention: '!', waiting: '◷' })[requestCardState(item.statusLabel).key]}</span>
-                    {item.statusLabel || 'Status not available yet'}
+                    <span aria-hidden="true">
+                      {
+                        { ready: "✓", processing: "↻", attention: "!", waiting: "◷" }[
+                          requestCardState(item.statusLabel).key
+                        ]
+                      }
+                    </span>
+                    {item.statusLabel || "Status not available yet"}
                   </span>
                   <span className="recent-meta">
                     Request {item.id}
-                    {item.createdAt ? ` · ${formatRequestTime(item.createdAt)}` : ''}
+                    {item.createdAt ? ` · ${formatRequestTime(item.createdAt)}` : ""}
                   </span>
                 </span>
-                <span className="recent-open-cue" aria-hidden="true">Open</span>
+                <span className="recent-open-cue" aria-hidden="true">
+                  Open
+                </span>
               </button>
             ))
           )}
         </div>
       </section>
     </main>
-  )
+  );
 }

frontend/app/account.css

@@ -36,6 +36,7 @@ button.account-secondary { min-height: 44px; padding: 11px 16px; border: 1px sol
 .account-notice { margin: 8px 0 0; padding: 12px 14px; border: 1px solid var(--ops-line); border-radius: 8px; font-size: 13px; line-height: 1.6; overflow-wrap: anywhere; }
 .account-notice.is-error { color: #ffb6b6; border-color: #763d44; background: #311e23; }
 .account-notice.is-status { color: #aae0cb; border-color: #365c50; background: #1b2924; }
+.account-login-message { color: #ded8ed; border-color: #514a60; background: #26222d; white-space: pre-line; }
 .account-connected { display: flex; align-items: center; gap: 9px; border-top: 1px solid var(--ops-line-soft); margin-top: 32px; padding-top: 20px; color: var(--ops-faint); font-size: 12px; }
 .account-connection-dot { width: 6px; height: 6px; background: #83bda7; border-radius: 50%; flex-shrink: 0; }
 .account-request-summary { display: flex; gap: 40px; align-items: center; padding-bottom: 24px; margin-bottom: 28px; border-bottom: 1px solid var(--ops-line-soft); }

frontend/app/admin/SettingField.tsx

@@ -1,72 +1,162 @@
-'use client'
+"use client";
 
-export type AdminSetting = { key: string; value: string | null; isSet: boolean; source: string; sensitive: boolean }
-type Option = { value: string; label: string }
+export type AdminSetting = { key: string; value: string | null; isSet: boolean; source: string; sensitive: boolean };
+type Option = { value: string; label: string };
 type Props = {
-  setting: AdminSetting
-  label: string
-  value: string
-  help?: string
-  placeholder?: string
-  boolean?: boolean
-  numeric?: boolean
-  multiline?: boolean
-  options?: Option[]
-  optionsUnavailable?: boolean
-  onChange: (value: string) => void
-}
+  setting: AdminSetting;
+  label: string;
+  value: string;
+  help?: string;
+  placeholder?: string;
+  boolean?: boolean;
+  numeric?: boolean;
+  multiline?: boolean;
+  options?: Option[];
+  optionsUnavailable?: boolean;
+  onChange: (value: string) => void;
+};
 
 const SELECTS: Record<string, Option[]> = {
-  log_level: ['DEBUG', 'INFO', 'WARNING', 'ERROR'].map((value) => ({ value, label: value })),
-  issue_confirmation_contact_attempts: Array.from({ length: 11 }, (_, index) => ({ value: String(index), label: index === 0 ? 'None — close when fixed' : String(index) })),
-  issue_confirmation_interval_unit: ['days', 'weeks', 'months'].map((value) => ({ value, label: value[0].toUpperCase() + value.slice(1) })),
-  artwork_cache_mode: [{ value: 'remote', label: 'Load from the internet' }, { value: 'cache', label: 'Store locally' }],
-  site_banner_tone: ['info', 'warning', 'error', 'maintenance'].map((value) => ({ value, label: value[0].toUpperCase() + value.slice(1) })),
-  magent_notify_push_provider: ['ntfy', 'gotify', 'pushover', 'webhook', 'telegram', 'discord'].map((value) => ({ value, label: value })),
-  requests_data_source: [{ value: 'always_js', label: 'Read directly from Seerr' }, { value: 'prefer_cache', label: 'Use saved requests' }],
-}
+  log_level: ["DEBUG", "INFO", "WARNING", "ERROR"].map((value) => ({ value, label: value })),
+  issue_confirmation_contact_attempts: Array.from({ length: 11 }, (_, index) => ({
+    value: String(index),
+    label: index === 0 ? "None — close when fixed" : String(index),
+  })),
+  issue_confirmation_interval_unit: ["days", "weeks", "months"].map((value) => ({
+    value,
+    label: value[0].toUpperCase() + value.slice(1),
+  })),
+  artwork_cache_mode: [
+    { value: "remote", label: "Load from the internet" },
+    { value: "cache", label: "Store locally" },
+  ],
+  site_banner_tone: ["info", "warning", "error", "maintenance"].map((value) => ({
+    value,
+    label: value[0].toUpperCase() + value.slice(1),
+  })),
+  magent_notify_push_provider: ["ntfy", "gotify", "pushover", "webhook", "telegram", "discord"].map((value) => ({
+    value,
+    label: value,
+  })),
+  requests_data_source: [
+    { value: "always_js", label: "Read directly from Seerr" },
+    { value: "prefer_cache", label: "Use saved requests" },
+  ],
+};
+
+const COLOR_DEFAULTS: Record<string, string> = {
+  site_banner_background_color: "#332814",
+  site_banner_border_color: "#a27b32",
+};
 
 export default function SettingField(props: Props) {
-  const { setting, label, value, help, placeholder, onChange } = props
-  const id = `setting-${setting.key}`
-  const options = props.options ?? SELECTS[setting.key] ?? (setting.key === 'log_http_client_level' || setting.key === 'log_background_sync_level' ? SELECTS.log_level : undefined)
-  const selectedOptions = options && value && !options.some((option) => option.value === value)
-    ? [{ value, label: `Current selection (${value})` }, ...options] : options
-  const isTime = setting.key === 'requests_full_sync_time' || setting.key === 'requests_cleanup_time'
-  const zeroAllowed = setting.key === 'log_file_backup_count'
-  const minimum = zeroAllowed ? 0 : 1
-  const maximum = setting.key === 'issue_confirmation_interval_value' ? 365 : setting.key.endsWith('_port') ? 65535 : undefined
-  const aria = { id, name: setting.key, 'aria-describedby': help ? `${id}-help` : undefined }
+  const { setting, label, value, help, placeholder, onChange } = props;
+  const id = `setting-${setting.key}`;
+  const options =
+    props.options ??
+    SELECTS[setting.key] ??
+    (setting.key === "log_http_client_level" || setting.key === "log_background_sync_level"
+      ? SELECTS.log_level
+      : undefined);
+  const selectedOptions =
+    options && value && !options.some((option) => option.value === value)
+      ? [{ value, label: `Current selection (${value})` }, ...options]
+      : options;
+  const isTime = setting.key === "requests_full_sync_time" || setting.key === "requests_cleanup_time";
+  const zeroAllowed = setting.key === "log_file_backup_count";
+  const minimum = zeroAllowed ? 0 : 1;
+  const maximum =
+    setting.key === "issue_confirmation_interval_value" ? 365 : setting.key.endsWith("_port") ? 65535 : undefined;
+  const colorDefault = COLOR_DEFAULTS[setting.key];
+  const pickerValue = /^#[0-9a-f]{6}$/i.test(value) ? value : colorDefault;
+  const aria = { id, name: setting.key, "aria-describedby": help ? `${id}-help` : undefined };
 
   if (props.boolean) {
     return (
       <div className="setting-field setting-switch">
-        <div><label htmlFor={id}>{label}</label>{help && <p id={`${id}-help`}>{help}</p>}</div>
-        <input {...aria} type="checkbox" role="switch" checked={value.toLowerCase() === 'true'} onChange={(event) => onChange(String(event.target.checked))} />
+        <div>
+          <label htmlFor={id}>{label}</label>
+          {help && <p id={`${id}-help`}>{help}</p>}
+        </div>
+        <input
+          {...aria}
+          type="checkbox"
+          role="switch"
+          aria-checked={value.toLowerCase() === "true"}
+          checked={value.toLowerCase() === "true"}
+          onChange={(event) => onChange(String(event.target.checked))}
+        />
       </div>
-    )
+    );
   }
 
   return (
-    <div className={`setting-field ${props.multiline ? 'field-span-full' : ''}`}>
-      <label htmlFor={id}>{label}{setting.sensitive && setting.isSet && <small>Saved</small>}</label>
+    <div className={`setting-field ${props.multiline ? "field-span-full" : ""}`}>
+      <label htmlFor={id}>
+        {label}
+        {setting.sensitive && setting.isSet && <small>Saved</small>}
+      </label>
       {props.optionsUnavailable ? (
-        <select {...aria} disabled value={value}><option value={value}>Save the connection, then reload available options</option></select>
+        <select {...aria} disabled value={value}>
+          <option value={value}>Save the connection, then reload available options</option>
+        </select>
+      ) : colorDefault ? (
+        <div className="setting-color-control">
+          <input
+            id={`${id}-picker`}
+            type="color"
+            aria-label={`Choose ${label.toLowerCase()}`}
+            value={pickerValue}
+            onChange={(event) => onChange(event.target.value)}
+          />
+          <input
+            {...aria}
+            type="text"
+            value={value}
+            pattern="#[0-9A-Fa-f]{6}"
+            placeholder={colorDefault}
+            autoComplete="off"
+            spellCheck={false}
+            onChange={(event) => onChange(event.target.value)}
+          />
+          {value ? (
+            <button type="button" className="ghost-button" onClick={() => onChange("")}>
+              Use tone default
+            </button>
+          ) : null}
+        </div>
       ) : selectedOptions ? (
         <select {...aria} value={value} onChange={(event) => onChange(event.target.value)}>
           {!value && <option value="">Choose an option</option>}
-          {selectedOptions.map((option) => <option key={option.value} value={option.value}>{option.label}</option>)}
+          {selectedOptions.map((option) => (
+            <option key={option.value} value={option.value}>
+              {option.label}
+            </option>
+          ))}
         </select>
       ) : props.multiline ? (
-        <textarea {...aria} rows={setting.key.includes('_pem') ? 6 : 3} value={value} placeholder={placeholder} onChange={(event) => onChange(event.target.value)} />
+        <textarea
+          {...aria}
+          rows={setting.key.includes("_pem") ? 6 : 3}
+          value={value}
+          placeholder={placeholder}
+          onChange={(event) => onChange(event.target.value)}
+        />
       ) : (
-        <input {...aria} type={setting.sensitive ? 'password' : props.numeric ? 'number' : isTime ? 'time' : 'text'}
-          value={value} min={props.numeric ? minimum : undefined} max={props.numeric ? maximum : undefined} step={props.numeric ? 1 : undefined}
-          autoComplete={setting.sensitive ? 'new-password' : 'off'} spellCheck={false}
-          placeholder={setting.sensitive && setting.isSet ? 'Leave blank to keep the saved value' : placeholder}
-          onChange={(event) => onChange(event.target.value)} />
+        <input
+          {...aria}
+          type={setting.sensitive ? "password" : props.numeric ? "number" : isTime ? "time" : "text"}
+          value={value}
+          min={props.numeric ? minimum : undefined}
+          max={props.numeric ? maximum : undefined}
+          step={props.numeric ? 1 : undefined}
+          autoComplete={setting.sensitive ? "new-password" : "off"}
+          spellCheck={false}
+          placeholder={setting.sensitive && setting.isSet ? "Leave blank to keep the saved value" : placeholder}
+          onChange={(event) => onChange(event.target.value)}
+        />
       )}
       {help && <p id={`${id}-help`}>{help}</p>}
     </div>
-  )
+  );
 }

frontend/app/admin/SettingsRegion.tsx

@@ -1,13 +1,38 @@
-'use client'
+"use client";
 
-import { useState, type ReactNode } from 'react'
+import { useState, type ReactNode } from "react";
 
-export default function SettingsRegion({ title, id, collapsed, children }: { title: string; id: string; collapsed: boolean; children: ReactNode }) {
-  const [open, setOpen] = useState(!collapsed)
+export default function SettingsRegion({
+  title,
+  id,
+  collapsed,
+  children,
+}: {
+  title: string;
+  id: string;
+  collapsed: boolean;
+  children: ReactNode;
+}) {
+  const [open, setOpen] = useState(!collapsed);
   return (
-    <section id={id} className={`admin-section admin-zone config-subsection ${open ? '' : 'is-collapsed'}`}>
-      {collapsed && <button type="button" className="config-region-toggle" aria-expanded={open} aria-controls={`${id}-content`} onClick={() => setOpen(!open)}><strong>{title}</strong><span>{open ? 'Hide' : 'Configure'} <b aria-hidden="true">{open ? '−' : '+'}</b></span></button>}
-      <div id={`${id}-content`} hidden={!open}>{children}</div>
+    <section id={id} className={`admin-section admin-zone config-subsection ${open ? "" : "is-collapsed"}`}>
+      {collapsed && (
+        <button
+          type="button"
+          className="config-region-toggle"
+          aria-expanded={open}
+          aria-controls={`${id}-content`}
+          onClick={() => setOpen(!open)}
+        >
+          <strong>{title}</strong>
+          <span>
+            {open ? "Hide" : "Configure"} <b aria-hidden="true">{open ? "−" : "+"}</b>
+          </span>
+        </button>
+      )}
+      <div id={`${id}-content`} hidden={!open}>
+        {children}
+      </div>
     </section>
-  )
+  );
 }

frontend/app/admin/[section]/page.tsx

@@ -1,36 +1,36 @@
-import { notFound } from 'next/navigation'
-import SettingsPage from '../SettingsPage'
+import { notFound } from "next/navigation";
+import SettingsPage from "../SettingsPage";
 
 const ALLOWED_SECTIONS = new Set([
-  'seerr',
-  'jellyseerr',
-  'jellyfin',
-  'jellystat',
-  'artwork',
-  'sonarr',
-  'radarr',
-  'bazarr',
-  'prowlarr',
-  'qbittorrent',
-  'requests',
-  'issue-workflow',
-  'cache',
-  'logs',
-  'maintenance',
-  'magent',
-  'general',
-  'notifications',
-  'site',
-])
+  "seerr",
+  "jellyseerr",
+  "jellyfin",
+  "jellystat",
+  "artwork",
+  "sonarr",
+  "radarr",
+  "bazarr",
+  "prowlarr",
+  "qbittorrent",
+  "requests",
+  "issue-workflow",
+  "cache",
+  "logs",
+  "maintenance",
+  "magent",
+  "general",
+  "notifications",
+  "site",
+]);
 
 type PageProps = {
-  params: Promise<{ section: string }>
-}
+  params: Promise<{ section: string }>;
+};
 
 export default async function AdminSectionPage({ params }: PageProps) {
-  const { section } = await params
+  const { section } = await params;
   if (!ALLOWED_SECTIONS.has(section)) {
-    notFound()
+    notFound();
   }
-  return <SettingsPage section={section} />
+  return <SettingsPage section={section} />;
 }

frontend/app/admin/backups/backups.module.css

@@ -0,0 +1,133 @@
+.page {
+  display: grid;
+  gap: 24px;
+  min-width: 0;
+}
+
+.page h2 {
+  margin: 0;
+  font-size: 1.15rem;
+}
+
+.page p {
+  margin: 0;
+  line-height: 1.65;
+}
+
+.summary,
+.pending,
+.panel {
+  display: grid;
+  align-content: start;
+  gap: 16px;
+  min-width: 0;
+  padding: 24px;
+  border: 1px solid var(--border);
+  border-radius: 12px;
+}
+
+.summary p,
+.panel > p,
+.muted,
+.help {
+  color: var(--ink-muted);
+}
+
+.columns {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 24px;
+  align-items: start;
+}
+
+.pending {
+  border-color: var(--accent);
+  border-inline-start-width: 4px;
+}
+
+.notice {
+  padding: 16px;
+  border: 1px solid var(--accent);
+  border-radius: 8px;
+}
+
+.fields {
+  display: grid;
+  gap: 16px;
+  min-width: 0;
+  margin: 0;
+  padding: 0;
+  border: 0;
+}
+
+.legend {
+  margin-bottom: 16px;
+  color: var(--ink-muted);
+  font-size: 0.85rem;
+}
+
+.field {
+  display: grid;
+  gap: 8px;
+  font-weight: 600;
+}
+
+.field input {
+  width: 100%;
+  min-width: 0;
+  min-height: 44px;
+  box-sizing: border-box;
+}
+
+.field input[type="file"] {
+  padding: 10px;
+  font-size: 0.85rem;
+}
+
+.checkbox {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  min-height: 44px;
+}
+
+.checkbox input {
+  flex: 0 0 auto;
+  width: 20px;
+  height: 20px;
+  margin: 0;
+}
+
+.help {
+  font-size: 0.85rem;
+}
+
+.page button {
+  justify-self: start;
+  min-height: 44px;
+  white-space: normal;
+}
+
+.page input:focus-visible,
+.page button:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 3px;
+}
+
+@media (max-width: 1000px) {
+  .columns {
+    grid-template-columns: minmax(0, 1fr);
+  }
+}
+
+@media (max-width: 600px) {
+  .summary,
+  .pending,
+  .panel {
+    padding: 18px;
+  }
+
+  .page button {
+    width: 100%;
+  }
+}

frontend/app/admin/backups/page.tsx

@@ -0,0 +1,395 @@
+"use client";
+
+import { type FormEvent, useCallback, useEffect, useRef, useState } from "react";
+import { useRouter } from "next/navigation";
+import { apiUrl, requestJson } from "../../lib/api-client";
+import { authFetchOrThrow, ForbiddenError, UnauthorizedError } from "../../lib/auth";
+import AdminShell from "../../ui/AdminShell";
+import styles from "./backups.module.css";
+
+type BackupDetails = {
+  created_at: string;
+  build: string;
+  include_cache: boolean;
+};
+
+type BackupStatus = {
+  format_version: number;
+  max_upload_bytes: number;
+  max_expanded_bytes: number;
+  include_cache_default: boolean;
+  pending_restore: (BackupDetails & { staged_at: string }) | null;
+  last_restore: { restored_at: string; rollback_directory: string; status?: string; message?: string } | null;
+};
+
+type RestoreResult = {
+  status: "staged";
+  restart_required: true;
+  backup: BackupDetails;
+  message: string;
+};
+
+const dateLabel = (value: string) => {
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? value : date.toLocaleString();
+};
+
+const sizeLabel = (bytes: number) => `${Math.ceil(bytes / (1024 * 1024))} MiB`;
+
+export default function BackupsPage() {
+  const router = useRouter();
+  const [data, setData] = useState<BackupStatus | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [revision, setRevision] = useState(0);
+  const [error, setError] = useState("");
+  const [notice, setNotice] = useState("");
+  const [busy, setBusy] = useState<"export" | "restore" | "cancel" | null>(null);
+  const [includeCache, setIncludeCache] = useState(false);
+  const [exportPassphrase, setExportPassphrase] = useState("");
+  const [confirmPassphrase, setConfirmPassphrase] = useState("");
+  const [restorePassphrase, setRestorePassphrase] = useState("");
+  const [confirmation, setConfirmation] = useState("");
+  const [file, setFile] = useState<File | null>(null);
+  const fileInput = useRef<HTMLInputElement>(null);
+
+  const handleError = useCallback(
+    (cause: unknown, fallback: string) => {
+      if (cause instanceof UnauthorizedError) {
+        router.replace("/login?next=%2Fadmin%2Fbackups");
+        return;
+      }
+      if (cause instanceof ForbiddenError) {
+        router.replace("/");
+        return;
+      }
+      setError(cause instanceof Error ? cause.message : fallback);
+    },
+    [router],
+  );
+
+  useEffect(() => {
+    void revision;
+    const abort = new AbortController();
+    setLoading(true);
+    void requestJson<BackupStatus>("/admin/backups", { signal: abort.signal })
+      .then((result) => {
+        if (abort.signal.aborted) return;
+        setData(result);
+        setIncludeCache(result.include_cache_default);
+      })
+      .catch((cause: unknown) => {
+        if (!abort.signal.aborted) handleError(cause, "Could not load backup settings.");
+      })
+      .finally(() => {
+        if (!abort.signal.aborted) setLoading(false);
+      });
+    return () => abort.abort();
+  }, [revision, handleError]);
+
+  const exportBackup = async (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    if (busy) return;
+    setError("");
+    setNotice("");
+    if (exportPassphrase.length < 12 || exportPassphrase.length > 1024) {
+      setError("Choose a backup passphrase between 12 and 1,024 characters.");
+      return;
+    }
+    if (exportPassphrase !== confirmPassphrase) {
+      setError("The backup passphrases do not match.");
+      return;
+    }
+    setBusy("export");
+    try {
+      const response = await authFetchOrThrow(apiUrl("/admin/backups/export"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ passphrase: exportPassphrase, include_cache: includeCache }),
+      });
+      if (!response.ok) {
+        const payload: unknown = await response.json().catch(() => null);
+        const detail = payload && typeof payload === "object" && "detail" in payload ? payload.detail : null;
+        throw new Error(typeof detail === "string" ? detail : "Could not create the backup. Please try again.");
+      }
+      const blob = await response.blob();
+      const downloadUrl = URL.createObjectURL(blob);
+      const link = document.createElement("a");
+      const filename = response.headers.get("Content-Disposition")?.match(/filename="?([\w.-]+\.magent-backup)"?/);
+      link.href = downloadUrl;
+      link.download = filename?.[1] ?? `magent-${new Date().toISOString().slice(0, 10)}.magent-backup`;
+      link.hidden = true;
+      document.body.appendChild(link);
+      try {
+        link.click();
+      } finally {
+        link.remove();
+        window.setTimeout(() => URL.revokeObjectURL(downloadUrl), 1000);
+      }
+      setExportPassphrase("");
+      setConfirmPassphrase("");
+      setNotice("Your encrypted backup is ready. Check your downloads and store its passphrase somewhere safe.");
+    } catch (cause) {
+      handleError(cause, "Could not create the backup.");
+    } finally {
+      setBusy(null);
+    }
+  };
+
+  const restoreBackup = async (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    if (busy || !data || data.pending_restore) return;
+    setError("");
+    setNotice("");
+    if (!file || file.size === 0) {
+      setError("Choose a Magent backup file to restore.");
+      return;
+    }
+    if (file.size > data.max_upload_bytes) {
+      setError(`The backup must be no larger than ${sizeLabel(data.max_upload_bytes)}.`);
+      return;
+    }
+    if (restorePassphrase.length < 12 || restorePassphrase.length > 1024) {
+      setError("Enter the backup passphrase, between 12 and 1,024 characters.");
+      return;
+    }
+    if (confirmation !== "RESTORE") {
+      setError("Type RESTORE to confirm that this backup will replace the current Magent data.");
+      return;
+    }
+    setBusy("restore");
+    try {
+      const form = new FormData();
+      form.append("file", file);
+      form.append("passphrase", restorePassphrase);
+      form.append("confirmation", confirmation);
+      const result = await requestJson<RestoreResult>("/admin/backups/restore", { method: "POST", body: form });
+      setData((current) =>
+        current ? { ...current, pending_restore: { ...result.backup, staged_at: new Date().toISOString() } } : current,
+      );
+      setRestorePassphrase("");
+      setConfirmation("");
+      setFile(null);
+      if (fileInput.current) fileInput.current.value = "";
+      setNotice(
+        "Backup checked and ready to restore. Restart Magent to apply it, or cancel the pending restore below.",
+      );
+    } catch (cause) {
+      handleError(cause, "Could not prepare the restore.");
+    } finally {
+      setBusy(null);
+    }
+  };
+
+  const cancelRestore = async () => {
+    if (busy) return;
+    setBusy("cancel");
+    setError("");
+    setNotice("");
+    try {
+      await requestJson("/admin/backups/restore", { method: "DELETE" });
+      setData((current) => (current ? { ...current, pending_restore: null } : current));
+      setNotice("Pending restore cancelled. Your current data is unchanged.");
+    } catch (cause) {
+      handleError(cause, "Could not cancel the restore.");
+    } finally {
+      setBusy(null);
+    }
+  };
+
+  return (
+    <AdminShell title="Backup & restore" subtitle="Save a secure copy of your Magent settings, database, and cache.">
+      <div className={styles.page}>
+        {error && (
+          <p className="error-banner" role="alert">
+            {error}
+          </p>
+        )}
+        {notice && (
+          <p className={styles.notice} role="status">
+            {notice}
+          </p>
+        )}
+        {loading && <p role="status">Loading backup settings...</p>}
+        {!loading && !data && (
+          <button
+            type="button"
+            className="ghost-button"
+            onClick={() => {
+              setError("");
+              setRevision((current) => current + 1);
+            }}
+          >
+            Try again
+          </button>
+        )}
+        {data && (
+          <>
+            <section className={styles.summary} aria-labelledby="backup-contents">
+              <h2 id="backup-contents">What is saved</h2>
+              <p>
+                Every backup includes Magent settings, app connection credentials, branding, and the complete database
+                with accounts, invites, requests, and cached records. You can also include downloaded artwork caches.
+              </p>
+              <p>
+                Connected apps and media files need their own backups. App credentials configured through the
+                environment are included, but the deployment environment file, host paths, and signing or encryption
+                keys are not.
+              </p>
+              {data.last_restore && (
+                <p className={styles.muted}>
+                  {data.last_restore.status === "rolled_back"
+                    ? "Last restore was rolled back"
+                    : "Last restore completed"}
+                  : {dateLabel(data.last_restore.restored_at)}.
+                  {data.last_restore.status === "rolled_back" &&
+                    ` ${data.last_restore.message || "The previous data was recovered automatically."}`}
+                </p>
+              )}
+            </section>
+
+            {data.pending_restore && (
+              <section className={styles.pending} aria-labelledby="pending-restore-title">
+                <h2 id="pending-restore-title">Restore ready — restart required</h2>
+                <p>
+                  Backup from {dateLabel(data.pending_restore.created_at)}
+                  {data.pending_restore.build ? ` (build ${data.pending_restore.build})` : ""}. Artwork cache{" "}
+                  {data.pending_restore.include_cache ? "included" : "not included"}.
+                </p>
+                <p>
+                  Restart the Magent container or service to apply this backup. Changes made since the backup was
+                  created will be replaced. Afterwards, sign in again with an administrator account from the restored
+                  backup.
+                </p>
+                <button type="button" className="ghost-button" onClick={cancelRestore} disabled={!!busy}>
+                  {busy === "cancel" ? "Cancelling..." : "Cancel pending restore"}
+                </button>
+              </section>
+            )}
+
+            <div className={styles.columns}>
+              <section className={styles.panel} aria-labelledby="create-backup-title">
+                <h2 id="create-backup-title">Create a backup</h2>
+                <p>Download an encrypted backup file. Keep the file and its passphrase in a safe place.</p>
+                <p>
+                  Backups must fit within {sizeLabel(data.max_upload_bytes)} encrypted and{" "}
+                  {sizeLabel(data.max_expanded_bytes)} when expanded. If artwork makes your backup too large, leave
+                  artwork caches unchecked.
+                </p>
+                <form onSubmit={exportBackup} aria-busy={busy === "export"}>
+                  <fieldset className={styles.fields} disabled={!!busy}>
+                    <legend className={styles.legend}>Backup options</legend>
+                    <label className={styles.checkbox}>
+                      <input
+                        type="checkbox"
+                        checked={includeCache}
+                        onChange={(event) => setIncludeCache(event.target.checked)}
+                        aria-describedby="cache-help"
+                      />
+                      Include artwork caches
+                    </label>
+                    <p id="cache-help" className={styles.help}>
+                      Adds downloaded images to the backup. This makes the file larger; images can otherwise be fetched
+                      again. Database caches are always included.
+                    </p>
+                    <label className={styles.field}>
+                      Backup passphrase
+                      <input
+                        type="password"
+                        autoComplete="new-password"
+                        value={exportPassphrase}
+                        onChange={(event) => setExportPassphrase(event.target.value)}
+                        minLength={12}
+                        maxLength={1024}
+                        required
+                        aria-describedby="backup-passphrase-help"
+                      />
+                    </label>
+                    <p id="backup-passphrase-help" className={styles.help}>
+                      Use at least 12 characters. This passphrase is separate from your login password. A lost
+                      passphrase cannot be recovered.
+                    </p>
+                    <label className={styles.field}>
+                      Confirm backup passphrase
+                      <input
+                        type="password"
+                        autoComplete="new-password"
+                        value={confirmPassphrase}
+                        onChange={(event) => setConfirmPassphrase(event.target.value)}
+                        minLength={12}
+                        maxLength={1024}
+                        required
+                      />
+                    </label>
+                    <button type="submit">
+                      {busy === "export" ? "Preparing backup..." : "Download encrypted backup"}
+                    </button>
+                  </fieldset>
+                </form>
+              </section>
+
+              <section className={styles.panel} aria-labelledby="restore-backup-title">
+                <h2 id="restore-backup-title">Restore a backup</h2>
+                <p>
+                  Restoring replaces Magent&apos;s settings and database, including users and invites. Download a
+                  current backup first if you want to keep these changes.
+                </p>
+                <form onSubmit={restoreBackup} aria-busy={busy === "restore"}>
+                  <fieldset className={styles.fields} disabled={!!busy || !!data.pending_restore}>
+                    <legend className={styles.legend}>Choose and confirm a backup</legend>
+                    <label className={styles.field}>
+                      Backup file
+                      <input
+                        ref={fileInput}
+                        type="file"
+                        accept=".magent-backup,application/octet-stream"
+                        onChange={(event) => setFile(event.target.files?.[0] ?? null)}
+                        required
+                        aria-describedby="backup-file-help"
+                      />
+                    </label>
+                    <p id="backup-file-help" className={styles.help}>
+                      Choose a .magent-backup file, up to {sizeLabel(data.max_upload_bytes)}.
+                    </p>
+                    <label className={styles.field}>
+                      Backup passphrase
+                      <input
+                        type="password"
+                        autoComplete="off"
+                        value={restorePassphrase}
+                        onChange={(event) => setRestorePassphrase(event.target.value)}
+                        minLength={12}
+                        maxLength={1024}
+                        required
+                      />
+                    </label>
+                    <label className={styles.field}>
+                      Type RESTORE to confirm replacement
+                      <input
+                        type="text"
+                        autoComplete="off"
+                        autoCapitalize="characters"
+                        spellCheck={false}
+                        value={confirmation}
+                        onChange={(event) => setConfirmation(event.target.value)}
+                        pattern="RESTORE"
+                        required
+                        aria-describedby="restore-restart-help"
+                      />
+                    </label>
+                    <p id="restore-restart-help" className={styles.help}>
+                      The backup is checked before being queued. It only takes effect when you restart Magent; you can
+                      cancel before then. You will need to sign in using an account from the backup.
+                    </p>
+                    <button type="submit" className="danger-button">
+                      {busy === "restore" ? "Checking and uploading..." : "Prepare restore"}
+                    </button>
+                  </fieldset>
+                </form>
+              </section>
+            </div>
+          </>
+        )}
+      </div>
+    </AdminShell>
+  );
+}

frontend/app/admin/config.css

@@ -50,6 +50,9 @@
 .config-subsection .setting-field p { margin: 0; color: var(--ops-muted); font: 400 12px/1.5 Inter, sans-serif; text-transform: none; }
 .config-subsection .setting-field input:not([type=checkbox]), .config-subsection .setting-field select, .config-subsection .setting-field textarea { margin: 0; width: 100%; min-width: 0; padding: 10px 12px; min-height: 42px; border: 1px solid var(--ops-line); background: var(--ops-bg-2); color: var(--ops-text); font: 400 13px/1.5 Inter, sans-serif; border-radius: 8px; }
 .config-subsection .setting-field input:focus-visible, .config-subsection .setting-field select:focus-visible, .config-subsection .setting-field textarea:focus-visible { outline: 2px solid var(--ops-primary-2); outline-offset: 2px; }
+.config-subsection .setting-color-control { display: grid; grid-template-columns: 52px minmax(140px, 1fr) auto; align-items: center; gap: 8px; }
+.config-subsection .setting-color-control input[type=color] { width: 52px; min-width: 52px; padding: 4px; cursor: pointer; }
+.config-subsection .setting-color-control .ghost-button { min-height: 42px; padding: 9px 12px; white-space: nowrap; }
 .config-subsection .setting-field.field-span-full { grid-column: 1 / -1; }
 .config-subsection .setting-switch { flex-direction: row; justify-content: space-between; align-items: center; padding: 12px 0; border-bottom: 1px solid var(--ops-line-soft); gap: 24px; }
 .setting-switch > div { display: grid; gap: 6px; }
@@ -92,6 +95,8 @@
 @media (max-width: 680px) {
   .admin-form .admin-grid { grid-template-columns: 1fr; }
   .admin-form .config-subsection { padding: 16px !important; }
+  .config-subsection .setting-color-control { grid-template-columns: 52px minmax(0, 1fr); }
+  .config-subsection .setting-color-control .ghost-button { grid-column: 1 / -1; }
   .config-directory-link { flex-wrap: wrap; gap: 12px; padding: 14px; }
   .config-link-copy { flex-basis: calc(100% - 62px); }
   .config-directory-link .config-connection-badge { margin-left: 46px; }

frontend/app/admin/configNavigation.ts

@@ -1,37 +1,106 @@
-type ConfigLink = { href: string; label: string; description: string; symbol?: string; service?: string }
-type ConfigGroup = { title: string; description: string; advanced?: boolean; items: ConfigLink[] }
+type ConfigLink = { href: string; label: string; description: string; symbol?: string; service?: string };
+type ConfigGroup = { title: string; description: string; advanced?: boolean; items: ConfigLink[] };
 
 export const CONFIG_GROUPS: ConfigGroup[] = [
-  { title: 'Media services', description: 'Connect the services that collect, repair and play your content.', items: [
-    { href: '/admin/seerr', label: 'Seerr', description: 'Requests and approvals', symbol: 'SE', service: 'Seerr' },
-    { href: '/admin/jellyfin', label: 'Jellyfin', description: 'Playback and library availability', symbol: 'JF', service: 'Jellyfin' },
-    { href: '/admin/jellystat', label: 'Jellystat', description: 'Personal viewing statistics', symbol: 'JS', service: 'Jellystat' },
-    { href: '/admin/sonarr', label: 'Sonarr', description: 'TV collection and quality', symbol: 'SO', service: 'Sonarr' },
-    { href: '/admin/radarr', label: 'Radarr', description: 'Movie collection and quality', symbol: 'RA', service: 'Radarr' },
-    { href: '/admin/bazarr', label: 'Bazarr', description: 'Subtitle repairs', symbol: 'BA', service: 'Bazarr' },
-    { href: '/admin/prowlarr', label: 'Prowlarr', description: 'Search sources', symbol: 'PR', service: 'Prowlarr' },
-    { href: '/admin/qbittorrent', label: 'qBittorrent', description: 'Download progress and recovery', symbol: 'QB', service: 'qBittorrent' },
-  ]},
-  { title: 'Preferences & access', description: 'Set the experience for your users and how issues are followed up.', items: [
-    { href: '/admin/site', label: 'Site & sign-in', description: 'Announcements and login options' },
-    { href: '/admin/notifications', label: 'Email & notifications', description: 'Invites, password resets and repair updates' },
-    { href: '/admin/recaps', label: 'Monthly email recaps', description: 'Personal viewing emails, schedule and delivery history' },
-    { href: '/admin/newsletters', label: 'Newsletters', description: 'New arrivals, featured picks and weekly editions' },
-    { href: '/admin/issue-workflow', label: 'Issue follow-up', description: 'Confirmation emails and automatic closure' },
-    { href: '/admin/requests', label: 'Request updates', description: 'Refresh schedule and history retention' },
-    { href: '/users', label: 'User management', description: 'Accounts, permissions, identity checks and repairs' },
-    { href: '/admin/invites', label: 'Invite policy & access', description: 'Defaults, profiles and issued invites' },
-  ]},
-  { title: 'Advanced tools', description: 'Hosting and troubleshooting.', advanced: true, items: [
-    { href: '/admin/general', label: 'Hosting & proxy', description: 'Public addresses and deployment options' },
-    { href: '/admin/diagnostics', label: 'System health', description: 'Service checks and diagnostics' },
-    { href: '/admin/logs', label: 'Logs', description: 'Recent activity and log settings' },
-    { href: '/admin/cache', label: 'Request cache', description: 'Inspect saved request records' },
-    { href: '/admin/artwork', label: 'Artwork cache', description: 'Poster storage and missing artwork' },
-    { href: '/admin/maintenance', label: 'Recovery & cleanup', description: 'Database repair and history cleanup' },
-  ]},
-]
+  {
+    title: "Media services",
+    description: "Connect the services that collect, repair and play your content.",
+    items: [
+      { href: "/admin/seerr", label: "Seerr", description: "Requests and approvals", symbol: "SE", service: "Seerr" },
+      {
+        href: "/admin/jellyfin",
+        label: "Jellyfin",
+        description: "Playback and library availability",
+        symbol: "JF",
+        service: "Jellyfin",
+      },
+      {
+        href: "/admin/jellystat",
+        label: "Jellystat",
+        description: "Personal viewing statistics",
+        symbol: "JS",
+        service: "Jellystat",
+      },
+      {
+        href: "/admin/sonarr",
+        label: "Sonarr",
+        description: "TV collection and quality",
+        symbol: "SO",
+        service: "Sonarr",
+      },
+      {
+        href: "/admin/radarr",
+        label: "Radarr",
+        description: "Movie collection and quality",
+        symbol: "RA",
+        service: "Radarr",
+      },
+      { href: "/admin/bazarr", label: "Bazarr", description: "Subtitle repairs", symbol: "BA", service: "Bazarr" },
+      { href: "/admin/prowlarr", label: "Prowlarr", description: "Search sources", symbol: "PR", service: "Prowlarr" },
+      {
+        href: "/admin/qbittorrent",
+        label: "qBittorrent",
+        description: "Download progress and recovery",
+        symbol: "QB",
+        service: "qBittorrent",
+      },
+    ],
+  },
+  {
+    title: "Preferences & access",
+    description: "Set the experience for your users and how issues are followed up.",
+    items: [
+      { href: "/admin/site", label: "Site & sign-in", description: "Announcements and login options" },
+      {
+        href: "/admin/notifications",
+        label: "Email & notifications",
+        description: "Invites, password resets and repair updates",
+      },
+      {
+        href: "/admin/recaps",
+        label: "Monthly email recaps",
+        description: "Personal viewing emails, schedule and delivery history",
+      },
+      {
+        href: "/admin/newsletters",
+        label: "Newsletters",
+        description: "New arrivals, featured picks and weekly editions",
+      },
+      {
+        href: "/admin/issue-workflow",
+        label: "Issue follow-up",
+        description: "Confirmation emails and automatic closure",
+      },
+      { href: "/admin/requests", label: "Request updates", description: "Refresh schedule and history retention" },
+      { href: "/users", label: "User management", description: "Accounts, permissions, identity checks and repairs" },
+      { href: "/admin/invites", label: "Invite policy & access", description: "Defaults, profiles and issued invites" },
+    ],
+  },
+  {
+    title: "Advanced tools",
+    description: "Hosting and troubleshooting.",
+    advanced: true,
+    items: [
+      { href: "/admin/general", label: "Hosting & proxy", description: "Public addresses and deployment options" },
+      { href: "/setup", label: "Setup wizard", description: "Guided app connections and installation preferences" },
+      {
+        href: "/admin/backups",
+        label: "Backup & restore",
+        description: "Encrypted settings, database and cache backups",
+      },
+      { href: "/admin/diagnostics", label: "System health", description: "Service checks and diagnostics" },
+      { href: "/admin/logs", label: "Logs", description: "Recent activity and log settings" },
+      { href: "/admin/cache", label: "Request cache", description: "Inspect saved request records" },
+      { href: "/admin/artwork", label: "Artwork cache", description: "Poster storage and missing artwork" },
+      { href: "/admin/maintenance", label: "Recovery & cleanup", description: "Database repair and history cleanup" },
+    ],
+  },
+];
 
-export const serviceStatusLabel = (status?: string) => ({
-  up: 'Connected', down: 'Unavailable', degraded: 'Needs attention', not_configured: 'Not set up',
-}[status ?? ''] ?? 'Not checked')
+export const serviceStatusLabel = (status?: string) =>
+  ({
+    up: "Connected",
+    down: "Unavailable",
+    degraded: "Needs attention",
+    not_configured: "Not set up",
+  })[status ?? ""] ?? "Not checked";

frontend/app/admin/diagnostics/page.tsx

@@ -1,15 +1,12 @@
-'use client'
+"use client";
 
-import AdminShell from '../../ui/AdminShell'
-import AdminDiagnosticsPanel from '../../ui/AdminDiagnosticsPanel'
+import AdminShell from "../../ui/AdminShell";
+import AdminDiagnosticsPanel from "../../ui/AdminDiagnosticsPanel";
 
 export default function AdminDiagnosticsPage() {
   return (
-    <AdminShell
-      title="Diagnostics"
-      subtitle="Check connections and investigate service problems."
-    >
+    <AdminShell title="Diagnostics" subtitle="Check connections and investigate service problems.">
       <AdminDiagnosticsPanel />
     </AdminShell>
-  )
+  );
 }

frontend/app/admin/identities/DuplicateAccountRepair.tsx

@@ -1,74 +1,232 @@
-'use client'
+"use client";
 
-import { useEffect, useRef, useState } from 'react'
-import { authFetch, getApiBase } from '../../lib/auth'
-import { FEATURES, type FeatureAccess } from '../../lib/features'
-import type { Row } from './IdentityReviewPanel'
+import { useEffect, useRef, useState } from "react";
+import { authFetch, getApiBase } from "../../lib/auth";
+import { FEATURES, type FeatureAccess } from "../../lib/features";
+import type { Row } from "./IdentityReviewPanel";
 
-type Account = { id: number; username: string; email: string | null; profile_id: number | null; last_login_at: string | null }
+type Account = {
+  id: number;
+  username: string;
+  email: string | null;
+  profile_id: number | null;
+  last_login_at: string | null;
+};
 type Preview = {
-  accounts: Account[]; keep_id: number; recommended_id: number; revision: string; can_confirm: boolean; issues: string[]
-  proposed: Account & { jellyfin_user_id: string; seerr_user_id: number; features: FeatureAccess; expires_at: string | null; is_blocked: boolean; auto_search_enabled: boolean }
-}
+  accounts: Account[];
+  keep_id: number;
+  recommended_id: number;
+  revision: string;
+  can_confirm: boolean;
+  issues: string[];
+  proposed: Account & {
+    jellyfin_user_id: string;
+    seerr_user_id: number;
+    features: FeatureAccess;
+    expires_at: string | null;
+    is_blocked: boolean;
+    auto_search_enabled: boolean;
+  };
+};
 
-export default function DuplicateAccountRepair({ row, onClose, onSaved }: { row: Row; onClose: () => void; onSaved: () => void }) {
-  const dialog = useRef<HTMLDialogElement>(null)
-  const controller = useRef<AbortController | null>(null)
-  const [preview, setPreview] = useState<Preview | null>(null)
-  const [busy, setBusy] = useState(false)
-  const [saving, setSaving] = useState(false)
-  const [acknowledged, setAcknowledged] = useState(false)
-  const [error, setError] = useState('')
+export default function DuplicateAccountRepair({
+  row,
+  onClose,
+  onSaved,
+}: {
+  row: Row;
+  onClose: () => void;
+  onSaved: () => void;
+}) {
+  const dialog = useRef<HTMLDialogElement>(null);
+  const controller = useRef<AbortController | null>(null);
+  const [preview, setPreview] = useState<Preview | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [saving, setSaving] = useState(false);
+  const [acknowledged, setAcknowledged] = useState(false);
+  const [error, setError] = useState("");
   const submit = async (confirm = false, keepId?: number) => {
-    const abort = new AbortController()
-    controller.current?.abort(); controller.current = abort
-    setError(''); setAcknowledged(false)
-    if (confirm) setSaving(true)
-    else setBusy(true)
+    const abort = new AbortController();
+    controller.current?.abort();
+    controller.current = abort;
+    setError("");
+    setAcknowledged(false);
+    if (confirm) setSaving(true);
+    else setBusy(true);
     try {
-      const response = await authFetch(`${getApiBase()}/admin/identities/duplicates/${confirm ? 'confirm' : 'check'}`, {
-        method: 'POST', signal: abort.signal, headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ user_id: row.user.id, ...(keepId ? { keep_id: keepId } : {}), ...(confirm ? { keep_id: preview?.keep_id, revision: preview?.revision } : {}) }),
-      })
-      const data = await response.json()
-      if (!response.ok) throw new Error(typeof data.detail === 'string' ? data.detail : 'Could not review these accounts.')
-      if (!abort.signal.aborted) { if (confirm) onSaved(); else setPreview(data) }
-    } catch (err) { if (!abort.signal.aborted) { setError(err instanceof Error ? err.message : 'Repair failed. Preview again.'); setPreview(null) } }
-    finally { if (!abort.signal.aborted) { setBusy(false); setSaving(false) } }
-  }
+      const response = await authFetch(`${getApiBase()}/admin/identities/duplicates/${confirm ? "confirm" : "check"}`, {
+        method: "POST",
+        signal: abort.signal,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          user_id: row.user.id,
+          ...(keepId ? { keep_id: keepId } : {}),
+          ...(confirm ? { keep_id: preview?.keep_id, revision: preview?.revision } : {}),
+        }),
+      });
+      const data = await response.json();
+      if (!response.ok)
+        throw new Error(typeof data.detail === "string" ? data.detail : "Could not review these accounts.");
+      if (!abort.signal.aborted) {
+        if (confirm) onSaved();
+        else setPreview(data);
+      }
+    } catch (err) {
+      if (!abort.signal.aborted) {
+        setError(err instanceof Error ? err.message : "Repair failed. Preview again.");
+        setPreview(null);
+      }
+    } finally {
+      if (!abort.signal.aborted) {
+        setBusy(false);
+        setSaving(false);
+      }
+    }
+  };
+  // biome-ignore lint/correctness/useExhaustiveDependencies: The dialog preview runs once when this keyed modal mounts.
   useEffect(() => {
-    const previous = document.activeElement as HTMLElement | null
-    const overflow = document.body.style.overflow
-    document.body.style.overflow = 'hidden'; dialog.current?.showModal()
-    void submit()
-    return () => { controller.current?.abort(); document.body.style.overflow = overflow; previous?.focus() }
-  }, [])
-  return <dialog ref={dialog} className="identity-resolve-dialog" aria-labelledby="duplicates-title" onCancel={(event) => { event.preventDefault(); if (!saving) onClose() }}>
-    <div className="identity-resolve-content">
-      <header><h2 id="duplicates-title">Repair duplicate accounts</h2><button type="button" className="ghost-button" disabled={saving} onClick={onClose}>Close</button></header>
-      <p>Review the Magent accounts for <strong>{row.user.username}</strong>. This repair keeps one account linked to the verified Jellyfin identity.</p>
-      {busy && <p role="status">Checking live service IDs and duplicate ownership...</p>}
-      {error && <p className="error-banner" role="alert">{error}</p>}
-      {!preview && !busy && <button type="button" disabled={saving} onClick={() => void submit()}>Check again</button>}
-      {preview && <section className="identity-confirm-panel" aria-label="Duplicate repair preview">
-        <label>Magent account to keep<select disabled={busy || saving} value={preview.keep_id} onChange={(event) => void submit(false, Number(event.target.value))}>
-          {preview.accounts.map((account) => <option key={account.id} value={account.id}>{account.username} — Magent {account.id}{account.id === preview.recommended_id ? ' (recommended)' : ''}</option>)}
-        </select></label>
-        <p>The recommended row already owns the Jellyfin link, or is the oldest row when neither owns it.</p>
-        <div className="identity-mapping identity-duplicate-accounts">{preview.accounts.map((account) => <div key={account.id}><strong>Magent {account.id}{account.id === preview.keep_id ? ' · Keep' : ' · Consolidate'}</strong><p>{account.username}</p><p>{account.email || 'No email'} · Profile {account.profile_id ?? 'None'}</p><p>Last login: {account.last_login_at ? new Date(account.last_login_at).toLocaleString() : 'Never'}</p></div>)}</div>
-        <h3>Resulting account</h3>
-        <p><strong>{preview.proposed.username}</strong> · Magent {preview.keep_id} · Seerr {preview.proposed.seerr_user_id ?? 'Not verified'}</p>
-        <p>Jellyfin / Jellystat: <code>{preview.proposed.jellyfin_user_id ?? 'Not verified'}</code></p>
-        <p>Email: {preview.proposed.email || 'None'} · Profile: {preview.proposed.profile_id ?? 'None'}</p>
-        <p>Access: {preview.proposed.is_blocked ? 'Blocked' : 'Not blocked'} · Expiry: {preview.proposed.expires_at ? new Date(preview.proposed.expires_at).toLocaleString() : 'None'} · Automatic search: {preview.proposed.auto_search_enabled ? 'Enabled' : 'Disabled'}</p>
-        <ul>{FEATURES.map((feature) => <li key={feature.key}>{feature.label}: {preview.proposed.features[feature.key] ? 'Enabled' : 'Disabled'}</li>)}</ul>
-        <p>Request, issue, invitation and login activity history is retained. The selected account keeps its email and profile. Any block, earlier expiry or disabled permission on either row is preserved.</p>
-        <p>Extra Magent rows are removed from the active directory after their details are archived. Their outstanding emails are cancelled and their email subscriptions are not inherited. The kept account retains its own subscriptions where still eligible. Password reset links must be requested again.</p>
-        <p>Jellyfin, Seerr and Jellystat accounts and media are unchanged. This action does not merge different Jellyfin identities or delete upstream users.</p>
-        {preview.issues.length > 0 && <ul className="identity-issues">{preview.issues.map((issue) => <li key={issue}>{issue}</li>)}</ul>}
-        <label className="identity-import-option"><span><input type="checkbox" checked={acknowledged} disabled={busy || saving || !preview.can_confirm} onChange={(event) => setAcknowledged(event.target.checked)} /> I confirm these rows belong to the same person and have reviewed the account to keep.</span></label>
-        <button type="button" disabled={!preview.can_confirm || !acknowledged || busy || saving} onClick={() => void submit(true)}>{saving ? 'Rechecking and repairing...' : 'Confirm duplicate repair'}</button>
-      </section>}
-    </div>
-  </dialog>
+    const previous = document.activeElement as HTMLElement | null;
+    const overflow = document.body.style.overflow;
+    document.body.style.overflow = "hidden";
+    dialog.current?.showModal();
+    void submit();
+    return () => {
+      controller.current?.abort();
+      document.body.style.overflow = overflow;
+      previous?.focus();
+    };
+  }, []);
+  return (
+    <dialog
+      ref={dialog}
+      className="identity-resolve-dialog"
+      aria-labelledby="duplicates-title"
+      onCancel={(event) => {
+        event.preventDefault();
+        if (!saving) onClose();
+      }}
+    >
+      <div className="identity-resolve-content">
+        <header>
+          <h2 id="duplicates-title">Repair duplicate accounts</h2>
+          <button type="button" className="ghost-button" disabled={saving} onClick={onClose}>
+            Close
+          </button>
+        </header>
+        <p>
+          Review the Magent accounts for <strong>{row.user.username}</strong>. This repair keeps one account linked to
+          the verified Jellyfin identity.
+        </p>
+        {busy && <p role="status">Checking live service IDs and duplicate ownership...</p>}
+        {error && (
+          <p className="error-banner" role="alert">
+            {error}
+          </p>
+        )}
+        {!preview && !busy && (
+          <button type="button" disabled={saving} onClick={() => void submit()}>
+            Check again
+          </button>
+        )}
+        {preview && (
+          <section className="identity-confirm-panel" aria-label="Duplicate repair preview">
+            <label>
+              Magent account to keep
+              <select
+                disabled={busy || saving}
+                value={preview.keep_id}
+                onChange={(event) => void submit(false, Number(event.target.value))}
+              >
+                {preview.accounts.map((account) => (
+                  <option key={account.id} value={account.id}>
+                    {account.username} — Magent {account.id}
+                    {account.id === preview.recommended_id ? " (recommended)" : ""}
+                  </option>
+                ))}
+              </select>
+            </label>
+            <p>The recommended row already owns the Jellyfin link, or is the oldest row when neither owns it.</p>
+            <div className="identity-mapping identity-duplicate-accounts">
+              {preview.accounts.map((account) => (
+                <div key={account.id}>
+                  <strong>
+                    Magent {account.id}
+                    {account.id === preview.keep_id ? " · Keep" : " · Consolidate"}
+                  </strong>
+                  <p>{account.username}</p>
+                  <p>
+                    {account.email || "No email"} · Profile {account.profile_id ?? "None"}
+                  </p>
+                  <p>
+                    Last login: {account.last_login_at ? new Date(account.last_login_at).toLocaleString() : "Never"}
+                  </p>
+                </div>
+              ))}
+            </div>
+            <h3>Resulting account</h3>
+            <p>
+              <strong>{preview.proposed.username}</strong> · Magent {preview.keep_id} · Seerr{" "}
+              {preview.proposed.seerr_user_id ?? "Not verified"}
+            </p>
+            <p>
+              Jellyfin / Jellystat: <code>{preview.proposed.jellyfin_user_id ?? "Not verified"}</code>
+            </p>
+            <p>
+              Email: {preview.proposed.email || "None"} · Profile: {preview.proposed.profile_id ?? "None"}
+            </p>
+            <p>
+              Access: {preview.proposed.is_blocked ? "Blocked" : "Not blocked"} · Expiry:{" "}
+              {preview.proposed.expires_at ? new Date(preview.proposed.expires_at).toLocaleString() : "None"} ·
+              Automatic search: {preview.proposed.auto_search_enabled ? "Enabled" : "Disabled"}
+            </p>
+            <ul>
+              {FEATURES.map((feature) => (
+                <li key={feature.key}>
+                  {feature.label}: {preview.proposed.features[feature.key] ? "Enabled" : "Disabled"}
+                </li>
+              ))}
+            </ul>
+            <p>
+              Request, issue, invitation and login activity history is retained. The selected account keeps its email
+              and profile. Any block, earlier expiry or disabled permission on either row is preserved.
+            </p>
+            <p>
+              Extra Magent rows are removed from the active directory after their details are archived. Their
+              outstanding emails are cancelled and their email subscriptions are not inherited. The kept account retains
+              its own subscriptions where still eligible. Password reset links must be requested again.
+            </p>
+            <p>
+              Jellyfin, Seerr and Jellystat accounts and media are unchanged. This action does not merge different
+              Jellyfin identities or delete upstream users.
+            </p>
+            {preview.issues.length > 0 && (
+              <ul className="identity-issues">
+                {preview.issues.map((issue) => (
+                  <li key={issue}>{issue}</li>
+                ))}
+              </ul>
+            )}
+            <label className="identity-import-option">
+              <span>
+                <input
+                  type="checkbox"
+                  checked={acknowledged}
+                  disabled={busy || saving || !preview.can_confirm}
+                  onChange={(event) => setAcknowledged(event.target.checked)}
+                />{" "}
+                I confirm these rows belong to the same person and have reviewed the account to keep.
+              </span>
+            </label>
+            <button
+              type="button"
+              disabled={!preview.can_confirm || !acknowledged || busy || saving}
+              onClick={() => void submit(true)}
+            >
+              {saving ? "Rechecking and repairing..." : "Confirm duplicate repair"}
+            </button>
+          </section>
+        )}
+      </div>
+    </dialog>
+  );
 }

frontend/app/admin/identities/IdentityReviewPanel.tsx

@@ -1,171 +1,506 @@
-'use client'
+"use client";
 
-import { useEffect, useRef, useState } from 'react'
-import { useRouter } from 'next/navigation'
-import { authFetch, getApiBase } from '../../lib/auth'
-import './identities.css'
-import DuplicateAccountRepair from './DuplicateAccountRepair'
-import ResolveIdentityLink from './ResolveIdentityLink'
+import { useEffect, useRef, useState } from "react";
+import { useRouter } from "next/navigation";
+import { authFetch, getApiBase } from "../../lib/auth";
+import "./identities.css";
+import DuplicateAccountRepair from "./DuplicateAccountRepair";
+import ResolveIdentityLink from "./ResolveIdentityLink";
 
-type Identity = { id: string; name: string }
+type Identity = { id: string; name: string };
 export type Row = {
-  user: { id: number; username: string; role: string; auth_provider: string; jellyseerr_user_id: number | null }
-  jellyfin: Identity | null
-  candidate_jellyfin_id: string | null
-  stored_jellyfin_id: string | null
-  seerr: { id: number; name: string; jellyfin_id: string }[]
-  jellystat: { state: string; id?: string; name?: string }
-  basis: string
-  issues: string[]
-  state: string
-  can_confirm: boolean
-  confirmed_at: string | null
-}
+  user: { id: number; username: string; role: string; auth_provider: string; jellyseerr_user_id: number | null };
+  jellyfin: Identity | null;
+  candidate_jellyfin_id: string | null;
+  stored_jellyfin_id: string | null;
+  seerr: { id: number; name: string; jellyfin_id: string }[];
+  jellystat: { state: string; id?: string; name?: string };
+  basis: string;
+  issues: string[];
+  state: string;
+  can_confirm: boolean;
+  confirmed_at: string | null;
+};
 type Report = {
-  revision: string; checked_at: string; server_id: string | null
-  services: Record<string, string>
-  counts: Record<string, number>
-  jellyfin_users: Identity[]
-  rows: Row[]
-  upstream: { platform: string; id: string; name: string; jellyfin_id: string | null; detail: string }[]
-}
-const labels: Record<string, string> = { ready: 'Ready to review', confirmed: 'Confirmed', conflict: 'Conflict', unlinked: 'Missing link', unavailable: 'Check incomplete' }
-const serviceLabels: Record<string, string> = { available: 'Checked', unavailable: 'Unavailable', not_configured: 'Not configured', not_checked: 'No IDs to check' }
-const basisLabels: Record<string, string> = { confirmed_id: 'Confirmed Jellyfin ID', stored_jellyfin_id: 'Stored Jellyfin ID', stored_seerr_id: 'Seerr’s Jellyfin ID', suggested_username: 'Suggested from Jellyfin username — review before saving', none: 'No identity match' }
-const statsLabels: Record<string, string> = { matched: 'ID matches', missing: 'ID not found', unavailable: 'Could not check', not_configured: 'Not configured', not_checked: 'No ID to check' }
+  revision: string;
+  checked_at: string;
+  server_id: string | null;
+  services: Record<string, string>;
+  counts: Record<string, number>;
+  jellyfin_users: Identity[];
+  rows: Row[];
+  upstream: { platform: string; id: string; name: string; jellyfin_id: string | null; detail: string }[];
+};
+const labels: Record<string, string> = {
+  ready: "Ready to review",
+  confirmed: "Confirmed",
+  conflict: "Conflict",
+  unlinked: "Missing link",
+  unavailable: "Check incomplete",
+};
+const serviceLabels: Record<string, string> = {
+  available: "Checked",
+  unavailable: "Unavailable",
+  not_configured: "Not configured",
+  not_checked: "No IDs to check",
+};
+const basisLabels: Record<string, string> = {
+  confirmed_id: "Confirmed Jellyfin ID",
+  stored_jellyfin_id: "Stored Jellyfin ID",
+  stored_seerr_id: "Seerr’s Jellyfin ID",
+  suggested_username: "Suggested from Jellyfin username — review before saving",
+  none: "No identity match",
+};
+const statsLabels: Record<string, string> = {
+  matched: "ID matches",
+  missing: "ID not found",
+  unavailable: "Could not check",
+  not_configured: "Not configured",
+  not_checked: "No ID to check",
+};
 
 export default function IdentityReviewPanel() {
-  const router = useRouter()
-  const [ready, setReady] = useState(false)
-  const [report, setReport] = useState<Report | null>(null)
-  const [busy, setBusy] = useState(false)
-  const [saving, setSaving] = useState(false)
-  const [error, setError] = useState('')
-  const [notice, setNotice] = useState('')
-  const [query, setQuery] = useState('')
-  const [filter, setFilter] = useState('all')
-  const [selected, setSelected] = useState<number[]>([])
-  const [duplicates, setDuplicates] = useState<Row | null>(null)
-  const [resolving, setResolving] = useState<Row | null>(null)
-  const [reviewing, setReviewing] = useState(false)
-  const controller = useRef<AbortController | null>(null)
-  const reviewPanel = useRef<HTMLElement | null>(null)
+  const router = useRouter();
+  const [ready, setReady] = useState(false);
+  const [report, setReport] = useState<Report | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState("");
+  const [notice, setNotice] = useState("");
+  const [query, setQuery] = useState("");
+  const [filter, setFilter] = useState("all");
+  const [selected, setSelected] = useState<number[]>([]);
+  const [duplicates, setDuplicates] = useState<Row | null>(null);
+  const [resolving, setResolving] = useState<Row | null>(null);
+  const [reviewing, setReviewing] = useState(false);
+  const controller = useRef<AbortController | null>(null);
+  const reviewPanel = useRef<HTMLElement | null>(null);
 
   useEffect(() => {
-    setQuery(new URLSearchParams(window.location.search).get('user') ?? '')
-    const abort = new AbortController()
-    void authFetch(`${getApiBase()}/auth/me`, { signal: abort.signal }).then(async (response) => {
-      if (response.status === 401) { router.replace('/login'); return }
-      if (!response.ok) throw new Error('Could not check administrator access. Refresh to try again.')
-      if ((await response.json()).role !== 'admin') { router.replace('/'); return }
-      if (!abort.signal.aborted) setReady(true)
-    }).catch((err: Error) => { if (!abort.signal.aborted) setError(err.message) })
-    return () => { abort.abort(); controller.current?.abort() }
-  }, [router])
+    setQuery(new URLSearchParams(window.location.search).get("user") ?? "");
+    const abort = new AbortController();
+    void authFetch(`${getApiBase()}/auth/me`, { signal: abort.signal })
+      .then(async (response) => {
+        if (response.status === 401) {
+          router.replace("/login");
+          return;
+        }
+        if (!response.ok) throw new Error("Could not check administrator access. Refresh to try again.");
+        if ((await response.json()).role !== "admin") {
+          router.replace("/");
+          return;
+        }
+        if (!abort.signal.aborted) setReady(true);
+      })
+      .catch((err: Error) => {
+        if (!abort.signal.aborted) setError(err.message);
+      });
+    return () => {
+      abort.abort();
+      controller.current?.abort();
+    };
+  }, [router]);
 
-  useEffect(() => { if (reviewing) reviewPanel.current?.focus() }, [reviewing])
+  useEffect(() => {
+    if (reviewing) reviewPanel.current?.focus();
+  }, [reviewing]);
 
   const responseData = async (response: Response) => {
-    if (response.status === 401) { router.replace('/login'); throw new Error('Your session has ended. Sign in again.') }
-    if (response.status === 403) { router.replace('/'); throw new Error('Administrator access is required.') }
-    const data = await response.json().catch(() => ({}))
-    if (!response.ok) throw new Error(typeof data.detail === 'string' ? data.detail : 'The identity check could not complete. Try again.')
-    return data
-  }
+    if (response.status === 401) {
+      router.replace("/login");
+      throw new Error("Your session has ended. Sign in again.");
+    }
+    if (response.status === 403) {
+      router.replace("/");
+      throw new Error("Administrator access is required.");
+    }
+    const data = await response.json().catch(() => ({}));
+    if (!response.ok)
+      throw new Error(
+        typeof data.detail === "string" ? data.detail : "The identity check could not complete. Try again.",
+      );
+    return data;
+  };
 
   const runCheck = async () => {
-    controller.current?.abort()
-    const abort = new AbortController()
-    controller.current = abort
-    setBusy(true); setError(''); setNotice(''); setSelected([]); setReviewing(false); setReport(null)
+    controller.current?.abort();
+    const abort = new AbortController();
+    controller.current = abort;
+    setBusy(true);
+    setError("");
+    setNotice("");
+    setSelected([]);
+    setReviewing(false);
+    setReport(null);
     try {
-      const data = await responseData(await authFetch(`${getApiBase()}/admin/identities`, { signal: abort.signal }))
-      if (!abort.signal.aborted) setReport(data)
+      const data = await responseData(await authFetch(`${getApiBase()}/admin/identities`, { signal: abort.signal }));
+      if (!abort.signal.aborted) setReport(data);
     } catch (err) {
-      if (!abort.signal.aborted) setError(err instanceof Error ? err.message : 'Could not check identities.')
-    } finally { if (!abort.signal.aborted) setBusy(false) }
-  }
+      if (!abort.signal.aborted) setError(err instanceof Error ? err.message : "Could not check identities.");
+    } finally {
+      if (!abort.signal.aborted) setBusy(false);
+    }
+  };
 
   const save = async () => {
-    if (!report || saving || !selected.length) return
-    setSaving(true); setError(''); setNotice('')
+    if (!report || saving || !selected.length) return;
+    setSaving(true);
+    setError("");
+    setNotice("");
     try {
-      const data = await responseData(await authFetch(`${getApiBase()}/admin/identities/confirm`, {
-        method: 'POST', headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ revision: report.revision, user_ids: selected }),
-      }))
-      setNotice(`${data.confirmed} account ${data.confirmed === 1 ? 'link' : 'links'} confirmed and saved. Run another check to see the updated mappings.`)
+      const data = await responseData(
+        await authFetch(`${getApiBase()}/admin/identities/confirm`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ revision: report.revision, user_ids: selected }),
+        }),
+      );
+      setNotice(
+        `${data.confirmed} account ${data.confirmed === 1 ? "link" : "links"} confirmed and saved. Run another check to see the updated mappings.`,
+      );
       // The scan describes the previous database state and cannot be reused for another write.
-      setReport(null); setSelected([]); setReviewing(false)
+      setReport(null);
+      setSelected([]);
+      setReviewing(false);
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Could not save identity links.')
-      setReport(null); setSelected([]); setReviewing(false)
-    } finally { setSaving(false) }
-  }
+      setError(err instanceof Error ? err.message : "Could not save identity links.");
+      setReport(null);
+      setSelected([]);
+      setReviewing(false);
+    } finally {
+      setSaving(false);
+    }
+  };
 
-  const needle = query.trim().toLowerCase()
-  const filtered = report?.rows.filter((row) => (filter === 'all' || row.state === filter) &&
-    [row.user.username, row.user.id, row.candidate_jellyfin_id, row.user.jellyseerr_user_id, ...row.seerr.map((entry) => entry.id)].join(' ').toLowerCase().includes(needle)) ?? []
-  const selectedRows = report?.rows.filter((row) => selected.includes(row.user.id)) ?? []
-  const eligible = filtered.filter((row) => row.can_confirm).map((row) => row.user.id)
-  const toggle = (id: number) => { setReviewing(false); setSelected((current) => current.includes(id) ? current.filter((value) => value !== id) : [...current, id]) }
+  const needle = query.trim().toLowerCase();
+  const filtered =
+    report?.rows.filter(
+      (row) =>
+        (filter === "all" || row.state === filter) &&
+        [
+          row.user.username,
+          row.user.id,
+          row.candidate_jellyfin_id,
+          row.user.jellyseerr_user_id,
+          ...row.seerr.map((entry) => entry.id),
+        ]
+          .join(" ")
+          .toLowerCase()
+          .includes(needle),
+    ) ?? [];
+  const selectedRows = report?.rows.filter((row) => selected.includes(row.user.id)) ?? [];
+  const eligible = filtered.filter((row) => row.can_confirm).map((row) => row.user.id);
+  const toggle = (id: number) => {
+    setReviewing(false);
+    setSelected((current) => (current.includes(id) ? current.filter((value) => value !== id) : [...current, id]));
+  };
 
   return (
     <div className="identity-review">
-      {error && <p className="error-banner" role="alert">{error}</p>}
-      {notice && <p className="status-banner" role="status">{notice}</p>}
+      {error && (
+        <p className="error-banner" role="alert">
+          {error}
+        </p>
+      )}
+      {notice && (
+        <p className="status-banner" role="status">
+          {notice}
+        </p>
+      )}
       {!ready && !error && <p role="status">Checking administrator access…</p>}
-      {ready && <>
-        <section className="identity-intro admin-panel">
-          <div><h2>Confirm user IDs</h2><p>Jellyfin’s server and user IDs identify each account. Seerr and Jellystat are checked against that same user ID.</p><p>Review the proposed links before saving. Repair incorrect Magent links after reviewing the IDs. Duplicate ownership and upstream changes require individual review.</p></div>
-          <button type="button" onClick={runCheck} disabled={busy || saving}>{busy ? 'Checking all accounts…' : report ? 'Run check again' : 'Check all user IDs'}</button>
-        </section>
-        {busy && <p role="status">Reading the live user directories and checking Jellystat IDs. This can take up to a minute.</p>}
-        {report && <>
-          <div className="identity-service-strip">{Object.entries(report.services).map(([service, state]) => <span key={service}><strong>{service === 'seerr' ? 'Seerr' : service === 'jellyfin' ? 'Jellyfin' : 'Jellystat'}</strong> {serviceLabels[state] ?? state}</span>)}</div>
-          <p className="identity-meta">Checked {new Date(report.checked_at).toLocaleString()} · Jellyfin server <code>{report.server_id ?? 'Unavailable'}</code></p>
-          <div className="identity-counts">{['magent', 'ready', 'confirmed', 'conflict', 'unlinked', 'unavailable'].map((state) => <div key={state}><strong>{report.counts[state]}</strong><span>{state === 'magent' ? 'Magent accounts' : labels[state]}</span></div>)}</div>
-          <p className="identity-meta">Includes duplicate Magent rows hidden in the user directory. Jellystat checks cover IDs found in Jellyfin, Seerr and stored Magent links; historical Jellystat-only IDs are outside this check.</p>
-          <div className="identity-filters">
-            <label>Find an account<input type="search" value={query} onChange={(event) => setQuery(event.target.value)} placeholder="Username or user ID" disabled={saving} /></label>
-            <label>Show<select value={filter} onChange={(event) => setFilter(event.target.value)} disabled={saving}><option value="all">All accounts</option>{Object.entries(labels).map(([state, label]) => <option key={state} value={state}>{label}</option>)}</select></label>
-          </div>
-          <div className="identity-selection">
-            <span>{filtered.length} accounts shown · {selected.length} selected</span>
-            <button type="button" className="ghost-button" disabled={saving || !eligible.length} onClick={() => { setSelected((current) => [...new Set([...current, ...eligible])]); setReviewing(false) }}>Select ready accounts shown</button>
-            <button type="button" className="ghost-button" disabled={saving || !selected.length} onClick={() => { setSelected([]); setReviewing(false) }}>Clear selection</button>
-            <button type="button" disabled={saving || !selected.length} onClick={() => setReviewing(true)}>Review selected links ({selected.length})</button>
-          </div>
-          {reviewing && <section className="identity-confirm-panel" ref={reviewPanel} tabIndex={-1} aria-label="Review links before saving">
-            <h2>Save these {selected.length} account links?</h2>
-            <p>Each selected Magent account will be linked to the Jellyfin ID and Seerr ID shown below. The live IDs will be checked again before saving.</p>
-            <ul>{selectedRows.map((row) => <li key={row.user.id}><strong>{row.user.username}</strong> · Magent {row.user.id} → Jellyfin <code>{row.candidate_jellyfin_id}</code> → Seerr {row.seerr[0].id}</li>)}</ul>
-            <p>Saving links does not merge or delete accounts. Existing requests and playback history stay with their service IDs.</p>
-            <div className="identity-confirm-actions"><button type="button" onClick={save} disabled={saving}>{saving ? 'Rechecking and saving…' : 'Confirm and save links'}</button><button type="button" className="ghost-button" disabled={saving} onClick={() => setReviewing(false)}>Back to review</button></div>
-          </section>}
-          <section className="identity-accounts" aria-label="Account identity results">
-            {!filtered.length && <p>No accounts match these filters.</p>}
-            {filtered.map((row) => <article className="identity-account" key={row.user.id}>
-              <header><div className="identity-account-name">{row.can_confirm && <input type="checkbox" aria-label={`Select ${row.user.username} (Magent ${row.user.id})`} checked={selected.includes(row.user.id)} disabled={saving} onChange={() => toggle(row.user.id)} />}<div><h2>{row.user.username}</h2><span>Magent {row.user.id} · {row.user.auth_provider === 'jellyseerr' ? 'Seerr' : row.user.auth_provider} sign-in</span></div></div><span className={`identity-badge is-${row.state}`}>{labels[row.state]}</span></header>
-              <dl className="identity-mapping">
-                <div><dt>Jellyfin user ID</dt><dd><code>{row.candidate_jellyfin_id ?? 'No match'}</code>{row.jellyfin && <span>{row.jellyfin.name}</span>}<small>{basisLabels[row.basis]}</small>{row.stored_jellyfin_id && row.stored_jellyfin_id !== row.candidate_jellyfin_id && <small>Stored: {row.stored_jellyfin_id}</small>}</dd></div>
-                <div><dt>Seerr user ID</dt><dd><strong>{row.seerr.length ? row.seerr.map((entry) => entry.id).join(', ') : 'No match'}</strong><span>{row.seerr.map((entry) => entry.name).join(', ')}</span><small>Stored in Magent: {row.user.jellyseerr_user_id ?? 'Not linked'}</small></dd></div>
-                <div><dt>Jellystat user ID</dt><dd><code>{row.jellystat.id ?? 'Not verified'}</code><span>{statsLabels[row.jellystat.state] ?? row.jellystat.state}</span></dd></div>
-              </dl>
-              {row.issues.length > 0 && <ul className="identity-issues">{row.issues.map((issue) => <li key={issue}>{issue}</li>)}</ul>}
-              {(row.state === 'unlinked' || row.state === 'conflict') && <div className="identity-resolution-entry"><p className="identity-meta">Compare the correct Jellyfin identity with the stored links and review the smallest safe repair.</p><button type="button" className="ghost-button" disabled={saving || report.services.jellyfin !== 'available'} onClick={() => setResolving(row)}>Review repair</button>{row.issues.some((issue) => issue.includes("resolve to this Jellyfin ID") || issue.includes("share this username")) && <button type="button" className="ghost-button" disabled={saving} onClick={() => setDuplicates(row)}>Repair duplicate accounts</button>}</div>}
-              {row.state === 'unavailable' && <p className="identity-meta">A required service could not be checked. Check its connection and run this again.</p>}
-              {row.confirmed_at && <p className="identity-meta">Last confirmed {new Date(row.confirmed_at).toLocaleString()}</p>}
-            </article>)}
+      {ready && (
+        <>
+          <section className="identity-intro admin-panel">
+            <div>
+              <h2>Confirm user IDs</h2>
+              <p>
+                Jellyfin’s server and user IDs identify each account. Seerr and Jellystat are checked against that same
+                user ID.
+              </p>
+              <p>
+                Review the proposed links before saving. Repair incorrect Magent links after reviewing the IDs.
+                Duplicate ownership and upstream changes require individual review.
+              </p>
+            </div>
+            <button type="button" onClick={runCheck} disabled={busy || saving}>
+              {busy ? "Checking all accounts…" : report ? "Run check again" : "Check all user IDs"}
+            </button>
           </section>
-          {report.upstream.length > 0 && <details className="identity-upstream"><summary>{report.upstream.length} upstream accounts need review</summary><ul>{report.upstream.map((entry) => <li key={`${entry.platform}-${entry.id}`}><strong>{entry.platform}: {entry.name}</strong> · ID <code>{entry.id}</code>{entry.jellyfin_id && <span> · Jellyfin <code>{entry.jellyfin_id}</code></span>}<p>{entry.detail}</p></li>)}</ul></details>}
-        </>}
-      </>}
-      {duplicates && <DuplicateAccountRepair row={duplicates} onClose={() => setDuplicates(null)} onSaved={() => { setDuplicates(null); void runCheck().then(() => setNotice('Duplicate accounts repaired. History retained and links rechecked.')) }} />}
-      {resolving && report && <ResolveIdentityLink row={resolving} accounts={report.jellyfin_users} onClose={() => setResolving(null)} onSaved={() => {
-        setResolving(null); setReport(null); setSelected([]); setReviewing(false)
-        setNotice('Account links repaired and saved. Run another check to see the updated mappings.')
-      }} />}
+          {busy && (
+            <p role="status">
+              Reading the live user directories and checking Jellystat IDs. This can take up to a minute.
+            </p>
+          )}
+          {report && (
+            <>
+              <div className="identity-service-strip">
+                {Object.entries(report.services).map(([service, state]) => (
+                  <span key={service}>
+                    <strong>{service === "seerr" ? "Seerr" : service === "jellyfin" ? "Jellyfin" : "Jellystat"}</strong>{" "}
+                    {serviceLabels[state] ?? state}
+                  </span>
+                ))}
+              </div>
+              <p className="identity-meta">
+                Checked {new Date(report.checked_at).toLocaleString()} · Jellyfin server{" "}
+                <code>{report.server_id ?? "Unavailable"}</code>
+              </p>
+              <div className="identity-counts">
+                {["magent", "ready", "confirmed", "conflict", "unlinked", "unavailable"].map((state) => (
+                  <div key={state}>
+                    <strong>{report.counts[state]}</strong>
+                    <span>{state === "magent" ? "Magent accounts" : labels[state]}</span>
+                  </div>
+                ))}
+              </div>
+              <p className="identity-meta">
+                Includes duplicate Magent rows hidden in the user directory. Jellystat checks cover IDs found in
+                Jellyfin, Seerr and stored Magent links; historical Jellystat-only IDs are outside this check.
+              </p>
+              <div className="identity-filters">
+                <label>
+                  Find an account
+                  <input
+                    type="search"
+                    value={query}
+                    onChange={(event) => setQuery(event.target.value)}
+                    placeholder="Username or user ID"
+                    disabled={saving}
+                  />
+                </label>
+                <label>
+                  Show
+                  <select value={filter} onChange={(event) => setFilter(event.target.value)} disabled={saving}>
+                    <option value="all">All accounts</option>
+                    {Object.entries(labels).map(([state, label]) => (
+                      <option key={state} value={state}>
+                        {label}
+                      </option>
+                    ))}
+                  </select>
+                </label>
+              </div>
+              <div className="identity-selection">
+                <span>
+                  {filtered.length} accounts shown · {selected.length} selected
+                </span>
+                <button
+                  type="button"
+                  className="ghost-button"
+                  disabled={saving || !eligible.length}
+                  onClick={() => {
+                    setSelected((current) => [...new Set([...current, ...eligible])]);
+                    setReviewing(false);
+                  }}
+                >
+                  Select ready accounts shown
+                </button>
+                <button
+                  type="button"
+                  className="ghost-button"
+                  disabled={saving || !selected.length}
+                  onClick={() => {
+                    setSelected([]);
+                    setReviewing(false);
+                  }}
+                >
+                  Clear selection
+                </button>
+                <button type="button" disabled={saving || !selected.length} onClick={() => setReviewing(true)}>
+                  Review selected links ({selected.length})
+                </button>
+              </div>
+              {reviewing && (
+                <section
+                  className="identity-confirm-panel"
+                  ref={reviewPanel}
+                  tabIndex={-1}
+                  aria-label="Review links before saving"
+                >
+                  <h2>Save these {selected.length} account links?</h2>
+                  <p>
+                    Each selected Magent account will be linked to the Jellyfin ID and Seerr ID shown below. The live
+                    IDs will be checked again before saving.
+                  </p>
+                  <ul>
+                    {selectedRows.map((row) => (
+                      <li key={row.user.id}>
+                        <strong>{row.user.username}</strong> · Magent {row.user.id} → Jellyfin{" "}
+                        <code>{row.candidate_jellyfin_id}</code> → Seerr {row.seerr[0].id}
+                      </li>
+                    ))}
+                  </ul>
+                  <p>
+                    Saving links does not merge or delete accounts. Existing requests and playback history stay with
+                    their service IDs.
+                  </p>
+                  <div className="identity-confirm-actions">
+                    <button type="button" onClick={save} disabled={saving}>
+                      {saving ? "Rechecking and saving…" : "Confirm and save links"}
+                    </button>
+                    <button
+                      type="button"
+                      className="ghost-button"
+                      disabled={saving}
+                      onClick={() => setReviewing(false)}
+                    >
+                      Back to review
+                    </button>
+                  </div>
+                </section>
+              )}
+              <section className="identity-accounts" aria-label="Account identity results">
+                {!filtered.length && <p>No accounts match these filters.</p>}
+                {filtered.map((row) => (
+                  <article className="identity-account" key={row.user.id}>
+                    <header>
+                      <div className="identity-account-name">
+                        {row.can_confirm && (
+                          <input
+                            type="checkbox"
+                            aria-label={`Select ${row.user.username} (Magent ${row.user.id})`}
+                            checked={selected.includes(row.user.id)}
+                            disabled={saving}
+                            onChange={() => toggle(row.user.id)}
+                          />
+                        )}
+                        <div>
+                          <h2>{row.user.username}</h2>
+                          <span>
+                            Magent {row.user.id} ·{" "}
+                            {row.user.auth_provider === "jellyseerr" ? "Seerr" : row.user.auth_provider} sign-in
+                          </span>
+                        </div>
+                      </div>
+                      <span className={`identity-badge is-${row.state}`}>{labels[row.state]}</span>
+                    </header>
+                    <dl className="identity-mapping">
+                      <div>
+                        <dt>Jellyfin user ID</dt>
+                        <dd>
+                          <code>{row.candidate_jellyfin_id ?? "No match"}</code>
+                          {row.jellyfin && <span>{row.jellyfin.name}</span>}
+                          <small>{basisLabels[row.basis]}</small>
+                          {row.stored_jellyfin_id && row.stored_jellyfin_id !== row.candidate_jellyfin_id && (
+                            <small>Stored: {row.stored_jellyfin_id}</small>
+                          )}
+                        </dd>
+                      </div>
+                      <div>
+                        <dt>Seerr user ID</dt>
+                        <dd>
+                          <strong>
+                            {row.seerr.length ? row.seerr.map((entry) => entry.id).join(", ") : "No match"}
+                          </strong>
+                          <span>{row.seerr.map((entry) => entry.name).join(", ")}</span>
+                          <small>Stored in Magent: {row.user.jellyseerr_user_id ?? "Not linked"}</small>
+                        </dd>
+                      </div>
+                      <div>
+                        <dt>Jellystat user ID</dt>
+                        <dd>
+                          <code>{row.jellystat.id ?? "Not verified"}</code>
+                          <span>{statsLabels[row.jellystat.state] ?? row.jellystat.state}</span>
+                        </dd>
+                      </div>
+                    </dl>
+                    {row.issues.length > 0 && (
+                      <ul className="identity-issues">
+                        {row.issues.map((issue) => (
+                          <li key={issue}>{issue}</li>
+                        ))}
+                      </ul>
+                    )}
+                    {(row.state === "unlinked" || row.state === "conflict") && (
+                      <div className="identity-resolution-entry">
+                        <p className="identity-meta">
+                          Compare the correct Jellyfin identity with the stored links and review the smallest safe
+                          repair.
+                        </p>
+                        <button
+                          type="button"
+                          className="ghost-button"
+                          disabled={saving || report.services.jellyfin !== "available"}
+                          onClick={() => setResolving(row)}
+                        >
+                          Review repair
+                        </button>
+                        {row.issues.some(
+                          (issue) =>
+                            issue.includes("resolve to this Jellyfin ID") || issue.includes("share this username"),
+                        ) && (
+                          <button
+                            type="button"
+                            className="ghost-button"
+                            disabled={saving}
+                            onClick={() => setDuplicates(row)}
+                          >
+                            Repair duplicate accounts
+                          </button>
+                        )}
+                      </div>
+                    )}
+                    {row.state === "unavailable" && (
+                      <p className="identity-meta">
+                        A required service could not be checked. Check its connection and run this again.
+                      </p>
+                    )}
+                    {row.confirmed_at && (
+                      <p className="identity-meta">Last confirmed {new Date(row.confirmed_at).toLocaleString()}</p>
+                    )}
+                  </article>
+                ))}
+              </section>
+              {report.upstream.length > 0 && (
+                <details className="identity-upstream">
+                  <summary>{report.upstream.length} upstream accounts need review</summary>
+                  <ul>
+                    {report.upstream.map((entry) => (
+                      <li key={`${entry.platform}-${entry.id}`}>
+                        <strong>
+                          {entry.platform}: {entry.name}
+                        </strong>{" "}
+                        · ID <code>{entry.id}</code>
+                        {entry.jellyfin_id && (
+                          <span>
+                            {" "}
+                            · Jellyfin <code>{entry.jellyfin_id}</code>
+                          </span>
+                        )}
+                        <p>{entry.detail}</p>
+                      </li>
+                    ))}
+                  </ul>
+                </details>
+              )}
+            </>
+          )}
+        </>
+      )}
+      {duplicates && (
+        <DuplicateAccountRepair
+          row={duplicates}
+          onClose={() => setDuplicates(null)}
+          onSaved={() => {
+            setDuplicates(null);
+            void runCheck().then(() => setNotice("Duplicate accounts repaired. History retained and links rechecked."));
+          }}
+        />
+      )}
+      {resolving && report && (
+        <ResolveIdentityLink
+          row={resolving}
+          accounts={report.jellyfin_users}
+          onClose={() => setResolving(null)}
+          onSaved={() => {
+            setResolving(null);
+            setReport(null);
+            setSelected([]);
+            setReviewing(false);
+            setNotice("Account links repaired and saved. Run another check to see the updated mappings.");
+          }}
+        />
+      )}
     </div>
-  )
+  );
 }

frontend/app/admin/identities/ResolveIdentityLink.tsx

@@ -1,106 +1,290 @@
-'use client'
+"use client";
 
-import { useEffect, useRef, useState } from 'react'
-import { authFetch, getApiBase } from '../../lib/auth'
-import type { Row } from './IdentityReviewPanel'
+import { useEffect, useRef, useState } from "react";
+import { authFetch, getApiBase } from "../../lib/auth";
+import type { Row } from "./IdentityReviewPanel";
 
 type Preview = {
-  revision: string; server_id: string; row: Row
-  before: { jellyfin_user_id: string | null; seerr_user_id: number | null }
-  seerr_users: { id: number; name: string; jellyfin_id: string | null }[]
-  scope: string
-  action: string
-}
+  revision: string;
+  server_id: string;
+  row: Row;
+  before: { jellyfin_user_id: string | null; seerr_user_id: number | null };
+  seerr_users: { id: number; name: string; jellyfin_id: string | null }[];
+  scope: string;
+  action: string;
+};
 
-export default function ResolveIdentityLink({ row, accounts, onClose, onSaved }: {
-  row: Row; accounts: { id: string; name: string }[]; onClose: () => void; onSaved: () => void
+export default function ResolveIdentityLink({
+  row,
+  accounts,
+  onClose,
+  onSaved,
+}: {
+  row: Row;
+  accounts: { id: string; name: string }[];
+  onClose: () => void;
+  onSaved: () => void;
 }) {
-  const dialog = useRef<HTMLDialogElement>(null)
-  const controller = useRef<AbortController | null>(null)
-  const [chosen, setChosen] = useState(row.candidate_jellyfin_id ?? '')
-  const [inspectSeerr, setInspectSeerr] = useState('')
-  const [createSeerr, setCreateSeerr] = useState(false)
-  const [preview, setPreview] = useState<Preview | null>(null)
-  const [busy, setBusy] = useState(false)
-  const [saving, setSaving] = useState(false)
-  const [error, setError] = useState('')
+  const dialog = useRef<HTMLDialogElement>(null);
+  const controller = useRef<AbortController | null>(null);
+  const [chosen, setChosen] = useState(row.candidate_jellyfin_id ?? "");
+  const [inspectSeerr, setInspectSeerr] = useState("");
+  const [createSeerr, setCreateSeerr] = useState(false);
+  const [preview, setPreview] = useState<Preview | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState("");
 
   useEffect(() => {
-    const previous = document.activeElement as HTMLElement | null
-    const overflow = document.body.style.overflow
-    document.body.style.overflow = 'hidden'
-    dialog.current?.showModal()
+    const previous = document.activeElement as HTMLElement | null;
+    const overflow = document.body.style.overflow;
+    document.body.style.overflow = "hidden";
+    dialog.current?.showModal();
     return () => {
-      controller.current?.abort()
-      document.body.style.overflow = overflow
-      previous?.focus()
-    }
-  }, [])
+      controller.current?.abort();
+      document.body.style.overflow = overflow;
+      previous?.focus();
+    };
+  }, []);
 
   const submit = async (confirm: boolean) => {
-    if (!chosen || busy || saving || (confirm && !preview?.row.can_confirm)) return
-    const abort = new AbortController()
-    controller.current = abort
-    setError('')
-    if (confirm) setSaving(true)
-    else { setBusy(true); setPreview(null) }
+    if (!chosen || busy || saving || (confirm && !preview?.row.can_confirm)) return;
+    const abort = new AbortController();
+    controller.current = abort;
+    setError("");
+    if (confirm) setSaving(true);
+    else {
+      setBusy(true);
+      setPreview(null);
+    }
     try {
-      const response = await authFetch(`${getApiBase()}/admin/identities/repair/${confirm ? 'confirm' : 'check'}`, {
-        method: 'POST', signal: abort.signal, headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ user_id: row.user.id, jellyfin_user_id: chosen, create_seerr: createSeerr, ...(confirm ? { revision: preview?.revision } : {}) }),
-      })
-      const data = await response.json().catch(() => ({}))
-      if (!response.ok) throw new Error(response.status === 401 ? 'Your session has ended. Sign in again.' : typeof data.detail === 'string' ? data.detail : 'Could not check the account links. Try again.')
+      const response = await authFetch(`${getApiBase()}/admin/identities/repair/${confirm ? "confirm" : "check"}`, {
+        method: "POST",
+        signal: abort.signal,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          user_id: row.user.id,
+          jellyfin_user_id: chosen,
+          create_seerr: createSeerr,
+          ...(confirm ? { revision: preview?.revision } : {}),
+        }),
+      });
+      const data = await response.json().catch(() => ({}));
+      if (!response.ok)
+        throw new Error(
+          response.status === 401
+            ? "Your session has ended. Sign in again."
+            : typeof data.detail === "string"
+              ? data.detail
+              : "Could not check the account links. Try again.",
+        );
       if (!abort.signal.aborted) {
-        if (confirm) onSaved()
-        else setPreview(data)
+        if (confirm) onSaved();
+        else setPreview(data);
       }
     } catch (err) {
       if (!abort.signal.aborted) {
-        setError(err instanceof Error ? err.message : 'Could not resolve the link.')
-        setPreview(null)
+        setError(err instanceof Error ? err.message : "Could not resolve the link.");
+        setPreview(null);
       }
-    } finally { if (!abort.signal.aborted) { setBusy(false); setSaving(false) } }
-  }
+    } finally {
+      if (!abort.signal.aborted) {
+        setBusy(false);
+        setSaving(false);
+      }
+    }
+  };
 
-  return <dialog ref={dialog} className="identity-resolve-dialog" aria-labelledby="resolve-title" onCancel={(event) => { event.preventDefault(); if (!saving) onClose() }}>
-    <div className="identity-resolve-content">
-      <header><h2 id="resolve-title">Review account repair</h2><button type="button" className="ghost-button" onClick={onClose} disabled={saving}>Close</button></header>
-      <p>Review <strong>{row.user.username}</strong> (Magent {row.user.id}) against their Jellyfin account. Confirm that these identities belong to the same person before repairing Magent.</p>
-      <label>Jellyfin account<select value={chosen} disabled={saving} onChange={(event) => {
-        controller.current?.abort(); setBusy(false); setPreview(null); setError(''); setCreateSeerr(false); setChosen(event.target.value)
-      }}><option value="">Choose an account</option>{[...accounts].sort((a, b) => a.name.localeCompare(b.name)).map((account) => <option key={account.id} value={account.id}>{account.name} — {account.id}</option>)}</select></label>
-      <label className="identity-import-option"><span><input type="checkbox" checked={createSeerr} disabled={busy || saving} onChange={(event) => { setCreateSeerr(event.target.checked); setPreview(null) }} /> This person has no existing Seerr account. Import only the selected Jellyfin account if it is missing.</span></label>
-      <button type="button" onClick={() => void submit(false)} disabled={!chosen || busy || saving}>{busy ? 'Checking all platform links…' : 'Preview repair'}</button>
-      {error && <p className="error-banner" role="alert">{error}</p>}
-      {busy && <p role="status">Checking live IDs and whether another Magent account already owns this identity.</p>}
-      {preview && <section className="identity-confirm-panel" aria-label="Selected account links" aria-live="polite">
-        <h3>{preview.row.can_confirm ? 'Ready to repair' : 'This link needs attention'}</h3>
-        <p className="identity-meta">Jellyfin server <code>{preview.server_id ?? 'Unavailable'}</code></p>
-        <div className="identity-mapping">
-          <div><strong>Current Magent links</strong><p>Jellyfin: <code>{preview.before.jellyfin_user_id ?? 'Not linked'}</code></p><p>Seerr: {preview.before.seerr_user_id ?? 'Not linked'}</p></div>
-          <div><strong>Proposed Magent links</strong><p>Jellyfin: <code>{preview.row.candidate_jellyfin_id}</code></p><p>Seerr: {preview.row.seerr.length === 1 ? preview.row.seerr[0].id : preview.action === 'import_seerr' ? 'Assigned by Seerr during import' : 'Not verified'}</p></div>
-        </div>
-        <dl className="identity-mapping">
-          <div><dt>Jellyfin</dt><dd>{preview.row.jellyfin?.name ?? 'Account not found'}<code>{preview.row.candidate_jellyfin_id}</code></dd></div>
-          <div><dt>Seerr</dt><dd>{preview.row.seerr.length ? preview.row.seerr.map((account) => `${account.name} (ID ${account.id})`).join(', ') : 'No matching Jellyfin ID. Check this user’s Jellyfin account link in Seerr, then check again.'}</dd></div>
-          <div><dt>Jellystat</dt><dd><code>{preview.row.jellystat.id ?? 'Not verified'}</code>{preview.row.jellystat.state === 'matched' ? 'Same Jellyfin ID verified' : preview.row.jellystat.state === 'missing' ? 'This ID is missing from Jellystat. Check its Jellyfin sync, then check again.' : 'Could not verify this ID. Check the Jellystat connection and try again.'}</dd></div>
-        </dl>
-        {preview.row.issues.length > 0 && <ul className="identity-issues">{preview.row.issues.map((issue) => <li key={issue}>{issue}</li>)}</ul>}
-        {preview.row.state === 'unavailable' && <p>A required service is unavailable. Restore its connection and check again.</p>}
-        {preview.row.seerr.length !== 1 && <div className="identity-upstream-guidance">
-          <h3>Check the existing Seerr account</h3>
-          <p>Choose an account to inspect its current Jellyfin ID. This selection does not change or link it.</p>
-          <label>Seerr account to inspect<select value={inspectSeerr} onChange={(event) => setInspectSeerr(event.target.value)}><option value="">Choose an existing account</option>{preview.seerr_users.map((account) => <option key={account.id} value={account.id}>{account.name} (ID {account.id})</option>)}</select></label>
-          {preview.seerr_users.filter((account) => String(account.id) === inspectSeerr).map((account) => <p key={account.id}>Current Jellyfin ID: <code>{account.jellyfin_id ?? 'Not linked'}</code></p>)}
-          <p>If this is the same person, use Seerr's account settings to reconnect their existing account to Jellyfin, then preview again. Linking requires that user's Jellyfin sign-in in Seerr. Keep the existing Seerr account to preserve its requests and settings.</p>
-          <p>If they have never had a Seerr account, import just their Jellyfin account from Seerr's Users page, then preview again. Do not import a second account to work around an existing identity mismatch.</p>
-        </div>}
-        <p>{preview.scope}</p>
-        <p>Repair records the previous and new links, your administrator name and the time. Live IDs and duplicate ownership are rechecked before the change is saved.</p>
-        {preview.before.jellyfin_user_id && preview.before.jellyfin_user_id !== preview.row.candidate_jellyfin_id && <p>Changing the Jellyfin identity also revokes identity-bound email subscriptions. The user will need to opt in again.</p>}
-        <button type="button" disabled={!preview.row.can_confirm || saving} onClick={() => void submit(true)}>{saving ? 'Rechecking and saving…' : preview.action === 'import_seerr' ? 'Import Seerr account and repair links' : 'Confirm repair'}</button>
-      </section>}
-    </div>
-  </dialog>
+  return (
+    <dialog
+      ref={dialog}
+      className="identity-resolve-dialog"
+      aria-labelledby="resolve-title"
+      onCancel={(event) => {
+        event.preventDefault();
+        if (!saving) onClose();
+      }}
+    >
+      <div className="identity-resolve-content">
+        <header>
+          <h2 id="resolve-title">Review account repair</h2>
+          <button type="button" className="ghost-button" onClick={onClose} disabled={saving}>
+            Close
+          </button>
+        </header>
+        <p>
+          Review <strong>{row.user.username}</strong> (Magent {row.user.id}) against their Jellyfin account. Confirm
+          that these identities belong to the same person before repairing Magent.
+        </p>
+        <label>
+          Jellyfin account
+          <select
+            value={chosen}
+            disabled={saving}
+            onChange={(event) => {
+              controller.current?.abort();
+              setBusy(false);
+              setPreview(null);
+              setError("");
+              setCreateSeerr(false);
+              setChosen(event.target.value);
+            }}
+          >
+            <option value="">Choose an account</option>
+            {[...accounts]
+              .sort((a, b) => a.name.localeCompare(b.name))
+              .map((account) => (
+                <option key={account.id} value={account.id}>
+                  {account.name} — {account.id}
+                </option>
+              ))}
+          </select>
+        </label>
+        <label className="identity-import-option">
+          <span>
+            <input
+              type="checkbox"
+              checked={createSeerr}
+              disabled={busy || saving}
+              onChange={(event) => {
+                setCreateSeerr(event.target.checked);
+                setPreview(null);
+              }}
+            />{" "}
+            This person has no existing Seerr account. Import only the selected Jellyfin account if it is missing.
+          </span>
+        </label>
+        <button type="button" onClick={() => void submit(false)} disabled={!chosen || busy || saving}>
+          {busy ? "Checking all platform links…" : "Preview repair"}
+        </button>
+        {error && (
+          <p className="error-banner" role="alert">
+            {error}
+          </p>
+        )}
+        {busy && <p role="status">Checking live IDs and whether another Magent account already owns this identity.</p>}
+        {preview && (
+          <section className="identity-confirm-panel" aria-label="Selected account links" aria-live="polite">
+            <h3>{preview.row.can_confirm ? "Ready to repair" : "This link needs attention"}</h3>
+            <p className="identity-meta">
+              Jellyfin server <code>{preview.server_id ?? "Unavailable"}</code>
+            </p>
+            <div className="identity-mapping">
+              <div>
+                <strong>Current Magent links</strong>
+                <p>
+                  Jellyfin: <code>{preview.before.jellyfin_user_id ?? "Not linked"}</code>
+                </p>
+                <p>Seerr: {preview.before.seerr_user_id ?? "Not linked"}</p>
+              </div>
+              <div>
+                <strong>Proposed Magent links</strong>
+                <p>
+                  Jellyfin: <code>{preview.row.candidate_jellyfin_id}</code>
+                </p>
+                <p>
+                  Seerr:{" "}
+                  {preview.row.seerr.length === 1
+                    ? preview.row.seerr[0].id
+                    : preview.action === "import_seerr"
+                      ? "Assigned by Seerr during import"
+                      : "Not verified"}
+                </p>
+              </div>
+            </div>
+            <dl className="identity-mapping">
+              <div>
+                <dt>Jellyfin</dt>
+                <dd>
+                  {preview.row.jellyfin?.name ?? "Account not found"}
+                  <code>{preview.row.candidate_jellyfin_id}</code>
+                </dd>
+              </div>
+              <div>
+                <dt>Seerr</dt>
+                <dd>
+                  {preview.row.seerr.length
+                    ? preview.row.seerr.map((account) => `${account.name} (ID ${account.id})`).join(", ")
+                    : "No matching Jellyfin ID. Check this user’s Jellyfin account link in Seerr, then check again."}
+                </dd>
+              </div>
+              <div>
+                <dt>Jellystat</dt>
+                <dd>
+                  <code>{preview.row.jellystat.id ?? "Not verified"}</code>
+                  {preview.row.jellystat.state === "matched"
+                    ? "Same Jellyfin ID verified"
+                    : preview.row.jellystat.state === "missing"
+                      ? "This ID is missing from Jellystat. Check its Jellyfin sync, then check again."
+                      : "Could not verify this ID. Check the Jellystat connection and try again."}
+                </dd>
+              </div>
+            </dl>
+            {preview.row.issues.length > 0 && (
+              <ul className="identity-issues">
+                {preview.row.issues.map((issue) => (
+                  <li key={issue}>{issue}</li>
+                ))}
+              </ul>
+            )}
+            {preview.row.state === "unavailable" && (
+              <p>A required service is unavailable. Restore its connection and check again.</p>
+            )}
+            {preview.row.seerr.length !== 1 && (
+              <div className="identity-upstream-guidance">
+                <h3>Check the existing Seerr account</h3>
+                <p>Choose an account to inspect its current Jellyfin ID. This selection does not change or link it.</p>
+                <label>
+                  Seerr account to inspect
+                  <select value={inspectSeerr} onChange={(event) => setInspectSeerr(event.target.value)}>
+                    <option value="">Choose an existing account</option>
+                    {preview.seerr_users.map((account) => (
+                      <option key={account.id} value={account.id}>
+                        {account.name} (ID {account.id})
+                      </option>
+                    ))}
+                  </select>
+                </label>
+                {preview.seerr_users
+                  .filter((account) => String(account.id) === inspectSeerr)
+                  .map((account) => (
+                    <p key={account.id}>
+                      Current Jellyfin ID: <code>{account.jellyfin_id ?? "Not linked"}</code>
+                    </p>
+                  ))}
+                <p>
+                  If this is the same person, use Seerr's account settings to reconnect their existing account to
+                  Jellyfin, then preview again. Linking requires that user's Jellyfin sign-in in Seerr. Keep the
+                  existing Seerr account to preserve its requests and settings.
+                </p>
+                <p>
+                  If they have never had a Seerr account, import just their Jellyfin account from Seerr's Users page,
+                  then preview again. Do not import a second account to work around an existing identity mismatch.
+                </p>
+              </div>
+            )}
+            <p>{preview.scope}</p>
+            <p>
+              Repair records the previous and new links, your administrator name and the time. Live IDs and duplicate
+              ownership are rechecked before the change is saved.
+            </p>
+            {preview.before.jellyfin_user_id &&
+              preview.before.jellyfin_user_id !== preview.row.candidate_jellyfin_id && (
+                <p>
+                  Changing the Jellyfin identity also revokes identity-bound email subscriptions. The user will need to
+                  opt in again.
+                </p>
+              )}
+            <button type="button" disabled={!preview.row.can_confirm || saving} onClick={() => void submit(true)}>
+              {saving
+                ? "Rechecking and saving…"
+                : preview.action === "import_seerr"
+                  ? "Import Seerr account and repair links"
+                  : "Confirm repair"}
+            </button>
+          </section>
+        )}
+      </div>
+    </dialog>
+  );
 }

frontend/app/admin/identities/page.tsx

@@ -1,5 +1,5 @@
-import { redirect } from 'next/navigation'
+import { redirect } from "next/navigation";
 
 export default function IdentityReviewPage() {
-  redirect('/users?view=identities')
+  redirect("/users?view=identities");
 }

frontend/app/admin/issues/page.tsx

@@ -1,5 +1,5 @@
-import PortalClient from '../../portal/PortalClient'
+import PortalClient from "../../portal/PortalClient";
 
 export default function AdminIssuesPage() {
-  return <PortalClient workspace="issue" />
+  return <PortalClient workspace="issue" />;
 }

frontend/app/admin/page.tsx

@@ -1,77 +1,126 @@
-'use client'
+"use client";
 
-import { useEffect, useState } from 'react'
-import { useRouter } from 'next/navigation'
-import { authFetch, getApiBase, getToken } from '../lib/auth'
-import AdminShell from '../ui/AdminShell'
-import { CONFIG_GROUPS, serviceStatusLabel } from './configNavigation'
+import { useEffect, useState } from "react";
+import { useRouter } from "next/navigation";
+import { authFetch, getApiBase, getToken } from "../lib/auth";
+import AdminShell from "../ui/AdminShell";
+import { CONFIG_GROUPS, serviceStatusLabel } from "./configNavigation";
 
-type ServiceState = { name: string; status: string }
+type ServiceState = { name: string; status: string };
 
 export default function AdminLandingPage() {
-  const router = useRouter()
-  const [services, setServices] = useState<ServiceState[]>([])
-  const [ready, setReady] = useState(false)
-  const [error, setError] = useState('')
+  const router = useRouter();
+  const [services, setServices] = useState<ServiceState[]>([]);
+  const [ready, setReady] = useState(false);
+  const [error, setError] = useState("");
 
   useEffect(() => {
-    let active = true
+    let active = true;
     const load = async () => {
-      if (!getToken()) { router.replace('/login'); return }
-      try {
-        const response = await authFetch(`${getApiBase()}/auth/me`)
-        if (!response.ok) { router.replace('/login'); return }
-        if ((await response.json())?.role !== 'admin') { router.replace('/'); return }
-        if (!active) return
-        setReady(true)
-        const status = await authFetch(`${getApiBase()}/status/services`)
-        if (!status.ok) throw new Error('Status unavailable')
-        const data = await status.json()
-        if (active) setServices(Array.isArray(data.services) ? data.services : [])
-      } catch {
-        if (active) setError('Connection status is unavailable. Refresh the page to try again.')
+      if (!getToken()) {
+        router.replace("/login");
+        return;
       }
-    }
-    void load()
-    return () => { active = false }
-  }, [router])
+      try {
+        const response = await authFetch(`${getApiBase()}/auth/me`);
+        if (!response.ok) {
+          router.replace("/login");
+          return;
+        }
+        if ((await response.json())?.role !== "admin") {
+          router.replace("/");
+          return;
+        }
+        if (!active) return;
+        setReady(true);
+        const status = await authFetch(`${getApiBase()}/status/services`);
+        if (!status.ok) throw new Error("Status unavailable");
+        const data = await status.json();
+        if (active) setServices(Array.isArray(data.services) ? data.services : []);
+      } catch {
+        if (active) setError("Connection status is unavailable. Refresh the page to try again.");
+      }
+    };
+    void load();
+    return () => {
+      active = false;
+    };
+  }, [router]);
 
   return (
     <AdminShell title="Settings" subtitle="Connections, access and the way Magent works.">
-      {!ready ? error ? <p className="error-banner" role="alert">{error}</p> : <p role="status">Loading settings…</p> : (
+      {!ready ? (
+        error ? (
+          <p className="error-banner" role="alert">
+            {error}
+          </p>
+        ) : (
+          <p role="status">Loading settings…</p>
+        )
+      ) : (
         <div className="config-directory">
-          {error && <p className="error-banner" role="alert">{error}</p>}
+          {error && (
+            <p className="error-banner" role="alert">
+              {error}
+            </p>
+          )}
           {CONFIG_GROUPS.filter((group) => !group.advanced).map((group) => (
             <section className="config-directory-region" key={group.title}>
-              <header><h2>{group.title}</h2><p>{group.description}</p></header>
+              <header>
+                <h2>{group.title}</h2>
+                <p>{group.description}</p>
+              </header>
               <div className="config-directory-links">
                 {group.items.map((item) => {
-                  const service = services.find((entry) => entry.name.toLowerCase() === item.service?.toLowerCase())
+                  const service = services.find((entry) => entry.name.toLowerCase() === item.service?.toLowerCase());
                   return (
                     <a href={item.href} key={item.href} className="config-directory-link">
-                      {item.symbol && <span className="config-link-icon" aria-hidden="true">{item.symbol}</span>}
-                      <span className="config-link-copy"><strong>{item.label}</strong><small>{item.description}</small></span>
-                      {item.service && <span className={`config-connection-badge is-${service?.status ?? 'unknown'}`}>{serviceStatusLabel(service?.status)}</span>}
-                      <span className="config-link-arrow" aria-hidden="true">→</span>
+                      {item.symbol && (
+                        <span className="config-link-icon" aria-hidden="true">
+                          {item.symbol}
+                        </span>
+                      )}
+                      <span className="config-link-copy">
+                        <strong>{item.label}</strong>
+                        <small>{item.description}</small>
+                      </span>
+                      {item.service && (
+                        <span className={`config-connection-badge is-${service?.status ?? "unknown"}`}>
+                          {serviceStatusLabel(service?.status)}
+                        </span>
+                      )}
+                      <span className="config-link-arrow" aria-hidden="true">
+                        →
+                      </span>
                     </a>
-                  )
+                  );
                 })}
               </div>
             </section>
           ))}
           <details className="config-advanced-directory">
-            <summary><strong>Advanced tools</strong><span>Hosting, logs, caches and recovery</span></summary>
+            <summary>
+              <strong>Advanced tools</strong>
+              <span>Hosting, logs, caches and recovery</span>
+            </summary>
             <div className="config-directory-links">
-              {CONFIG_GROUPS.filter((group) => group.advanced).flatMap((group) => group.items).map((item) => (
-                <a href={item.href} key={item.href} className="config-directory-link">
-                  <span className="config-link-copy"><strong>{item.label}</strong><small>{item.description}</small></span>
-                  <span className="config-link-arrow" aria-hidden="true">→</span>
-                </a>
-              ))}
+              {CONFIG_GROUPS.filter((group) => group.advanced)
+                .flatMap((group) => group.items)
+                .map((item) => (
+                  <a href={item.href} key={item.href} className="config-directory-link">
+                    <span className="config-link-copy">
+                      <strong>{item.label}</strong>
+                      <small>{item.description}</small>
+                    </span>
+                    <span className="config-link-arrow" aria-hidden="true">
+                      →
+                    </span>
+                  </a>
+                ))}
             </div>
           </details>
         </div>
       )}
     </AdminShell>
-  )
+  );
 }

frontend/app/admin/profiles/page.tsx

@@ -1,6 +1,5 @@
-import { redirect } from 'next/navigation'
+import { redirect } from "next/navigation";
 
 export default function AdminProfilesRedirectPage() {
-  redirect('/admin/invites')
+  redirect("/admin/invites");
 }
-

frontend/app/admin/recaps/page.tsx

@@ -1,132 +1,526 @@
-'use client'
+"use client";
 
-import { useCallback, useEffect, useRef, useState, type FormEvent } from 'react'
-import Link from 'next/link'
-import { useRouter } from 'next/navigation'
-import AdminShell from '../../ui/AdminShell'
-import { authFetch, getApiBase } from '../../lib/auth'
-import '../../email-recaps/recaps.css'
+import { useCallback, useEffect, useRef, useState, type FormEvent } from "react";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import AdminShell from "../../ui/AdminShell";
+import { authFetch, getApiBase } from "../../lib/auth";
+import "../../email-recaps/recaps.css";
 
-type Settings = { enabled: boolean; day: number; hour: number; public_url: string; next_send_at?: number | null }
-type Delivery = { id: string; month: string; kind: string; email: string; username: string | null; state: string; attempts: number; created_at: number; updated_at: number; next_attempt_at: number; detail: string }
-type Overview = { settings: Settings; ready: boolean; detail: string; months: string[]; deliveries: Delivery[]; total: number; subscribers: number; worker_enabled: boolean }
-type Preview = { month: string; subject: string; body_html: string; body_text: string; email: string | null }
-const monthLabel = (month: string) => new Date(`${month}-01T00:00:00Z`).toLocaleDateString(undefined, { month: 'long', year: 'numeric', timeZone: 'UTC' })
-const dateLabel = (value?: number | null) => value ? `${new Date(value * 1000).toLocaleString(undefined, { dateStyle: 'medium', timeStyle: 'short', timeZone: 'UTC' })} UTC` : 'Not scheduled'
-const stateLabels: Record<string, string> = { queued: 'Queued', preparing: 'Preparing report', sending: 'Sending', sent: 'Accepted by mail server', retry: 'Retry scheduled', failed: 'Failed', unknown: 'Needs review', cancelled: 'Cancelled' }
+type Settings = { enabled: boolean; day: number; hour: number; public_url: string; next_send_at?: number | null };
+type Delivery = {
+  id: string;
+  month: string;
+  kind: string;
+  email: string;
+  username: string | null;
+  state: string;
+  attempts: number;
+  created_at: number;
+  updated_at: number;
+  next_attempt_at: number;
+  detail: string;
+};
+type Overview = {
+  settings: Settings;
+  ready: boolean;
+  detail: string;
+  months: string[];
+  deliveries: Delivery[];
+  total: number;
+  subscribers: number;
+  worker_enabled: boolean;
+};
+type Preview = { month: string; subject: string; body_html: string; body_text: string; email: string | null };
+const monthLabel = (month: string) =>
+  new Date(`${month}-01T00:00:00Z`).toLocaleDateString(undefined, { month: "long", year: "numeric", timeZone: "UTC" });
+const dateLabel = (value?: number | null) =>
+  value
+    ? `${new Date(value * 1000).toLocaleString(undefined, { dateStyle: "medium", timeStyle: "short", timeZone: "UTC" })} UTC`
+    : "Not scheduled";
+const stateLabels: Record<string, string> = {
+  queued: "Queued",
+  preparing: "Preparing report",
+  sending: "Sending",
+  sent: "Accepted by mail server",
+  retry: "Retry scheduled",
+  failed: "Failed",
+  unknown: "Needs review",
+  cancelled: "Cancelled",
+};
 
 export default function EmailRecapsAdminPage() {
-  const router = useRouter()
-  const [data, setData] = useState<Overview | null>(null)
-  const [settings, setSettings] = useState<Settings>({ enabled: false, day: 2, hour: 9, public_url: '' })
-  const [month, setMonth] = useState('')
-  const [preview, setPreview] = useState<Preview | null>(null)
-  const [previewMode, setPreviewMode] = useState<'html' | 'text'>('html')
-  const [error, setError] = useState('')
-  const [notice, setNotice] = useState('')
-  const [busy, setBusy] = useState('')
-  const [offset, setOffset] = useState(0)
-  const [revision, setRevision] = useState(0)
-  const testRequest = useRef<{ month: string; id: string } | null>(null)
-  const initialized = useRef(false)
-  const previewController = useRef<AbortController | null>(null)
+  const router = useRouter();
+  const [data, setData] = useState<Overview | null>(null);
+  const [settings, setSettings] = useState<Settings>({ enabled: false, day: 2, hour: 9, public_url: "" });
+  const [month, setMonth] = useState("");
+  const [preview, setPreview] = useState<Preview | null>(null);
+  const [previewMode, setPreviewMode] = useState<"html" | "text">("html");
+  const [error, setError] = useState("");
+  const [notice, setNotice] = useState("");
+  const [busy, setBusy] = useState("");
+  const [offset, setOffset] = useState(0);
+  const [revision, setRevision] = useState(0);
+  const testRequest = useRef<{ month: string; id: string } | null>(null);
+  const initialized = useRef(false);
+  const previewController = useRef<AbortController | null>(null);
 
-  const responseData = useCallback(async (response: Response) => {
-    if (response.status === 401) { router.replace('/login?next=%2Fadmin%2Frecaps'); throw new Error('Sign in to continue.') }
-    if (response.status === 403) { router.replace('/'); throw new Error('Administrator access is required.') }
-    const result = await response.json().catch(() => ({}))
-    if (!response.ok) throw new Error(typeof result.detail === 'string' ? result.detail : 'Could not complete this action. Check your settings and try again.')
-    return result
-  }, [router])
+  const responseData = useCallback(
+    async (response: Response) => {
+      if (response.status === 401) {
+        router.replace("/login?next=%2Fadmin%2Frecaps");
+        throw new Error("Sign in to continue.");
+      }
+      if (response.status === 403) {
+        router.replace("/");
+        throw new Error("Administrator access is required.");
+      }
+      const result = await response.json().catch(() => ({}));
+      if (!response.ok)
+        throw new Error(
+          typeof result.detail === "string"
+            ? result.detail
+            : "Could not complete this action. Check your settings and try again.",
+        );
+      return result;
+    },
+    [router],
+  );
 
   useEffect(() => {
-    const abort = new AbortController()
-    void authFetch(`${getApiBase()}/admin/email-recaps?offset=${offset}`, { signal: abort.signal }).then(responseData).then((result: Overview) => {
-      if (abort.signal.aborted) return
-      setData(result)
-      if (!initialized.current) { setSettings(result.settings); setMonth(result.months[0] || ''); initialized.current = true }
-    }).catch((err: Error) => { if (!abort.signal.aborted) setError(err.message) })
-    return () => abort.abort()
-  }, [offset, revision, responseData])
+    void revision;
+    const abort = new AbortController();
+    void authFetch(`${getApiBase()}/admin/email-recaps?offset=${offset}`, { signal: abort.signal })
+      .then(responseData)
+      .then((result: Overview) => {
+        if (abort.signal.aborted) return;
+        setData(result);
+        if (!initialized.current) {
+          setSettings(result.settings);
+          setMonth(result.months[0] || "");
+          initialized.current = true;
+        }
+      })
+      .catch((err: Error) => {
+        if (!abort.signal.aborted) setError(err.message);
+      });
+    return () => abort.abort();
+  }, [offset, revision, responseData]);
 
   useEffect(() => {
-    if (!data?.deliveries.some((delivery) => ['queued', 'preparing', 'sending', 'retry'].includes(delivery.state))) return
-    const timer = window.setInterval(() => setRevision((value) => value + 1), 10000)
-    return () => window.clearInterval(timer)
-  }, [data])
-  useEffect(() => () => previewController.current?.abort(), [])
+    if (!data?.deliveries.some((delivery) => ["queued", "preparing", "sending", "retry"].includes(delivery.state)))
+      return;
+    const timer = window.setInterval(() => setRevision((value) => value + 1), 10000);
+    return () => window.clearInterval(timer);
+  }, [data]);
+  useEffect(() => () => previewController.current?.abort(), []);
 
-  const dirty = !!data && (settings.enabled !== data.settings.enabled || settings.day !== data.settings.day || settings.hour !== data.settings.hour || settings.public_url !== data.settings.public_url)
+  const dirty =
+    !!data &&
+    (settings.enabled !== data.settings.enabled ||
+      settings.day !== data.settings.day ||
+      settings.hour !== data.settings.hour ||
+      settings.public_url !== data.settings.public_url);
   const save = async (event: FormEvent) => {
-    event.preventDefault()
-    if (busy) return
-    setBusy('save'); setError(''); setNotice('')
+    event.preventDefault();
+    if (busy) return;
+    setBusy("save");
+    setError("");
+    setNotice("");
     try {
-      const { enabled, day, hour } = settings
-      const result = await responseData(await authFetch(`${getApiBase()}/admin/email-recaps`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ enabled, day, hour }) })) as Settings
-      setSettings(result); setData((current) => current ? { ...current, settings: result } : current)
-      setPreview(null)
-      setNotice(result.enabled ? `Schedule saved. Next send: ${dateLabel(result.next_send_at)}.` : 'Settings saved. Scheduled delivery is paused.')
-      setRevision((value) => value + 1)
-    } catch (err) { setError(err instanceof Error ? err.message : 'Could not save the schedule.') }
-    finally { setBusy('') }
-  }
+      const { enabled, day, hour } = settings;
+      const result = (await responseData(
+        await authFetch(`${getApiBase()}/admin/email-recaps`, {
+          method: "PUT",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ enabled, day, hour }),
+        }),
+      )) as Settings;
+      setSettings(result);
+      setData((current) => (current ? { ...current, settings: result } : current));
+      setPreview(null);
+      setNotice(
+        result.enabled
+          ? `Schedule saved. Next send: ${dateLabel(result.next_send_at)}.`
+          : "Settings saved. Scheduled delivery is paused.",
+      );
+      setRevision((value) => value + 1);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Could not save the schedule.");
+    } finally {
+      setBusy("");
+    }
+  };
 
   const loadPreview = async () => {
-    if (busy || !month) return
-    const abort = new AbortController()
-    previewController.current?.abort(); previewController.current = abort
-    setBusy('preview'); setError(''); setNotice(''); setPreview(null)
+    if (busy || !month) return;
+    const abort = new AbortController();
+    previewController.current?.abort();
+    previewController.current = abort;
+    setBusy("preview");
+    setError("");
+    setNotice("");
+    setPreview(null);
     try {
-      const result = await responseData(await authFetch(`${getApiBase()}/admin/email-recaps/preview?month=${month}`, { signal: abort.signal })) as Preview
-      if (!abort.signal.aborted) setPreview(result)
-    } catch (err) { if (!abort.signal.aborted) setError(err instanceof Error ? err.message : 'Could not prepare your preview.') }
-    finally { if (!abort.signal.aborted) setBusy('') }
-  }
+      const result = (await responseData(
+        await authFetch(`${getApiBase()}/admin/email-recaps/preview?month=${month}`, { signal: abort.signal }),
+      )) as Preview;
+      if (!abort.signal.aborted) setPreview(result);
+    } catch (err) {
+      if (!abort.signal.aborted) setError(err instanceof Error ? err.message : "Could not prepare your preview.");
+    } finally {
+      if (!abort.signal.aborted) setBusy("");
+    }
+  };
 
   const sendTest = async () => {
-    if (busy || !preview || preview.month !== month) return
-    if (!testRequest.current || testRequest.current.month !== month) testRequest.current = { month, id: crypto.randomUUID() }
-    setBusy('test'); setError(''); setNotice('')
+    if (busy || !preview || preview.month !== month) return;
+    if (!testRequest.current || testRequest.current.month !== month)
+      testRequest.current = { month, id: crypto.randomUUID() };
+    setBusy("test");
+    setError("");
+    setNotice("");
     try {
-      const result = await responseData(await authFetch(`${getApiBase()}/admin/email-recaps/test`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ month, request_id: testRequest.current.id }) }))
-      setNotice(result.message); testRequest.current = null; setOffset(0); setRevision((value) => value + 1)
-    } catch (err) { setError(err instanceof Error ? err.message : 'Could not queue your test.') }
-    finally { setBusy('') }
-  }
+      const result = await responseData(
+        await authFetch(`${getApiBase()}/admin/email-recaps/test`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ month, request_id: testRequest.current.id }),
+        }),
+      );
+      setNotice(result.message);
+      testRequest.current = null;
+      setOffset(0);
+      setRevision((value) => value + 1);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Could not queue your test.");
+    } finally {
+      setBusy("");
+    }
+  };
 
-  return <AdminShell title="Monthly email recaps" subtitle="Give each user a personal look back at their month in viewing." actions={<a className="ghost-button" href="/admin/notifications">Email settings ↗</a>}>
-    <div className="recap-admin">
-      {error && <p className="error-banner" role="alert">{error}</p>}
-      {notice && <p className="status-banner" role="status">{notice}</p>}
-      {!data && !error && <p role="status">Loading email recaps…</p>}
-      {!data && error && <button className="ghost-button" type="button" onClick={() => { setError(''); setRevision((value) => value + 1) }}>Try again</button>}
-      {data && <>
-        <div className="recap-overview-strip"><div><span className={`recap-pill ${data.settings.enabled ? 'is-enabled' : ''}`}>{data.settings.enabled ? 'Schedule running' : 'Schedule paused'}</span><p>{data.settings.enabled ? `Next send ${dateLabel(data.settings.next_send_at)}` : 'Start the schedule when you’re ready for monthly delivery.'}</p></div><div className="recap-subscriber-count"><strong>{data.subscribers}</strong><span>confirmed {data.subscribers === 1 ? 'subscriber' : 'subscribers'}</span></div></div>
-        <div className="recap-admin-grid">
-          <section className="admin-panel recap-panel"><div className="recap-section-heading"><div><span className="recap-eyebrow">Set the rhythm</span><h2>Monthly schedule</h2></div></div>
-            <p>Send the previous month’s report to users who have opted in and confirmed their email. All report periods and send times use UTC.</p>
-            <form className="recap-schedule-form" onSubmit={save}>
-              <label htmlFor="recap-public-url">Public Magent address<input id="recap-public-url" type="url" value={settings.public_url} readOnly /><small>Inherited from <Link href="/admin/general">Hosting &amp; proxy</Link>. Email links update when that address changes.</small></label>
-              <div className="recap-schedule-fields"><label htmlFor="recap-day">Day of the month<select id="recap-day" value={settings.day} onChange={(event) => setSettings({ ...settings, day: Number(event.target.value) })} disabled={!!busy}>{Array.from({ length: 28 }, (_, index) => <option key={index + 1} value={index + 1}>{index + 1}</option>)}</select></label><label htmlFor="recap-hour">Send time (UTC)<select id="recap-hour" value={settings.hour} onChange={(event) => setSettings({ ...settings, hour: Number(event.target.value) })} disabled={!!busy}>{Array.from({ length: 24 }, (_, hour) => <option key={hour} value={hour}>{String(hour).padStart(2, '0')}:00 UTC</option>)}</select></label></div>
-              <label className="recap-checkbox"><input type="checkbox" checked={settings.enabled} disabled={!!busy} onChange={(event) => setSettings({ ...settings, enabled: event.target.checked })} /><span>Enable scheduled monthly recaps</span></label>
-              <p className="recap-muted">Starting or changing the schedule begins at its next future send time. Pausing cancels queued monthly emails.</p>
-              <button className="account-primary" type="submit" disabled={!!busy || !dirty}>{busy === 'save' ? 'Saving…' : 'Save schedule'}</button>
-            </form>
-            {!data.ready && <p className="recap-setup-note">{data.detail} <a href="/admin/notifications">Review email settings ↗</a></p>}
-          </section>
-          <section className="admin-panel recap-panel"><span className="recap-eyebrow">Make it yours</span><h2>Preview your recap</h2><p>See your own viewing highlights in the email design. A test goes only to your confirmed profile email.</p>
-            <label className="recap-month-label" htmlFor="recap-month">Report month<select id="recap-month" value={month} disabled={!!busy} onChange={(event) => { setMonth(event.target.value); setPreview(null); testRequest.current = null }}>{data.months.map((value) => <option key={value} value={value}>{monthLabel(value)}</option>)}</select></label>
-            <div className="recap-actions"><button type="button" className="account-primary" onClick={() => void loadPreview()} disabled={!!busy || dirty || !month}>{busy === 'preview' ? 'Preparing preview…' : 'Preview my recap'}</button><button type="button" className="account-secondary" onClick={() => void sendTest()} disabled={!!busy || dirty || !preview || !data.ready}>{busy === 'test' ? 'Queuing test…' : 'Send test to me'}</button></div>
-            {dirty && <p className="recap-muted">Save your settings before previewing or sending a test.</p>}
-            <div className="recap-preview-guidance"><h3>One email. Your month.</h3><ul><li>Minutes, movies, episodes and requests</li><li>Changes from the previous month</li><li>Most watched titles and your longest run</li><li>A link to the full report and easy unsubscribe</li></ul><a href="/profile#monthly-recaps">Confirm your email in Profile ↗</a></div>
-          </section>
-        </div>
-        {preview && <section className="admin-panel recap-panel recap-preview"><div className="recap-section-heading"><div><span className="recap-eyebrow">Email preview</span><h2>{preview.subject}</h2><p>For {preview.email || 'your profile email'} · Preview links use your saved public address.</p></div><div className="recap-mode-buttons"><button type="button" aria-pressed={previewMode === 'html'} onClick={() => setPreviewMode('html')}>Email design</button><button type="button" aria-pressed={previewMode === 'text'} onClick={() => setPreviewMode('text')}>Plain text</button></div></div>{previewMode === 'html' ? <iframe title="Monthly recap email preview" sandbox="" referrerPolicy="no-referrer" srcDoc={preview.body_html} /> : <pre className="recap-plain-preview">{preview.body_text}</pre>}</section>}
-        <section className="admin-panel recap-panel"><div className="recap-section-heading"><div><span className="recap-eyebrow">From queue to inbox</span><h2>Delivery history</h2><p>Server acceptance is recorded here. Inbox placement depends on your mail provider.</p></div><button type="button" className="ghost-button" disabled={!!busy} onClick={() => { setError(''); setRevision((value) => value + 1) }}>Refresh history</button></div>
-          {data.deliveries.length ? <><div className="recap-history-scroll"><table className="recap-history"><thead><tr><th scope="col">Recipient</th><th scope="col">Report</th><th scope="col">Delivery</th><th scope="col">Updated</th></tr></thead><tbody>{data.deliveries.map((delivery) => <tr key={delivery.id}><td><strong>{delivery.username || 'Removed account'}</strong><small>{delivery.email}</small></td><td>{monthLabel(delivery.month)}<small>{delivery.kind === 'test' ? 'Test email' : delivery.kind === 'on_demand' ? 'Requested by user' : 'Scheduled recap'}</small></td><td><span className={`recap-pill ${delivery.state === 'sent' ? 'is-enabled' : ['failed', 'unknown'].includes(delivery.state) ? 'is-attention' : ''}`}>{stateLabels[delivery.state] || delivery.state}</span><small>{delivery.attempts} {delivery.attempts === 1 ? 'attempt' : 'attempts'} · {delivery.detail || 'Waiting for the next worker check.'}</small>{delivery.state === 'retry' && <small>Next attempt {dateLabel(delivery.next_attempt_at)}</small>}{delivery.state === 'unknown' && <small>Automatic retries are stopped to avoid a duplicate email.</small>}</td><td>{dateLabel(delivery.updated_at)}</td></tr>)}</tbody></table></div><div className="recap-pagination"><span>{offset + 1}–{Math.min(offset + 50, data.total)} of {data.total}</span><div className="recap-actions"><button className="ghost-button" type="button" disabled={!offset} onClick={() => setOffset(Math.max(0, offset - 50))}>Previous</button><button className="ghost-button" type="button" disabled={offset + 50 >= data.total} onClick={() => setOffset(offset + 50)}>Next</button></div></div></> : <div className="recap-empty"><span aria-hidden="true">✉</span><h3>Your first recap starts here</h3><p>Preview your email, send yourself a test, then start the monthly schedule. Delivery results will appear here.</p></div>}
-        </section>
-      </>}
-    </div>
-  </AdminShell>
+  return (
+    <AdminShell
+      title="Monthly email recaps"
+      subtitle="Give each user a personal look back at their month in viewing."
+      actions={
+        <a className="ghost-button" href="/admin/notifications">
+          Email settings ↗
+        </a>
+      }
+    >
+      <div className="recap-admin">
+        {error && (
+          <p className="error-banner" role="alert">
+            {error}
+          </p>
+        )}
+        {notice && (
+          <p className="status-banner" role="status">
+            {notice}
+          </p>
+        )}
+        {!data && !error && <p role="status">Loading email recaps…</p>}
+        {!data && error && (
+          <button
+            className="ghost-button"
+            type="button"
+            onClick={() => {
+              setError("");
+              setRevision((value) => value + 1);
+            }}
+          >
+            Try again
+          </button>
+        )}
+        {data && (
+          <>
+            <div className="recap-overview-strip">
+              <div>
+                <span className={`recap-pill ${data.settings.enabled ? "is-enabled" : ""}`}>
+                  {data.settings.enabled ? "Schedule running" : "Schedule paused"}
+                </span>
+                <p>
+                  {data.settings.enabled
+                    ? `Next send ${dateLabel(data.settings.next_send_at)}`
+                    : "Start the schedule when you’re ready for monthly delivery."}
+                </p>
+              </div>
+              <div className="recap-subscriber-count">
+                <strong>{data.subscribers}</strong>
+                <span>confirmed {data.subscribers === 1 ? "subscriber" : "subscribers"}</span>
+              </div>
+            </div>
+            <div className="recap-admin-grid">
+              <section className="admin-panel recap-panel">
+                <div className="recap-section-heading">
+                  <div>
+                    <span className="recap-eyebrow">Set the rhythm</span>
+                    <h2>Monthly schedule</h2>
+                  </div>
+                </div>
+                <p>
+                  Send the previous month’s report to users who have opted in and confirmed their email. All report
+                  periods and send times use UTC.
+                </p>
+                <form className="recap-schedule-form" onSubmit={save}>
+                  <label htmlFor="recap-public-url">
+                    Public Magent address
+                    <input id="recap-public-url" type="url" value={settings.public_url} readOnly />
+                    <small>
+                      Inherited from <Link href="/admin/general">Hosting &amp; proxy</Link>. Email links update when
+                      that address changes.
+                    </small>
+                  </label>
+                  <div className="recap-schedule-fields">
+                    <label htmlFor="recap-day">
+                      Day of the month
+                      <select
+                        id="recap-day"
+                        value={settings.day}
+                        onChange={(event) => setSettings({ ...settings, day: Number(event.target.value) })}
+                        disabled={!!busy}
+                      >
+                        {Array.from({ length: 28 }, (_, index) => (
+                          <option key={index + 1} value={index + 1}>
+                            {index + 1}
+                          </option>
+                        ))}
+                      </select>
+                    </label>
+                    <label htmlFor="recap-hour">
+                      Send time (UTC)
+                      <select
+                        id="recap-hour"
+                        value={settings.hour}
+                        onChange={(event) => setSettings({ ...settings, hour: Number(event.target.value) })}
+                        disabled={!!busy}
+                      >
+                        {Array.from({ length: 24 }, (_, hour) => (
+                          <option key={hour} value={hour}>
+                            {String(hour).padStart(2, "0")}:00 UTC
+                          </option>
+                        ))}
+                      </select>
+                    </label>
+                  </div>
+                  <label className="recap-checkbox">
+                    <input
+                      type="checkbox"
+                      checked={settings.enabled}
+                      disabled={!!busy}
+                      onChange={(event) => setSettings({ ...settings, enabled: event.target.checked })}
+                    />
+                    <span>Enable scheduled monthly recaps</span>
+                  </label>
+                  <p className="recap-muted">
+                    Starting or changing the schedule begins at its next future send time. Pausing cancels queued
+                    monthly emails.
+                  </p>
+                  <button className="account-primary" type="submit" disabled={!!busy || !dirty}>
+                    {busy === "save" ? "Saving…" : "Save schedule"}
+                  </button>
+                </form>
+                {!data.ready && (
+                  <p className="recap-setup-note">
+                    {data.detail} <a href="/admin/notifications">Review email settings ↗</a>
+                  </p>
+                )}
+              </section>
+              <section className="admin-panel recap-panel">
+                <span className="recap-eyebrow">Make it yours</span>
+                <h2>Preview your recap</h2>
+                <p>
+                  See your own viewing highlights in the email design. A test goes only to your confirmed profile email.
+                </p>
+                <label className="recap-month-label" htmlFor="recap-month">
+                  Report month
+                  <select
+                    id="recap-month"
+                    value={month}
+                    disabled={!!busy}
+                    onChange={(event) => {
+                      setMonth(event.target.value);
+                      setPreview(null);
+                      testRequest.current = null;
+                    }}
+                  >
+                    {data.months.map((value) => (
+                      <option key={value} value={value}>
+                        {monthLabel(value)}
+                      </option>
+                    ))}
+                  </select>
+                </label>
+                <div className="recap-actions">
+                  <button
+                    type="button"
+                    className="account-primary"
+                    onClick={() => void loadPreview()}
+                    disabled={!!busy || dirty || !month}
+                  >
+                    {busy === "preview" ? "Preparing preview…" : "Preview my recap"}
+                  </button>
+                  <button
+                    type="button"
+                    className="account-secondary"
+                    onClick={() => void sendTest()}
+                    disabled={!!busy || dirty || !preview || !data.ready}
+                  >
+                    {busy === "test" ? "Queuing test…" : "Send test to me"}
+                  </button>
+                </div>
+                {dirty && <p className="recap-muted">Save your settings before previewing or sending a test.</p>}
+                <div className="recap-preview-guidance">
+                  <h3>One email. Your month.</h3>
+                  <ul>
+                    <li>Minutes, movies, episodes and requests</li>
+                    <li>Changes from the previous month</li>
+                    <li>Most watched titles and your longest run</li>
+                    <li>A link to the full report and easy unsubscribe</li>
+                  </ul>
+                  <a href="/profile#monthly-recaps">Confirm your email in Profile ↗</a>
+                </div>
+              </section>
+            </div>
+            {preview && (
+              <section className="admin-panel recap-panel recap-preview">
+                <div className="recap-section-heading">
+                  <div>
+                    <span className="recap-eyebrow">Email preview</span>
+                    <h2>{preview.subject}</h2>
+                    <p>For {preview.email || "your profile email"} · Preview links use your saved public address.</p>
+                  </div>
+                  <div className="recap-mode-buttons">
+                    <button type="button" aria-pressed={previewMode === "html"} onClick={() => setPreviewMode("html")}>
+                      Email design
+                    </button>
+                    <button type="button" aria-pressed={previewMode === "text"} onClick={() => setPreviewMode("text")}>
+                      Plain text
+                    </button>
+                  </div>
+                </div>
+                {previewMode === "html" ? (
+                  <iframe
+                    title="Monthly recap email preview"
+                    sandbox=""
+                    referrerPolicy="no-referrer"
+                    srcDoc={preview.body_html}
+                  />
+                ) : (
+                  <pre className="recap-plain-preview">{preview.body_text}</pre>
+                )}
+              </section>
+            )}
+            <section className="admin-panel recap-panel">
+              <div className="recap-section-heading">
+                <div>
+                  <span className="recap-eyebrow">From queue to inbox</span>
+                  <h2>Delivery history</h2>
+                  <p>Server acceptance is recorded here. Inbox placement depends on your mail provider.</p>
+                </div>
+                <button
+                  type="button"
+                  className="ghost-button"
+                  disabled={!!busy}
+                  onClick={() => {
+                    setError("");
+                    setRevision((value) => value + 1);
+                  }}
+                >
+                  Refresh history
+                </button>
+              </div>
+              {data.deliveries.length ? (
+                <>
+                  <div className="recap-history-scroll">
+                    <table className="recap-history">
+                      <thead>
+                        <tr>
+                          <th scope="col">Recipient</th>
+                          <th scope="col">Report</th>
+                          <th scope="col">Delivery</th>
+                          <th scope="col">Updated</th>
+                        </tr>
+                      </thead>
+                      <tbody>
+                        {data.deliveries.map((delivery) => (
+                          <tr key={delivery.id}>
+                            <td>
+                              <strong>{delivery.username || "Removed account"}</strong>
+                              <small>{delivery.email}</small>
+                            </td>
+                            <td>
+                              {monthLabel(delivery.month)}
+                              <small>
+                                {delivery.kind === "test"
+                                  ? "Test email"
+                                  : delivery.kind === "on_demand"
+                                    ? "Requested by user"
+                                    : "Scheduled recap"}
+                              </small>
+                            </td>
+                            <td>
+                              <span
+                                className={`recap-pill ${delivery.state === "sent" ? "is-enabled" : ["failed", "unknown"].includes(delivery.state) ? "is-attention" : ""}`}
+                              >
+                                {stateLabels[delivery.state] || delivery.state}
+                              </span>
+                              <small>
+                                {delivery.attempts} {delivery.attempts === 1 ? "attempt" : "attempts"} ·{" "}
+                                {delivery.detail || "Waiting for the next worker check."}
+                              </small>
+                              {delivery.state === "retry" && (
+                                <small>Next attempt {dateLabel(delivery.next_attempt_at)}</small>
+                              )}
+                              {delivery.state === "unknown" && (
+                                <small>Automatic retries are stopped to avoid a duplicate email.</small>
+                              )}
+                            </td>
+                            <td>{dateLabel(delivery.updated_at)}</td>
+                          </tr>
+                        ))}
+                      </tbody>
+                    </table>
+                  </div>
+                  <div className="recap-pagination">
+                    <span>
+                      {offset + 1}–{Math.min(offset + 50, data.total)} of {data.total}
+                    </span>
+                    <div className="recap-actions">
+                      <button
+                        className="ghost-button"
+                        type="button"
+                        disabled={!offset}
+                        onClick={() => setOffset(Math.max(0, offset - 50))}
+                      >
+                        Previous
+                      </button>
+                      <button
+                        className="ghost-button"
+                        type="button"
+                        disabled={offset + 50 >= data.total}
+                        onClick={() => setOffset(offset + 50)}
+                      >
+                        Next
+                      </button>
+                    </div>
+                  </div>
+                </>
+              ) : (
+                <div className="recap-empty">
+                  <span aria-hidden="true">✉</span>
+                  <h3>Your first recap starts here</h3>
+                  <p>
+                    Preview your email, send yourself a test, then start the monthly schedule. Delivery results will
+                    appear here.
+                  </p>
+                </div>
+              )}
+            </section>
+          </>
+        )}
+      </div>
+    </AdminShell>
+  );
 }

frontend/app/admin/requests-all/page.tsx

@@ -1,115 +1,111 @@
-'use client'
+"use client";
 
-import { useEffect, useMemo, useState } from 'react'
-import { useRouter } from 'next/navigation'
-import { authFetch, clearToken, getApiBase, getToken } from '../../lib/auth'
-import AdminShell from '../../ui/AdminShell'
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { useRouter } from "next/navigation";
+import { authFetch, clearToken, getApiBase, getToken } from "../../lib/auth";
+import AdminShell from "../../ui/AdminShell";
 
 type RequestRow = {
-  id: number
-  title?: string | null
-  year?: number | null
-  type?: string | null
-  statusLabel?: string | null
-  requestedBy?: string | null
-  createdAt?: string | null
-}
+  id: number;
+  title?: string | null;
+  year?: number | null;
+  type?: string | null;
+  statusLabel?: string | null;
+  requestedBy?: string | null;
+  createdAt?: string | null;
+};
 
 const REQUEST_STAGE_OPTIONS = [
-  { value: 'all', label: 'All stages' },
-  { value: 'pending', label: 'Waiting for approval' },
-  { value: 'approved', label: 'Approved' },
-  { value: 'in_progress', label: 'In progress' },
-  { value: 'working', label: 'Working on it' },
-  { value: 'partial', label: 'Partially ready' },
-  { value: 'ready', label: 'Ready to watch' },
-  { value: 'declined', label: 'Declined' },
-]
+  { value: "all", label: "All stages" },
+  { value: "pending", label: "Waiting for approval" },
+  { value: "approved", label: "Approved" },
+  { value: "in_progress", label: "In progress" },
+  { value: "working", label: "Working on it" },
+  { value: "partial", label: "Partially ready" },
+  { value: "ready", label: "Ready to watch" },
+  { value: "declined", label: "Declined" },
+];
 
 const formatDateTime = (value?: string | null) => {
-  if (!value) return 'Unknown'
-  const date = new Date(value)
-  if (Number.isNaN(date.valueOf())) return value
-  return date.toLocaleString()
-}
+  if (!value) return "Unknown";
+  const date = new Date(value);
+  if (Number.isNaN(date.valueOf())) return value;
+  return date.toLocaleString();
+};
 
 export default function AdminRequestsAllPage() {
-  const router = useRouter()
-  const [rows, setRows] = useState<RequestRow[]>([])
-  const [total, setTotal] = useState(0)
-  const [loading, setLoading] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const [pageSize, setPageSize] = useState(50)
-  const [page, setPage] = useState(1)
-  const [stage, setStage] = useState('all')
+  const router = useRouter();
+  const [rows, setRows] = useState<RequestRow[]>([]);
+  const [total, setTotal] = useState(0);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pageSize, setPageSize] = useState(50);
+  const [page, setPage] = useState(1);
+  const [stage, setStage] = useState("all");
 
   const pageCount = useMemo(() => {
-    if (!total || pageSize <= 0) return 1
-    return Math.max(1, Math.ceil(total / pageSize))
-  }, [total, pageSize])
+    if (!total || pageSize <= 0) return 1;
+    return Math.max(1, Math.ceil(total / pageSize));
+  }, [total, pageSize]);
 
-  const load = async () => {
+  const load = useCallback(async () => {
     if (!getToken()) {
-      router.push('/login')
-      return
+      router.push("/login");
+      return;
     }
-    setLoading(true)
-    setError(null)
+    setLoading(true);
+    setError(null);
     try {
-      const baseUrl = getApiBase()
-      const skip = (page - 1) * pageSize
+      const baseUrl = getApiBase();
+      const skip = (page - 1) * pageSize;
       const params = new URLSearchParams({
         take: String(pageSize),
         skip: String(skip),
-      })
-      if (stage !== 'all') {
-        params.set('stage', stage)
+      });
+      if (stage !== "all") {
+        params.set("stage", stage);
       }
-      const response = await authFetch(
-        `${baseUrl}/admin/requests/all?${params.toString()}`
-      )
+      const response = await authFetch(`${baseUrl}/admin/requests/all?${params.toString()}`);
       if (!response.ok) {
         if (response.status === 401) {
-          clearToken()
-          router.push('/login')
-          return
+          clearToken();
+          router.push("/login");
+          return;
         }
         if (response.status === 403) {
-          router.push('/')
-          return
+          router.push("/");
+          return;
         }
-        throw new Error(`Load failed: ${response.status}`)
+        throw new Error(`Load failed: ${response.status}`);
       }
-      const data = await response.json()
-      setRows(Array.isArray(data?.results) ? data.results : [])
-      setTotal(Number(data?.total ?? 0))
+      const data = await response.json();
+      setRows(Array.isArray(data?.results) ? data.results : []);
+      setTotal(Number(data?.total ?? 0));
     } catch (err) {
-      console.error(err)
-      setError('Unable to load requests.')
+      console.error(err);
+      setError("Unable to load requests.");
     } finally {
-      setLoading(false)
+      setLoading(false);
     }
-  }
+  }, [page, pageSize, router, stage]);
 
   useEffect(() => {
-    void load()
-  }, [page, pageSize, stage])
+    void load();
+  }, [load]);
 
   useEffect(() => {
     if (page > pageCount) {
-      setPage(pageCount)
+      setPage(pageCount);
     }
-  }, [pageCount, page])
+  }, [pageCount, page]);
 
   useEffect(() => {
-    setPage(1)
-  }, [stage])
+    void stage;
+    setPage(1);
+  }, [stage]);
 
   return (
-    <AdminShell
-      title="All requests"
-      subtitle="Paginated view of every cached request."
-    >
+    <AdminShell title="All requests" subtitle="Paginated view of every cached request.">
       <section className="admin-section">
         <div className="admin-toolbar">
           <div className="admin-toolbar-info">
@@ -160,10 +156,10 @@ export default function AdminRequestsAllPage() {
               >
                 <span>
                   {row.title || `Request #${row.id}`}
-                  {row.year ? ` (${row.year})` : ''}
+                  {row.year ? ` (${row.year})` : ""}
                 </span>
-                <span>{row.statusLabel || 'Unknown'}</span>
-                <span>{row.requestedBy || 'Unknown'}</span>
+                <span>{row.statusLabel || "Unknown"}</span>
+                <span>{row.requestedBy || "Unknown"}</span>
                 <span>{formatDateTime(row.createdAt)}</span>
               </button>
             ))}
@@ -179,22 +175,14 @@ export default function AdminRequestsAllPage() {
           <span>
             Page {page} of {pageCount}
           </span>
-          <button
-            type="button"
-            onClick={() => setPage(page + 1)}
-            disabled={page >= pageCount}
-          >
+          <button type="button" onClick={() => setPage(page + 1)} disabled={page >= pageCount}>
             Next
           </button>
-          <button
-            type="button"
-            onClick={() => setPage(pageCount)}
-            disabled={page >= pageCount}
-          >
+          <button type="button" onClick={() => setPage(pageCount)} disabled={page >= pageCount}>
             Last
           </button>
         </div>
       </section>
     </AdminShell>
-  )
+  );
 }

frontend/app/admin/system/page.tsx

@@ -1,106 +1,106 @@
-'use client'
+"use client";
 
-import { useEffect, useState } from 'react'
-import { useRouter } from 'next/navigation'
-import AdminShell from '../../ui/AdminShell'
-import { authFetch, clearToken, getApiBase, getToken } from '../../lib/auth'
+import { useEffect, useState } from "react";
+import { useRouter } from "next/navigation";
+import AdminShell from "../../ui/AdminShell";
+import { authFetch, clearToken, getApiBase, getToken } from "../../lib/auth";
 
 type FlowStage = {
-  title: string
-  input: string
-  action: string
-  output: string
-}
+  title: string;
+  input: string;
+  action: string;
+  output: string;
+};
 
 const REQUEST_FLOW: FlowStage[] = [
   {
-    title: 'Identity + access',
-    input: 'Jellyfin/local login',
-    action: 'Magent validates credentials and role',
-    output: 'JWT token + user scope',
+    title: "Identity + access",
+    input: "Jellyfin/local login",
+    action: "Magent validates credentials and role",
+    output: "JWT token + user scope",
   },
   {
-    title: 'Request intake',
-    input: 'Seerr request ID',
-    action: 'Magent snapshots request + media metadata',
-    output: 'Unified request state',
+    title: "Request intake",
+    input: "Seerr request ID",
+    action: "Magent snapshots request + media metadata",
+    output: "Unified request state",
   },
   {
-    title: 'Queue orchestration',
-    input: 'Approved request',
-    action: 'Sonarr/Radarr add/search operations',
-    output: 'Grab decision',
+    title: "Queue orchestration",
+    input: "Approved request",
+    action: "Sonarr/Radarr add/search operations",
+    output: "Grab decision",
   },
   {
-    title: 'Download execution',
-    input: 'Selected release',
-    action: 'qBittorrent downloads + reports progress',
-    output: 'Import-ready payload',
+    title: "Download execution",
+    input: "Selected release",
+    action: "qBittorrent downloads + reports progress",
+    output: "Import-ready payload",
   },
   {
-    title: 'Library import',
-    input: 'Completed download',
-    action: 'Sonarr/Radarr import and finalize',
-    output: 'Available media object',
+    title: "Library import",
+    input: "Completed download",
+    action: "Sonarr/Radarr import and finalize",
+    output: "Available media object",
   },
   {
-    title: 'Playback availability',
-    input: 'Imported media',
-    action: 'Jellyfin refresh + link resolution',
-    output: 'Ready-to-watch state',
+    title: "Playback availability",
+    input: "Imported media",
+    action: "Jellyfin refresh + link resolution",
+    output: "Ready-to-watch state",
   },
-]
+];
 
 export default function AdminSystemGuidePage() {
-  const router = useRouter()
-  const [loading, setLoading] = useState(true)
-  const [authorized, setAuthorized] = useState(false)
+  const router = useRouter();
+  const [loading, setLoading] = useState(true);
+  const [authorized, setAuthorized] = useState(false);
 
   useEffect(() => {
-    let active = true
+    let active = true;
     const load = async () => {
       if (!getToken()) {
-        router.push('/login')
-        return
+        router.push("/login");
+        return;
       }
       try {
-        const baseUrl = getApiBase()
-        const response = await authFetch(`${baseUrl}/auth/me`)
+        const baseUrl = getApiBase();
+        const response = await authFetch(`${baseUrl}/auth/me`);
         if (!response.ok) {
           if (response.status === 401) {
-            clearToken()
-            router.push('/login')
-            return
+            clearToken();
+            router.push("/login");
+            return;
           }
-          router.push('/')
-          return
+          router.push("/");
+          return;
         }
-        const me = await response.json()
-        if (!active) return
-        if (me?.role !== 'admin') {
-          router.push('/')
-          return
+        const me = await response.json();
+        if (!active) return;
+        if (me?.role !== "admin") {
+          router.push("/");
+          return;
         }
-        setAuthorized(true)
+        setAuthorized(true);
       } catch (error) {
-        console.error(error)
-        router.push('/')
+        console.error(error);
+        router.push("/");
       } finally {
-        if (active) setLoading(false)
+        if (active) setLoading(false);
       }
-    }
-    void load()
+    };
+    void load();
     return () => {
-      active = false
-    }
-  }, [router])
+      active = false;
+    };
+  }, [router]);
 
   if (loading) {
-    return <main className="card">Loading system guide...</main>
+    return <main className="card">Loading system guide...</main>;
   }
 
   if (!authorized) {
-    return null
+    return null;
   }
 
   const rail = (
@@ -112,26 +112,23 @@ export default function AdminSystemGuidePage() {
         <span className="small-pill">Admin only</span>
       </div>
     </div>
-  )
+  );
 
   return (
-    <AdminShell
-      title="System guide"
-      subtitle="Service connections, controls, and recovery paths."
-      rail={rail}
-    >
+    <AdminShell title="System guide" subtitle="Service connections, controls, and recovery paths." rail={rail}>
       <section className="admin-section system-guide">
         <div className="admin-panel">
           <h2>End-to-end system flow</h2>
           <p className="lede">
-            This is the runtime path the platform follows from authentication through to playback
-            availability.
+            This is the runtime path the platform follows from authentication through to playback availability.
           </p>
           <div className="system-flow-track">
             {REQUEST_FLOW.map((stage, index) => (
               <div key={stage.title} className="system-flow-segment">
                 <article className="system-flow-card">
-                  <div className="system-flow-card-title">{index + 1}. {stage.title}</div>
+                  <div className="system-flow-card-title">
+                    {index + 1}. {stage.title}
+                  </div>
                   <div className="system-flow-card-row">
                     <span>Input</span>
                     <strong>{stage.input}</strong>
@@ -145,7 +142,11 @@ export default function AdminSystemGuidePage() {
                     <strong>{stage.output}</strong>
                   </div>
                 </article>
-                {index < REQUEST_FLOW.length - 1 && <div className="system-flow-arrow" aria-hidden="true">→</div>}
+                {index < REQUEST_FLOW.length - 1 && (
+                  <div className="system-flow-arrow" aria-hidden="true">
+                    →
+                  </div>
+                )}
               </div>
             ))}
           </div>
@@ -157,30 +158,23 @@ export default function AdminSystemGuidePage() {
             <article className="system-guide-card">
               <h3>Magent</h3>
               <p>
-                Handles authentication, request pages, live event updates, invite workflows,
-                diagnostics, notifications, and admin operations.
+                Handles authentication, request pages, live event updates, invite workflows, diagnostics, notifications,
+                and admin operations.
               </p>
             </article>
             <article className="system-guide-card">
               <h3>Seerr</h3>
               <p>
-                Stores the request itself and remains the request-state source for approval and
-                media request metadata.
+                Stores the request itself and remains the request-state source for approval and media request metadata.
               </p>
             </article>
             <article className="system-guide-card">
               <h3>Jellyfin</h3>
-              <p>
-                Provides user sign-in identity and the final playback destination once content is
-                available.
-              </p>
+              <p>Provides user sign-in identity and the final playback destination once content is available.</p>
             </article>
             <article className="system-guide-card">
               <h3>Sonarr / Radarr</h3>
-              <p>
-                Control queue placement, quality-profile decisions, import handling, and release
-                monitoring.
-              </p>
+              <p>Control queue placement, quality-profile decisions, import handling, and release monitoring.</p>
             </article>
             <article className="system-guide-card">
               <h3>Prowlarr</h3>
@@ -188,10 +182,7 @@ export default function AdminSystemGuidePage() {
             </article>
             <article className="system-guide-card">
               <h3>qBittorrent</h3>
-              <p>
-                Executes the download and exposes live progress, paused states, and queue
-                visibility.
-              </p>
+              <p>Executes the download and exposes live progress, paused states, and queue visibility.</p>
             </article>
           </div>
         </div>
@@ -213,10 +204,7 @@ export default function AdminSystemGuidePage() {
             </article>
             <article className="system-guide-card">
               <h3>Invite management</h3>
-              <p>
-                Master template, profile assignment, invite access policy, invite emails, and trace
-                map lineage.
-              </p>
+              <p>Master template, profile assignment, invite access policy, invite emails, and trace map lineage.</p>
             </article>
             <article className="system-guide-card">
               <h3>Requests + cache</h3>
@@ -225,8 +213,8 @@ export default function AdminSystemGuidePage() {
             <article className="system-guide-card">
               <h3>Maintenance + diagnostics</h3>
               <p>
-                Connectivity checks, live diagnostics, database repair, cleanup, log review, and
-                nuclear flush/resync operations.
+                Connectivity checks, live diagnostics, database repair, cleanup, log review, and nuclear flush/resync
+                operations.
               </p>
             </article>
           </div>
@@ -235,23 +223,11 @@ export default function AdminSystemGuidePage() {
         <div className="admin-panel">
           <h2>User and invite model</h2>
           <ol className="system-decision-list">
-            <li>
-              Jellyfin is used for sign-in identity and user presence across the platform.
-            </li>
-            <li>
-              Seerr provides request ownership and request-state data for Magent request pages.
-            </li>
-            <li>
-              Invite links, invite profiles, blanket rules, and invite-access controls are managed
-              inside Magent.
-            </li>
-            <li>
-              If invite tracing is enabled, the lineage view shows who invited whom and how the
-              chain branches.
-            </li>
-            <li>
-              Cross-system removal and ban flows are initiated from Magent admin controls.
-            </li>
+            <li>Jellyfin is used for sign-in identity and user presence across the platform.</li>
+            <li>Seerr provides request ownership and request-state data for Magent request pages.</li>
+            <li>Invite links, invite profiles, blanket rules, and invite-access controls are managed inside Magent.</li>
+            <li>If invite tracing is enabled, the lineage view shows who invited whom and how the chain branches.</li>
+            <li>Cross-system removal and ban flows are initiated from Magent admin controls.</li>
           </ol>
         </div>
 
@@ -265,7 +241,8 @@ export default function AdminSystemGuidePage() {
               In queue but no release found <span>→</span> run <strong>Search releases</strong> and inspect options.
             </li>
             <li>
-              Release exists and user should not pick manually <span>→</span> run <strong>Search + auto-download</strong>.
+              Release exists and user should not pick manually <span>→</span> run{" "}
+              <strong>Search + auto-download</strong>.
             </li>
             <li>
               Download paused/stalled in qBittorrent <span>→</span> run <strong>Resume download</strong>.
@@ -295,5 +272,5 @@ export default function AdminSystemGuidePage() {
         </div>
       </section>
     </AdminShell>
-  )
+  );
 }

frontend/app/changelog/page.tsx

@@ -1,95 +1,95 @@
-'use client'
+"use client";
 
-import PageHeading from '../ui/PageHeading'
+import PageHeading from "../ui/PageHeading";
 
-import { useEffect, useMemo, useState } from 'react'
-import { useRouter } from 'next/navigation'
-import { authFetch, clearToken, getApiBase, getToken } from '../lib/auth'
+import { useEffect, useMemo, useState } from "react";
+import { useRouter } from "next/navigation";
+import { authFetch, clearToken, getApiBase, getToken } from "../lib/auth";
 
 type SiteInfo = {
-  changelog?: string
-}
+  changelog?: string;
+};
 
 type ChangelogGroup = {
-  date: string
-  entries: string[]
-}
+  date: string;
+  entries: string[];
+};
 
-const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/
+const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
 
 const parseChangelog = (raw: string): ChangelogGroup[] => {
-  const groups: ChangelogGroup[] = []
-  for (const rawLine of raw.split('\n')) {
-    const line = rawLine.trim()
-    if (!line) continue
-    const [candidateDate, ...messageParts] = line.split('|')
+  const groups: ChangelogGroup[] = [];
+  for (const rawLine of raw.split("\n")) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    const [candidateDate, ...messageParts] = line.split("|");
     if (DATE_PATTERN.test(candidateDate) && messageParts.length > 0) {
-      const message = messageParts.join('|').trim()
-      if (!message) continue
-      const currentGroup = groups[groups.length - 1]
+      const message = messageParts.join("|").trim();
+      if (!message) continue;
+      const currentGroup = groups[groups.length - 1];
       if (currentGroup?.date === candidateDate) {
-        currentGroup.entries.push(message)
+        currentGroup.entries.push(message);
       } else {
-        groups.push({ date: candidateDate, entries: [message] })
+        groups.push({ date: candidateDate, entries: [message] });
       }
-      continue
+      continue;
     }
     if (groups.length === 0) {
-      groups.push({ date: 'Updates', entries: [line] })
+      groups.push({ date: "Updates", entries: [line] });
     } else {
-      groups[groups.length - 1].entries.push(line)
+      groups[groups.length - 1].entries.push(line);
     }
   }
-  return groups
-}
+  return groups;
+};
 
 export default function ChangelogPage() {
-  const router = useRouter()
-  const [groups, setGroups] = useState<ChangelogGroup[]>([])
-  const [loading, setLoading] = useState(true)
+  const router = useRouter();
+  const [groups, setGroups] = useState<ChangelogGroup[]>([]);
+  const [loading, setLoading] = useState(true);
 
   useEffect(() => {
-    const token = getToken()
+    const token = getToken();
     if (!token) {
-      router.push('/login')
-      return
+      router.push("/login");
+      return;
     }
-    let active = true
+    let active = true;
     const load = async () => {
       try {
-        const baseUrl = getApiBase()
-        const response = await authFetch(`${baseUrl}/site/info`)
+        const baseUrl = getApiBase();
+        const response = await authFetch(`${baseUrl}/site/info`);
         if (!response.ok) {
           if (response.status === 401) {
-            clearToken()
-            router.push('/login')
-            return
+            clearToken();
+            router.push("/login");
+            return;
           }
-          throw new Error('Failed to load changelog')
+          throw new Error("Failed to load changelog");
         }
-        const data: SiteInfo = await response.json()
-        if (!active) return
-        setGroups(parseChangelog(data?.changelog ?? ''))
+        const data: SiteInfo = await response.json();
+        if (!active) return;
+        setGroups(parseChangelog(data?.changelog ?? ""));
       } catch (err) {
-        console.error(err)
-        if (!active) return
-        setGroups([])
+        console.error(err);
+        if (!active) return;
+        setGroups([]);
       } finally {
-        if (active) setLoading(false)
+        if (active) setLoading(false);
       }
-    }
-    void load()
+    };
+    void load();
     return () => {
-      active = false
-    }
-  }, [router])
+      active = false;
+    };
+  }, [router]);
 
   const content = useMemo(() => {
     if (loading) {
-      return <div className="loading-text">Loading changelog...</div>
+      return <div className="loading-text">Loading changelog...</div>;
     }
     if (groups.length === 0) {
-      return <div className="meta">No updates posted yet.</div>
+      return <div className="meta">No updates posted yet.</div>;
     }
     return (
       <div className="changelog-groups">
@@ -104,13 +104,13 @@ export default function ChangelogPage() {
           </section>
         ))}
       </div>
-    )
-  }, [groups, loading])
+    );
+  }, [groups, loading]);
 
   return (
     <main className="card changelog-page">
       <PageHeading title="Changelog" description="What’s new and improved in Magent." />
       {content}
     </main>
-  )
+  );
 }

frontend/app/coming-soon/page.tsx

@@ -1,17 +1,34 @@
-import './style.css'
+import "./style.css";
 
-export const metadata = { title: 'Coming soon | Magent — Grizzlyflix' }
+export const metadata = { title: "Coming soon | Magent — Grizzlyflix" };
 
 export default function ComingSoonPage() {
-  return <main className="launch-cover">
-    <div className="launch-brand">GRIZZLYFLIX</div>
-    <span className="launch-badge">COMING SOON</span>
-    <h1>Your next watch.<br /><em>Made simpler.</em></h1>
-    <p className="launch-intro">The new Magent is on its way. Easier requests, clearer updates and a simpler way to get things fixed.</p>
-    <div className="launch-path" aria-label="Request journey">
-      {['Request', 'Track', 'Watch'].map((label, index) => <div key={label}><span>0{index + 1}</span><strong>{label}</strong></div>)}
-    </div>
-    <p className="launch-note">We’re getting everything ready. Check back soon.</p>
-    <footer><strong>Magent</strong><span>Grizzlyflix member portal</span><a href="/login">Admin sign in</a></footer>
-  </main>
+  return (
+    <main className="launch-cover">
+      <div className="launch-brand">GRIZZLYFLIX</div>
+      <span className="launch-badge">COMING SOON</span>
+      <h1>
+        Your next watch.
+        <br />
+        <em>Made simpler.</em>
+      </h1>
+      <p className="launch-intro">
+        The new Magent is on its way. Easier requests, clearer updates and a simpler way to get things fixed.
+      </p>
+      <ol className="launch-path" aria-label="Request journey">
+        {["Request", "Track", "Watch"].map((label, index) => (
+          <li key={label}>
+            <span>0{index + 1}</span>
+            <strong>{label}</strong>
+          </li>
+        ))}
+      </ol>
+      <p className="launch-note">We’re getting everything ready. Check back soon.</p>
+      <footer>
+        <strong>Magent</strong>
+        <span>Grizzlyflix member portal</span>
+        <a href="/login">Admin sign in</a>
+      </footer>
+    </main>
+  );
 }

frontend/app/coming-soon/style.css

@@ -5,9 +5,9 @@
 .launch-cover h1 { font-size: clamp(40px, 7vw, 88px); line-height: 1.08; letter-spacing: -.045em; margin: 28px 0 22px; }
 .launch-cover h1 em { color: #c7bdff; font-style: normal; }
 .launch-intro { max-width: 560px; font-size: 18px; line-height: 1.6; color: #bcb8c9; margin: 0; }
-.launch-path { display: grid; grid-template-columns: repeat(3, 1fr); width: min(580px, 100%); margin: 40px 0 24px; border: 1px solid #ffffff20; border-radius: 16px; background: #ffffff04; }
-.launch-path > div { padding: 22px 12px; display: grid; gap: 8px; }
-.launch-path > div + div { border-left: 1px solid #ffffff15; }
+.launch-path { display: grid; grid-template-columns: repeat(3, 1fr); width: min(580px, 100%); margin: 40px 0 24px; padding: 0; list-style: none; border: 1px solid #ffffff20; border-radius: 16px; background: #ffffff04; }
+.launch-path > li { padding: 22px 12px; display: grid; gap: 8px; }
+.launch-path > li + li { border-left: 1px solid #ffffff15; }
 .launch-path span { color: #8be7f1; font-size: 12px; }
 .launch-path strong { font-size: 18px; }
 .launch-note { color: #a9a4b5; font-size: 14px; }

frontend/app/email-recaps/page.tsx

@@ -1,66 +1,145 @@
-'use client'
+"use client";
 
-import { useEffect, useState } from 'react'
-import { getApiBase } from '../lib/auth'
-import BrandingLogo from '../ui/BrandingLogo'
-import './recaps.css'
+import { useEffect, useState } from "react";
+import { getApiBase } from "../lib/auth";
+import BrandingLogo from "../ui/BrandingLogo";
+import "./recaps.css";
 
-type LinkAction = { action: 'confirm' | 'unsubscribe'; token: string }
+type LinkAction = { action: "confirm" | "unsubscribe"; token: string };
 
 export default function EmailRecapLinkPage() {
-  const [link, setLink] = useState<LinkAction | null>(null)
-  const [state, setState] = useState('loading')
-  const [error, setError] = useState('')
-  const [busy, setBusy] = useState(false)
+  const [link, setLink] = useState<LinkAction | null>(null);
+  const [state, setState] = useState("loading");
+  const [error, setError] = useState("");
+  const [busy, setBusy] = useState(false);
 
   useEffect(() => {
-    let controller: AbortController | null = null
+    let controller: AbortController | null = null;
     const checkLink = () => {
-      controller?.abort()
-      const abort = new AbortController()
-      controller = abort
-      setError(''); setState('loading'); setLink(null)
+      controller?.abort();
+      const abort = new AbortController();
+      controller = abort;
+      setError("");
+      setState("loading");
+      setLink(null);
       // Fragments stay out of web-server access logs and referrers. Opening the link only checks it.
-      const params = new URLSearchParams(window.location.hash.slice(1))
-      const action = params.get('action')
-      const token = params.get('token') || ''
-      if ((action !== 'confirm' && action !== 'unsubscribe') || !/^[A-Za-z0-9_-]{40,100}$/.test(token)) {
-        setError('This email link is incomplete. Open Profile to manage your monthly recaps.'); setState('error'); return
+      const params = new URLSearchParams(window.location.hash.slice(1));
+      const action = params.get("action");
+      const token = params.get("token") || "";
+      if ((action !== "confirm" && action !== "unsubscribe") || !/^[A-Za-z0-9_-]{40,100}$/.test(token)) {
+        setError("This email link is incomplete. Open Profile to manage your monthly recaps.");
+        setState("error");
+        return;
       }
-      const payload = { action, token } as LinkAction
-      setLink(payload)
-      void fetch(`${getApiBase()}/email-recaps/check`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload), signal: abort.signal, credentials: 'omit' }).then(async (response) => {
-        const result = await response.json().catch(() => ({}))
-        if (!response.ok) throw new Error(typeof result.detail === 'string' ? result.detail : 'Could not check this email link. Please open it again.')
-        if (!abort.signal.aborted) setState(result.state)
-      }).catch((err: Error) => { if (!abort.signal.aborted) { setError(err.message); setState('error') } })
-    }
-    checkLink()
-    window.addEventListener('hashchange', checkLink)
-    return () => { controller?.abort(); window.removeEventListener('hashchange', checkLink) }
-  }, [])
+      const payload = { action, token } as LinkAction;
+      setLink(payload);
+      void fetch(`${getApiBase()}/email-recaps/check`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+        signal: abort.signal,
+        credentials: "omit",
+      })
+        .then(async (response) => {
+          const result = await response.json().catch(() => ({}));
+          if (!response.ok)
+            throw new Error(
+              typeof result.detail === "string"
+                ? result.detail
+                : "Could not check this email link. Please open it again.",
+            );
+          if (!abort.signal.aborted) setState(result.state);
+        })
+        .catch((err: Error) => {
+          if (!abort.signal.aborted) {
+            setError(err.message);
+            setState("error");
+          }
+        });
+    };
+    checkLink();
+    window.addEventListener("hashchange", checkLink);
+    return () => {
+      controller?.abort();
+      window.removeEventListener("hashchange", checkLink);
+    };
+  }, []);
 
   const apply = async () => {
-    if (!link || busy) return
-    setBusy(true); setError('')
+    if (!link || busy) return;
+    setBusy(true);
+    setError("");
     try {
-      const response = await fetch(`${getApiBase()}/email-recaps/confirm`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(link), credentials: 'omit' })
-      const result = await response.json().catch(() => ({}))
-      if (!response.ok) throw new Error(typeof result.detail === 'string' ? result.detail : 'Could not update your preference. Please try again.')
-      setState(result.state)
-      window.history.replaceState(null, '', '/email-recaps')
-    } catch (err) { setError(err instanceof Error ? err.message : 'Could not update your preference.') }
-    finally { setBusy(false) }
-  }
+      const response = await fetch(`${getApiBase()}/email-recaps/confirm`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(link),
+        credentials: "omit",
+      });
+      const result = await response.json().catch(() => ({}));
+      if (!response.ok)
+        throw new Error(
+          typeof result.detail === "string" ? result.detail : "Could not update your preference. Please try again.",
+        );
+      setState(result.state);
+      window.history.replaceState(null, "", "/email-recaps");
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Could not update your preference.");
+    } finally {
+      setBusy(false);
+    }
+  };
 
-  const done = state === 'enabled' || state === 'off'
-  return <main className="recap-link-page"><a className="recap-brand" href="/login"><BrandingLogo className="brand-logo" /><span>Magent</span></a><section className="account-panel">
-    <span className="recap-eyebrow">Personal viewing reports</span>
-    <h1>{state === 'enabled' ? 'You’re on the list.' : state === 'off' ? 'Recaps are turned off.' : state === 'loading' ? 'Checking your email link' : state === 'error' ? 'This link needs another look' : link?.action === 'unsubscribe' ? 'Unsubscribe from recaps?' : 'Your month, delivered.'}</h1>
-    <p>{state === 'enabled' ? 'Your email is confirmed. You’ll receive your personal viewing recap when the monthly schedule runs.' : state === 'off' ? 'You won’t receive further monthly recaps. You can turn them back on in Profile.' : state === 'ready' && link?.action === 'unsubscribe' ? 'This turns off all personal viewing report emails. You can still explore all your reports in Magent.' : state === 'ready' ? 'Confirm to email yourself your minutes, movies, episodes, longest run and requests. Manage automatic monthly delivery separately in Profile.' : ''}</p>
-    {error && <p className="account-notice is-error" role="alert">{error}</p>}
-    {state === 'ready' && <button type="button" className="account-primary" disabled={busy} onClick={() => void apply()}>{busy ? 'Updating…' : link?.action === 'unsubscribe' ? 'Unsubscribe from recaps' : 'Confirm email recaps'}</button>}
-    {(done || state === 'error') && <a className="recap-text-link" href="/profile#monthly-recaps">Manage email preferences ↗</a>}
-    {state === 'loading' && <p role="status">One moment…</p>}
-  </section></main>
+  const done = state === "enabled" || state === "off";
+  return (
+    <main className="recap-link-page">
+      <a className="recap-brand" href="/login">
+        <BrandingLogo className="brand-logo" />
+        <span>Magent</span>
+      </a>
+      <section className="account-panel">
+        <span className="recap-eyebrow">Personal viewing reports</span>
+        <h1>
+          {state === "enabled"
+            ? "You’re on the list."
+            : state === "off"
+              ? "Recaps are turned off."
+              : state === "loading"
+                ? "Checking your email link"
+                : state === "error"
+                  ? "This link needs another look"
+                  : link?.action === "unsubscribe"
+                    ? "Unsubscribe from recaps?"
+                    : "Your month, delivered."}
+        </h1>
+        <p>
+          {state === "enabled"
+            ? "Your email is confirmed. You’ll receive your personal viewing recap when the monthly schedule runs."
+            : state === "off"
+              ? "You won’t receive further monthly recaps. You can turn them back on in Profile."
+              : state === "ready" && link?.action === "unsubscribe"
+                ? "This turns off all personal viewing report emails. You can still explore all your reports in Magent."
+                : state === "ready"
+                  ? "Confirm to email yourself your minutes, movies, episodes, longest run and requests. Manage automatic monthly delivery separately in Profile."
+                  : ""}
+        </p>
+        {error && (
+          <p className="account-notice is-error" role="alert">
+            {error}
+          </p>
+        )}
+        {state === "ready" && (
+          <button type="button" className="account-primary" disabled={busy} onClick={() => void apply()}>
+            {busy ? "Updating…" : link?.action === "unsubscribe" ? "Unsubscribe from recaps" : "Confirm email recaps"}
+          </button>
+        )}
+        {(done || state === "error") && (
+          <a className="recap-text-link" href="/profile#monthly-recaps">
+            Manage email preferences ↗
+          </a>
+        )}
+        {state === "loading" && <p role="status">One moment…</p>}
+      </section>
+    </main>
+  );
 }

frontend/app/feedback/page.tsx

@@ -1,83 +1,83 @@
-'use client'
+"use client";
 
-import PageHeading from '../ui/PageHeading'
+import PageHeading from "../ui/PageHeading";
 
-import { useEffect, useState } from 'react'
-import { useRouter } from 'next/navigation'
-import { authFetchOrThrow, getApiBase, getToken, UnauthorizedError } from '../lib/auth'
+import { useEffect, useState } from "react";
+import { useRouter } from "next/navigation";
+import { authFetchOrThrow, getApiBase, getToken, UnauthorizedError } from "../lib/auth";
 
 type Profile = {
-  username?: string
-}
+  username?: string;
+};
 
 export default function FeedbackPage() {
-  const router = useRouter()
-  const [profile, setProfile] = useState<Profile | null>(null)
-  const [category, setCategory] = useState('bug')
-  const [message, setMessage] = useState('')
-  const [status, setStatus] = useState<string | null>(null)
-  const [submitting, setSubmitting] = useState(false)
+  const router = useRouter();
+  const [profile, setProfile] = useState<Profile | null>(null);
+  const [category, setCategory] = useState("bug");
+  const [message, setMessage] = useState("");
+  const [status, setStatus] = useState<string | null>(null);
+  const [submitting, setSubmitting] = useState(false);
 
   useEffect(() => {
     if (!getToken()) {
-      router.push('/login')
-      return
+      router.push("/login");
+      return;
     }
     const load = async () => {
       try {
-        const baseUrl = getApiBase()
-        const response = await authFetchOrThrow(`${baseUrl}/auth/me`)
+        const baseUrl = getApiBase();
+        const response = await authFetchOrThrow(`${baseUrl}/auth/me`);
         if (!response.ok) {
-          throw new Error('Could not load profile.')
+          throw new Error("Could not load profile.");
         }
-        const data = await response.json()
-        setProfile({ username: data?.username })
+        const data = await response.json();
+        setProfile({ username: data?.username });
       } catch (error) {
         if (error instanceof UnauthorizedError) {
-          router.push('/login')
-          return
+          router.push("/login");
+          return;
         }
-        console.error(error)
+        console.error(error);
       }
-    }
-    void load()
-  }, [router])
+    };
+    void load();
+  }, [router]);
 
   const submit = async (event: React.FormEvent<HTMLFormElement>) => {
-    event.preventDefault()
-    setStatus(null)
+    event.preventDefault();
+    setStatus(null);
     if (!message.trim()) {
-      setStatus('Please write a short message before sending.')
-      return
+      setStatus("Please write a short message before sending.");
+      return;
     }
-    setSubmitting(true)
+    setSubmitting(true);
     try {
-      const baseUrl = getApiBase()
+      const baseUrl = getApiBase();
       const response = await authFetchOrThrow(`${baseUrl}/feedback`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           type: category,
           message: message.trim(),
         }),
-      })
+      });
       if (!response.ok) {
-        const text = await response.text()
-        throw new Error(text || `Request failed: ${response.status}`)
+        const text = await response.text();
+        throw new Error(text || `Request failed: ${response.status}`);
       }
-      setMessage('')
-      setStatus('Thanks! Your message has been sent.')
+      setMessage("");
+      setStatus("Thanks! Your message has been sent.");
     } catch (error) {
       if (error instanceof UnauthorizedError) {
-        router.push('/login')
-        return
+        router.push("/login");
+        return;
       }
-      console.error(error)
-      setStatus('That did not send. Please try again.')
+      console.error(error);
+      setStatus("That did not send. Please try again.");
     } finally {
-      setSubmitting(false)
+      setSubmitting(false);
     }
-  }
+  };
 
   return (
     <main className="card feedback-page">
@@ -85,14 +85,10 @@ export default function FeedbackPage() {
 
       <form className="account-panel account-form feedback-form" onSubmit={submit}>
         <label htmlFor="feedback-user">Your username</label>
-        <input id="feedback-user" value={profile?.username ?? ''} readOnly />
+        <input id="feedback-user" value={profile?.username ?? ""} readOnly />
 
         <label htmlFor="feedback-type">What is this about?</label>
-        <select
-          id="feedback-type"
-          value={category}
-          onChange={(event) => setCategory(event.target.value)}
-        >
+        <select id="feedback-type" value={category} onChange={(event) => setCategory(event.target.value)}>
           <option value="bug">Bug (something is broken)</option>
           <option value="feature">Feature idea (new option)</option>
         </select>
@@ -109,9 +105,9 @@ export default function FeedbackPage() {
         {status && <div className="status-banner">{status}</div>}
 
         <button type="submit" disabled={submitting}>
-          {submitting ? 'Sending...' : 'Send feedback'}
+          {submitting ? "Sending..." : "Send feedback"}
         </button>
       </form>
     </main>
-  )
+  );
 }

frontend/app/forgot-password/page.tsx

@@ -1,49 +1,49 @@
-'use client'
+"use client";
 
-import { useState } from 'react'
-import { useRouter } from 'next/navigation'
-import AuthLayout from '../ui/AuthLayout'
-import { getApiBase } from '../lib/auth'
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import AuthLayout from "../ui/AuthLayout";
+import { getApiBase } from "../lib/auth";
 
 export default function ForgotPasswordPage() {
-  const router = useRouter()
-  const [identifier, setIdentifier] = useState('')
-  const [loading, setLoading] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const [status, setStatus] = useState<string | null>(null)
+  const router = useRouter();
+  const [identifier, setIdentifier] = useState("");
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [status, setStatus] = useState<string | null>(null);
 
   const submit = async (event: React.FormEvent) => {
-    event.preventDefault()
+    event.preventDefault();
     if (!identifier.trim()) {
-      setError('Enter your username or email.')
-      return
+      setError("Enter your username or email.");
+      return;
     }
-    setLoading(true)
-    setError(null)
-    setStatus(null)
+    setLoading(true);
+    setError(null);
+    setStatus(null);
     try {
-      const baseUrl = getApiBase()
+      const baseUrl = getApiBase();
       const response = await fetch(`${baseUrl}/auth/password/forgot`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ identifier: identifier.trim() }),
-      })
-      const data = await response.json().catch(() => null)
+      });
+      const data = await response.json().catch(() => null);
       if (!response.ok) {
-        throw new Error(typeof data?.detail === 'string' ? data.detail : 'Unable to send reset link.')
+        throw new Error(typeof data?.detail === "string" ? data.detail : "Unable to send reset link.");
       }
       setStatus(
-        typeof data?.message === 'string'
+        typeof data?.message === "string"
           ? data.message
-          : 'If an account exists for that username or email, a password reset link has been sent.',
-      )
+          : "If an account exists for that username or email, a password reset link has been sent.",
+      );
     } catch (err) {
-      console.error(err)
-      setError(err instanceof Error ? err.message : 'Unable to send reset link.')
+      console.error(err);
+      setError(err instanceof Error ? err.message : "Unable to send reset link.");
     } finally {
-      setLoading(false)
+      setLoading(false);
     }
-  }
+  };
 
   return (
     <AuthLayout title="Forgot password?" description="Enter your username or email to request a reset link.">
@@ -57,17 +57,25 @@ export default function ForgotPasswordPage() {
             placeholder="you@example.com"
           />
         </label>
-        {error && <div className="account-notice is-error" role="alert">{error}</div>}
-        {status && <div className="account-notice is-status" role="status">{status}</div>}
+        {error && (
+          <div className="account-notice is-error" role="alert">
+            {error}
+          </div>
+        )}
+        {status && (
+          <div className="account-notice is-status" role="status">
+            {status}
+          </div>
+        )}
         <div className="auth-actions">
           <button type="submit" className="account-primary" disabled={loading}>
-            {loading ? 'Sending reset link…' : 'Send reset link'}
+            {loading ? "Sending reset link…" : "Send reset link"}
           </button>
         </div>
-        <button type="button" className="ghost-button" onClick={() => router.push('/login')} disabled={loading}>
+        <button type="button" className="ghost-button" onClick={() => router.push("/login")} disabled={loading}>
           Back to sign in
         </button>
       </form>
     </AuthLayout>
-  )
+  );
 }

frontend/app/globals.css

@@ -1,41 +1,3 @@
-@import url('https://fonts.googleapis.com/css2?family=Manrope:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;600&display=swap');
-
-:root {
-  color-scheme: light;
-  --ink: #0f1117;
-  --ink-muted: #3f4656;
-  --paper: #f0f4ff;
-  --paper-strong: #ffffff;
-  --accent: #ff6b2b;
-  --accent-2: #1c6bff;
-  --accent-3: #11d6c6;
-  --border: rgba(15, 17, 23, 0.12);
-  --shadow: rgba(15, 17, 23, 0.18);
-  --glow: 0 0 18px rgba(28, 107, 255, 0.25);
-  --input-bg: rgba(15, 17, 23, 0.04);
-  --input-ink: var(--ink);
-  --error-bg: rgba(255, 107, 43, 0.12);
-  --error-ink: #6b2c17;
-}
-
-[data-theme='dark'] {
-  color-scheme: dark;
-  --ink: #e9ecf5;
-  --ink-muted: #9aa3b8;
-  --paper: #0b0f18;
-  --paper-strong: #111827;
-  --accent: #ff6b2b;
-  --accent-2: #3b82f6;
-  --accent-3: #22f6e3;
-  --border: rgba(255, 255, 255, 0.08);
-  --shadow: rgba(0, 0, 0, 0.6);
-  --glow: 0 0 22px rgba(59, 130, 246, 0.45);
-  --input-bg: rgba(255, 255, 255, 0.08);
-  --input-ink: var(--ink);
-  --error-bg: rgba(255, 107, 43, 0.18);
-  --error-ink: #ffd3bf;
-}
-
 * {
   box-sizing: border-box;
   margin: 0;
@@ -2505,38 +2467,6 @@ button span {
 /* Professional UI Refresh (graphite / silver / black + subtle blue accents) */
 /* -------------------------------------------------------------------------- */
 
-:root {
-  --ink: #10151d;
-  --ink-muted: #5b6472;
-  --paper: #eaedf1;
-  --paper-strong: #f8fafc;
-  --accent: #3f78d7;
-  --accent-2: #5ea0ff;
-  --accent-3: #8fa7c8;
-  --border: rgba(16, 21, 29, 0.1);
-  --shadow: rgba(16, 21, 29, 0.14);
-  --glow: 0 0 0 transparent;
-  --input-bg: rgba(16, 21, 29, 0.03);
-  --error-bg: rgba(185, 28, 28, 0.08);
-  --error-ink: #7f1d1d;
-}
-
-[data-theme='dark'] {
-  --ink: #edf1f7;
-  --ink-muted: #98a2b3;
-  --paper: #090c10;
-  --paper-strong: #11151b;
-  --accent: #4b7fdb;
-  --accent-2: #66a3ff;
-  --accent-3: #93a6c4;
-  --border: rgba(255, 255, 255, 0.07);
-  --shadow: rgba(0, 0, 0, 0.45);
-  --glow: 0 0 0 transparent;
-  --input-bg: rgba(255, 255, 255, 0.035);
-  --error-bg: rgba(248, 113, 113, 0.12);
-  --error-ink: #fecaca;
-}
-
 body {
   font-family: "Manrope", "Segoe UI", sans-serif;
   background:
@@ -3075,40 +3005,6 @@ button:disabled {
 }
 
 /* Release 1.1 UI Refresh: Professional control-panel theme */
-:root {
-  --ink: #111318;
-  --ink-muted: #5f6776;
-  --paper: #eef1f6;
-  --paper-strong: #ffffff;
-  --accent: #4e8ef7;
-  --accent-2: #77abff;
-  --accent-3: #9dbdff;
-  --border: rgba(17, 19, 24, 0.1);
-  --shadow: rgba(17, 19, 24, 0.16);
-  --glow: 0 0 0 1px rgba(78, 142, 247, 0.08), 0 14px 30px rgba(16, 20, 28, 0.08);
-  --input-bg: rgba(17, 19, 24, 0.035);
-  --input-ink: var(--ink);
-  --error-bg: rgba(225, 81, 81, 0.12);
-  --error-ink: #6f1f1f;
-}
-
-[data-theme='dark'] {
-  --ink: #eef1f7;
-  --ink-muted: #9aa3b2;
-  --paper: #0a0d12;
-  --paper-strong: #12161d;
-  --accent: #5d9cff;
-  --accent-2: #87b5ff;
-  --accent-3: #a5c4ff;
-  --border: rgba(255, 255, 255, 0.08);
-  --shadow: rgba(0, 0, 0, 0.55);
-  --glow: 0 0 0 1px rgba(93, 156, 255, 0.12), 0 18px 42px rgba(0, 0, 0, 0.38);
-  --input-bg: rgba(255, 255, 255, 0.035);
-  --input-ink: var(--ink);
-  --error-bg: rgba(248, 113, 113, 0.14);
-  --error-ink: #ffd4d4;
-}
-
 body {
   font-family: "Manrope", "Segoe UI", sans-serif;
   background:
@@ -3853,12 +3749,6 @@ button:disabled {
 }
 
 /* Enterprise polish pass */
-[data-theme='dark'] {
-  --accent: #6f95c6;
-  --accent-2: #8aa9d1;
-  --accent-3: #b2c5de;
-}
-
 body {
   background:
     radial-gradient(circle at 12% -8%, rgba(111, 149, 198, 0.08), transparent 40%),

frontend/app/how-it-works/page.tsx

@@ -1,56 +1,177 @@
-import PageHeading from '../ui/PageHeading'
-import '../welcome.css'
+import PageHeading from "../ui/PageHeading";
+import "../welcome.css";
 
 export default function HowItWorksPage() {
-  return <main className="friendly-guide">
-    <PageHeading title="A little help getting started." description="Magent looks after your requests. GrizzlyFlix is where you watch them." />
-    <nav aria-label="Quick links"><a href="/welcome">Welcome page</a><a href="/">My Requests</a><a href="/profile">My profile</a></nav>
-    <details open><summary>Request a movie or TV show</summary>
-      <ol>
-        <li><strong>Choose Movie or TV show.</strong><p>Open <a href="/new-requests">New Requests</a> and pick what you’re looking for.</p></li>
-        <li><strong>Search and choose the right title.</strong><p>For TV, choose the seasons you want. If it’s already requested, open that request to see its progress.</p></li>
-        <li><strong>Check your choices and send it.</strong><p>Choose from the quality options shown. These come from the library’s settings.</p></li>
-        <li><strong>Follow it in My Requests.</strong><p>We’ll show what’s happening and any next step you can take. Some titles need approval or may not have a suitable download yet.</p></li>
-      </ol>
-    </details>
-    <details><summary>Understand the six progress steps</summary>
-      <ol>
-        <li><strong>Requested:</strong> Your request has been received.</li>
-        <li><strong>Approved:</strong> It has permission to go ahead.</li>
-        <li><strong>Library collection:</strong> The library is tracking what’s collected and what’s missing.</li>
-        <li><strong>Release search:</strong> A suitable download is being looked for. Waiting here can mean there isn’t a good match yet.</li>
-        <li><strong>Download:</strong> The files are being downloaded. TV requests can include several episodes or a season pack.</li>
-        <li><strong>Available to watch:</strong> GrizzlyFlix has added the content. Use the watch button to open it.</li>
-      </ol>
-      <p>A finished download still needs to be added to the media library. Wait for “Available to watch” before heading over.</p>
-    </details>
-    <details><summary>Something looks stuck</summary>
-      <ol>
-        <li><strong>Open the request.</strong><p>Read its current status and next step.</p></li>
-        <li><strong>Choose Recheck request.</strong><p>Magent checks the connected services again to refresh where things are up to.</p></li>
-        <li><strong>Follow the action offered.</strong><p>You may be able to restart a search or review suitable releases. Choose “Best pick” when offered if you’re unsure.</p></li>
-      </ol>
-      <p>Remote activity explains the latest check. Open it to see the full list. A successful search doesn’t always mean a download was found.</p>
-    </details>
-    <details><summary>Report a problem and follow the fix</summary>
-      <ol>
-        <li><strong>Open <a href="/portal/issues">Issues</a>.</strong><p>Choose what’s wrong: missing content, broken picture, wrong download, audio, subtitles, or playback.</p></li>
-        <li><strong>Choose the affected content.</strong><p>Find the movie or show. For TV, select the affected seasons or episodes; you can choose more than one.</p></li>
-        <li><strong>Read “What will happen”, then submit.</strong><p>It tells you whether the selected files will be replaced, missing content searched for, subtitles checked, or playback investigated.</p></li>
-        <li><strong>Follow the issue’s progress.</strong><p>Open your reported issue to see the work recorded and where the fix is up to.</p></li>
-        <li><strong>Tell us if it worked.</strong><p>When a supported repair is detected as ready to check, Magent can email you. Try the content, then choose “Yes” if it’s fixed or “No” if you still need help.</p></li>
-      </ol>
-      <p>Add your email in <a href="/profile">My profile</a> so updates can reach you. Reminder and automatic closure timings depend on the site’s settings.</p>
-    </details>
-    <details><summary>Invite someone</summary>
-      <ol>
-        <li><strong>Open <a href="/profile/invites">Invites</a>.</strong><p>If invites are enabled for your account, give your invite a name you’ll recognise.</p></li>
-        <li><strong>Add a welcome note, or skip it.</strong><p>A custom invite code is optional too.</p></li>
-        <li><strong>Choose how to share it.</strong><p>Copy the link yourself, or enter an email address to send it directly.</p></li>
-        <li><strong>Manage it later.</strong><p>You can return to your invites to check them or disable a link. Your account’s invite limits apply automatically.</p></li>
-      </ol>
-    </details>
-    <details><summary>Update your account</summary><p>Open the account menu and choose <a href="/profile">My profile</a> to update your contact email, view your activity, or use the password options available for your account.</p><p>Looking for your downloads instead? <a href="/">My Requests</a> is your starting point.</p></details>
-    <footer>Ready? <a href="/welcome">Choose where to go next →</a></footer>
-  </main>
+  return (
+    <main className="friendly-guide">
+      <PageHeading
+        title="A little help getting started."
+        description="Magent looks after your requests. GrizzlyFlix is where you watch them."
+      />
+      <nav aria-label="Quick links">
+        <a href="/welcome">Welcome page</a>
+        <a href="/">My Requests</a>
+        <a href="/profile">My profile</a>
+      </nav>
+      <details open>
+        <summary>Request a movie or TV show</summary>
+        <ol>
+          <li>
+            <strong>Choose Movie or TV show.</strong>
+            <p>
+              Open <a href="/new-requests">New Requests</a> and pick what you’re looking for.
+            </p>
+          </li>
+          <li>
+            <strong>Search and choose the right title.</strong>
+            <p>
+              For TV, choose the seasons you want. If it’s already requested, open that request to see its progress.
+            </p>
+          </li>
+          <li>
+            <strong>Check your choices and send it.</strong>
+            <p>Choose from the quality options shown. These come from the library’s settings.</p>
+          </li>
+          <li>
+            <strong>Follow it in My Requests.</strong>
+            <p>
+              We’ll show what’s happening and any next step you can take. Some titles need approval or may not have a
+              suitable download yet.
+            </p>
+          </li>
+        </ol>
+      </details>
+      <details>
+        <summary>Understand the six progress steps</summary>
+        <ol>
+          <li>
+            <strong>Requested:</strong> Your request has been received.
+          </li>
+          <li>
+            <strong>Approved:</strong> It has permission to go ahead.
+          </li>
+          <li>
+            <strong>Library collection:</strong> The library is tracking what’s collected and what’s missing.
+          </li>
+          <li>
+            <strong>Release search:</strong> A suitable download is being looked for. Waiting here can mean there isn’t
+            a good match yet.
+          </li>
+          <li>
+            <strong>Download:</strong> The files are being downloaded. TV requests can include several episodes or a
+            season pack.
+          </li>
+          <li>
+            <strong>Available to watch:</strong> GrizzlyFlix has added the content. Use the watch button to open it.
+          </li>
+        </ol>
+        <p>
+          A finished download still needs to be added to the media library. Wait for “Available to watch” before heading
+          over.
+        </p>
+      </details>
+      <details>
+        <summary>Something looks stuck</summary>
+        <ol>
+          <li>
+            <strong>Open the request.</strong>
+            <p>Read its current status and next step.</p>
+          </li>
+          <li>
+            <strong>Choose Recheck request.</strong>
+            <p>Magent checks the connected services again to refresh where things are up to.</p>
+          </li>
+          <li>
+            <strong>Follow the action offered.</strong>
+            <p>
+              You may be able to restart a search or review suitable releases. Choose “Best pick” when offered if you’re
+              unsure.
+            </p>
+          </li>
+        </ol>
+        <p>
+          Remote activity explains the latest check. Open it to see the full list. A successful search doesn’t always
+          mean a download was found.
+        </p>
+      </details>
+      <details>
+        <summary>Report a problem and follow the fix</summary>
+        <ol>
+          <li>
+            <strong>
+              Open <a href="/portal/issues">Issues</a>.
+            </strong>
+            <p>Choose what’s wrong: missing content, broken picture, wrong download, audio, subtitles, or playback.</p>
+          </li>
+          <li>
+            <strong>Choose the affected content.</strong>
+            <p>
+              Find the movie or show. For TV, select the affected seasons or episodes; you can choose more than one.
+            </p>
+          </li>
+          <li>
+            <strong>Read “What will happen”, then submit.</strong>
+            <p>
+              It tells you whether the selected files will be replaced, missing content searched for, subtitles checked,
+              or playback investigated.
+            </p>
+          </li>
+          <li>
+            <strong>Follow the issue’s progress.</strong>
+            <p>Open your reported issue to see the work recorded and where the fix is up to.</p>
+          </li>
+          <li>
+            <strong>Tell us if it worked.</strong>
+            <p>
+              When a supported repair is detected as ready to check, Magent can email you. Try the content, then choose
+              “Yes” if it’s fixed or “No” if you still need help.
+            </p>
+          </li>
+        </ol>
+        <p>
+          Add your email in <a href="/profile">My profile</a> so updates can reach you. Reminder and automatic closure
+          timings depend on the site’s settings.
+        </p>
+      </details>
+      <details>
+        <summary>Invite someone</summary>
+        <ol>
+          <li>
+            <strong>
+              Open <a href="/profile/invites">Invites</a>.
+            </strong>
+            <p>If invites are enabled for your account, give your invite a name you’ll recognise.</p>
+          </li>
+          <li>
+            <strong>Add a welcome note, or skip it.</strong>
+            <p>A custom invite code is optional too.</p>
+          </li>
+          <li>
+            <strong>Choose how to share it.</strong>
+            <p>Copy the link yourself, or enter an email address to send it directly.</p>
+          </li>
+          <li>
+            <strong>Manage it later.</strong>
+            <p>
+              You can return to your invites to check them or disable a link. Your account’s invite limits apply
+              automatically.
+            </p>
+          </li>
+        </ol>
+      </details>
+      <details>
+        <summary>Update your account</summary>
+        <p>
+          Open the account menu and choose <a href="/profile">My profile</a> to update your contact email, view your
+          activity, or use the password options available for your account.
+        </p>
+        <p>
+          Looking for your downloads instead? <a href="/">My Requests</a> is your starting point.
+        </p>
+      </details>
+      <footer>
+        Ready? <a href="/welcome">Choose where to go next →</a>
+      </footer>
+    </main>
+  );
 }

frontend/app/insights/components.tsx

@@ -1,93 +1,282 @@
-'use client'
+"use client";
 
-import { useState } from 'react'
-import { getApiBase } from '../lib/auth'
+import { useState } from "react";
+import { getApiBase } from "../lib/auth";
 
-export type Breakdown = { name: string; minutes: number }
-export type Day = { date: string; minutes: number }
+export type Breakdown = { name: string; minutes: number };
+export type Day = { date: string; minutes: number };
 export type Transcoding = {
-  video_minutes: number; audio_minutes: number; hardware_video_minutes: number; software_video_minutes: number
-  unknown_hardware_minutes: number; unknown_video_minutes: number; unknown_audio_minutes: number
-  hardware: Breakdown[]; audio_codecs: Breakdown[]; gpu_busy_minutes: null
-}
+  video_minutes: number;
+  audio_minutes: number;
+  hardware_video_minutes: number;
+  software_video_minutes: number;
+  unknown_hardware_minutes: number;
+  unknown_video_minutes: number;
+  unknown_audio_minutes: number;
+  hardware: Breakdown[];
+  audio_codecs: Breakdown[];
+  gpu_busy_minutes: null;
+};
 export type Stats = {
-  state: 'ready' | 'not_configured' | 'unlinked'
-  is_admin: boolean
-  days: number
-  updated_at?: string
-  summary: null | { minutes: number; movies: number; episodes: number; plays: number; current_streak: number; longest_streak: number; active_days: number }
-  daily?: Day[]
-  top_titles?: { title: string; type: string; minutes: number; plays: number }[]
-  recent?: { id: string; title: string; series: string; episode?: string; type: string; minutes: number; played_at: string; client: string; method: string; artwork_url?: string | null }[]
-  clients?: Breakdown[]
-  methods?: Breakdown[]
-  transcoding?: Transcoding
-  requests: { total: number; movies: number; tv: number; pending: number; approved: number; declined: number; recent: { request_id: number; title: string; media_type: string; status: number }[] }
-}
+  state: "ready" | "not_configured" | "unlinked";
+  is_admin: boolean;
+  days: number;
+  updated_at?: string;
+  summary: null | {
+    minutes: number;
+    movies: number;
+    episodes: number;
+    plays: number;
+    current_streak: number;
+    longest_streak: number;
+    active_days: number;
+  };
+  daily?: Day[];
+  patterns?: {
+    average_play_minutes: number;
+    longest_play_minutes: number;
+    weekend_percent: number;
+    weekdays: Breakdown[];
+    media: Breakdown[];
+  };
+  top_titles?: { artwork_url?: string | null; title: string; type: string; minutes: number; plays: number }[];
+  recent?: {
+    id: string;
+    title: string;
+    series: string;
+    episode?: string;
+    type: string;
+    minutes: number;
+    played_at: string;
+    client: string;
+    method: string;
+    artwork_url?: string | null;
+  }[];
+  clients?: Breakdown[];
+  methods?: Breakdown[];
+  transcoding?: Transcoding;
+  requests: {
+    total: number;
+    movies: number;
+    tv: number;
+    pending: number;
+    approved: number;
+    declined: number;
+    recent: { request_id: number; title: string; media_type: string; status: number }[];
+  };
+};
 
-export const number = (value: number) => value.toLocaleString(undefined, { maximumFractionDigits: 0 })
-export const dateLabel = (date: string) => new Date(date).toLocaleDateString(undefined, { month: 'short', day: 'numeric', timeZone: 'UTC' })
+export const number = (value: number) => value.toLocaleString(undefined, { maximumFractionDigits: 0 });
+export const dateLabel = (date: string) =>
+  new Date(date).toLocaleDateString(undefined, { month: "short", day: "numeric", timeZone: "UTC" });
 
 export function ViewingChart({ daily }: { daily: Day[] }) {
-  const [selected, setSelected] = useState<number | null>(null)
-  const bucket = daily.length > 100 ? 7 : daily.length > 35 ? 3 : 1
-  const bars: { start: string; end: string; minutes: number }[] = []
+  const [selected, setSelected] = useState<number | null>(null);
+  const bucket = daily.length > 100 ? 7 : daily.length > 35 ? 3 : 1;
+  const bars: { start: string; end: string; minutes: number }[] = [];
   for (let i = 0; i < daily.length; i += bucket) {
-    const group = daily.slice(i, i + bucket)
-    bars.push({ start: group[0].date, end: group[group.length - 1].date, minutes: group.reduce((sum, day) => sum + day.minutes, 0) })
+    const group = daily.slice(i, i + bucket);
+    bars.push({
+      start: group[0].date,
+      end: group[group.length - 1].date,
+      minutes: group.reduce((sum, day) => sum + day.minutes, 0),
+    });
   }
-  const peak = Math.max(1, ...bars.map((bar) => bar.minutes))
-  const active = selected === null ? null : bars[selected]
+  const peak = Math.max(1, ...bars.map((bar) => bar.minutes));
+  const active = selected === null ? null : bars[selected];
   return (
     <section className="stats-panel stats-viewing" aria-labelledby="viewing-title">
-      <div className="stats-panel-heading"><div><h2 id="viewing-title">Your viewing rhythm</h2><p>{bucket === 1 ? 'Daily' : `${bucket}-day`} watch time · UTC</p></div><span className="stats-unit">Minutes</span></div>
-      <div className="stats-chart-detail" aria-live="polite">{active ? `${dateLabel(active.start)}${active.end !== active.start ? ` – ${dateLabel(active.end)}` : ''} · ${number(active.minutes)} minutes` : 'Select a bar to explore your watch time.'}</div>
+      <div className="stats-panel-heading">
+        <div>
+          <h2 id="viewing-title">Your viewing rhythm</h2>
+          <p>{bucket === 1 ? "Daily" : `${bucket}-day`} watch time · UTC</p>
+        </div>
+        <span className="stats-unit">Minutes</span>
+      </div>
+      <div className="stats-chart-detail" aria-live="polite">
+        {active
+          ? `${dateLabel(active.start)}${active.end !== active.start ? ` – ${dateLabel(active.end)}` : ""} · ${number(active.minutes)} minutes`
+          : "Select a bar to explore your watch time."}
+      </div>
       <div className="stats-chart">
-        <div className="stats-chart-scale" aria-hidden="true"><span>{number(peak)}</span><span>{number(peak / 2)}</span><span>0</span></div>
+        <div className="stats-chart-scale" aria-hidden="true">
+          <span>{number(peak)}</span>
+          <span>{number(peak / 2)}</span>
+          <span>0</span>
+        </div>
         <div className="stats-chart-bars">
-          {bars.map((bar, index) => <button type="button" className={selected === index ? 'is-selected' : ''} key={bar.start} aria-label={`${dateLabel(bar.start)}${bar.end !== bar.start ? ` to ${dateLabel(bar.end)}` : ''}: ${number(bar.minutes)} minutes`} aria-pressed={selected === index} onClick={() => setSelected(index)} onFocus={() => setSelected(index)}><span style={{ height: `${bar.minutes > 0 ? Math.max(2, bar.minutes / peak * 100) : 1}%` }} /></button>)}
+          {bars.map((bar, index) => (
+            <button
+              type="button"
+              className={selected === index ? "is-selected" : ""}
+              key={bar.start}
+              aria-label={`${dateLabel(bar.start)}${bar.end !== bar.start ? ` to ${dateLabel(bar.end)}` : ""}: ${number(bar.minutes)} minutes`}
+              aria-pressed={selected === index}
+              onClick={() => setSelected(index)}
+              onFocus={() => setSelected(index)}
+            >
+              <span style={{ height: `${bar.minutes > 0 ? Math.max(2, (bar.minutes / peak) * 100) : 1}%` }} />
+            </button>
+          ))}
         </div>
       </div>
-      <div className="stats-chart-axis" aria-hidden="true"><span>{bars[0] && dateLabel(bars[0].start)}</span><span>{bars.length > 0 && dateLabel(bars[bars.length - 1].end)}</span></div>
+      <div className="stats-chart-axis" aria-hidden="true">
+        <span>{bars[0] && dateLabel(bars[0].start)}</span>
+        <span>{bars.length > 0 && dateLabel(bars[bars.length - 1].end)}</span>
+      </div>
     </section>
-  )
+  );
 }
 
 export function BreakdownCard({ title, rows }: { title: string; rows: Breakdown[] }) {
-  const total = rows.reduce((sum, row) => sum + row.minutes, 0)
-  return <section className="stats-panel"><div className="stats-panel-heading"><h2>{title}</h2></div>{rows.length ? <div className="stats-breakdown">{rows.map((row) => <div key={row.name}><div className="stats-breakdown-label"><span>{row.name}</span><strong>{number(row.minutes)} min</strong></div><div className="stats-meter"><span style={{ width: `${total ? row.minutes / total * 100 : 0}%` }} /></div></div>)}</div> : <p className="stats-muted">Your next watch will start the story here.</p>}</section>
+  const total = rows.reduce((sum, row) => sum + row.minutes, 0);
+  return (
+    <section className="stats-panel">
+      <div className="stats-panel-heading">
+        <h2>{title}</h2>
+      </div>
+      {rows.length ? (
+        <div className="stats-breakdown">
+          {rows.map((row) => (
+            <div key={row.name}>
+              <div className="stats-breakdown-label">
+                <span>{row.name}</span>
+                <strong>{number(row.minutes)} min</strong>
+              </div>
+              <div className="stats-meter">
+                <span style={{ width: `${total ? (row.minutes / total) * 100 : 0}%` }} />
+              </div>
+            </div>
+          ))}
+        </div>
+      ) : (
+        <p className="stats-muted">Your next watch will start the story here.</p>
+      )}
+    </section>
+  );
 }
 
-const minutes = (value: number) => `${value.toLocaleString(undefined, { maximumFractionDigits: 1 })} min`
+const minutes = (value: number) => `${value.toLocaleString(undefined, { maximumFractionDigits: 1 })} min`;
 
 export function StreamingCard({ rows, transcoding }: { rows: Breakdown[]; transcoding?: Transcoding }) {
-  const total = rows.reduce((sum, row) => sum + row.minutes, 0)
-  return <section className="stats-panel stats-streaming">
-    <div className="stats-panel-heading"><h2>How you streamed</h2></div>
-    <div className="stats-breakdown">{rows.map((row) => <div key={row.name}><div className="stats-breakdown-label"><span>{row.name}</span><strong>{minutes(row.minutes)}</strong></div><div className="stats-meter"><span style={{ width: `${total ? row.minutes / total * 100 : 0}%` }} /></div></div>)}</div>
-    {transcoding && <div className="stats-transcoding">
-      <h3>Transcoding playback time</h3>
-      <div className="stats-transcode-metrics">
-        <div><span>GPU-assisted video</span><strong>{transcoding.hardware_video_minutes === 0 && (transcoding.unknown_hardware_minutes > 0 || transcoding.unknown_video_minutes > 0) ? 'Not recorded' : minutes(transcoding.hardware_video_minutes)}</strong><small>{transcoding.hardware.map((entry) => `${entry.name} · ${minutes(entry.minutes)}`).join(' / ') || 'Hardware-accelerated video'}</small></div>
-        <div><span>Audio transcoding</span><strong>{transcoding.audio_minutes === 0 && transcoding.unknown_audio_minutes > 0 ? 'Not recorded' : minutes(transcoding.audio_minutes)}</strong><small>{transcoding.audio_codecs.slice(0, 3).map((entry) => `${entry.name} · ${minutes(entry.minutes)}`).join(' / ') || 'Audio converted for your player'}</small></div>
+  const total = rows.reduce((sum, row) => sum + row.minutes, 0);
+  return (
+    <section className="stats-panel stats-streaming">
+      <div className="stats-panel-heading">
+        <h2>How you streamed</h2>
       </div>
-      <dl className="stats-transcode-details"><div><dt>Total video transcoding</dt><dd>{transcoding.video_minutes === 0 && transcoding.unknown_video_minutes > 0 ? 'Not recorded' : minutes(transcoding.video_minutes)}</dd></div>{transcoding.software_video_minutes > 0 && <div><dt>Software video</dt><dd>{minutes(transcoding.software_video_minutes)}</dd></div>}{transcoding.unknown_hardware_minutes > 0 && <div><dt>Video hardware not recorded</dt><dd>{minutes(transcoding.unknown_hardware_minutes)}</dd></div>}</dl>
-      {(transcoding.unknown_audio_minutes > 0 || transcoding.unknown_video_minutes > 0) && <p className="stats-muted">Some stream details are missing: video {minutes(transcoding.unknown_video_minutes)}, audio {minutes(transcoding.unknown_audio_minutes)}.</p>}
-      <p className="stats-muted">Playback minutes, with audio and video counted separately. They can overlap. GPU busy time is not recorded by Jellystat.</p>
-    </div>}
-  </section>
+      <div className="stats-breakdown">
+        {rows.map((row) => (
+          <div key={row.name}>
+            <div className="stats-breakdown-label">
+              <span>{row.name}</span>
+              <strong>{minutes(row.minutes)}</strong>
+            </div>
+            <div className="stats-meter">
+              <span style={{ width: `${total ? (row.minutes / total) * 100 : 0}%` }} />
+            </div>
+          </div>
+        ))}
+      </div>
+      {transcoding && (
+        <div className="stats-transcoding">
+          <h3>Transcoding playback time</h3>
+          <div className="stats-transcode-metrics">
+            <div>
+              <span>GPU-assisted video</span>
+              <strong>
+                {transcoding.hardware_video_minutes === 0 &&
+                (transcoding.unknown_hardware_minutes > 0 || transcoding.unknown_video_minutes > 0)
+                  ? "Not recorded"
+                  : minutes(transcoding.hardware_video_minutes)}
+              </strong>
+              <small>
+                {transcoding.hardware.map((entry) => `${entry.name} · ${minutes(entry.minutes)}`).join(" / ") ||
+                  "Hardware-accelerated video"}
+              </small>
+            </div>
+            <div>
+              <span>Audio transcoding</span>
+              <strong>
+                {transcoding.audio_minutes === 0 && transcoding.unknown_audio_minutes > 0
+                  ? "Not recorded"
+                  : minutes(transcoding.audio_minutes)}
+              </strong>
+              <small>
+                {transcoding.audio_codecs
+                  .slice(0, 3)
+                  .map((entry) => `${entry.name} · ${minutes(entry.minutes)}`)
+                  .join(" / ") || "Audio converted for your player"}
+              </small>
+            </div>
+          </div>
+          <dl className="stats-transcode-details">
+            <div>
+              <dt>Total video transcoding</dt>
+              <dd>
+                {transcoding.video_minutes === 0 && transcoding.unknown_video_minutes > 0
+                  ? "Not recorded"
+                  : minutes(transcoding.video_minutes)}
+              </dd>
+            </div>
+            {transcoding.software_video_minutes > 0 && (
+              <div>
+                <dt>Software video</dt>
+                <dd>{minutes(transcoding.software_video_minutes)}</dd>
+              </div>
+            )}
+            {transcoding.unknown_hardware_minutes > 0 && (
+              <div>
+                <dt>Video hardware not recorded</dt>
+                <dd>{minutes(transcoding.unknown_hardware_minutes)}</dd>
+              </div>
+            )}
+          </dl>
+          {(transcoding.unknown_audio_minutes > 0 || transcoding.unknown_video_minutes > 0) && (
+            <p className="stats-muted">
+              Some stream details are missing: video {minutes(transcoding.unknown_video_minutes)}, audio{" "}
+              {minutes(transcoding.unknown_audio_minutes)}.
+            </p>
+          )}
+          <p className="stats-muted">
+            Playback minutes, with audio and video counted separately. They can overlap. GPU busy time is not recorded
+            by Jellystat.
+          </p>
+        </div>
+      )}
+    </section>
+  );
 }
 
 export function RecentArtwork({ url, type }: { url?: string | null; type: string }) {
-  const [failed, setFailed] = useState(false)
-  return <div className={`stats-media-icon stats-media-icon-${type}`} aria-hidden="true">
-    {url && !failed ? <img src={`${getApiBase()}${url}`} alt="" width={44} height={66} loading="lazy" onError={() => setFailed(true)} /> : <span>{type === 'episode' ? 'TV' : type === 'movie' ? 'MV' : '▶'}</span>}
-  </div>
+  const [failed, setFailed] = useState(false);
+  return (
+    <div className={`stats-media-icon stats-media-icon-${type}`} aria-hidden="true">
+      {url && !failed ? (
+        <img
+          src={`${getApiBase()}${url}`}
+          alt=""
+          width={44}
+          height={66}
+          loading="lazy"
+          onError={() => setFailed(true)}
+        />
+      ) : (
+        <span>{type === "episode" ? "TV" : type === "movie" ? "MV" : "▶"}</span>
+      )}
+    </div>
+  );
 }
 
 export function StatsNavigation({ reports = false }: { reports?: boolean }) {
-  return <nav className="stats-view-tabs" aria-label="My Stats views">
-    <a href="/insights" aria-current={!reports ? 'page' : undefined}>Overview</a>
-    <a href="/insights/reports" aria-current={reports ? 'page' : undefined}>Monthly reports</a>
-  </nav>
+  return (
+    <nav className="stats-view-tabs" aria-label="My Stats views">
+      <a href="/insights" aria-current={!reports ? "page" : undefined}>
+        Overview
+      </a>
+      <a href="/insights/reports" aria-current={reports ? "page" : undefined}>
+        Monthly reports
+      </a>
+    </nav>
+  );
 }

frontend/app/insights/page.tsx

@@ -1,86 +1,338 @@
-'use client'
+"use client";
 
-import { useCallback, useEffect, useState } from 'react'
-import { useRouter } from 'next/navigation'
-import { authFetch, getApiBase } from '../lib/auth'
-import PageHeading from '../ui/PageHeading'
-import { type Stats, BreakdownCard, RecentArtwork, StatsNavigation, StreamingCard, ViewingChart, dateLabel, number } from './components'
-import './stats.css'
+import { useCallback, useEffect, useState } from "react";
+import { useRouter } from "next/navigation";
+import { authFetch, getApiBase } from "../lib/auth";
+import { useEffectiveRole } from "../lib/viewMode";
+import PageHeading from "../ui/PageHeading";
+import {
+  type Stats,
+  BreakdownCard,
+  RecentArtwork,
+  StatsNavigation,
+  StreamingCard,
+  ViewingChart,
+  dateLabel,
+  number,
+} from "./components";
+import "./stats.css";
 
 export default function InsightsPage() {
-  const router = useRouter()
-  const [days, setDays] = useState(30)
-  const [data, setData] = useState<Stats | null>(null)
-  const [busy, setBusy] = useState(true)
-  const [error, setError] = useState('')
-  const [revision, setRevision] = useState(0)
-  const load = useCallback(async (signal: AbortSignal) => {
-    setBusy(true)
-    setError('')
-    setData(null)
-    try {
-      const response = await authFetch(`${getApiBase()}/insights?days=${days}`, { signal })
-      if (response.status === 401) { router.replace('/login?next=%2Finsights'); return }
-      if (response.status === 403) throw new Error('Your account cannot access viewing stats. Please contact an administrator.')
-      if (!response.ok) {
-        const result = await response.json().catch(() => ({}))
-        throw new Error(typeof result.detail === 'string' ? result.detail : 'Your viewing stats are temporarily unavailable. Please try again shortly.')
+  const router = useRouter();
+  const [days, setDays] = useState(30);
+  const [data, setData] = useState<Stats | null>(null);
+  const isAdmin = useEffectiveRole(data?.is_admin ? "admin" : "user") === "admin";
+  const [busy, setBusy] = useState(true);
+  const [error, setError] = useState("");
+  const [revision, setRevision] = useState(0);
+  const load = useCallback(
+    async (signal: AbortSignal) => {
+      setBusy(true);
+      setError("");
+      setData(null);
+      try {
+        const response = await authFetch(`${getApiBase()}/insights?days=${days}`, { signal });
+        if (response.status === 401) {
+          router.replace("/login?next=%2Finsights");
+          return;
+        }
+        if (response.status === 403)
+          throw new Error("Your account cannot access viewing stats. Please contact an administrator.");
+        if (!response.ok) {
+          const result = await response.json().catch(() => ({}));
+          throw new Error(
+            typeof result.detail === "string"
+              ? result.detail
+              : "Your viewing stats are temporarily unavailable. Please try again shortly.",
+          );
+        }
+        const result = (await response.json()) as Stats;
+        if (!signal.aborted) setData(result);
+      } catch (err) {
+        if (!signal.aborted) setError(err instanceof Error ? err.message : "Could not load your stats.");
+      } finally {
+        if (!signal.aborted) setBusy(false);
       }
-      const result = await response.json() as Stats
-      if (!signal.aborted) setData(result)
-    } catch (err) {
-      if (!signal.aborted) setError(err instanceof Error ? err.message : 'Could not load your stats.')
-    } finally {
-      if (!signal.aborted) setBusy(false)
-    }
-  }, [days, router])
+    },
+    [days, router],
+  );
 
   useEffect(() => {
-    const controller = new AbortController()
-    void load(controller.signal)
-    return () => controller.abort()
-  }, [load, revision])
+    void revision;
+    const controller = new AbortController();
+    void load(controller.signal);
+    return () => controller.abort();
+  }, [load, revision]);
 
-  const summary = data?.summary
+  const summary = data?.summary;
   return (
     <main className="stats-page">
-      <PageHeading title="My Stats" description="Your viewing, in numbers. Watch time, favourite stories, and the requests that started it all." actions={<button className="ghost-button" type="button" disabled={busy} onClick={() => setRevision((value) => value + 1)}>{busy ? 'Loading…' : 'Refresh stats'}</button>} />
+      <PageHeading
+        title="My Stats"
+        description="Your viewing, in numbers. Watch time, favourite stories, and the requests that started it all."
+        actions={
+          <button
+            className="ghost-button"
+            type="button"
+            disabled={busy}
+            onClick={() => setRevision((value) => value + 1)}
+          >
+            {busy ? "Loading…" : "Refresh stats"}
+          </button>
+        }
+      />
       <StatsNavigation />
       <div className="stats-toolbar">
-        <fieldset className="stats-period"><legend className="stats-sr-only">Stats period</legend>{[7, 30, 90, 365].map((value) => <button type="button" key={value} aria-pressed={days === value} onClick={() => setDays(value)}>{value === 365 ? 'Past year' : `${value} days`}</button>)}</fieldset>
-        <p className="stats-source"><span className={data?.state === 'ready' ? 'stats-source-dot is-ready' : 'stats-source-dot'} />From Jellystat{data?.updated_at && <span> · Updated {new Date(data.updated_at).toLocaleTimeString(undefined, { hour: '2-digit', minute: '2-digit' })}</span>}</p>
+        <fieldset className="stats-period">
+          <legend className="stats-sr-only">Stats period</legend>
+          {[7, 30, 90, 365].map((value) => (
+            <button type="button" key={value} aria-pressed={days === value} onClick={() => setDays(value)}>
+              {value === 365 ? "Past year" : `${value} days`}
+            </button>
+          ))}
+        </fieldset>
+        <p className="stats-source">
+          <span className={data?.state === "ready" ? "stats-source-dot is-ready" : "stats-source-dot"} />
+          From Jellystat
+          {data?.updated_at && (
+            <span>
+              {" "}
+              · Updated{" "}
+              {new Date(data.updated_at).toLocaleTimeString(undefined, { hour: "2-digit", minute: "2-digit" })}
+            </span>
+          )}
+        </p>
       </div>
-      {busy && <div className="stats-state" role="status"><span className="stats-state-symbol" aria-hidden="true">◷</span><h2>Gathering your stats</h2><p>Fetching your viewing history from Jellystat.</p></div>}
-      {error && <div className="stats-state" role="alert"><h2>Stats couldn’t load</h2><p>{error}</p><button type="button" className="ghost-button" onClick={() => setRevision((value) => value + 1)}>Try again</button></div>}
-      {data?.state === 'not_configured' && <section className="stats-state"><span className="stats-state-symbol" aria-hidden="true">▥</span><h2>Your viewing story starts here</h2><p>{data.is_admin ? 'Connect your Jellystat instance to bring personal viewing stats into Magent.' : 'Viewing stats will appear here once your administrator connects Jellystat.'}</p>{data.is_admin && <a className="stats-action" href="/admin/jellystat">Connect Jellystat</a>}</section>}
-      {data?.state === 'unlinked' && <section className="stats-state"><h2>Link your viewing account</h2><p>Your Magent account needs a Jellyfin identity to find your stats. Sign in using Jellyfin, or ask your administrator to sync Jellyfin users.</p></section>}
-      {summary && <>
-        <section className="stats-metrics" aria-label="Viewing totals">
-          <article className="stats-metric stats-metric-accent"><span>Minutes watched</span><strong>{number(summary.minutes)}</strong><small>{number(summary.minutes / 60)} hours across {number(summary.plays)} plays</small></article>
-          <article className="stats-metric"><span>Movies played</span><strong>{number(summary.movies)}</strong><small>Different movies you pressed play on</small></article>
-          <article className="stats-metric"><span>Episodes played</span><strong>{number(summary.episodes)}</strong><small>Different episodes in your history</small></article>
-          <article className="stats-metric"><span>Requests made</span><strong>{number(data.requests.total)}</strong><small>{number(data.requests.movies)} movies · {number(data.requests.tv)} TV requests</small></article>
+      {busy && (
+        <div className="stats-state" role="status">
+          <span className="stats-state-symbol" aria-hidden="true">
+            ◷
+          </span>
+          <h2>Gathering your stats</h2>
+          <p>Fetching your viewing history from Jellystat.</p>
+        </div>
+      )}
+      {error && (
+        <div className="stats-state" role="alert">
+          <h2>Stats couldn’t load</h2>
+          <p>{error}</p>
+          <button type="button" className="ghost-button" onClick={() => setRevision((value) => value + 1)}>
+            Try again
+          </button>
+        </div>
+      )}
+      {data?.state === "not_configured" && (
+        <section className="stats-state">
+          <span className="stats-state-symbol" aria-hidden="true">
+            ▥
+          </span>
+          <h2>Your viewing story starts here</h2>
+          <p>
+            {isAdmin
+              ? "Connect your Jellystat instance to bring personal viewing stats into Magent."
+              : "Viewing stats will appear here once your administrator connects Jellystat."}
+          </p>
+          {isAdmin && (
+            <a className="stats-action" href="/admin/jellystat">
+              Connect Jellystat
+            </a>
+          )}
         </section>
-        {summary.plays === 0 && <div className="stats-notice" role="status">No viewing history in this period yet. Try a longer period, or come back after your next watch.</div>}
+      )}
+      {data?.state === "unlinked" && (
+        <section className="stats-state">
+          <h2>Link your viewing account</h2>
+          <p>
+            Your Magent account needs a Jellyfin identity to find your stats. Sign in using Jellyfin, or ask your
+            administrator to sync Jellyfin users.
+          </p>
+        </section>
+      )}
+      {summary && (
+        <>
+          <section className="stats-metrics" aria-label="Viewing totals">
+            <article className="stats-metric stats-metric-accent">
+              <span>Minutes watched</span>
+              <strong>{number(summary.minutes)}</strong>
+              <small>
+                {number(summary.minutes / 60)} hours across {number(summary.plays)} plays
+              </small>
+            </article>
+            <article className="stats-metric">
+              <span>Movies played</span>
+              <strong>{number(summary.movies)}</strong>
+              <small>Different movies you pressed play on</small>
+            </article>
+            <article className="stats-metric">
+              <span>Episodes played</span>
+              <strong>{number(summary.episodes)}</strong>
+              <small>Different episodes in your history</small>
+            </article>
+            <article className="stats-metric">
+              <span>Requests made</span>
+              <strong>{number(data.requests.total)}</strong>
+              <small>
+                {number(data.requests.movies)} movies · {number(data.requests.tv)} TV requests
+              </small>
+            </article>
+          </section>
+          {summary.plays === 0 && (
+            <div className="stats-notice" role="status">
+              No viewing history in this period yet. Try a longer period, or come back after your next watch.
+            </div>
+          )}
+          <div className="stats-main-grid">
+            <ViewingChart key={`${days}-${revision}`} daily={data.daily ?? []} />
+            <section className="stats-panel stats-highlights">
+              <div className="stats-panel-heading">
+                <h2>A little watch history</h2>
+              </div>
+              <div className="stats-highlight">
+                <span className="stats-highlight-number">
+                  {summary.current_streak}
+                  <small> days</small>
+                </span>
+                <div>
+                  <strong>Current streak</strong>
+                  <p>Consecutive viewing days through today or yesterday.</p>
+                </div>
+              </div>
+              <div className="stats-highlight">
+                <span className="stats-highlight-number">
+                  {summary.longest_streak}
+                  <small> days</small>
+                </span>
+                <div>
+                  <strong>Longest run</strong>
+                  <p>Your best streak in this period.</p>
+                </div>
+              </div>
+              <div className="stats-highlight">
+                <span className="stats-highlight-number">
+                  {summary.active_days}
+                  <small> days</small>
+                </span>
+                <div>
+                  <strong>Time for a story</strong>
+                  <p>Days with at least a minute watched.</p>
+                </div>
+              </div>
+            </section>
+          </div>
+          <div className="stats-three-grid">
+            <section className="stats-panel">
+              <div className="stats-panel-heading">
+                <h2>Most watched</h2>
+                <span className="stats-unit">By minutes</span>
+              </div>
+              {data.top_titles?.length ? (
+                <ol className="stats-top-titles">
+                  {data.top_titles.map((title, index) => (
+                    <li key={`${title.title}-${index}`}>
+                      <span className="stats-rank">{String(index + 1).padStart(2, "0")}</span>
+                      <div>
+                        <strong>{title.title}</strong>
+                        <small>
+                          {title.type === "series" ? "TV series" : title.type === "movie" ? "Movie" : "Other media"} ·{" "}
+                          {title.plays} plays
+                        </small>
+                      </div>
+                      <span>
+                        {number(title.minutes)}
+                        <small>min</small>
+                      </span>
+                    </li>
+                  ))}
+                </ol>
+              ) : (
+                <p className="stats-muted">Your favourites will find their place here.</p>
+              )}
+            </section>
+            <BreakdownCard title="Your players" rows={data.clients ?? []} />
+            <StreamingCard rows={data.methods ?? []} transcoding={data.transcoding} />
+          </div>
+        </>
+      )}
+      {data && (
         <div className="stats-main-grid">
-          <ViewingChart key={`${days}-${revision}`} daily={data.daily ?? []} />
-          <section className="stats-panel stats-highlights"><div className="stats-panel-heading"><h2>A little watch history</h2></div>
-            <div className="stats-highlight"><span className="stats-highlight-number">{summary.current_streak}<small> days</small></span><div><strong>Current streak</strong><p>Consecutive viewing days through today or yesterday.</p></div></div>
-            <div className="stats-highlight"><span className="stats-highlight-number">{summary.longest_streak}<small> days</small></span><div><strong>Longest run</strong><p>Your best streak in this period.</p></div></div>
-            <div className="stats-highlight"><span className="stats-highlight-number">{summary.active_days}<small> days</small></span><div><strong>Time for a story</strong><p>Days with at least a minute watched.</p></div></div>
+          {summary && (
+            <section className="stats-panel stats-history">
+              <div className="stats-panel-heading">
+                <h2>Recently watched</h2>
+                <span className="stats-unit">Latest 20 plays</span>
+              </div>
+              {data.recent?.length ? (
+                <div className="stats-history-list">
+                  {data.recent.map((play) => (
+                    <article key={play.id}>
+                      <RecentArtwork key={play.artwork_url ?? play.id} url={play.artwork_url} type={play.type} />
+                      <div className="stats-history-title">
+                        <strong>{play.series || play.title}</strong>
+                        <small>
+                          {play.series ? `${play.episode} · ${play.title}` : play.type === "movie" ? "Movie" : "Media"}
+                        </small>
+                        <span>
+                          {play.client} · {play.method}
+                        </span>
+                      </div>
+                      <div className="stats-history-time">
+                        <strong>{number(play.minutes)} min</strong>
+                        <time dateTime={play.played_at}>{dateLabel(play.played_at)}</time>
+                      </div>
+                    </article>
+                  ))}
+                </div>
+              ) : (
+                <p className="stats-muted">Plays recorded by Jellystat will appear here.</p>
+              )}
+            </section>
+          )}
+          <section className="stats-panel stats-requests">
+            <div className="stats-panel-heading">
+              <h2>Your requests</h2>
+              <a href="/">View all</a>
+            </div>
+            <div className="stats-request-total">
+              <strong>{data.requests.total}</strong>
+              <span>submitted in the past {days} days</span>
+            </div>
+            <div className="stats-request-counts">
+              <span>
+                <strong>{data.requests.pending}</strong> Pending
+              </span>
+              <span>
+                <strong>{data.requests.approved}</strong> Approved
+              </span>
+              <span>
+                <strong>{data.requests.declined}</strong> Declined
+              </span>
+            </div>
+            {data.requests.recent.length > 0 ? (
+              <ul className="stats-request-list">
+                {data.requests.recent.map((request) => (
+                  <li key={request.request_id}>
+                    <a href={`/requests/${request.request_id}`}>
+                      {request.title || `Request ${request.request_id}`}
+                      <span aria-hidden="true">↗</span>
+                    </a>
+                  </li>
+                ))}
+              </ul>
+            ) : (
+              <p className="stats-muted">
+                Something on your watchlist? <a href="/new-requests">Make a request.</a>
+              </p>
+            )}
           </section>
         </div>
-        <div className="stats-three-grid">
-          <section className="stats-panel"><div className="stats-panel-heading"><h2>Most watched</h2><span className="stats-unit">By minutes</span></div>{data.top_titles?.length ? <ol className="stats-top-titles">{data.top_titles.map((title, index) => <li key={`${title.title}-${index}`}><span className="stats-rank">{String(index + 1).padStart(2, '0')}</span><div><strong>{title.title}</strong><small>{title.type === 'series' ? 'TV series' : title.type === 'movie' ? 'Movie' : 'Other media'} · {title.plays} plays</small></div><span>{number(title.minutes)}<small>min</small></span></li>)}</ol> : <p className="stats-muted">Your favourites will find their place here.</p>}</section>
-          <BreakdownCard title="Your players" rows={data.clients ?? []} />
-          <StreamingCard rows={data.methods ?? []} transcoding={data.transcoding} />
-        </div>
-      </>}
-      {data && <div className="stats-main-grid">
-        {summary && <section className="stats-panel stats-history"><div className="stats-panel-heading"><h2>Recently watched</h2><span className="stats-unit">Latest 20 plays</span></div>{data.recent?.length ? <div className="stats-history-list">{data.recent.map((play) => <article key={play.id}><RecentArtwork key={play.artwork_url ?? play.id} url={play.artwork_url} type={play.type} /><div className="stats-history-title"><strong>{play.series || play.title}</strong><small>{play.series ? `${play.episode} · ${play.title}` : play.type === 'movie' ? 'Movie' : 'Media'}</small><span>{play.client} · {play.method}</span></div><div className="stats-history-time"><strong>{number(play.minutes)} min</strong><time dateTime={play.played_at}>{dateLabel(play.played_at)}</time></div></article>)}</div> : <p className="stats-muted">Plays recorded by Jellystat will appear here.</p>}</section>}
-        <section className="stats-panel stats-requests"><div className="stats-panel-heading"><h2>Your requests</h2><a href="/">View all</a></div><div className="stats-request-total"><strong>{data.requests.total}</strong><span>submitted in the past {days} days</span></div><div className="stats-request-counts"><span><strong>{data.requests.pending}</strong> Pending</span><span><strong>{data.requests.approved}</strong> Approved</span><span><strong>{data.requests.declined}</strong> Declined</span></div>{data.requests.recent.length > 0 ? <ul className="stats-request-list">{data.requests.recent.map((request) => <li key={request.request_id}><a href={`/requests/${request.request_id}`}>{request.title || `Request ${request.request_id}`}<span aria-hidden="true">↗</span></a></li>)}</ul> : <p className="stats-muted">Something on your watchlist? <a href="/new-requests">Make a request.</a></p>}</section>
-      </div>}
-      {summary && <p className="stats-footnote">Private to your account · Stats come from Jellystat and may take a minute to refresh. Counts describe plays, including unfinished watches. Movies are identified from Jellystat’s movie libraries; other media still contributes to watch time. Charts and streaks use UTC and the activity dates recorded by Jellystat.</p>}
+      )}
+      {summary && (
+        <p className="stats-footnote">
+          Private to your account · Stats come from Jellystat and may take a minute to refresh. Counts describe plays,
+          including unfinished watches. Movies are identified from Jellystat’s movie libraries; other media still
+          contributes to watch time. Charts and streaks use UTC and the activity dates recorded by Jellystat.
+        </p>
+      )}
     </main>
-  )
+  );
 }

frontend/app/insights/reports/EmailReportControl.tsx

@@ -1,60 +1,108 @@
-'use client'
+"use client";
 
-import { useEffect, useRef, useState } from 'react'
-import { authFetch, getApiBase } from '../../lib/auth'
+import { useEffect, useRef, useState } from "react";
+import { authFetch, getApiBase } from "../../lib/auth";
 
-type Delivery = { id: string; month: string; state: string; detail: string }
-type Preference = { email: string | null; can_send: boolean; state: string; detail: string; deliveries: Delivery[] }
+type Delivery = { id: string; month: string; state: string; detail: string };
+type Preference = { email: string | null; can_send: boolean; state: string; detail: string; deliveries: Delivery[] };
 
 export default function EmailReportControl({ month }: { month: string }) {
-  const [data, setData] = useState<Preference | null>(null)
-  const [busy, setBusy] = useState(false)
-  const [notice, setNotice] = useState('')
-  const [error, setError] = useState('')
-  const [revision, setRevision] = useState(0)
-  const request = useRef<{ month: string; id: string } | null>(null)
-  const pending = data?.deliveries.some((item) => ['queued', 'preparing', 'sending', 'retry'].includes(item.state)) ?? false
+  const [data, setData] = useState<Preference | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [notice, setNotice] = useState("");
+  const [error, setError] = useState("");
+  const [revision, setRevision] = useState(0);
+  const request = useRef<{ month: string; id: string } | null>(null);
+  const pending =
+    data?.deliveries.some((item) => ["queued", "preparing", "sending", "retry"].includes(item.state)) ?? false;
 
   useEffect(() => {
-    const abort = new AbortController()
-    void authFetch(`${getApiBase()}/profile/email-recaps`, { signal: abort.signal }).then(async (response) => {
-      if (!response.ok) throw new Error('Could not load your report email preferences. Refresh to try again.')
-      const result = await response.json()
-      if (!abort.signal.aborted) setData(result)
-    }).catch((err: Error) => { if (!abort.signal.aborted) setError(err.message) })
-    return () => abort.abort()
-  }, [revision])
+    void revision;
+    const abort = new AbortController();
+    void authFetch(`${getApiBase()}/profile/email-recaps`, { signal: abort.signal })
+      .then(async (response) => {
+        if (!response.ok) throw new Error("Could not load your report email preferences. Refresh to try again.");
+        const result = await response.json();
+        if (!abort.signal.aborted) setData(result);
+      })
+      .catch((err: Error) => {
+        if (!abort.signal.aborted) setError(err.message);
+      });
+    return () => abort.abort();
+  }, [revision]);
 
   useEffect(() => {
-    if (!pending) return
-    const timer = window.setInterval(() => setRevision((value) => value + 1), 10000)
-    return () => window.clearInterval(timer)
-  }, [pending])
+    if (!pending) return;
+    const timer = window.setInterval(() => setRevision((value) => value + 1), 10000);
+    return () => window.clearInterval(timer);
+  }, [pending]);
 
   const send = async () => {
-    if (busy || !data?.can_send) return
-    setBusy(true); setError(''); setNotice('')
-    if (request.current?.month !== month) request.current = { month, id: crypto.randomUUID() }
+    if (busy || !data?.can_send) return;
+    setBusy(true);
+    setError("");
+    setNotice("");
+    if (request.current?.month !== month) request.current = { month, id: crypto.randomUUID() };
     try {
       const response = await authFetch(`${getApiBase()}/profile/email-recaps/send`, {
-        method: 'POST', headers: { 'Content-Type': 'application/json' },
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ month, request_id: request.current.id }),
-      })
-      const result = await response.json().catch(() => ({}))
-      if (!response.ok) throw new Error(typeof result.detail === 'string' ? result.detail : 'Could not queue your report. Try again.')
-      setNotice(result.message); request.current = null
-      setRevision((value) => value + 1)
-    } catch (err) { setError(err instanceof Error ? err.message : 'Could not queue your report.') }
-    finally { setBusy(false) }
-  }
+      });
+      const result = await response.json().catch(() => ({}));
+      if (!response.ok)
+        throw new Error(typeof result.detail === "string" ? result.detail : "Could not queue your report. Try again.");
+      setNotice(result.message);
+      request.current = null;
+      setRevision((value) => value + 1);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Could not queue your report.");
+    } finally {
+      setBusy(false);
+    }
+  };
 
-  return <section className="stats-panel report-email-panel" aria-label="Email your report">
-    <div className="stats-panel-heading"><h2>Email yourself this report</h2><a href="/profile#monthly-recaps">Email preferences</a></div>
-    <p>Choose a month above, including the current month so far, then send its viewing and request summary to your confirmed profile email.</p>
-    {data?.can_send ? <p><strong>{data.email}</strong> · One report email every five minutes.</p> : data && <p>{data.state === 'enabled' ? data.detail : 'Confirm your profile email in Email preferences first. You can choose on-demand delivery without automatic monthly emails.'}</p>}
-    <button type="button" disabled={busy || !data?.can_send} onClick={() => void send()}>{busy ? 'Queueing report…' : 'Email this report'}</button>
-    {notice && <p role="status">{notice}</p>}
-    {error && <p role="alert">{error}</p>}
-    {!!data?.deliveries.length && <details><summary>Recent report emails</summary><ul>{data.deliveries.map((item) => <li key={item.id}><strong>{item.month}</strong> · {item.state === 'sent' ? 'Accepted by mail server' : item.state} — {item.detail || 'Waiting for delivery'}</li>)}</ul></details>}
-  </section>
+  return (
+    <section className="stats-panel report-email-panel" aria-label="Email your report">
+      <div className="stats-panel-heading">
+        <h2>Email yourself this report</h2>
+        <a href="/profile#monthly-recaps">Email preferences</a>
+      </div>
+      <p>
+        Choose a month above, including the current month so far, then send its viewing and request summary to your
+        confirmed profile email.
+      </p>
+      {data?.can_send ? (
+        <p>
+          <strong>{data.email}</strong> · One report email every five minutes.
+        </p>
+      ) : (
+        data && (
+          <p>
+            {data.state === "enabled"
+              ? data.detail
+              : "Confirm your profile email in Email preferences first. You can choose on-demand delivery without automatic monthly emails."}
+          </p>
+        )
+      )}
+      <button type="button" disabled={busy || !data?.can_send} onClick={() => void send()}>
+        {busy ? "Queueing report…" : "Email this report"}
+      </button>
+      {notice && <p role="status">{notice}</p>}
+      {error && <p role="alert">{error}</p>}
+      {!!data?.deliveries.length && (
+        <details>
+          <summary>Recent report emails</summary>
+          <ul>
+            {data.deliveries.map((item) => (
+              <li key={item.id}>
+                <strong>{item.month}</strong> · {item.state === "sent" ? "Accepted by mail server" : item.state} —{" "}
+                {item.detail || "Waiting for delivery"}
+              </li>
+            ))}
+          </ul>
+        </details>
+      )}
+    </section>
+  );
 }

frontend/app/insights/reports/page.tsx

@@ -1,166 +1,533 @@
-'use client'
+"use client";
 
-import EmailReportControl from './EmailReportControl'
+import EmailReportControl from "./EmailReportControl";
 
-import { useCallback, useEffect, useRef, useState } from 'react'
-import { useRouter } from 'next/navigation'
-import { authFetch, getApiBase } from '../../lib/auth'
-import PageHeading from '../../ui/PageHeading'
-import { type Stats, BreakdownCard, RecentArtwork, StatsNavigation, StreamingCard, ViewingChart, dateLabel, number } from '../components'
-import '../stats.css'
-import './reports.css'
+import { useCallback, useEffect, useRef, useState } from "react";
+import { useRouter } from "next/navigation";
+import { authFetch, getApiBase } from "../../lib/auth";
+import { useEffectiveRole } from "../../lib/viewMode";
+import PageHeading from "../../ui/PageHeading";
+import {
+  type Stats,
+  BreakdownCard,
+  RecentArtwork,
+  StatsNavigation,
+  StreamingCard,
+  ViewingChart,
+  dateLabel,
+  number,
+} from "../components";
+import "../stats.css";
+import "./reports.css";
 
-type Change = { current: number; previous: number; difference: number; percent: number | null }
-type MonthlyReport = Omit<Stats, 'days'> & {
-  month: string; available_months: string[]; is_partial: boolean; comparison_capped: boolean
-  period_start: string; period_end: string; comparison_month: string; comparison_start: string; comparison_end: string
-  previous_summary?: Stats['summary']; previous_requests?: Omit<Stats['requests'], 'recent'>
-  changes?: Record<'minutes' | 'movies' | 'episodes' | 'plays' | 'active_days' | 'longest_streak' | 'requests', Change>
-}
+type Change = { current: number; previous: number; difference: number; percent: number | null };
+type MonthlyReport = Omit<Stats, "days"> & {
+  month: string;
+  available_months: string[];
+  is_partial: boolean;
+  comparison_capped: boolean;
+  period_start: string;
+  period_end: string;
+  comparison_month: string;
+  comparison_start: string;
+  comparison_end: string;
+  previous_summary?: Stats["summary"];
+  previous_requests?: Omit<Stats["requests"], "recent">;
+  changes?: Record<"minutes" | "movies" | "episodes" | "plays" | "active_days" | "longest_streak" | "requests", Change>;
+};
 
-const monthLabel = (month: string, short = false) => new Date(`${month}-01T00:00:00Z`).toLocaleDateString(undefined, { month: short ? 'short' : 'long', year: 'numeric', timeZone: 'UTC' })
-const decimal = (value: number) => value.toLocaleString(undefined, { maximumFractionDigits: 1 })
+const monthLabel = (month: string, short = false) =>
+  new Date(`${month}-01T00:00:00Z`).toLocaleDateString(undefined, {
+    month: short ? "short" : "long",
+    year: "numeric",
+    timeZone: "UTC",
+  });
+const decimal = (value: number) => value.toLocaleString(undefined, { maximumFractionDigits: 1 });
 
-function ChangeLabel({ change, unit = '' }: { change: Change; unit?: string }) {
-  const delta = change.difference
-  return <div className={`report-change ${delta > 0 ? 'is-up' : delta < 0 ? 'is-down' : 'is-flat'}`}>
-    <span>{delta === 0 ? 'No change' : `${delta > 0 ? '+' : '−'}${decimal(Math.abs(delta))}${unit}${change.percent === null ? '' : ` (${delta > 0 ? '+' : '−'}${decimal(Math.abs(change.percent))}%)`}`}</span>
-    <small>{change.percent === null ? 'No activity recorded in the comparison period' : `Previously ${decimal(change.previous)}${unit}`}</small>
-  </div>
+function ChangeLabel({ change, unit = "" }: { change: Change; unit?: string }) {
+  const delta = change.difference;
+  return (
+    <div className={`report-change ${delta > 0 ? "is-up" : delta < 0 ? "is-down" : "is-flat"}`}>
+      <span>
+        {delta === 0
+          ? "No change"
+          : `${delta > 0 ? "+" : "−"}${decimal(Math.abs(delta))}${unit}${change.percent === null ? "" : ` (${delta > 0 ? "+" : "−"}${decimal(Math.abs(change.percent))}%)`}`}
+      </span>
+      <small>
+        {change.percent === null
+          ? "No activity recorded in the comparison period"
+          : `Previously ${decimal(change.previous)}${unit}`}
+      </small>
+    </div>
+  );
 }
 
 export default function MonthlyReportsPage() {
-  const router = useRouter()
-  const [month, setMonth] = useState('')
-  const [monthReady, setMonthReady] = useState(false)
-  const [months, setMonths] = useState<string[]>([])
-  const [data, setData] = useState<MonthlyReport | null>(null)
-  const [busy, setBusy] = useState(true)
-  const [error, setError] = useState('')
-  const [revision, setRevision] = useState(0)
-  const [downloading, setDownloading] = useState(false)
-  const [downloadError, setDownloadError] = useState('')
-  const downloadController = useRef<AbortController | null>(null)
+  const router = useRouter();
+  const [month, setMonth] = useState("");
+  const [monthReady, setMonthReady] = useState(false);
+  const [months, setMonths] = useState<string[]>([]);
+  const [data, setData] = useState<MonthlyReport | null>(null);
+  const isAdmin = useEffectiveRole(data?.is_admin ? "admin" : "user") === "admin";
+  const [busy, setBusy] = useState(true);
+  const [error, setError] = useState("");
+  const [revision, setRevision] = useState(0);
+  const [downloading, setDownloading] = useState(false);
+  const [downloadError, setDownloadError] = useState("");
+  const downloadController = useRef<AbortController | null>(null);
 
   useEffect(() => {
-    setMonth(new URLSearchParams(window.location.search).get('month') || '')
-    setMonthReady(true)
-  }, [])
+    setMonth(new URLSearchParams(window.location.search).get("month") || "");
+    setMonthReady(true);
+  }, []);
   useEffect(() => {
-    if (monthReady) window.history.replaceState(null, '', `/insights/reports${month ? `?month=${encodeURIComponent(month)}` : ''}`)
-  }, [month, monthReady])
-  useEffect(() => () => downloadController.current?.abort(), [])
-  const load = useCallback(async (signal: AbortSignal) => {
-    setBusy(true)
-    setError('')
-    setData(null)
-    setDownloadError('')
-    try {
-      const query = month ? `?month=${encodeURIComponent(month)}` : ''
-      const response = await authFetch(`${getApiBase()}/insights/reports/monthly${query}`, { signal })
-      if (response.status === 401) { router.replace(`/login?next=${encodeURIComponent(`/insights/reports${query}`)}`); return }
-      if (response.status === 403) throw new Error('Your account cannot access viewing reports. Please contact an administrator.')
-      if (!response.ok) {
-        const result = await response.json().catch(() => ({}))
-        throw new Error(typeof result.detail === 'string' ? result.detail : 'Your report is temporarily unavailable. Please try again shortly.')
+    if (monthReady)
+      window.history.replaceState(null, "", `/insights/reports${month ? `?month=${encodeURIComponent(month)}` : ""}`);
+  }, [month, monthReady]);
+  useEffect(() => () => downloadController.current?.abort(), []);
+  const load = useCallback(
+    async (signal: AbortSignal) => {
+      setBusy(true);
+      setError("");
+      setData(null);
+      setDownloadError("");
+      try {
+        const query = month ? `?month=${encodeURIComponent(month)}` : "";
+        const response = await authFetch(`${getApiBase()}/insights/reports/monthly${query}`, { signal });
+        if (response.status === 401) {
+          router.replace(`/login?next=${encodeURIComponent(`/insights/reports${query}`)}`);
+          return;
+        }
+        if (response.status === 403)
+          throw new Error("Your account cannot access viewing reports. Please contact an administrator.");
+        if (!response.ok) {
+          const result = await response.json().catch(() => ({}));
+          throw new Error(
+            typeof result.detail === "string"
+              ? result.detail
+              : "Your report is temporarily unavailable. Please try again shortly.",
+          );
+        }
+        const result = (await response.json()) as MonthlyReport;
+        if (!signal.aborted) {
+          setData(result);
+          setMonths(result.available_months);
+        }
+      } catch (err) {
+        if (!signal.aborted) setError(err instanceof Error ? err.message : "Could not load your report.");
+      } finally {
+        if (!signal.aborted) setBusy(false);
       }
-      const result = await response.json() as MonthlyReport
-      if (!signal.aborted) { setData(result); setMonths(result.available_months) }
-    } catch (err) {
-      if (!signal.aborted) setError(err instanceof Error ? err.message : 'Could not load your report.')
-    } finally {
-      if (!signal.aborted) setBusy(false)
-    }
-  }, [month, router])
+    },
+    [month, router],
+  );
   useEffect(() => {
-    if (!monthReady) return
-    const controller = new AbortController()
-    void load(controller.signal)
-    return () => controller.abort()
-  }, [load, revision, monthReady])
+    void revision;
+    if (!monthReady) return;
+    const controller = new AbortController();
+    void load(controller.signal);
+    return () => controller.abort();
+  }, [load, revision, monthReady]);
 
   const download = async () => {
-    if (data?.state !== 'ready' || downloading) return
-    const selected = data.month
-    const controller = new AbortController()
-    downloadController.current = controller
-    setDownloading(true)
-    setDownloadError('')
+    if (data?.state !== "ready" || downloading) return;
+    const selected = data.month;
+    const controller = new AbortController();
+    downloadController.current = controller;
+    setDownloading(true);
+    setDownloadError("");
     try {
-      const response = await authFetch(`${getApiBase()}/insights/reports/monthly.csv?month=${selected}`, { signal: controller.signal })
-      if (response.status === 401) { router.replace(`/login?next=${encodeURIComponent(`/insights/reports?month=${selected}`)}`); return }
-      if (!response.ok) throw new Error('The report could not be downloaded. Please try again.')
-      const blob = await response.blob()
-      if (controller.signal.aborted) return
-      const url = URL.createObjectURL(blob)
-      const link = document.createElement('a')
-      link.href = url
-      link.download = `magent-monthly-report-${selected}.csv`
-      document.body.appendChild(link)
-      link.click()
-      link.remove()
-      window.setTimeout(() => URL.revokeObjectURL(url), 1000)
+      const response = await authFetch(`${getApiBase()}/insights/reports/monthly.csv?month=${selected}`, {
+        signal: controller.signal,
+      });
+      if (response.status === 401) {
+        router.replace(`/login?next=${encodeURIComponent(`/insights/reports?month=${selected}`)}`);
+        return;
+      }
+      if (!response.ok) throw new Error("The report could not be downloaded. Please try again.");
+      const blob = await response.blob();
+      if (controller.signal.aborted) return;
+      const url = URL.createObjectURL(blob);
+      const link = document.createElement("a");
+      link.href = url;
+      link.download = `magent-monthly-report-${selected}.csv`;
+      document.body.appendChild(link);
+      link.click();
+      link.remove();
+      window.setTimeout(() => URL.revokeObjectURL(url), 1000);
     } catch (err) {
-      if (!controller.signal.aborted) setDownloadError(err instanceof Error ? err.message : 'Could not download your report.')
+      if (!controller.signal.aborted)
+        setDownloadError(err instanceof Error ? err.message : "Could not download your report.");
     } finally {
-      if (!controller.signal.aborted) setDownloading(false)
+      if (!controller.signal.aborted) setDownloading(false);
     }
-  }
+  };
 
-  const selectedMonth = month || data?.month || ''
-  const monthIndex = months.indexOf(selectedMonth)
-  const summary = data?.summary
-  const changes = data?.changes
-  return <main className="stats-page reports-page">
-    <PageHeading title="Monthly report" description="Your month in viewing. See what you watched, what changed, and what you requested." actions={<>
-      <button className="ghost-button" type="button" disabled={busy || downloading} onClick={() => setRevision((value) => value + 1)}>Refresh report</button>
-      <button className="ghost-button" type="button" disabled={busy || downloading || data?.state !== 'ready'} onClick={() => void download()}>{downloading ? 'Downloading…' : 'Download CSV'}</button>
-    </>} />
-    <StatsNavigation reports />
-    <div className="stats-toolbar">
-      <div className="report-month-picker">
-        <button type="button" className="ghost-button" aria-label="Previous month" disabled={busy || downloading || monthIndex < 0 || monthIndex >= months.length - 1} onClick={() => setMonth(months[monthIndex + 1])}>←</button>
-        <label><span className="stats-sr-only">Report month</span><select value={selectedMonth} disabled={busy || downloading || !months.length} onChange={(event) => setMonth(event.target.value)}>{!selectedMonth && <option value="">Latest complete month</option>}{months.map((value, index) => <option value={value} key={value}>{monthLabel(value)}{index === 0 ? ' · month to date' : ''}</option>)}</select></label>
-        <button type="button" className="ghost-button" aria-label="Next month" disabled={busy || downloading || monthIndex <= 0} onClick={() => setMonth(months[monthIndex - 1])}>→</button>
+  const selectedMonth = month || data?.month || "";
+  const monthIndex = months.indexOf(selectedMonth);
+  const summary = data?.summary;
+  const changes = data?.changes;
+  return (
+    <main className="stats-page reports-page">
+      <PageHeading
+        title="Monthly report"
+        description="Your month in viewing. See what you watched, what changed, and what you requested."
+        actions={
+          <>
+            <button
+              className="ghost-button"
+              type="button"
+              disabled={busy || downloading}
+              onClick={() => setRevision((value) => value + 1)}
+            >
+              Refresh report
+            </button>
+            <button
+              className="ghost-button"
+              type="button"
+              disabled={busy || downloading || data?.state !== "ready"}
+              onClick={() => void download()}
+            >
+              {downloading ? "Downloading…" : "Download CSV"}
+            </button>
+          </>
+        }
+      />
+      <StatsNavigation reports />
+      <div className="stats-toolbar">
+        <div className="report-month-picker">
+          <button
+            type="button"
+            className="ghost-button"
+            aria-label="Previous month"
+            disabled={busy || downloading || monthIndex < 0 || monthIndex >= months.length - 1}
+            onClick={() => setMonth(months[monthIndex + 1])}
+          >
+            ←
+          </button>
+          <label>
+            <span className="stats-sr-only">Report month</span>
+            <select
+              value={selectedMonth}
+              disabled={busy || downloading || !months.length}
+              onChange={(event) => setMonth(event.target.value)}
+            >
+              {!selectedMonth && <option value="">Latest complete month</option>}
+              {months.map((value, index) => (
+                <option value={value} key={value}>
+                  {monthLabel(value)}
+                  {index === 0 ? " · month to date" : ""}
+                </option>
+              ))}
+            </select>
+          </label>
+          <button
+            type="button"
+            className="ghost-button"
+            aria-label="Next month"
+            disabled={busy || downloading || monthIndex <= 0}
+            onClick={() => setMonth(months[monthIndex - 1])}
+          >
+            →
+          </button>
+        </div>
+        <p className="stats-source">
+          <span className={data?.state === "ready" ? "stats-source-dot is-ready" : "stats-source-dot"} />
+          From Jellystat · UTC
+        </p>
       </div>
-      <p className="stats-source"><span className={data?.state === 'ready' ? 'stats-source-dot is-ready' : 'stats-source-dot'} />From Jellystat · UTC</p>
-    </div>
-    {downloadError && <p className="stats-notice" role="alert">{downloadError}</p>}
-    {data?.state === 'ready' && !busy && <EmailReportControl month={data.month} />}
-    {busy && <div className="stats-state" role="status"><span className="stats-state-symbol" aria-hidden="true">◷</span><h2>Putting your month together</h2><p>Gathering your viewing history and the previous month’s comparison.</p></div>}
-    {error && <div className="stats-state" role="alert"><h2>Report couldn’t load</h2><p>{error}</p><button type="button" className="ghost-button" onClick={() => setRevision((value) => value + 1)}>Try again</button>{month && <button type="button" className="ghost-button" onClick={() => setMonth('')}>Latest complete month</button>}</div>}
-    {data?.state === 'not_configured' && <section className="stats-state"><h2>Your monthly story starts here</h2><p>{data.is_admin ? 'Connect Jellystat to bring your monthly viewing reports into Magent.' : 'Monthly reports will appear once your administrator connects Jellystat.'}</p>{data.is_admin && <a className="stats-action" href="/admin/jellystat">Connect Jellystat</a>}</section>}
-    {data?.state === 'unlinked' && <section className="stats-state"><h2>Link your viewing account</h2><p>Your report needs your Jellyfin account link. Sign in using Jellyfin, or ask your administrator to review your user identities.</p>{data.is_admin && <a className="stats-action" href="/admin/identities">Review user identities</a>}</section>}
-    {data && summary && changes && <>
-      <section className="report-intro" aria-label="Report period">
-        <div><span className="report-kicker">{data.is_partial ? 'Month to date' : 'Your monthly recap'}</span><h2>{monthLabel(data.month)}</h2><p>{data.is_partial ? `Compared with the same elapsed time in ${monthLabel(data.comparison_month)}${data.comparison_capped ? ', capped at the end of that month' : ''}.` : `Compared with ${monthLabel(data.comparison_month)}.`}</p></div>
-        <div className="report-period-meta"><span>{data.is_partial ? 'In progress' : 'Complete month'}</span><small>{data.updated_at && `Updated ${new Date(data.updated_at).toLocaleString(undefined, { dateStyle: 'medium', timeStyle: 'short', timeZone: 'UTC' })} UTC`}</small></div>
-      </section>
-      <section className="stats-metrics" aria-label="Monthly totals">
-        <article className="stats-metric stats-metric-accent"><span>Minutes watched</span><strong>{number(summary.minutes)}</strong><small>{decimal(summary.minutes / 60)} hours across {number(summary.plays)} plays</small><ChangeLabel change={changes.minutes} unit=" min" /></article>
-        <article className="stats-metric"><span>Movies played</span><strong>{number(summary.movies)}</strong><small>Different movies you pressed play on</small><ChangeLabel change={changes.movies} /></article>
-        <article className="stats-metric"><span>Episodes played</span><strong>{number(summary.episodes)}</strong><small>Different episodes in your history</small><ChangeLabel change={changes.episodes} /></article>
-        <article className="stats-metric"><span>Requests made</span><strong>{number(data.requests.total)}</strong><small>{data.requests.movies} movies · {data.requests.tv} TV requests</small><ChangeLabel change={changes.requests} /></article>
-      </section>
-      {summary.plays === 0 && <div className="stats-notice" role="status">No viewing history was recorded for this month. Your request totals and comparison are still shown.</div>}
-      <div className="stats-main-grid">
-        <ViewingChart key={`${data.month}-${revision}`} daily={data.daily ?? []} />
-        <section className="stats-panel report-highlights"><div className="stats-panel-heading"><h2>Your viewing habits</h2></div>
-          <div className="stats-highlight"><span className="stats-highlight-number">{summary.active_days}<small> days</small></span><div><strong>Days you watched</strong><p>At least one minute of viewing.</p><ChangeLabel change={changes.active_days} unit=" days" /></div></div>
-          <div className="stats-highlight"><span className="stats-highlight-number">{summary.longest_streak}<small> days</small></span><div><strong>Longest run</strong><p>Consecutive viewing days this month.</p><ChangeLabel change={changes.longest_streak} unit=" days" /></div></div>
-          <div className="stats-highlight"><span className="stats-highlight-number">{data.daily?.length ? number(summary.minutes / data.daily.length) : 0}<small> min</small></span><div><strong>Daily average</strong><p>Across the calendar days in this report.</p></div></div>
+      {downloadError && (
+        <p className="stats-notice" role="alert">
+          {downloadError}
+        </p>
+      )}
+      {data?.state === "ready" && !busy && <EmailReportControl month={data.month} />}
+      {busy && (
+        <div className="stats-state" role="status">
+          <span className="stats-state-symbol" aria-hidden="true">
+            ◷
+          </span>
+          <h2>Putting your month together</h2>
+          <p>Gathering your viewing history and the previous month’s comparison.</p>
+        </div>
+      )}
+      {error && (
+        <div className="stats-state" role="alert">
+          <h2>Report couldn’t load</h2>
+          <p>{error}</p>
+          <button type="button" className="ghost-button" onClick={() => setRevision((value) => value + 1)}>
+            Try again
+          </button>
+          {month && (
+            <button type="button" className="ghost-button" onClick={() => setMonth("")}>
+              Latest complete month
+            </button>
+          )}
+        </div>
+      )}
+      {data?.state === "not_configured" && (
+        <section className="stats-state">
+          <h2>Your monthly story starts here</h2>
+          <p>
+            {isAdmin
+              ? "Connect Jellystat to bring your monthly viewing reports into Magent."
+              : "Monthly reports will appear once your administrator connects Jellystat."}
+          </p>
+          {isAdmin && (
+            <a className="stats-action" href="/admin/jellystat">
+              Connect Jellystat
+            </a>
+          )}
         </section>
-      </div>
-      <div className="stats-three-grid">
-        <section className="stats-panel"><div className="stats-panel-heading"><h2>Most watched</h2><span className="stats-unit">By minutes</span></div>{data.top_titles?.length ? <ol className="stats-top-titles report-top-titles">{data.top_titles.map((title, index) => <li key={`${title.title}-${index}`}><div><strong>{title.title}</strong><small>{title.type === 'series' ? 'TV series' : title.type === 'movie' ? 'Movie' : 'Other media'} · {title.plays} plays</small></div><span>{number(title.minutes)}<small>min</small></span></li>)}</ol> : <p className="stats-muted">Your most watched titles will appear here.</p>}</section>
-        <BreakdownCard title="Your players" rows={data.clients ?? []} />
-        <StreamingCard rows={data.methods ?? []} transcoding={data.transcoding} />
-      </div>
-      <div className="stats-main-grid">
-        <section className="stats-panel stats-history"><div className="stats-panel-heading"><h2>A look back</h2><span className="stats-unit">Latest 20 plays this month</span></div>{data.recent?.length ? <div className="stats-history-list">{data.recent.map((play) => <article key={play.id}><RecentArtwork key={play.artwork_url ?? play.id} url={play.artwork_url} type={play.type} /><div className="stats-history-title"><strong>{play.series || play.title}</strong><small>{play.series ? `${play.episode} · ${play.title}` : play.type === 'movie' ? 'Movie' : 'Media'}</small><span>{play.client} · {play.method}</span></div><div className="stats-history-time"><strong>{number(play.minutes)} min</strong><time dateTime={play.played_at}>{dateLabel(play.played_at)}</time></div></article>)}</div> : <p className="stats-muted">Plays recorded during this month will appear here.</p>}</section>
-        <section className="stats-panel stats-requests"><div className="stats-panel-heading"><h2>Your requests</h2><a href="/">View all</a></div><div className="stats-request-total"><strong>{data.requests.total}</strong><span>submitted in {monthLabel(data.month, true)}</span></div><div className="stats-request-counts"><span><strong>{data.requests.pending}</strong> Pending</span><span><strong>{data.requests.approved}</strong> Approved</span><span><strong>{data.requests.declined}</strong> Declined</span></div>{data.requests.recent.length ? <ul className="stats-request-list">{data.requests.recent.map((request) => <li key={request.request_id}><a href={`/requests/${request.request_id}`}>{request.title || `Request ${request.request_id}`}<span aria-hidden="true">↗</span></a></li>)}</ul> : <p className="stats-muted">No requests recorded during this month.</p>}<p className="stats-muted">Statuses reflect where these requests are now.</p></section>
-      </div>
-      <p className="stats-footnote">Private to your account · Based on history retained by Jellystat and requests available in Magent. Plays include unfinished watches. Dates and streaks use UTC. Reports may take a minute to refresh; historical totals can change when retained history or library metadata changes.</p>
-    </>}
-  </main>
+      )}
+      {data?.state === "unlinked" && (
+        <section className="stats-state">
+          <h2>Link your viewing account</h2>
+          <p>
+            Your report needs your Jellyfin account link. Sign in using Jellyfin, or ask your administrator to review
+            your user identities.
+          </p>
+          {isAdmin && (
+            <a className="stats-action" href="/admin/identities">
+              Review user identities
+            </a>
+          )}
+        </section>
+      )}
+      {data && summary && changes && (
+        <>
+          <section className="report-intro" aria-label="Report period">
+            <div>
+              <span className="report-kicker">{data.is_partial ? "Month to date" : "Your monthly recap"}</span>
+              <h2>{monthLabel(data.month)}</h2>
+              <p>
+                {data.is_partial
+                  ? `Compared with the same elapsed time in ${monthLabel(data.comparison_month)}${data.comparison_capped ? ", capped at the end of that month" : ""}.`
+                  : `Compared with ${monthLabel(data.comparison_month)}.`}
+              </p>
+            </div>
+            <div className="report-period-meta">
+              <span>{data.is_partial ? "In progress" : "Complete month"}</span>
+              <small>
+                {data.updated_at &&
+                  `Updated ${new Date(data.updated_at).toLocaleString(undefined, { dateStyle: "medium", timeStyle: "short", timeZone: "UTC" })} UTC`}
+              </small>
+            </div>
+          </section>
+          <section className="stats-metrics" aria-label="Monthly totals">
+            <article className="stats-metric stats-metric-accent">
+              <span>Minutes watched</span>
+              <strong>{number(summary.minutes)}</strong>
+              <small>
+                {decimal(summary.minutes / 60)} hours across {number(summary.plays)} plays
+              </small>
+              <ChangeLabel change={changes.minutes} unit=" min" />
+            </article>
+            <article className="stats-metric">
+              <span>Movies played</span>
+              <strong>{number(summary.movies)}</strong>
+              <small>Different movies you pressed play on</small>
+              <ChangeLabel change={changes.movies} />
+            </article>
+            <article className="stats-metric">
+              <span>Episodes played</span>
+              <strong>{number(summary.episodes)}</strong>
+              <small>Different episodes in your history</small>
+              <ChangeLabel change={changes.episodes} />
+            </article>
+            <article className="stats-metric">
+              <span>Requests made</span>
+              <strong>{number(data.requests.total)}</strong>
+              <small>
+                {data.requests.movies} movies · {data.requests.tv} TV requests
+              </small>
+              <ChangeLabel change={changes.requests} />
+            </article>
+          </section>
+          {summary.plays === 0 && (
+            <div className="stats-notice" role="status">
+              No viewing history was recorded for this month. Your request totals and comparison are still shown.
+            </div>
+          )}
+          <div className="stats-main-grid">
+            <ViewingChart key={`${data.month}-${revision}`} daily={data.daily ?? []} />
+            <section className="stats-panel report-highlights">
+              <div className="stats-panel-heading">
+                <h2>Your viewing habits</h2>
+              </div>
+              <div className="stats-highlight">
+                <span className="stats-highlight-number">
+                  {summary.active_days}
+                  <small> days</small>
+                </span>
+                <div>
+                  <strong>Days you watched</strong>
+                  <p>At least one minute of viewing.</p>
+                  <ChangeLabel change={changes.active_days} unit=" days" />
+                </div>
+              </div>
+              <div className="stats-highlight">
+                <span className="stats-highlight-number">
+                  {summary.longest_streak}
+                  <small> days</small>
+                </span>
+                <div>
+                  <strong>Longest run</strong>
+                  <p>Consecutive viewing days this month.</p>
+                  <ChangeLabel change={changes.longest_streak} unit=" days" />
+                </div>
+              </div>
+              <div className="stats-highlight">
+                <span className="stats-highlight-number">
+                  {data.daily?.length ? number(summary.minutes / data.daily.length) : 0}
+                  <small> min</small>
+                </span>
+                <div>
+                  <strong>Daily average</strong>
+                  <p>Across the calendar days in this report.</p>
+                </div>
+              </div>
+            </section>
+          </div>
+          {data.patterns && (
+            <>
+              <section className="report-pattern-summary" aria-label="Viewing insights">
+                <article>
+                  <span>Average play</span>
+                  <strong>
+                    {decimal(data.patterns.average_play_minutes)} <small>min</small>
+                  </strong>
+                  <p>Time per recorded playback session.</p>
+                </article>
+                <article>
+                  <span>Longest play</span>
+                  <strong>
+                    {decimal(data.patterns.longest_play_minutes)} <small>min</small>
+                  </strong>
+                  <p>Your longest recorded session this month.</p>
+                </article>
+                <article>
+                  <span>Weekend viewing</span>
+                  <strong>
+                    {decimal(data.patterns.weekend_percent)}
+                    <small>%</small>
+                  </strong>
+                  <p>Share of viewing on Saturday and Sunday (UTC).</p>
+                </article>
+              </section>
+              <div className="stats-main-grid">
+                <BreakdownCard title="Your week in viewing (UTC)" rows={data.patterns.weekdays} />
+                <BreakdownCard title="Movies, TV and more" rows={data.patterns.media} />
+              </div>
+            </>
+          )}
+          <div className="stats-three-grid">
+            <section className="stats-panel">
+              <div className="stats-panel-heading">
+                <h2>Most watched</h2>
+                <span className="stats-unit">By minutes</span>
+              </div>
+              {data.top_titles?.length ? (
+                <ol className="stats-top-titles report-top-titles">
+                  {data.top_titles.map((title, index) => (
+                    <li key={`${title.title}-${index}`}>
+                      <RecentArtwork url={title.artwork_url} type={title.type} />
+                      <div>
+                        <strong>{title.title}</strong>
+                        <small>
+                          {title.type === "series" ? "TV series" : title.type === "movie" ? "Movie" : "Other media"} ·{" "}
+                          {title.plays} plays
+                        </small>
+                      </div>
+                      <span>
+                        {number(title.minutes)}
+                        <small>min</small>
+                      </span>
+                    </li>
+                  ))}
+                </ol>
+              ) : (
+                <p className="stats-muted">Your most watched titles will appear here.</p>
+              )}
+            </section>
+            <BreakdownCard title="Your players" rows={data.clients ?? []} />
+            <StreamingCard rows={data.methods ?? []} transcoding={data.transcoding} />
+          </div>
+          <div className="stats-main-grid">
+            <section className="stats-panel stats-history">
+              <div className="stats-panel-heading">
+                <h2>A look back</h2>
+                <span className="stats-unit">Latest 20 plays this month</span>
+              </div>
+              {data.recent?.length ? (
+                <div className="stats-history-list">
+                  {data.recent.map((play) => (
+                    <article key={play.id}>
+                      <RecentArtwork key={play.artwork_url ?? play.id} url={play.artwork_url} type={play.type} />
+                      <div className="stats-history-title">
+                        <strong>{play.series || play.title}</strong>
+                        <small>
+                          {play.series ? `${play.episode} · ${play.title}` : play.type === "movie" ? "Movie" : "Media"}
+                        </small>
+                        <span>
+                          {play.client} · {play.method}
+                        </span>
+                      </div>
+                      <div className="stats-history-time">
+                        <strong>{number(play.minutes)} min</strong>
+                        <time dateTime={play.played_at}>{dateLabel(play.played_at)}</time>
+                      </div>
+                    </article>
+                  ))}
+                </div>
+              ) : (
+                <p className="stats-muted">Plays recorded during this month will appear here.</p>
+              )}
+            </section>
+            <section className="stats-panel stats-requests">
+              <div className="stats-panel-heading">
+                <h2>Your requests</h2>
+                <a href="/">View all</a>
+              </div>
+              <div className="stats-request-total">
+                <strong>{data.requests.total}</strong>
+                <span>submitted in {monthLabel(data.month, true)}</span>
+              </div>
+              <div className="stats-request-counts">
+                <span>
+                  <strong>{data.requests.pending}</strong> Pending
+                </span>
+                <span>
+                  <strong>{data.requests.approved}</strong> Approved
+                </span>
+                <span>
+                  <strong>{data.requests.declined}</strong> Declined
+                </span>
+              </div>
+              {data.requests.recent.length ? (
+                <ul className="stats-request-list">
+                  {data.requests.recent.map((request) => (
+                    <li key={request.request_id}>
+                      <a href={`/requests/${request.request_id}`}>
+                        {request.title || `Request ${request.request_id}`}
+                        <span aria-hidden="true">↗</span>
+                      </a>
+                    </li>
+                  ))}
+                </ul>
+              ) : (
+                <p className="stats-muted">No requests recorded during this month.</p>
+              )}
+              <p className="stats-muted">Statuses reflect where these requests are now.</p>
+            </section>
+          </div>
+          <p className="stats-footnote">
+            Private to your account · Based on history retained by Jellystat and requests available in Magent. Plays
+            include unfinished watches. Dates and streaks use UTC. Reports may take a minute to refresh; historical
+            totals can change when retained history or library metadata changes.
+          </p>
+        </>
+      )}
+    </main>
+  );
 }