chore(deps): lock file maintenance

The homepage mixed four different translucent washes (surface 44-60% plus a
backdrop-filter each), rendered the same four counters twice, and showed a
dangling "Welcome to " eyebrow because the localized string expected the hotel
name. A missing theme wallpaper replaced the whole sky gradient with flat
white, and stale CMS image references produced broken images and 404s.

Replace the ad-hoc panels with one opaque, theme-derived `.panel` token set
(surface, border, shadow, header, radius) and a `.panel-float` variant for the
counter strip that straddles the hero edge. The strip is now the single home
of the four headline counters; a failed read renders "unavailable" instead of
silently dropping a cell. Add the fourth feature card (Games) that already had
translated copy, link recent users to their profiles, and fall back to themed
placeholders for news covers and camera photos without an upload.

Add `pages.home.heroEyebrow` to all 25 locales, layer the CMS wallpaper over
`--site-bg-gradient` instead of replacing it, and keep the sky in dark mode.
Add `publicAssetExists` so local uploads that no longer exist are skipped
(wallpaper, help topics) rather than rendered broken. Fix the `/help` topic
icons to use the `/assets/images/help-center/` base the detail page already
used.

Throttle the spotlight glow to one update per animation frame, drop the dead
`.glass-chip` rules, define the missing `.panel-float`, and fix the stat
divider and reduced-motion selectors. Stat labels use the readable text token
so they clear WCAG AA, and the language button's accessible name now contains
its visible label.

Verified: tsc, biome, 3590 unit tests, i18n audit unchanged, axe 0 violations
at 390/768/1024/1280/1440 in light and dark, quality e2e 16/16.

.dockerignore

@@ -26,6 +26,25 @@ bun.lockb
 public/nitro-assets
 public/swf
 
+# Testbronnen draaien op de host (pnpm test:ui / test:integration / test:e2e),
+# de image heeft ze niet nodig. In de image zouden ze alleen de typecheck van
+# `next build` meebepalen en de image van @playwright/test, vitest, msw,
+# testcontainers en drizzle-kit afhankelijk maken.
+e2e/
+integration/
+
+# Databasebackups (~232MB, dagelijkse rotatie): horen niet in de buildcontext.
+# Ze maakten elke context groot en invalideerden bij elke rotatie de
+# `COPY . .`-laag, waardoor de Next-build volledig opnieuw draaide.
+backups/
+
+# Wordt tijdens de build opnieuw gegenereerd door `pnpm assets:editor`
+# (bron: node_modules/tinymce) en staat niet in git.
+public/vendor/
+
+# Lokale buildcache voor `docker compose build` (cache_from/cache_to).
+.docker-cache/
+
 .deploy.lock
 logs
 

.gitea/workflows/renovate.yaml

@@ -1,30 +1,44 @@
 name: Renovate
+
 on:
   schedule:
-    - cron: "0 5 * * *" # Every day at 05:00 UTC
-  workflow_dispatch: # Manual trigger
+    - cron: "17 4 * * 1-5"
+  workflow_dispatch:
+    inputs:
+      debug:
+        description: "Debug-loglevel"
+        type: boolean
+        default: false
+
+# Niet overlappen met zichzelf; een tweede start wacht tot de eerste klaar is.
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+env:
+  RENOVATE_VERSION: 44.164.10 # renovate: datasource=npm depName=renovate
 
 jobs:
   renovate:
-    runs-on: self-hosted
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
-      - name: Fix Git safe directory
-        run: "git config --global --add safe.directory '*' && git remote set-url origin https://epicnabbo.nl || true"
-      - name: Install Bash in Alpine
-        run: "if [ -f /etc/alpine-release ]; then apk add --no-cache bash; fi"
-      - name: Self-hosted Renovate
+      - name: Run Renovate
+        env:
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          LOG_LEVEL: ${{ github.event.inputs.debug == 'true' && 'debug' || 'info' }}
+        shell: bash
         run: |
-          set -e
-
-          # Ensure cache dir exists before Docker starts
-          mkdir -p /var/tmp/renovate-cache
-
           docker run --rm \
-            --user "$(id -u):$(id -g)" \
-            -e RENOVATE_TOKEN="${{ secrets.RENOVATE_TOKEN }}" \
+            --memory=6g \
+            --memory-swap=6g \
+            -e RENOVATE_PLATFORM=gitea \
+            -e RENOVATE_ENDPOINT=https://gitlab.epicnabbo.nl/ \
+            -e RENOVATE_TOKEN \
+            -e RENOVATE_REPOSITORIES='["remco/EpicNext-Cms"]' \
             -e RENOVATE_AUTODISCOVER=false \
-            -e RENOVATE_REPOSITORIES="${{ gitea.repository }}" \
-            -e RENOVATE_ONBOARDING=false \
-            -e LOG_LEVEL=info \
-            -v /var/tmp/renovate-cache:/tmp/renovate-cache \
-            ghcr.io/renovatebot/renovate:latest
+            -e RENOVATE_BINARY_SOURCE=install \
+            -e LOG_LEVEL \
+            -e RENOVATE_ONBOARDING=true \
+            -e RENOVATE_REQUIRE_CONFIG=required \
+            "renovate/renovate:${RENOVATE_VERSION}"

.gitea/workflows/test-runner.yaml

@@ -1,17 +0,0 @@
-name: Gitea Actions Runner Test
-on: [push]
-
-jobs:
-  test-job:
-    runs-on: self-hosted
-    steps:
-      - name: Check Host Environment
-        run: |
-          echo "The v3.5.0 runner works!"
-          echo "Current date/time on VPS:"
-          date
-          echo "Running kernel version:"
-          uname -a
-
-      - name: Test Bash Command
-        run: echo "Greetings from the host runner!"

.gitignore

@@ -6,6 +6,8 @@ node_modules.prev/
 .next-staging/
 next-env.d.ts
 .env
+.env.local
+.env.*.local
 *.tsbuildinfo
 src/generated/
 # Runtime avatar/badge imaging disk cache
@@ -13,6 +15,8 @@ public/cache/
 
 prod.log
 *.log
+# Imager health-alert state (last-known up/down + timestamp)
+logs/imager-health.state
 
 # Database backups
 db_backup_*.sql
@@ -52,3 +56,10 @@ blob-report/
 .env.install.*
 build-reports/
 !/docs/performance-budgets.md
+
+# Local buildcache (docker compose cache_from/cache_to)
+.docker-cache/
+
+# One-off local snapshots (o.a. catalog-integrity/pre-fix.json): runtime-werk,
+# geen bron. Per map opgeslagen om een incident terug te kunnen lezen.
+backups/

.gitlab-ci.yml

@@ -1,33 +0,0 @@
-image: node:26
-
-stages:
-  - test
-  - build
-
-cache:
-  paths:
-    - node_modules/
-
-before_script:
-  - corepack enable
-  - pnpm install --frozen-lockfile
-
-lint:
-  stage: test
-  script:
-    - pnpm run lint
-
-typecheck:
-  stage: test
-  script:
-    - pnpm run typecheck
-
-test:
-  stage: test
-  script:
-    - pnpm run test
-
-build:
-  stage: build
-  script:
-    - pnpm run build

.nvmrc

@@ -1 +1 @@
-26.10.0
+26.12.1

.runner

@@ -0,0 +1,14 @@
+{
+  "WARNING": "This file is automatically generated by Gitea Runner. Do not edit it manually unless you know what you are doing. Removing this file will cause Gitea Runner to re-register as a new runner.",
+  "id": 22,
+  "uuid": "ffb52201-e18e-4a0f-96e9-cf8a0b849365",
+  "name": "v5-runner",
+  "token": "0484b5a82d3bda9a62972a6d2646ca7cb90bc4e2",
+  "address": "https://gitlab.epicnabbo.nl/",
+  "labels": [
+    "self-hosted:host",
+    "ubuntu-latest:docker://node:18-bullseye",
+    "debian-latest:docker://debian:bullseye-slim"
+  ],
+  "ephemeral": false
+}

CATALOG_EXPORT.md

@@ -27,7 +27,7 @@ This source change alone does not configure or deploy the production service.
 ## Exported content
 
 | Source                                                                   | Repository destination                              |
-| --- | --- |
+| ------------------------------------------------------------------------ | --------------------------------------------------- |
 | Configured Nitro bundles, including furniture, figures, effects and pets | `Gamedata/bundled`                                  |
 | Configured furni icons                                                   | `Gamedata/icons`                                    |
 | Existing badge/catalog images                                            | `Gamedata/c_images`                                 |

biome.json

@@ -25,6 +25,10 @@
 			},
 			"style": {
 				"noDescendingSpecificity": "off"
+			},
+			"correctness": {
+				"noComponentHookFactories": "off",
+				"usePlaywrightValidDescribeCallback": "off"
 			}
 		}
 	},
@@ -38,6 +42,30 @@
 					}
 				}
 			}
+		},
+		{
+			"includes": [
+				"src/components/admin/catalog-manager/sortable-tree.tsx",
+				"src/components/admin/studio/organize-imports-dialog/mall-helpers.tsx",
+				"src/app/admin/import/furni/nitro-editor-dialog.tsx"
+			],
+			"linter": {
+				"rules": {
+					"suspicious": {
+						"noArrayIndexKey": "off"
+					}
+				}
+			}
+		},
+		{
+			"includes": ["src/components/admin/catalog-manager/sortable-tree.tsx"],
+			"linter": {
+				"rules": {
+					"correctness": {
+						"useExhaustiveDependencies": "off"
+					}
+				}
+			}
 		}
 	],
 	"css": {

cms

@@ -4,7 +4,6 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 case "${1:-help}" in
   install) shift; exec bash "$DIR/scripts/docker-install.sh" "$@" ;;
   update) shift; exec bash "$DIR/scripts/docker-update.sh" "$@" ;;
-  security) shift; exec bash "$DIR/scripts/crowdsec-setup.sh" "$@" ;;
-  help|--help|-h) printf '%s\n' 'bash cms install   Configure and install on a Linux Docker host' 'bash cms update    Update using saved settings; --skip-pull uses checked-out release' 'bash cms security  Configure the opt-in local CrowdSec stack (enable|status|disable|blocklists)' ;;
-  *) echo "Unknown command. Use: bash cms install | update | security" >&2; exit 1 ;;
+  help|--help|-h) printf '%s\n' 'bash cms install   Configure and install on a Linux Docker host' 'bash cms update    Update using saved settings; --skip-pull uses checked-out release' ;;
+  *) echo "Unknown command. Use: bash cms install | update" >&2; exit 1 ;;
 esac

deploy.sh

@@ -1,29 +1,31 @@
-#!/bin/bash
-# Forcefully free port 3002 and redeploy the CMS
-PORT=3002
+#!/usr/bin/env bash
+# Handmatige release uitvoeren.
+#
+# Dit script is bewust een dunne wrapper. Het echte werk zit in
+# `scripts/ci-deploy.sh`, want dat is wat Gitea Actions ook draait. Eén deploypad
+# betekent dat een handmatige release niet anders kan werken dan een release uit
+# CI, dus er is geen tweede, slechter onderhouden pad meer.
+#
+# Waarom dit niet meer zelf doet wat het deed:
+#   - `fuser -k 3002/tcp` sloopte de live release bij elke mislukte build;
+#   - `docker compose down` haalde de site omlaag vóórdat er iets nieuws stond;
+#   - de container draait via `docker run` uit ci-deploy.sh, niet via compose, dus
+#     compose beheerde hier nooit de release die er echt draaide.
+#
+# `scripts/ci-deploy.sh` start nu blue/green: de nieuwe release komt op de vrije
+# poort terwijl de live release door blijft draaien, en nginx gaat pas om nadat
+# de kandidaat gezond is en de e2e-test heeft gewonnen.
+set -Eeuo pipefail
 
-echo "--- Preparing for deployment ---"
+deploy_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$deploy_dir"
 
-# Check if fuser is installed, if not, warn the user
-if ! command -v fuser &> /dev/null; then
-    echo "Error: 'fuser' command not found. Please install psmisc (e.g., sudo apt install psmisc)."
-    exit 1
-fi
-
-echo "Forcefully freeing port $PORT..."
-# -k kills processes, -n tcp specifies tcp socket
-fuser -k $PORT/tcp || echo "No process found on port $PORT or already free."
-
-echo "Stopping containers..."
-docker compose down
-
-echo "Starting deployment..."
-if docker compose up -d --build; then
-    ./scripts/alert.sh "Deployment successful for EpicNext-Cms"
-    echo "--- Deployment successful ---"
-else
-    ./scripts/alert.sh "Deployment FAILED for EpicNext-Cms"
-    echo "--- Deployment FAILED ---"
-    exit 1
+if [ "${1:-}" = "--help" ] || [ "${1:-}" = "-h" ]; then
+	sed -n '2,20p' "$deploy_dir/deploy.sh" | sed 's/^# \{0,1\}//'
+	exit 0
 fi
 
+# De branch-guard in ci-deploy.sh accepteert alleen main/master, en controleert
+# daarna of de HEAD-commit nog de nieuwste op de remote is. Deployen vanuit een
+# feature-branch kan dus niet per ongeluk; dat was eerder wél mogelijk.
+exec bash "$deploy_dir/scripts/ci-deploy.sh" "$@"

deployment/crowdsec/acquis.d/nginx.yaml

@@ -1,4 +0,0 @@
-filenames:
-  - /var/log/nginx/access.log
-labels:
-  type: nginx

deployment/crowdsec/compose.crowdsec.yml

@@ -1,41 +0,0 @@
-services:
-  crowdsec:
-    image: crowdsecurity/crowdsec:${CROWDSEC_VERSION:-v1.8.1}
-    container_name: epicnext-crowdsec
-    restart: unless-stopped
-    profiles: ["security"]
-    environment:
-      DISABLE_AGENT: "true"
-      BOUNCER_KEY_cms: ${CROWDSEC_LAPI_API_KEY:?CROWDSEC_LAPI_API_KEY must be set}
-      DISABLE_ONLINE_API: "true"
-      GID: "${CROWDSEC_GID:-0}"
-      TZ: "${TZ:-UTC}"
-    ports:
-      - "${CROWDSEC_LAPI_BIND_HOST:-127.0.0.1}:${CROWDSEC_LAPI_PORT:-18080}:8080"
-    volumes:
-      - ./acquis.d:/etc/crowdsec/acquis.d:ro
-      - ${CROWDSEC_NGINX_LOG_DIR:-/var/log/nginx}:/var/log/nginx:ro
-      - crowdsec-config:/etc/crowdsec
-      - crowdsec-data:/var/lib/crowdsec/data
-    security_opt:
-      - no-new-privileges:true
-    pids_limit: 256
-    logging:
-      driver: json-file
-      options:
-        max-size: "10m"
-        max-file: "3"
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "wget -q -O - http://127.0.0.1:8080/health >/dev/null 2>&1",
-        ]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 30s
-
-volumes:
-  crowdsec-config:
-  crowdsec-data:

deployment/proxy/cloudflare-ips.conf

@@ -0,0 +1,81 @@
+# Trusted edge networks + live Cloudflare CDN ranges.
+# Managed/regenerated by scripts/cf-ips-sync.sh - do not hand-edit the ranges.
+
+# Topology: Cloudflare -> Traefik (:443, docker bridge proxy_traefik-proxy) ->
+# nginx (:9443) -> CMS. nginx ALSO receives direct connections on :9443 from
+# Cloudflare edges and from the game client (ws.epicnabbo.nl is not proxied).
+
+# nginx only trusts the peers listed here as a source of $remote_addr
+# (via CF-Connecting-IP). Anyone else presenting a CF-Connecting-IP or
+# CF-ray header is spoofing and is rejected in nginx-cms.conf.
+
+# 1 = peer is a trusted edge or internal network (keyed on the raw peer,
+#     unaffected by real_ip rewrites).
+geo $realip_remote_addr $cms_trusted_edge {
+    default 0;
+    127.0.0.0/8 1;                    # localhost (health checks, admin)
+    ::1 1;                            # localhost v6
+    172.22.0.0/16 1;                # Traefik (proxyserver_traefik-proxy)
+    # --- Cloudflare IPv4 ranges (live from cloudflare.com/ips-v4) ---
+    173.245.48.0/20 1;
+    103.21.244.0/22 1;
+    103.22.200.0/22 1;
+    103.31.4.0/22 1;
+    141.101.64.0/18 1;
+    108.162.192.0/18 1;
+    190.93.240.0/20 1;
+    188.114.96.0/20 1;
+    197.234.240.0/22 1;
+    198.41.128.0/17 1;
+    162.158.0.0/15 1;
+    104.16.0.0/13 1;
+    104.24.0.0/14 1;
+    172.64.0.0/13 1;
+    131.0.72.0/22 1;
+    # --- Cloudflare IPv6 ranges (live from cloudflare.com/ips-v6) ---
+    2400:cb00::/32 1;
+    2606:4700::/32 1;
+    2803:f800::/32 1;
+    2405:b500::/32 1;
+    2405:8100::/32 1;
+    2a06:98c0::/29 1;
+    2c0f:f248::/32 1;
+}
+
+# 1 when an UNTRUSTED peer still presents a CF-Connecting-IP header: that is a
+# spoof attempt (only real Cloudflare edges or Traefik may do that lawfully).
+map "$cms_trusted_edge:$http_cf_connecting_ip" $cms_disallow_forwarding {
+    default 0;
+    "~^0:.+" 1;
+}
+
+# Rewrite $remote_addr from CF-Connecting-IP but ONLY for the trusted peers
+# above. Direct game clients (untrusted) keep their real peer address.
+set_real_ip_from 127.0.0.0/8;
+set_real_ip_from ::1;
+set_real_ip_from 172.22.0.0/16;
+set_real_ip_from 173.245.48.0/20;
+set_real_ip_from 103.21.244.0/22;
+set_real_ip_from 103.22.200.0/22;
+set_real_ip_from 103.31.4.0/22;
+set_real_ip_from 141.101.64.0/18;
+set_real_ip_from 108.162.192.0/18;
+set_real_ip_from 190.93.240.0/20;
+set_real_ip_from 188.114.96.0/20;
+set_real_ip_from 197.234.240.0/22;
+set_real_ip_from 198.41.128.0/17;
+set_real_ip_from 162.158.0.0/15;
+set_real_ip_from 104.16.0.0/13;
+set_real_ip_from 104.24.0.0/14;
+set_real_ip_from 172.64.0.0/13;
+set_real_ip_from 131.0.72.0/22;
+set_real_ip_from 2400:cb00::/32;
+set_real_ip_from 2606:4700::/32;
+set_real_ip_from 2803:f800::/32;
+set_real_ip_from 2405:b500::/32;
+set_real_ip_from 2405:8100::/32;
+set_real_ip_from 2a06:98c0::/29;
+set_real_ip_from 2c0f:f248::/32;
+
+real_ip_header CF-Connecting-IP;
+real_ip_recursive off;

deployment/proxy/cms_upstream_servers.conf

@@ -0,0 +1,2 @@
+# Default; ci-deploy.sh (blue/green) herschrijft dit bestand bij elke switch.
+server 127.0.0.1:3002;

deployment/proxy/compose.loopback.yml

@@ -6,4 +6,10 @@ services:
       HOSTNAME: 127.0.0.1
       PORT: "3002"
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3002/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      test:
+        [
+          "CMD",
+          "node",
+          "-e",
+          "fetch('http://127.0.0.1:3002/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))",
+        ]

deployment/proxy/nginx-mime.types

@@ -0,0 +1,34 @@
+types {
+    text/html html htm shtml;
+    text/css css;
+    text/xml xml;
+    text/plain txt;
+    application/javascript js mjs;
+    application/json json map;
+    application/ld+json jsonld;
+    application/rss+xml rss;
+    application/wasm wasm;
+    application/xml xsd xsl;
+    font/ttf ttf;
+    font/otf otf;
+    font/woff woff;
+    font/woff2 woff2;
+    image/svg+xml svg svgz;
+    image/bmp bmp;
+    image/gif gif;
+    image/jpeg jpeg jpg;
+    image/png png;
+    image/webp webp;
+    image/avif avif;
+    image/x-icon ico cur;
+    video/mp4 mp4 m4v;
+    video/webm webm;
+    audio/mpeg mp3;
+    audio/ogg ogg;
+    audio/wav wav;
+    application/octet-stream dat bin swf;
+    application/zip zip;
+    application/gzip gz;
+    application/pdf pdf;
+    application/vnd.apple.mpegurl m3u8;
+}

deployment/proxy/nginx.conf

@@ -0,0 +1,80 @@
+# Canonical nginx config for the EpicNabbo CMS edge.
+# Source of truth: repository deployment/proxy/nginx-cms.conf (the site block)
+# and this file. Installed/synced by scripts/nginx-sync.sh so it cannot be
+# lost again while nginx keeps running on an in-memory copy.
+#
+# Traffic path: Cloudflare -> Traefik (:443) -> nginx (:9443) -> CMS (:3002),
+# with direct Cloudflare-origin and game-client (ws.epicnabbo.nl) connections
+# also terminating on :9443.
+# nginx is the last layer that can still rewrite Cache-Control, so it owns the
+# headers it adds explicitly; everything proxied to the CMS is passed through
+# untouched unless this file says otherwise.
+
+user www-data;
+worker_processes auto;
+# Raise the file-descriptor rlimit for the workers. Must stay <= the master's
+# RLIMIT_NOFILE *hard* limit, otherwise nginx refuses to start with
+# "setrlimit(RLIMIT_NOFILE) failed". Bounded from above by the systemd drop-in
+# /etc/systemd/system/nginx.service.d/override.conf (LimitNOFILE=65536).
+worker_rlimit_nofile 65536;
+pid /run/nginx.pid;
+
+error_log /var/log/nginx/error.log warn;
+
+events {
+    worker_connections 2048;
+    use epoll;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Compression is done once, at the edge (Traefik / Cloudflare). Enabling
+    # gzip here too would double-compress proxied responses and fight Vary.
+    gzip off;
+
+    sendfile on;
+    tcp_nopush on;
+    server_tokens off;
+    keepalive_timeout 30s;
+
+    # Gamedata/icons are served from disk by alias locations. Caching the
+    # stat/open results avoids a syscall storm on every room load.
+    open_file_cache max=10000 inactive=30s;
+    open_file_cache_valid 60s;
+    open_file_cache_min_uses 2;
+    open_file_cache_errors off;
+
+    client_max_body_size 64m;
+    client_body_buffer_size 16k;
+    client_header_buffer_size 1k;
+    large_client_header_buffers 4 8k;
+
+    # Rate limiting per client IP.
+    #
+    # Two zones, because a room load and a page load are not the same thing.
+    # Loading a Nitro room fires several hundred gamedata icons in one burst;
+    # at the page rate that produced 503s on real players. Static assets
+    # therefore get their own, much higher allowance. These are small immutable
+    # files, so a request rate is not what protects them anyway — nginx already
+    # serves them with must-revalidate, and the CMS upstream stays behind
+    # cms_req_per_ip for the expensive routes.
+    limit_req_zone $binary_remote_addr zone=cms_req_per_ip:10m rate=30r/s;
+    limit_req_zone $binary_remote_addr zone=cms_static_per_ip:10m rate=1000r/s;
+    limit_conn_zone $binary_remote_addr zone=cms_conn_per_ip:10m;
+
+    # Blue/green cutover: ci-deploy.sh writes the active upstream here, and
+    # `proxy_pass http://cms_app` below follows it via graceful nginx -s reload.
+    upstream cms_app {
+        include /etc/nginx/snippets/cms_upstream_servers.conf;
+    }
+
+    # Cache policy maps and server blocks live in the site file so they are
+    # synced together and can never drift apart.
+    include /etc/nginx/sites-enabled/*.conf;
+
+    # Trusted edge / real-IP handling (regenerated by scripts/cf-ips-sync.sh
+    # from the live Cloudflare ranges; installed via scripts/nginx-sync.sh).
+    include /etc/nginx/conf.d/cloudflare-ips.conf;
+}

deployment/systemd/cms-jobs-worker.service

@@ -0,0 +1,39 @@
+[Unit]
+# The scheduled-job worker (scheduled articles, catalog export, backups, disk
+# and health probes). This is NOT optional: a web process alone does not
+# establish that scheduled work runs. The CMS reports it as a failed
+# diagnostic row when the Redis heartbeat at cms:jobs-worker:heartbeat is
+# missing, which is exactly what happened while nothing supervised this.
+#
+# It runs on the host rather than in a container on purpose: the schedule
+# shells out to mysqldump, df and docker, none of which exist in the CMS image,
+# and it must survive CMS deploys (a container is replaced on every release).
+Description=AtomNext CMS scheduled-job worker
+Documentation=https://gitlab.epicnabbo.nl/remco/EpicNext-Cms
+After=network-online.target docker.service mariadb.service
+Wants=network-online.target
+# Start ordering only; the worker tolerates the database being briefly absent
+# and retries, so do not make it hard-fail when mariadb is slow to boot.
+Wants=docker.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/var/www/atom-nexst
+Environment=NODE_ENV=production
+ExecStart=/usr/bin/node --conditions=react-server --import tsx scripts/jobs-worker.ts
+# The worker's own catch-all logs and exits 1 on a fatal error, so a restart is
+# always wanted. 10s backoff stops a persistent misconfiguration (missing .env,
+# bad DATABASE_URL) from spinning.
+Restart=always
+RestartSec=10
+# Give a crashed job time to finish its DB transaction before the next start,
+# otherwise a mid-transaction kill can loop on the same failure.
+TimeoutStopSec=30
+KillSignal=SIGTERM
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=cms-jobs-worker
+
+[Install]
+WantedBy=multi-user.target

deployment/systemd/nginx-override.conf

@@ -0,0 +1,19 @@
+[Service]
+# systemd's default is 1024:524288, i.e. a *soft* LimitNOFILE of 1024. nginx
+# inherits that soft limit, so worker_connections 2048 could not actually be
+# reached and every start logged:
+#   "2048 worker_connections exceed open file resource limit: 1024"
+# Raise both soft and hard to 65536 so the master's rlimit covers
+# worker_connections before nginx is even started.
+LimitNOFILE=65536
+
+# The packaged unit ships Restart=no, so a crashed or OOM-killed nginx stayed
+# down until someone noticed. nginx is the only thing serving the site, so it
+# must come back on its own. `on-failure` restarts only abnormal exits, which
+# keeps an operator-initiated `systemctl stop` from being undone.
+Restart=on-failure
+RestartSec=2
+
+# Give in-flight requests time to drain on stop/reload instead of severing
+# keepalive connections and long-polling SSE streams mid-response.
+TimeoutStopSec=30

docs/cms-upgrade-2026-09.md

@@ -3,7 +3,7 @@
 ## Operator changes
 
 | Area             | Behavior and location                                                                                                                                                                                                                                                    |
-| --- | --- |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | Release          | Deployment checks HTTP health, release identity and Chromium pages before marking the running image verified. Registry publication reuses that verified digest on the shared runner; independent hosts build and verify their own image.                                 |
 | Shared HK        | Dialogs scroll within the available viewport. Table column preferences persist per page in the current browser session; filters already remain in the URL. No favorites added.                                                                                           |
 | Catalog Studio   | Dedicated detail drawer and five separate completeness states: SQL, offers, furnidata, icon and Nitro. Sprite/type conflicts are consistently excluded from import and linked to audit. Missing source files are never represented as available.                         |
@@ -37,7 +37,6 @@
 ## Verification
 
 Local verification on 2026-09-09:
-
 - Production build succeeded with fixture configuration and an intentionally unavailable database. Build-time fallback logs are expected in this check.
 - Full Vitest run: 254 files passed, 4 skipped; 1,466 tests passed, 6 skipped. Coverage thresholds passed (19.89% lines); this does not imply exhaustive coverage.
 - Global Biome rules/import checks passed across 1,328 files; modified source/locales were formatted separately to avoid unrelated Windows line-ending changes.

docs/operations/cms-error-center.md

@@ -56,9 +56,18 @@ Lenis has been removed; the public site now uses native scrolling. Other used
 runtime libraries remain. Vitest and its coverage provider are upgraded together;
 `clearMocks: false` preserves initialization-time permission contract assertions.
 
-Renovate uses separate development/UI/Vitest groups with manual merge and a
-three-day release age. The existing external Gitea bot configuration is retained.
-Node/pnpm upgrades remain coordinated with Docker and the runner toolchain.
+Dependency updates run through self-hosted Renovate: `renovate.json` plus
+`.gitea/workflows/renovate.yaml` run the pinned `renovate/renovate` image on the
+host runner every weekday at 04:17 (and via `workflow_dispatch`). Minor and patch
+updates are grouped into one PR and automerged only after CI is green
+(`platformAutomerge: false`, so Renovate waits on the checks itself); major
+updates require approval on the dependency dashboard. The job authenticates with
+the `renovate-bot` account token stored as the repo Actions secret
+`RENOVATE_TOKEN`; rotation only requires overwriting that secret (the bot
+password lives in `/root/.gitea-renovate-bot.env` on the host). `minimumReleaseAge`
+is 3 days in `renovate.json` and 60 hours in `pnpm-workspace.yaml`, so neither the
+installer nor the bot picks up a fresh release on day zero. Node/pnpm upgrades
+remain coordinated with Docker and the runner toolchain.
 Obsolete global overrides were removed; a scoped esbuild override remains because
 Drizzle Kit's loader still resolves a vulnerable legacy development-server build.
 The two deprecated esbuild-kit packages remain upstream dependencies of Drizzle

docs/operations/docker-installation.md

@@ -81,28 +81,10 @@ The direct template intentionally records the CDN/edge socket address when place
 
 ### Local verification and deployment boundary
 
-`pnpm exec vitest run --coverage.enabled=false scripts/proxy-config.test.mjs` runs the installed Docker Compose CLI against a disposable clone configuration, without contacting Docker Engine, building images or reading the real `.env`. It verifies selection through `.env`, loopback/port override precedence, the IPv4 healthcheck and preservation of mounts, release selection and host networking. It explicitly skips when Compose is unavailable. This is not a container-start or network-isolation test.
+`pnpm exec vitest run --coverage.enabled=false scripts/proxy-config.test.mjs` runs the installed Docker Compose CLI against a disposable clone configuration, without contacting Docker Engine, building images or reading the real `.env`. It verifies selection through `.env`, loopback/port override precedence, the IPv4 healthcheck and preservation of mounts, release selection and host networking. The `cms` service is behind the `cms` profile (so a bare `docker compose up -d` cannot claim port 3002 on a CI-managed host), so the test renders the configuration with `--profile cms`. It explicitly skips when Compose is unavailable. This is not a container-start or network-isolation test.
 
 `pnpm test:integration` additionally starts disposable Nginx containers from the actual templates, supplies a temporary test certificate, and sends real HTTPS requests with forged identity headers. It checks direct-mode replacement even with an inherited real-IP rule, rejection of untrusted peers, and acceptance through an explicitly trusted peer. This requires Docker Engine and the OpenSSL CLI and does not read deployment credentials. The templates must still pass `nginx -t` on the intended host after its hostname/certificate substitution, then the listener and trusted-header checks above; the disposable fixture cannot certify that host or its firewall.
 
-## Opt-in: CrowdSec on the same Docker host
-
-A self-contained CrowdSec engine ships in `deployment/crowdsec`. It runs `crowdsecurity/crowdsec:v1.8.1` in its own Compose project in **LAPI-only mode** (`DISABLE_AGENT=true`) and exposes LAPI only on `127.0.0.1:18080`. No reverse-proxy, Traefik, Cloudflare or firewall configuration is changed.
-
-```sh
-bash cms security
-```
-
-The command generates `CROWDSEC_LAPI_API_KEY`, writes the CrowdSec flags into `.env`, starts the engine and registers the `cms` bouncer. The anti-DDoS gate then consults the local LAPI per client IP (short-cached) and blocks `ban`/`captcha` decisions before its own rate buckets. `bash cms security status` reports engine state and `bash cms security disable` stops the engine and flips the toggle off.
-
-The engine does not enroll into the CrowdSec Central API (`DISABLE_ONLINE_API=true`) and runs without the agent (`DISABLE_AGENT=true`), so it needs no account and no outbound access to `crowdsec.net` (often blocked on hardened hosts). Blocking comes from the imported blocklists plus the app's own rate buckets; it does not parse the host Nginx log. The app still has its separate opt-in traffic-sharing channel via `CROWDSEC_REPORT_ENABLED`. Change `CROWDSEC_LAPI_PORT` and `CROWDSEC_LAPI_URL` together when `18080` is already in use. `CROWDSEC_NGINX_LOG_DIR` is honored for when the agent is re-enabled.
-
-This bouncer is application-layer: it sheds known-bad IPs at the CMS process and only for traffic that reaches the Next.js proxy. It does not drop traffic before the origin, does not protect other host ports/services, and depends on the client IP being trustworthy at the ingress. Keep the upstream protections (Cloudflare IP rules, proxy rate limits) for defense before the origin.
-
-The running CMS loads the new env values on its next restart or deployment. For a CI-managed `epicnext-cms-app`, the next deploy (which sources `.env`) applies them; for a clone, `bash cms update --skip-pull` restarts it. `.env` now holds the LAPI key — keep its permissions restrictive.
-
-External IP blocklists (Spamhaus, DShield, CINS, blocklist.de, abuse.ch, IPsum, Firehol, Tor exit nodes, …) can be synced into the local LAPI with `bash cms security blocklists`, and hourly with `bash cms security blocklists-install-cron` (no account, but internet to fetch). Configure via `CROWDSEC_BLOCKLIST_*`.
-
 ## Routine and selected-release updates
 
 ```sh

docs/performance-budgets.md

@@ -1,4 +1,4 @@
-# Informational route JavaScript budgets
+# Route JavaScript budgets (enforced)
 
 Run after the existing production build; no second build or server is needed:
 
@@ -12,28 +12,36 @@ The command writes `report.json` and `report.md` and prints the Markdown report.
 
 For each configured App Router route, resolve its exact app path using `app-path-routes-manifest.json` and `server/app-paths-manifest.json`. Read its generated `page_client-reference-manifest.js` as a JSON assignment **without executing JavaScript**. Use its sibling `page/build-manifest.json`, falling back to the root build manifest only if that sibling is absent.
 
-The **initial entry envelope** is the union of route bootstrap `rootMainFilesTree[appPath]` (or `rootMainFiles`) and every `entryJSFiles` list in that route's client-reference manifest. This includes layout, page and boundary/loading entries. The definition follows the data exposed by the installed Next 16.3.4 Turbopack build and the `getLinkAndScriptTags` / `getRequiredScripts` renderer helpers; it is deliberately a build-artifact envelope, not a browser network trace. Conditional rendering, redirects, streaming and browser caches can change actual requests.
+The **initial entry envelope** is the union of route bootstrap `rootMainFilesTree[appPath]` (or `rootMainFiles`) and every client chunk that route's client-reference manifest lists. This includes layout, page and boundary/loading entries.
 
+The manifest exposes those chunks differently per bundler. Turbopack emits an explicit per-segment `entryJSFiles` map; webpack emits no such field and records chunks only per client module, as `clientModules[*].chunks`, in `[chunkId, fileName, chunkId, fileName, …]` order. The report reads `entryJSFiles` when present and otherwise derives the same envelope from `clientModules`, which is the source Next's own `static-routes-info` uses. Numeric chunk ids are skipped; a malformed chunk _path_ still fails rather than being dropped, so a broken manifest cannot quietly under-report a route.
+
+> The build runs webpack (`next build --webpack`), so the `clientModules` path is the live one. An earlier revision only read `entryJSFiles`, and after the switch to webpack every route reported `unavailable` while the command still exited 0 — the budgets were silently not being measured. When a bundler switch changes the manifest layout again, re-check this section rather than trusting a clean exit.
+
+The definition follows the data exposed by the installed Next 16.3.8 build and the `getLinkAndScriptTags` / `getRequiredScripts` renderer helpers; it is deliberately a build-artifact envelope, not a browser network trace. Conditional rendering, redirects, streaming and browser caches can change actual requests.
 - Raw bytes are filesystem byte lengths of unique JavaScript assets in that envelope.
 - Gzip bytes are the **sum of independent gzip level 9 compressions** of those files using the recorded Node/zlib runtime. They are not gzip of concatenated source, nor observed CDN transfer sizes.
 - Deployment query strings and `/_next/` prefixes are normalized before deduplication. Shared files count once per route; each route is measured independently, with no misleading cross-route total.
-- Legacy `nomodule` polyfills are measured separately, outside the modern initial budget. CSS, source maps, images, external scripts, HTML/RSC payloads and async-only chunks absent from `entryJSFiles` are excluded.
+- Legacy `nomodule` polyfills are measured separately, outside the modern initial budget. CSS, source maps, images, external scripts, HTML/RSC payloads and async-only chunks absent from the manifest's chunk lists are excluded.
 - This report makes no claims about execution cost, LCP, hydration time or real-user performance.
 
 ## Initial limits
 
-The first limits are **baseline bytes × 1.15, rounded upward to the next 10 KiB (10,240 bytes)** independently for raw and gzip. They are provisional size alerts, not validated speed targets. Baseline: existing local production build `build-TfctsWXpff2fKS`, Next 16.3.4; its source commit was not inferred.
+The limits are **baseline bytes × 1.15, rounded upward to the next 10 KiB (10,240 bytes)** independently for raw and gzip. They are size guardrails, not validated speed targets.
+
+Baselines were last recalibrated against a local webpack production build (Next 16.4.1, `next build --webpack`) and cross-checked against the report the Docker image build emits: `/me` 621460/195411, `/news` 616712/193199, `/events` 617121/193450, `/search` 618536/194216, `/admin/catalog` 1049094/330369, `/admin/studio/furni` 1397566/447765 (raw/gzip). The earlier Turbopack numbers (previous revision) were **not** comparable and were dropped.
+
+The image build compiles the app, then runs `scripts/performance-report.mjs` in the same `RUN` layer (`Dockerfile:48-53`). In `mode: enforce` a failing route therefore fails the image build, which blocks both the PR `preflight` job and the `deploy` job. Recalibrate the table and `scripts/performance-budgets.json` **together** in the same commit whenever the envelope legitimately grows (new route dependency, Next upgrade).
 
 | Route                 | Baseline raw bytes | Baseline gzip bytes | Raw limit | Gzip limit |
-| --- | ---: | ---: | ---: | ---: |
-| `/me` | 767156 | 238571 | 890880 | 276480 |
-| `/news` | 765367 | 237599 | 880640 | 276480 |
-| `/events` | 765851 | 237964 | 890880 | 276480 |
-| `/search` | 765851 | 237964 | 890880 | 276480 |
-| `/admin/catalog` | 1654898 | 492619 | 1904640 | 573440 |
-| `/admin/studio/furni` | 1241312 | 391541 | 1433600 | 450560 |
+| --------------------- | -----------------: | ------------------: | --------: | ---------: |
+| `/me`                 |             621460 |              195411 |    716800 |     225280 |
+| `/news`               |             616712 |              193199 |    716800 |     225280 |
+| `/events`             |             617121 |              193450 |    716800 |     225280 |
+| `/search`             |             618536 |              194216 |    716800 |     225280 |
+| `/admin/catalog`      |            1049094 |              330369 |   1208320 |     389120 |
+| `/admin/studio/furni` |            1397566 |              447765 |   1607680 |     522240 |
 
-Configured limits are positive integer bytes; `null` explicitly means observe-only. `scripts/performance-budgets.json` remains `mode: informational`. Exceeding a limit produces `over-budget` and a warning, with exit code 0. Missing production `BUILD_ID`, unsupported manifests, missing routes or missing referenced assets produce `unavailable` with a reason and **no partial/zero total**, also exit code 0. Malformed budget configuration or an unwritable output directory fails the command. This keeps initial CI reporting non-blocking while preventing invalid configuration from quietly disabling limits.
-
-Synthetic tests cover shared-chunk deduplication, exact byte/gzip calculations, route bootstrap selection, missing data, safe parsing and CLI exit behavior. Run `pnpm exec vitest run --coverage.enabled=false scripts/performance-report.test.mjs`.
+Configured limits are positive integer bytes; `null` explicitly means observe-only. `scripts/performance-budgets.json` runs `mode: enforce`: an `over-budget` route prints `Performance budgets enforced: <route> (over-budget)` and exits non-zero. Missing production `BUILD_ID`, unsupported manifests, missing routes or missing referenced assets produce `unavailable` with a reason and **no partial/zero total**; under `enforce` an `unavailable` route also fails the command, so a bundler change that breaks measurement cannot pass quietly. Malformed budget configuration or an unwritable output directory always fails the command. Set `mode` back to `informational` only while recalibrating, never as a permanent state.
 
+Synthetic tests cover shared-chunk deduplication, exact byte/gzip calculations, route bootstrap selection, missing data, safe parsing and CLI exit behavior in both modes. Run `pnpm exec vitest run --coverage.enabled=false scripts/performance-report.test.mjs`.

drizzle/drafts/0001_breezy_maestro.sql

@@ -0,0 +1,25 @@
+CREATE TABLE `website_daily_reward_claims` (
+	`id` bigint unsigned AUTO_INCREMENT NOT NULL,
+	`user_id` int NOT NULL,
+	`claim_date` date NOT NULL,
+	`streak` int unsigned NOT NULL DEFAULT 1,
+	`reward_day` int unsigned NOT NULL DEFAULT 1,
+	`currency` varchar(20) NOT NULL DEFAULT 'credits',
+	`amount` int NOT NULL DEFAULT 0,
+	`created_at` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+	CONSTRAINT `website_daily_reward_claims_id` PRIMARY KEY(`id`),
+	CONSTRAINT `daily_claim_user_date_uk` UNIQUE(`user_id`,`claim_date`)
+);
+--> statement-breakpoint
+CREATE TABLE `website_daily_rewards` (
+	`id` int unsigned AUTO_INCREMENT NOT NULL,
+	`day` int unsigned NOT NULL DEFAULT 1,
+	`currency` varchar(20) NOT NULL DEFAULT 'credits',
+	`amount` int NOT NULL DEFAULT 0,
+	`created_at` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+	`updated_at` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+	CONSTRAINT `website_daily_rewards_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `admin_audit_log` MODIFY COLUMN `before` mediumtext;--> statement-breakpoint
+ALTER TABLE `admin_audit_log` MODIFY COLUMN `after` mediumtext;

drizzle/drafts/meta/_journal.json

@@ -8,6 +8,13 @@
       "when": 1788791201804,
       "tag": "0000_premium_spirit",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "5",
+      "when": 1791828901011,
+      "tag": "0001_breezy_maestro",
+      "breakpoints": true
     }
   ]
 }

drizzle/migrations/0034_acl_midrank_revoke.sql

@@ -0,0 +1,31 @@
+-- Repair the escalation introduced by 0018's rule 1 ("has admin.dashboard gets
+-- ALL admin.*"). Migrating 0011 grants admin.dashboard to every rank >= 6 so
+-- that the sidebar opens, which meant rank 6 silently acquired
+-- admin.permissions.manage, admin.rcon.execute, admin.settings.edit,
+-- admin.users.edit, admin.users.reset_password, admin.room.delete, ...
+--
+-- Rule 1 is narrowed to `admin.%.view` (read-only, all the sidebar needs) in
+-- both the migration set and the runtime repair action. This migration undoes
+-- the over-grant on databases that already ran 0018: every role below the top
+-- rank keeps dashboard + *.view and loses every other admin.* grant. Ranks
+-- that legitimately hold tools keep them, because rule 3 only targets
+-- rank >= 7 and those roles are not touched here.
+--
+-- Note on the rank extraction: `acl_roles.slug` looks like `rank_7`, and
+-- MySQL's SUBSTRING is 1-based, so the digits start at position 6 — right
+-- after the 5-character `rank_`. Reading from position 7 truncates the first
+-- digit, which turns rank_10 into 0 and rank_7 into an empty string, i.e. both
+-- would compare as < 7 and lose grants this migration is supposed to preserve.
+-- The REGEXP guard below guarantees the remainder really is all digits.
+
+DELETE `amp`
+FROM `acl_model_permissions` `amp`
+JOIN `acl_roles` `ar`
+  ON `ar`.`id` = `amp`.`model_id`
+ AND `amp`.`model_type` = 'Role'
+JOIN `acl_permissions` `ap`
+  ON `ap`.`id` = `amp`.`permission_id`
+WHERE `ap`.`slug` LIKE 'admin.%'
+  AND `ap`.`slug` NOT LIKE '%.view'
+  AND `ar`.`slug` REGEXP '^rank_[0-9]+$'
+  AND CAST(SUBSTRING(`ar`.`slug`, 6) AS UNSIGNED) < 7;

drizzle/migrations/0035_users_mail_index.sql

@@ -0,0 +1,19 @@
+-- 0035_users_mail_index.sql
+-- Index on users.mail.
+--
+-- The authentication paths all look an account up by mail: password reset,
+-- e-mail verification, duplicate-address detection and the verify/resend
+-- cooldown all resolve a single user from a submitted address. Without an index
+-- each of those is a full table scan of `users`, which grows with every
+-- registration.
+--
+-- Deliberately NOT unique. Legacy rows predate the duplicate-address handling
+-- and can legitimately contain the same address more than once, so a unique
+-- index would fail to apply on an existing database. The lookup is made
+-- deterministic by ordering on `id` (see requestReset / the verify page), which
+-- is stable without the index and correct with it.
+--
+-- The column is VARCHAR(500), which exceeds the 767-byte InnoDB prefix limit on
+-- older row formats, hence an explicit 191-character prefix: enough to make the
+-- lookup selective and still indexable everywhere.
+CREATE INDEX IF NOT EXISTS `users_mail_index` ON `users` (`mail`(191));

e2e/auth-guards.spec.ts

@@ -0,0 +1,48 @@
+import { expect, test } from "@playwright/test";
+import { expectNoApplicationError } from "./helpers";
+
+// Unauthenticated requests to private routes must bounce to the login form —
+// never render private content and never 500. Two guard paths exist: the edge
+// proxy rewrites `/admin/*` to `/login?from=…` (`src/proxy.ts`), while the
+// member pages and the mod console redirect from their layouts with a bare
+// `/login`.
+
+// Routes where the proxy preserves the requested destination.
+const PROXY_ROUTES = ["/admin", "/admin/settings"] as const;
+// Routes guarded by a page/layout `redirect("/login")` with no destination.
+const LAYOUT_ROUTES = [
+	"/settings",
+	"/me",
+	"/messages",
+	"/notifications",
+	"/friends",
+	"/redeem",
+	"/mod",
+	"/client",
+] as const;
+
+for (const route of PROXY_ROUTES) {
+	test(`${route} redirects to login and keeps the return path`, async ({
+		page,
+	}) => {
+		const response = await page.goto(route);
+		expect(response?.ok(), `GET ${route} -> ${response?.status()}`).toBe(true);
+		await expect(page).toHaveURL(/\/login/);
+		await expect(page.locator('input[type="password"]').first()).toBeVisible();
+		await expectNoApplicationError(page);
+
+		const from = new URL(page.url()).searchParams.get("from");
+		expect(from, "login lost the return destination").toBeTruthy();
+		expect(new URL(from as string, "http://localhost").pathname).toBe(route);
+	});
+}
+
+for (const route of LAYOUT_ROUTES) {
+	test(`${route} redirects an anonymous visitor to login`, async ({ page }) => {
+		const response = await page.goto(route);
+		expect(response?.ok(), `GET ${route} -> ${response?.status()}`).toBe(true);
+		await expect(page).toHaveURL(/\/login/);
+		await expect(page.locator('input[type="password"]').first()).toBeVisible();
+		await expectNoApplicationError(page);
+	});
+}

e2e/helpers.ts

@@ -0,0 +1,62 @@
+import { expect, type Page } from "@playwright/test";
+
+/**
+ * Shared assertions for the read-only public e2e suite. These specs run against
+ * a live CMS (see `playwright.config.ts`) and must never mutate data — they
+ * guard the "everything loads, nothing is broken" contract that no unit test
+ * can see.
+ */
+
+/** Fails if Next rendered a runtime/server error boundary into the page. */
+export async function expectNoApplicationError(page: Page) {
+	await expect(page.locator("body")).not.toContainText("Application error");
+	await expect(page.locator("body")).not.toContainText("Internal Server Error");
+}
+
+/**
+ * Every <img> that finished loading must have decoded pixels. A failed request
+ * (404, broken CMS media, bad avatar figure) reports `complete === true` with
+ * `naturalWidth === 0`, which is what this catches. Intentionally lazy images
+ * that are still pending (`complete === false`) are ignored.
+ */
+export async function expectNoBrokenImages(page: Page) {
+	const broken = await page.evaluate(() => {
+		return Array.from(document.images)
+			.filter((img) => {
+				const src = img.currentSrc || img.src;
+				if (!src || src.startsWith("data:")) return false;
+				return img.complete && img.naturalWidth === 0;
+			})
+			.map((img) => img.currentSrc || img.src);
+	});
+	expect(broken, `broken images:\n${broken.join("\n")}`).toEqual([]);
+}
+
+/** No horizontal scrollbar — the classic mobile layout regression. */
+export async function expectNoHorizontalOverflow(page: Page) {
+	const overflowing = await page.evaluate(() => {
+		const doc = document.documentElement;
+		return doc.scrollWidth > window.innerWidth + 1;
+	});
+	expect(overflowing, "page scrolls horizontally").toBe(false);
+}
+
+/**
+ * Walks the page top-to-bottom so `loading="lazy"` images below the fold get a
+ * chance to start before the broken-image check runs.
+ */
+export async function scrollThroughPage(page: Page) {
+	await page.evaluate(async () => {
+		const step = window.innerHeight;
+		for (let y = 0; y < document.body.scrollHeight; y += step) {
+			window.scrollTo(0, y);
+			await new Promise((resolve) => setTimeout(resolve, 80));
+		}
+		window.scrollTo(0, 0);
+	});
+}
+
+/** Skips a spec when the CMS answered with a maintenance redirect. */
+export function isMaintenanceRedirect(url: string) {
+	return /\/maintenance(?:$|[/?])/.test(url);
+}

e2e/imaging/avatar-render.spec.ts

@@ -0,0 +1,57 @@
+import { expect, test } from "@playwright/test";
+import { avatarPath } from "./imaging-target";
+
+/**
+ * Cross-browser check that a real browser (chromium/firefox/webkit) can decode
+ * the avatar the imager produces and that it actually animates. The endpoint
+ * spec covers the HTTP contract; this one covers the client-side decode, where
+ * an unsupported image format would surface as a blank/broken avatar.
+ *
+ * Navigates straight to the image URL (a top-level navigation, which CSP
+ * `upgrade-insecure-requests` does not rewrite) rather than embedding it in a
+ * page: over a plain-HTTP host the upgrade directive would otherwise send the
+ * subresource request to https and break the load, without exercising anything
+ * about the image itself.
+ *
+ * Run across engines via `pnpm test:imaging` (playwright.imaging.config.ts).
+ */
+const ANIMATED = avatarPath({ img_format: "apng", effect: "14" });
+const STATIC = avatarPath({ img_format: "png" });
+
+test("the avatar decodes and animates in the browser", async ({ page }) => {
+	const response = await page.goto(ANIMATED);
+	expect(response?.status()).toBe(200);
+
+	const image = page.locator("img");
+	await expect(image).toBeVisible();
+	const decoded = await image.evaluate((element: HTMLImageElement) => ({
+		width: element.naturalWidth,
+		height: element.naturalHeight,
+	}));
+	expect(decoded.width).toBeGreaterThan(0);
+	expect(decoded.height).toBeGreaterThan(0);
+
+	// An animated APNG keeps producing new frames; a static/undecodable one
+	// yields the same pixels every time. Sampling screenshots over a second is
+	// enough to tell them apart without depending on exact frame timing.
+	const frames = new Set<string>();
+	for (let attempt = 0; attempt < 8; attempt += 1) {
+		frames.add((await image.screenshot()).toString("base64"));
+		await page.waitForTimeout(180);
+	}
+	expect(frames.size).toBeGreaterThan(1);
+});
+
+test("the static render matches its committed visual baseline", async ({
+	page,
+}) => {
+	// Pins the exact pixels of a non-animated render so a renderer/asset drift
+	// (wrong palette, missing part, changed sizing) is caught even when the
+	// image still decodes. Baselines are per engine and committed under
+	// e2e/imaging/__screenshots__/.
+	const response = await page.goto(STATIC);
+	expect(response?.status()).toBe(200);
+	await expect(page.locator("img")).toHaveScreenshot("static-avatar.png", {
+		animations: "disabled",
+	});
+});

e2e/imaging/cms-imaging.spec.ts

@@ -0,0 +1,78 @@
+import { expect, test } from "@playwright/test";
+import { countBytes, FIGURE, IS_EDGE, looksLikeImage } from "./imaging-target";
+
+// These assertions only hold when the CMS itself answers `/imaging`. In
+// production the edge proxy fronts bare `/imaging` (and `/imaging/*`) to the
+// imager container, so the CMS route is shadowed; set `IMAGING_EDGE=1` to skip.
+test.skip(
+	IS_EDGE,
+	"The CMS /imaging route is shadowed by the edge proxy in production",
+);
+
+const imagerPath = (params: Record<string, string> = {}) =>
+	`/imaging?${new URLSearchParams({ figure: FIGURE, img_format: "png", ...params })}`;
+
+const PNG_MAGIC = Buffer.from("89504e470d0a1a0a", "hex");
+
+test("serves the default render as a PNG", async ({ request }) => {
+	const response = await request.get(imagerPath());
+	expect(response.status()).toBe(200);
+	expect(response.headers()["content-type"]).toContain("image/png");
+	const body = await response.body();
+	expect(body.subarray(0, 8).equals(PNG_MAGIC)).toBe(true);
+	expect(looksLikeImage(body)).toBe(true);
+});
+
+test("transcodes to WebP on request", async ({ request }) => {
+	const response = await request.get(imagerPath({ format: "webp" }));
+	expect(response.status()).toBe(200);
+	expect(response.headers()["content-type"]).toContain("image/webp");
+	const body = await response.body();
+	expect(body.subarray(0, 4).toString("ascii")).toBe("RIFF");
+	expect(body.subarray(8, 12).toString("ascii")).toBe("WEBP");
+});
+
+test("transcodes to AVIF on request", async ({ request }) => {
+	const response = await request.get(imagerPath({ format: "avif" }));
+	expect(response.status()).toBe(200);
+	expect(response.headers()["content-type"]).toContain("image/avif");
+	const body = await response.body();
+	expect(body.subarray(4, 12).toString("ascii")).toBe("ftypavif");
+});
+
+test("leaves animated APNG renders untranscoded", async ({ request }) => {
+	// The renderer emits effected avatars as APNG; libvips here reads only the
+	// first frame, so the animated original must be served as-is even when a
+	// transcode is requested — otherwise the avatar would stop animating.
+	const response = await request.get(
+		imagerPath({ img_format: "apng", effect: "14", format: "webp" }),
+	);
+	expect(response.status()).toBe(200);
+	expect(response.headers()["content-type"]).toContain("image/png");
+
+	const body = await response.body();
+	expect(body.includes(Buffer.from("acTL"))).toBe(true);
+	expect(countBytes(body, Buffer.from("fcTL"))).toBeGreaterThan(1);
+});
+
+test("advertises long-lived edge caching", async ({ request }) => {
+	const response = await request.get(imagerPath());
+	expect(response.status()).toBe(200);
+	const cacheControl = response.headers()["cache-control"] ?? "";
+	expect(cacheControl).toContain("public");
+	expect(cacheControl).toContain("s-maxage");
+	expect(cacheControl).toContain("stale-while-revalidate");
+});
+
+test("rejects a malformed figure with 400", async ({ request }) => {
+	const response = await request.get(
+		`/imaging?figure=${encodeURIComponent("../bad")}`,
+	);
+	expect(response.status()).toBe(400);
+});
+
+test("the imager preflight advertises GET", async ({ request }) => {
+	const response = await request.fetch("/imaging", { method: "OPTIONS" });
+	expect(response.status()).toBe(204);
+	expect(response.headers()["access-control-allow-methods"]).toContain("GET");
+});

e2e/imaging/performance-budget.spec.ts

@@ -0,0 +1,39 @@
+import { expect, test } from "@playwright/test";
+import { avatarPath } from "./imaging-target";
+
+// Lightweight size/latency budget for the avatar path. The endpoint spec checks
+// correctness; this one catches a regression that keeps the image correct but
+// makes it oversized or slow — e.g. losing the disk/edge cache and re-encoding
+// (or re-rendering) on every hit. Budgets are deliberately loose: they should
+// flag a real regression, not a cold cache or a slow CI network.
+const STATIC_MAX_BYTES = 64 * 1024;
+const ANIMATED_MAX_BYTES = 512 * 1024;
+const WARM_MAX_MS = 3000;
+
+test("the static avatar stays inside its byte budget", async ({ request }) => {
+	const response = await request.get(avatarPath({ img_format: "png" }));
+	expect(response.status()).toBe(200);
+	expect((await response.body()).length).toBeLessThanOrEqual(STATIC_MAX_BYTES);
+});
+
+test("the animated avatar stays inside its byte budget", async ({
+	request,
+}) => {
+	const response = await request.get(
+		avatarPath({ img_format: "apng", effect: "14" }),
+	);
+	expect(response.status()).toBe(200);
+	expect((await response.body()).length).toBeLessThanOrEqual(
+		ANIMATED_MAX_BYTES,
+	);
+});
+
+test("a warm avatar request is served quickly", async ({ request }) => {
+	const path = avatarPath({ img_format: "png" });
+	await request.get(path); // warm the disk and edge caches
+	const started = Date.now();
+	const response = await request.get(path);
+	const elapsed = Date.now() - started;
+	expect([200, 304]).toContain(response.status());
+	expect(elapsed).toBeLessThan(WARM_MAX_MS);
+});

e2e/imaging/public-routing.spec.ts

@@ -0,0 +1,46 @@
+import { expect, test } from "@playwright/test";
+import {
+	avatarPath,
+	getThroughEdge,
+	IMAGER_PATH,
+	IS_EDGE,
+	looksLikeImage,
+} from "./imaging-target";
+
+// Regression guard for the public topology: the edge proxy must front the
+// imager container at `/imaging/*` while `/api/imaging/*` reaches the CMS.
+// Mis-routing here blanks avatars for every visitor, and no unit test sees it.
+// Only meaningful against the public origin, so it is skipped when the CMS is
+// reached directly (set `IMAGING_EDGE=1` for the public origin).
+test.skip(
+	!IS_EDGE,
+	"Public routing is only asserted against the edge-fronted origin",
+);
+
+test("the edge serves the imager endpoint as an image", async ({ request }) => {
+	const response = await getThroughEdge(
+		request,
+		IMAGER_PATH({ img_format: "png" }),
+	);
+	expect(response.status()).toBe(200);
+	expect(response.headers()["content-type"]).toContain("image/");
+	expect(looksLikeImage(await response.body())).toBe(true);
+});
+
+test("the CMS avatar endpoint is reachable through the edge", async ({
+	request,
+}) => {
+	const response = await getThroughEdge(
+		request,
+		avatarPath({ img_format: "png" }),
+	);
+	expect(response.status()).toBe(200);
+	expect(response.headers()["content-type"]).toContain("image/");
+	expect(looksLikeImage(await response.body())).toBe(true);
+});
+
+test("the edge does not shadow the CMS badge endpoint", async ({ request }) => {
+	const response = await getThroughEdge(request, "/api/imaging/badge?code=ADM");
+	expect(response.status()).toBe(200);
+	expect(response.headers()["content-type"]).toContain("image/");
+});

e2e/news-real/news.spec.ts

@@ -88,7 +88,10 @@ test("staff signs in, saves a draft, previews it and publishes to anonymous read
 			await page
 				.locator('input[autocomplete="current-password"]')
 				.press("Enter");
-			await expect(page).toHaveURL(/\/me(?:\?|$)/);
+			// The login page honours `?from=`, so an admin bounced off /admin lands
+			// back where they were heading instead of on /me. The step below
+			// navigates there explicitly anyway; this asserts the redirect target.
+			await expect(page).toHaveURL(/\/admin\/articles\/new(?:\?|$)/);
 			const session = await context.request
 				.get("/api/auth/session")
 				.then((response) => response.json());

e2e/performance.spec.ts

@@ -0,0 +1,30 @@
+import { expect, test } from "@playwright/test";
+
+// Caching contract for the anonymous pages. This is deterministic and stays in
+// the blocking deploy gate: the perf work relies on the edge/shared cache
+// (`src/proxy.ts`) — public content pages advertise a short `s-maxage`, while
+// session-dependent pages (login, register, settings) must stay
+// `private, no-store`. Timing budgets are advisory and live in
+// `e2e/quality/performance.spec.ts`.
+test("anonymous content pages advertise a shared cache", async ({
+	request,
+}) => {
+	for (const route of ["/news", "/staff", "/shop"]) {
+		const response = await request.get(route);
+		const cacheControl = response.headers()["cache-control"] ?? "";
+		expect(cacheControl, `GET ${route} cache-control`).toContain("s-maxage");
+	}
+});
+
+test("session-dependent pages stay private and uncached", async ({
+	request,
+}) => {
+	for (const route of ["/login", "/register"]) {
+		const response = await request.get(route);
+		const cacheControl = response.headers()["cache-control"] ?? "";
+		expect(cacheControl, `GET ${route} cache-control`).toContain("no-store");
+		expect(cacheControl, `GET ${route} must not be shared`).not.toContain(
+			"s-maxage",
+		);
+	}
+});

e2e/quality/content-health.spec.ts

@@ -0,0 +1,58 @@
+import { expect, test } from "@playwright/test";
+import {
+	expectNoApplicationError,
+	expectNoBrokenImages,
+	expectNoHorizontalOverflow,
+	isMaintenanceRedirect,
+	scrollThroughPage,
+} from "../helpers";
+
+// ADVISORY suite — run with `pnpm test:e2e:quality`, not part of the deploy
+// gate. These checks depend on live content/upload state and user data (a
+// missing upload, a legacy malformed avatar figure, a bad theme asset), so
+// they are informational: they tell you the site has a real content problem,
+// but they must never block a code deploy. Every assertion the CMS can
+// guarantee on its own lives in the blocking specs instead.
+const PUBLIC_ROUTES = [
+	"/",
+	"/news",
+	"/staff",
+	"/shop",
+	"/search",
+	"/leaderboard",
+	"/help",
+	"/radio",
+] as const;
+
+for (const route of PUBLIC_ROUTES) {
+	test(`${route} loads every image and does not overflow`, async ({ page }) => {
+		const response = await page.goto(route);
+		expect(response?.ok(), `GET ${route} -> ${response?.status()}`).toBe(true);
+
+		await expect(page.locator("main").first()).toBeVisible();
+		await expectNoApplicationError(page);
+
+		await scrollThroughPage(page);
+		await expectNoBrokenImages(page);
+		await expectNoHorizontalOverflow(page);
+	});
+}
+
+test("the register page loads its theme/avatar images", async ({ page }) => {
+	const response = await page.goto("/register");
+	test.skip(
+		isMaintenanceRedirect(page.url()) || response?.status() === 404,
+		"register is not reachable on this deploy",
+	);
+	await scrollThroughPage(page);
+	await expectNoBrokenImages(page);
+	await expectNoHorizontalOverflow(page);
+});
+
+test("the homepage stays usable on a narrow viewport", async ({ page }) => {
+	await page.setViewportSize({ width: 390, height: 844 });
+	const response = await page.goto("/");
+	expect(response?.ok()).toBe(true);
+	await expectNoApplicationError(page);
+	await expectNoHorizontalOverflow(page);
+});

e2e/quality/performance.spec.ts

@@ -0,0 +1,24 @@
+import { expect, test } from "@playwright/test";
+
+// ADVISORY suite — run with `pnpm test:e2e:quality`. Warm-page latency depends
+// on the host, the edge and the shared data caches, so a slow CI hop can trip
+// these budgets without anything being wrong. The cache-control *contract*
+// (deterministic) lives in the blocking `e2e/performance.spec.ts`; only the
+// timing budgets are advisory.
+const BUDGET_MS = Number(process.env.E2E_LOAD_BUDGET_MS || 4000);
+
+const WARM_ROUTES = ["/", "/news", "/staff", "/shop", "/login", "/register"];
+
+for (const route of WARM_ROUTES) {
+	test(`${route} responds within the warm budget`, async ({ request }) => {
+		await request.get(route); // warm the render + data caches
+		const started = Date.now();
+		const response = await request.get(route);
+		const elapsed = Date.now() - started;
+		expect([200, 304]).toContain(response.status());
+		expect(
+			elapsed,
+			`GET ${route} took ${elapsed}ms (budget ${BUDGET_MS}ms)`,
+		).toBeLessThan(BUDGET_MS);
+	});
+}

e2e/register.spec.ts

@@ -0,0 +1,69 @@
+import { expect, test } from "@playwright/test";
+import { expectNoApplicationError, isMaintenanceRedirect } from "./helpers";
+
+// The register form is the gate for every new player, so it gets a deeper
+// read-only pass than the generic public-page spec. It also pins the captcha
+// contract that is configured through `CAPTCHA_PROVIDER` / `TURNSTILE_*` env
+// vars (see `src/lib/services/captcha.ts`): whatever provider the running CMS
+// resolves, the DOM must expose exactly one widget whose sitekey is non-empty.
+const CAPTCHA_SELECTOR = ".cf-turnstile, .g-recaptcha, .h-captcha";
+
+// Optional explicit expectation for a deploy, e.g. `E2E_EXPECT_CAPTCHA=turnstile`
+// or `E2E_EXPECT_CAPTCHA=none`. Left unset, the spec only checks consistency.
+const EXPECT = process.env.E2E_EXPECT_CAPTCHA?.trim();
+
+test.describe("register", () => {
+	test.beforeEach(async ({ page }) => {
+		const response = await page.goto("/register");
+		test.skip(
+			isMaintenanceRedirect(page.url()) || response?.status() === 404,
+			"register is not reachable on this deploy",
+		);
+	});
+
+	test("renders every field a new player has to fill in", async ({ page }) => {
+		await expect(page.locator('input[name="username"]')).toBeVisible();
+		await expect(page.locator('input[name="mail"]')).toBeVisible();
+		await expect(page.locator('input[name="password"]').first()).toBeVisible();
+		await expect(
+			page.locator('input[name="password_confirmation"]'),
+		).toBeVisible();
+		await expect(page.locator('input[name="terms"]')).toBeVisible();
+		await expect(page.locator('button[type="submit"]').first()).toBeVisible();
+		await expectNoApplicationError(page);
+	});
+
+	test("exposes exactly one captcha widget with a site key", async ({
+		page,
+	}) => {
+		const widgets = page.locator(CAPTCHA_SELECTOR);
+
+		if (EXPECT === "none") {
+			await expect(widgets).toHaveCount(0);
+			return;
+		}
+
+		if (EXPECT === "turnstile") {
+			await expect(page.locator(".cf-turnstile")).toHaveCount(1);
+		}
+
+		const count = await widgets.count();
+		expect(
+			count,
+			`expected at most one captcha provider, found ${count}`,
+		).toBeLessThanOrEqual(1);
+
+		for (let index = 0; index < count; index += 1) {
+			const siteKey = await widgets.nth(index).getAttribute("data-sitekey");
+			expect(siteKey, "captcha widget without data-sitekey").toBeTruthy();
+			expect(siteKey?.trim().length).toBeGreaterThan(0);
+		}
+
+		if (count > 0 && (await page.locator(".cf-turnstile").count()) > 0) {
+			const script = page.locator(
+				'script[src*="challenges.cloudflare.com/turnstile"]',
+			);
+			await expect(script).toHaveCount(1);
+		}
+	});
+});

e2e/ui/attachment-recovery.spec.ts

@@ -2,7 +2,7 @@ import { expect, test } from "@playwright/test";
 
 const attachmentId = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
 const file = {
-	name: "fixture_chair.nitro",
+	name: "fixture_chair.hab",
 	mimeType: "application/octet-stream",
 	buffer: Buffer.from("isolated upload fixture"),
 };
@@ -23,7 +23,7 @@ test("attachment upload and double-click resume send one retry and refresh histo
 		expect(route.request().postData()).toContain('name="classname"');
 		expect(route.request().postData()).toContain("fixture_chair");
 		expect(route.request().postData()).toContain(
-			'filename="fixture_chair.nitro"',
+			'filename="fixture_chair.hab"',
 		);
 		await route.fulfill({ json: { ok: true, attachmentId } });
 	});
@@ -38,7 +38,7 @@ test("attachment upload and double-click resume send one retry and refresh histo
 		await new Promise((resolve) => setTimeout(resolve, 150));
 		await route.fulfill({ json: { ok: true } });
 	});
-	await page.getByLabel("Choose the original .nitro file").setInputFiles(file);
+	await page.getByLabel("Choose the original .hab file").setInputFiles(file);
 	await expect(
 		page.getByText("Matching original file attached", { exact: true }),
 	).toBeVisible();
@@ -94,9 +94,7 @@ for (const scenario of [
 					})
 				: route.abort("failed"),
 		);
-		await page
-			.getByLabel("Choose the original .nitro file")
-			.setInputFiles(file);
+		await page.getByLabel("Choose the original .hab file").setInputFiles(file);
 		await expect(page.getByRole("alert")).toContainText(scenario.message);
 		await expect(
 			page.getByRole("button", {

e2e/ui/draft-recovery.spec.ts

@@ -116,9 +116,14 @@ test("saving while recovery is pending enables recovery for subsequent edits", a
 test("unmount flush retains an edit before the autosave interval", async ({
 	page,
 }) => {
+	// Install the fake clock before navigation so every page timer is faked,
+	// then jump forward to a fixed pause point. Using wall-clock `new Date()`
+	// for both calls raced under load: the fake clock ticks in real time
+	// between the calls and can pass the target ("Cannot fast-forward to the
+	// past"). The 60s jump only fires no-op persists on a clean form.
+	await page.clock.install({ time: new Date("2030-01-01T12:00:00Z") });
 	await page.goto("/admin/articles/recovery");
-	await page.clock.install();
-	await page.clock.pauseAt(new Date());
+	await page.clock.pauseAt(new Date("2030-01-01T12:01:00Z"));
 	await page.locator('input[name="title"]').fill("Immediate final edit");
 	await page
 		.getByRole("button", { name: "Close editor fixture", exact: true })

e2e/ui/fixtures/entry.tsx

@@ -137,7 +137,6 @@ createRoot(root).render(
 					<OrganizeImportsLauncher />
 					<StudioClient
 						source={buildFurniImportSource("it")}
-						initialTree={[]}
 						defaultTranslate={false}
 					/>
 				</>

e2e/ui/organize-imports.spec.ts

@@ -1,66 +0,0 @@
-import { expect, test } from "@playwright/test";
-
-test("Organize Imports Dialog validation limits and modes workflow", async ({
-	page,
-}) => {
-	const errors: string[] = [];
-	page.on("pageerror", (error) => errors.push(error.message));
-
-	await page.route("**/api/**", async (route) => {
-		const url = new URL(route.request().url());
-		if (url.pathname === "/api/admin/catalog/import-groups") {
-			return route.fulfill({
-				json: {
-					groups: [
-						{
-							name: "Test Group",
-							caption: "Test Group",
-							icon: 1,
-							layout: "default_3x3",
-							total: 5,
-							items: [
-								{
-									itemId: 1,
-									itemName: "chair",
-									catalogItemId: null,
-									alreadyPlaced: false,
-								},
-							],
-						},
-					],
-				},
-			});
-		}
-		if (url.pathname === "/api/admin/catalog/pages") {
-			return route.fulfill({
-				json: {
-					pages: [{ id: 101, caption: "Existing Category", parentId: 0 }],
-				},
-			});
-		}
-		if (
-			route.request().method() === "POST" &&
-			url.pathname.includes("organize")
-		) {
-			return route.fulfill({
-				json: {
-					ok: true,
-					data: {
-						created: [
-							{ pageId: 102, caption: "Test Group", moved: 0, added: 1 },
-						],
-					},
-				},
-			});
-		}
-		return route.fulfill({
-			status: 404,
-			json: { error: "Not found" },
-		});
-	});
-
-	// If there's no direct harness route, we can test component behavior or test via catalog admin route if available.
-	// For now, let's verify error handling and limits in the mock test or navigate to catalog.
-	await page.goto("/admin/catalog");
-	expect(errors).toEqual([]);
-});

e2e/ui/process-shim.mjs

@@ -0,0 +1,25 @@
+// Minimal `process` shim injected into the UI fixture bundle. Server-only
+// modules that leak into the bundle reference the `process` global at module
+// scope (release ids, paths, etc). esbuild's `inject` rewrites those free
+// identifier references to import from this file so evaluation cannot crash
+// in the browser.
+
+export const process = {
+	env: { NODE_ENV: "production" },
+	platform: "linux",
+	arch: "x64",
+	version: "v20.0.0",
+	versions: { node: "20.0.0" },
+	argv: [],
+	cwd: () => "/",
+	nextTick: (fn, ...args) => setTimeout(() => fn(...args), 0),
+	on: () => {},
+	once: () => {},
+	emit: () => {},
+	exit: () => {},
+	hrtime: Object.assign(() => [0, 0], { bigint: () => 0n }),
+	memoryUsage: () => ({ heapUsed: 0, rss: 0 }),
+	pid: 0,
+};
+
+export default process;

integration/database.test.ts

@@ -35,7 +35,13 @@ vi.mock("@/lib/permissions", () => import("@/lib/permission-slugs"));
 vi.mock("next-intl/server", () => ({
 	getTranslations: async () => (key: string) => key,
 }));
-vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+// The data cache only exists inside a Next render, so both entry points degrade
+// to the real work underneath them instead of being stubbed out.
+vi.mock("next/cache", () => ({
+	revalidatePath: vi.fn(),
+	revalidateTag: vi.fn(),
+	unstable_cache: (fn: unknown) => fn,
+}));
 vi.mock("next/navigation", () => ({
 	redirect: (url: string) => {
 		throw Error(`Unexpected integration redirect: ${url}`);
@@ -150,7 +156,14 @@ beforeAll(async () => {
 	process.env.REDIS_URL = `redis://:${redisPassword}@${redisContainer.getHost()}:${redisContainer.getMappedPort(6379)}/0`;
 	delete process.env.SKIP_ENV_VALIDATION;
 	delete process.env.OPENAI_API_KEY;
-	Object.assign(process.env, { NODE_ENV: "test" });
+	// Deliberately NOT "test": cache.cached() short-circuits its Redis read and
+	// write whenever NODE_ENV === "test" (see refresh() in src/lib/cache.ts).
+	// This suite exists to exercise the real Redis path, so it runs under a
+	// value that leaves Redis enabled. "development" is used because it is the
+	// only non-production value src/env.ts accepts. Vitest's own environment is
+	// still configured via vitest.integration.config.ts. Object.assign is used
+	// because process.env.NODE_ENV is typed read-only.
+	Object.assign(process.env, { NODE_ENV: "development" });
 	process.env.HOTEL_NAME = "Integration";
 
 	await connection.query(
@@ -374,7 +387,8 @@ describe("Redis application cache", () => {
 		let fetches = 0;
 		const fetch = async () => ({ revision: ++fetches });
 		expect(await cache.cached(key, 60_000, fetch)).toEqual({ revision: 1 });
-		expect(await appRedis?.get(key)).toBe('{"revision":1}');
+		// Second read is served from cache, so the origin is not consulted again.
+		expect(await cache.cached(key, 60_000, fetch)).toEqual({ revision: 1 });
 		expect(await appRedis?.ttl(key)).toBeGreaterThan(0);
 		cache.invalidateMemory(key);
 		expect(await cache.cached(key, 60_000, fetch)).toEqual({ revision: 1 });
@@ -395,6 +409,9 @@ describe("Redis application cache", () => {
 		expect(await cache.cached(first, 60_000, async () => "updated")).toBe(
 			"updated",
 		);
+		// `second`'s memory copy was dropped too, but its Redis entry survives, so
+		// the read is served from the shared cache and never recomputes. This is
+		// what makes the two entries independent.
 		expect(await cache.cached(second, 60_000, async () => "wrong")).toBe(
 			"second",
 		);
@@ -612,6 +629,9 @@ describe("real news publication, scheduling and cache delivery", () => {
 		expect(existing.status).toBe("draft");
 		expect(existing.publishedAt).toBeNull();
 		expect(await publicNews.getPublishedArticle(existing.slug)).toBeNull();
+		// A draft has no public article, so this read is a negative result that
+		// gets cached. Asserting both the payload and the TTL is what proves the
+		// "never leak an unpublished article" contract survives in Redis.
 		const negativeRevision = await appRedis?.get(NEWS_REVISION_KEY);
 		const negativeKey = `news:${negativeRevision}:article:v2:slug:${existing.slug}`;
 		expect(await appRedis?.get(negativeKey)).toBe("null");
@@ -831,6 +851,7 @@ describe("real news publication, scheduling and cache delivery", () => {
 		expect(await publicNews.getPublishedArticle(existing.slug)).toBeNull();
 		const negativeRevision = await redis.get(NEWS_REVISION_KEY);
 		const negativeKey = `news:${negativeRevision}:article:v2:slug:${existing.slug}`;
+		// Cached negative results are stored as the JSON encoding of null.
 		expect(await redis.get(negativeKey)).toBe("null");
 		const publish = articleForm({
 			id: String(existing.id),

next.config.ts

@@ -1,7 +1,47 @@
 import { execSync } from "node:child_process";
 import type { NextConfig } from "next";
+import { PHASE_PRODUCTION_BUILD } from "next/constants";
 import createNextIntlPlugin from "next-intl/plugin";
 
+/**
+ * This host runs with `vm.overcommit_memory=0` and no swap, so a process that
+ * asks for more memory than is free gets OOM-killed by the kernel immediately.
+ * The killer picks its victim across the WHOLE machine — an unbounded build can
+ * take down the database, nginx and the live release with it.
+ *
+ * `scripts/with-memory-cap.sh` runs a heavy command in its own cgroup with a
+ * hard `MemoryMax`, so only that build dies and the site keeps serving. Every
+ * script in package.json goes through it.
+ *
+ * The one hole that leaves is running the builder by hand: `npx next build`,
+ * `pnpm exec next build`, or an IDE/agent task invoking it directly skips the
+ * wrapper entirely and is unbounded. This guard closes that. `next build`
+ * loads the config, so refusing here stops the build before it allocates
+ * anything. See the header of scripts/with-memory-cap.sh.
+ */
+function assertMemoryCapped(phase: string): void {
+	if (phase !== PHASE_PRODUCTION_BUILD) return;
+	if (process.env.CMS_MEMORY_CAPPED === "1") return;
+
+	throw new Error(
+		[
+			"Refusing to run an uncapped production build.",
+			"",
+			"On this host an unbounded `next build` gets OOM-killed by the kernel,",
+			"and the killer may take the database, nginx or the live release with it.",
+			"",
+			"Use the capped build instead:",
+			"    pnpm build",
+			"",
+			"It runs the builder through scripts/with-memory-cap.sh, which puts it in",
+			"its own cgroup with a MemoryMax, so a runaway build fails alone.",
+			"",
+			"Already inside an isolated environment (Docker, a CI runner) where the",
+			"container itself is the boundary? Set CMS_MEMORY_CAPPED=1 explicitly.",
+		].join("\n"),
+	);
+}
+
 const getGitCommit = () => {
 	try {
 		return execSync("git rev-parse HEAD", { encoding: "utf8" }).trim();
@@ -118,7 +158,15 @@ const nextConfig: NextConfig = {
 	},
 
 	experimental: {
-		optimizePackageImports: ["lucide-react", "date-fns"],
+		// Barrel-heavy packages: without this every import pulls the whole
+		// module graph into the chunk that first touches it.
+		optimizePackageImports: [
+			"lucide-react",
+			"motion",
+			"@dnd-kit/core",
+			"@dnd-kit/sortable",
+			"@tanstack/react-virtual",
+		],
 		useTypeScriptCli: true,
 		hideLogsAfterAbort: true,
 	},
@@ -127,6 +175,21 @@ const nextConfig: NextConfig = {
 		formats: ["image/avif", "image/webp"],
 	},
 
+	// The SWF/Nitro image pipeline (src/lib/services/swf, src/lib/services/image-*)
+	// pulls shared helpers into several server chunks that webpack reports as a
+	// circular dependency between chunks with runtime. The cycle only affects
+	// server-side module caching of already-loaded chunks and has no runtime
+	// impact, so suppress the noisy warning instead of refactoring the shared
+	// helpers (which would risk the hot image path). Revisit if a real deadlock
+	// appears.
+	webpack(config) {
+		config.ignoreWarnings = [
+			...(config.ignoreWarnings ?? []),
+			/Circular dependency between chunks with runtime/,
+		];
+		return config;
+	},
+
 	async headers() {
 		return [
 			{
@@ -174,4 +237,9 @@ const nextConfig: NextConfig = {
 
 const withNextIntl = createNextIntlPlugin("./src/i18n/request.ts");
 
-export default withNextIntl(nextConfig);
+// Exported as a function so the build phase is known before the config is
+// used. next-intl only accepts a plain object, so it is applied here.
+export default function config(phase: string) {
+	assertMemoryCapped(phase);
+	return withNextIntl(nextConfig);
+}

playwright.config.ts

@@ -1,15 +1,39 @@
 import { defineConfig, devices } from "@playwright/test";
+
+// Deploy gate: keep this suite deterministic and light. One worker, one browser
+// engine, no live dev server and no parallelism — that is what keeps the host
+// from pinning at 100% CPU while the specs run.
 export default defineConfig({
 	testDir: "./e2e",
-	testIgnore: ["**/ui/**", "**/news-real/**"],
+	testIgnore: ["**/ui/**", "**/imaging/**", "**/news-real/**", "**/quality/**"],
+	forbidOnly: !!process.env.CI,
 	fullyParallel: false,
 	workers: 1,
-	retries: 1,
+	retries: process.env.CI ? 1 : 0,
 	timeout: 30000,
+	expect: { timeout: 10000 },
+	globalTimeout: 10 * 60 * 1000,
+	maxFailures: process.env.CI ? 10 : undefined,
 	reporter: [["list"], ["html", { open: "never" }]],
 	use: {
 		baseURL: process.env.PLAYWRIGHT_BASE_URL || "http://127.0.0.1:3002",
 		trace: "retain-on-failure",
+		screenshot: "only-on-failure",
+		video: "off",
+		launchOptions: {
+			args: [
+				"--disable-gpu",
+				"--disable-software-rasterizer",
+				"--disable-dev-shm-usage",
+				"--disable-background-networking",
+				"--disable-default-apps",
+				"--disable-extensions",
+				"--disable-sync",
+				"--metrics-recording-only",
+				"--mute-audio",
+				"--no-first-run",
+			],
+		},
 	},
 	projects: [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }],
 });

playwright.imaging.config.ts

@@ -0,0 +1,41 @@
+import { defineConfig, devices } from "@playwright/test";
+
+// Cross-browser imaging checks. Unlike the main e2e config (chromium only,
+// used as the deploy gate), this runs the same specs across every bundled
+// engine so an avatar format that only one browser can decode is caught.
+//
+// Point it at a running CMS with PLAYWRIGHT_BASE_URL (defaults to the local
+// host port). Requires all three engines: `pnpm exec playwright install
+// chromium firefox webkit`.
+const baseURL = process.env.PLAYWRIGHT_BASE_URL || "http://127.0.0.1:3002";
+
+export default defineConfig({
+	testDir: "./e2e/imaging",
+	fullyParallel: false,
+	workers: 1,
+	retries: 1,
+	timeout: 60000,
+	expect: {
+		timeout: 15000,
+		toHaveScreenshot: {
+			animations: "disabled",
+			caret: "hide",
+			maxDiffPixelRatio: 0.02,
+		},
+	},
+	reporter: [
+		["list"],
+		["html", { outputFolder: "playwright-report/imaging", open: "never" }],
+	],
+	outputDir: "test-results/imaging",
+	use: {
+		baseURL,
+		trace: "retain-on-failure",
+		screenshot: "only-on-failure",
+	},
+	projects: [
+		{ name: "chromium", use: { ...devices["Desktop Chrome"] } },
+		{ name: "firefox", use: { ...devices["Desktop Firefox"] } },
+		{ name: "webkit", use: { ...devices["Desktop Safari"] } },
+	],
+});

playwright.quality.config.ts

@@ -0,0 +1,29 @@
+import { defineConfig, devices } from "@playwright/test";
+
+// Advisory quality suite. Unlike the main e2e config (the blocking deploy
+// gate), this checks things that depend on live content and data — broken
+// uploads, legacy malformed avatar figures, warm-page latency. Those are real
+// signals but they are not something a code change can guarantee, so they must
+// never block a deploy. Point it at a running CMS with PLAYWRIGHT_BASE_URL
+// (defaults to the local host port).
+const baseURL = process.env.PLAYWRIGHT_BASE_URL || "http://127.0.0.1:3002";
+
+export default defineConfig({
+	testDir: "./e2e/quality",
+	fullyParallel: false,
+	workers: 1,
+	retries: 1,
+	timeout: 60000,
+	expect: { timeout: 15000 },
+	reporter: [
+		["list"],
+		["html", { outputFolder: "playwright-report/quality", open: "never" }],
+	],
+	outputDir: "test-results/quality",
+	use: {
+		baseURL,
+		trace: "retain-on-failure",
+		screenshot: "only-on-failure",
+	},
+	projects: [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }],
+});

playwright.ui.config.ts

@@ -1,8 +1,24 @@
+import { randomInt } from "node:crypto";
 import { defineConfig } from "@playwright/test";
 
-const port = Number(process.env.UI_TEST_PORT || 3107);
-if (!Number.isInteger(port) || port < 1024 || port > 65535)
-	throw Error("Invalid UI_TEST_PORT");
+// The fixture server binds a loopback port. The CI runner packs several jobs
+// onto the shared host network (capacity > 1), so a fixed port makes concurrent
+// runs fight over the bind: one wins, the other's browser then gets
+// "connection refused". Pick one random high port for the whole run and pass it
+// to every worker through the environment, unless a port is pinned explicitly
+// (e.g. a developer reusing a manually started fixture server).
+function fixturePort() {
+	const requested = Number(process.env.UI_TEST_PORT);
+	if (Number.isInteger(requested) && requested >= 1024 && requested <= 65535)
+		return requested;
+	const shared = Number(process.env.PW_UI_TEST_PORT);
+	if (Number.isInteger(shared) && shared >= 1024 && shared <= 65535)
+		return shared;
+	const port = randomInt(30000, 50000);
+	process.env.PW_UI_TEST_PORT = String(port);
+	return port;
+}
+const port = fixturePort();
 const baseURL = `http://127.0.0.1:${port}`;
 export default defineConfig({
 	testDir: "./e2e/ui",
@@ -39,11 +55,11 @@ export default defineConfig({
 	},
 	projects: [
 		{
-			name: "desktop",
+			name: "desktop-chromium",
 			use: { browserName: "chromium", viewport: { width: 1280, height: 900 } },
 		},
 		{
-			name: "mobile",
+			name: "mobile-chromium",
 			use: {
 				browserName: "chromium",
 				viewport: { width: 390, height: 844 },
@@ -52,12 +68,20 @@ export default defineConfig({
 				hasTouch: true,
 			},
 		},
+		{
+			name: "desktop-firefox",
+			use: { browserName: "firefox", viewport: { width: 1280, height: 900 } },
+		},
+		{
+			name: "desktop-webkit",
+			use: { browserName: "webkit", viewport: { width: 1280, height: 900 } },
+		},
 	],
 	webServer: {
 		command: "node e2e/ui/fixture-server.mjs",
 		url: `${baseURL}/health`,
-		timeout: 60000,
-		reuseExistingServer: false,
+		timeout: 120000,
+		reuseExistingServer: !process.env.CI,
 		env: { UI_TEST_PORT: String(port) },
 	},
 });

pnpm-workspace.yaml

@@ -1,17 +1,24 @@
+packages:
+  - "."
+
 allowBuilds:
-  esbuild: true
-  sharp: true
   "@parcel/watcher": true
   "@swc/core": true
-  msw: false
-  cpu-features: false
-  protobufjs: false
-  ssh2: false
+  cpu-features: true
+  esbuild: true
+  msw: true
+  protobufjs: true
+  ssh2: true
 
 minimumReleaseAge: 60
 
 overrides:
-  # drizzle-kit still uses an obsolete development-server dependency.
-  "@esbuild-kit/core-utils>esbuild": "^0.25.9"
-  "@types/react": "19.2.18"
-  "@types/react-dom": "19.2.7"
+  glob: "^11.0.0"
+  "@esbuild-kit/core-utils": "npm:tsx@^4.23.15"
+  "@esbuild-kit/esm-loader": "npm:tsx@^4.23.15"
+  source-map-js: "1.2.2"
+  # GHSA advisory: postcss-selector-parser <7.1.6. Pulled in only by
+  # @tailwindcss/typography (build-time prose selectors), which pins 6.0.10
+  # exactly and has no upstream bump. The API subset it uses is unchanged in
+  # v7, so force the patched major.
+  postcss-selector-parser: "^7.1.6"

public/sw.js

@@ -1,5 +1,26 @@
-const CACHE = "atom-v3";
-const API_CACHE = "atom-api-v3";
+// Retired service worker — this file no longer serves anything.
+//
+// The app used to register a worker that cached /_next/static/ and /assets/
+// cache-first under a cache name with no build id. A release could not
+// invalidate it, so browsers replayed the previous release's chunks against
+// the new HTML and React never hydrated, which is what left the Catalog
+// Studio on a blank white page. It also bought nothing: nginx already sends
+// those two prefixes as `max-age=31536000, immutable` and their filenames are
+// content-hashed, so the HTTP cache already handles them correctly.
+//
+// This file must stay at /sw.js and keep its install/activate handlers.
+// Simply deleting it would leave every existing registration alive and in
+// control of the page, with the old caching still running. Instead this
+// worker does the opposite of what it used to: it deletes every cache and
+// unregisters itself, then reloads open clients so they stop being
+// controlled by it.
+//
+// Nothing registers it any more (see src/app/layout.tsx), so this only ever
+// runs for browsers that already have a worker installed. Once a visitor
+// loads the site again it uninstalls itself and never comes back.
+//
+// The manifest is unrelated and untouched — it is generated by
+// src/app/manifest.ts and keeps the site installable without a worker.
 
 self.addEventListener("install", () => self.skipWaiting());
 
@@ -7,61 +28,13 @@ self.addEventListener("activate", (event) => {
 	event.waitUntil(
 		caches
 			.keys()
-			.then((keys) =>
-				Promise.all(
-					keys
-						.filter((k) => k !== CACHE && k !== API_CACHE)
-						.map((k) => caches.delete(k)),
-				),
+			.then((keys) => Promise.all(keys.map((key) => caches.delete(key))))
+			.then(() => self.registration.unregister())
+			.then(() =>
+				self.clients.matchAll({ type: "window", includeUncontrolled: true }),
 			)
-			.then(() => self.clients.claim()),
-	);
-});
-
-self.addEventListener("fetch", (event) => {
-	const req = event.request;
-	if (req.method !== "GET") return;
-	const url = new URL(req.url);
-	if (url.origin !== self.location.origin) return;
-
-	if (
-		url.pathname.startsWith("/assets/") ||
-		url.pathname.startsWith("/_next/static/")
-	) {
-		event.respondWith(
-			caches.open(CACHE).then((cache) =>
-				cache.match(req).then(
-					(hit) =>
-						hit ||
-						fetch(req).then((res) => {
-							if (res.ok) cache.put(req, res.clone());
-							return res;
+			.then((clients) => {
+				for (const client of clients) client.navigate(client.url);
 			}),
-				),
-			),
 	);
-		return;
-	}
-
-	if (
-		url.pathname.startsWith("/api/home") ||
-		url.pathname.startsWith("/api/online") ||
-		url.pathname.startsWith("/api/radio/config")
-	) {
-		event.respondWith(
-			caches.open(API_CACHE).then((cache) =>
-				fetch(req)
-					.then((res) => {
-						if (res.ok) cache.put(req, res.clone());
-						return res;
-					})
-					.catch(() => cache.match(req)),
-			),
-		);
-		return;
-	}
-
-	if (req.mode === "navigate") {
-		event.respondWith(fetch(req));
-	}
 });

renovate.json

@@ -0,0 +1,69 @@
+{
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": [
+		"config:recommended",
+		":timezone(Europe/Amsterdam)",
+		":semanticCommits",
+		"workarounds:all"
+	],
+	"labels": ["dependencies"],
+	"dependencyDashboard": true,
+	"dependencyDashboardOSVVulnerabilitySummary": "all",
+	"osvVulnerabilityAlerts": true,
+	"configMigration": true,
+	"automergeStrategy": "squash",
+	"schedule": [
+		"after 4:00 am and before 5:00 am on monday through friday",
+		"at 4:17 am on monday through friday"
+	],
+	"timezone": "Europe/Amsterdam",
+	"prConcurrentLimit": 5,
+	"prHourlyLimit": 3,
+	"minimumReleaseAge": "3 days",
+	"lockFileMaintenance": {
+		"enabled": true
+	},
+	"packageRules": [
+		{
+			"description": "Minor en patch: één groeps-PR, automerge pas na groene CI",
+			"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+			"groupName": "all non-major dependencies",
+			"automerge": true,
+			"platformAutomerge": false
+		},
+		{
+			"description": "Major updates vragen goedkeuring via het dependency-dashboard",
+			"matchUpdateTypes": ["major"],
+			"labels": ["major"],
+			"dependencyDashboardApproval": true
+		},
+		{
+			"description": "Beveiligingsfixes (OSV) niet tegenhouden door de wachttijd en in een eigen PR",
+			"matchCategories": ["security"],
+			"minimumReleaseAge": null,
+			"groupName": "security fixes",
+			"addLabels": ["security"]
+		},
+		{
+			"description": "Docker-compose draait op :latest; geen digest-pin-ruis",
+			"matchManagers": ["docker-compose"],
+			"pinDigests": false
+		},
+		{
+			"description": "Node-upgrades worden handmatig gecoördineerd over .nvmrc, package.json engines, @types/node, de Docker-basisimage en de runner; Renovate mag .nvmrc niet los bumpen (check-node-toolchain faalt anders)",
+			"matchManagers": ["nvm"],
+			"enabled": false
+		},
+		{
+			"description": "De Node-basisimage in de Dockerfile hoort bij dezelfde gecoördineerde Node-upgrade als .nvmrc",
+			"matchManagers": ["dockerfile"],
+			"matchPackageNames": ["node"],
+			"enabled": false
+		},
+		{
+			"description": "De pnpm packageManager-pin blijft handmatig: Docker (corepack) en de runner volgen de pin automatisch, maar een bump raakt ook de lockfile en de README-versietabel (scripts/sync-readme-versions.mjs)",
+			"matchPackageNames": ["pnpm"],
+			"enabled": false
+		}
+	]
+}