chore(deps): update all non-major dependencies

perf(build): keep test suites out of the image and cache CI builds durably
Three build-time improvements, all measured on this host. The build context no longer ships the test suites. `next build` type-checks the whole project, so `e2e/` and `integration/` in the context made the image build fail on a type error in test code and pulled @playwright/test, vitest, msw, testcontainers and drizzle-kit into the image. The CI runs those suites on the host. Type-check time in the build drops from 2.2s to 1.3s, and a contract test now fails if application code ever imports from those folders. The CI now exports the build cache to a directory outside the runner workspace: /var/cache/epicnext-cms-buildcache for the release and a separate map for branch preflights, so a branch can never feed the release cache. The workspace is wiped after every job and `docker builder prune` runs after every release, so the next build started with an empty cache and downloaded all 493 packages again (measured: reused 0, downloaded 493). With the durable export the frozen dependency layer is reused (measured: reused 493, downloaded 0) even after a full prune. A cache directory that is not writable only produces a warning; the release is never blocked. Investigated the remaining ~30s of Next.js build tracing: excluding the dev-only packages with `outputFileTracingExcludes` made it slower (35s vs 30s), because the traced output was already minimal (5 packages). The cost is Next's own page-config collection and file tracing over 329 routes, not the dependency set, so no configuration was kept.
2026-10-22 02:01:13 +00:00 · 2026-10-21 19:29:50 +02:00 · 2026-10-21 18:51:17 +02:00 · 2026-10-19 20:16:28 +02:00 · 2026-10-19 19:55:41 +02:00 · 2026-10-19 19:52:08 +02:00
134 changed files with 1701 additions and 1224 deletions
@@ -26,6 +26,25 @@ bun.lockb
 public/nitro-assets
 public/swf

+# Testbronnen draaien op de host (pnpm test:ui / test:integration / test:e2e),
+# de image heeft ze niet nodig. In de image zouden ze alleen de typecheck van
+# `next build` meebepalen en de image van @playwright/test, vitest, msw,
+# testcontainers en drizzle-kit afhankelijk maken.
+e2e/
+integration/
+
+# Databasebackups (~232MB, dagelijkse rotatie): horen niet in de buildcontext.
+# Ze maakten elke context groot en invalideerden bij elke rotatie de
+# `COPY . .`-laag, waardoor de Next-build volledig opnieuw draaide.
+backups/
+
+# Wordt tijdens de build opnieuw gegenereerd door `pnpm assets:editor`
+# (bron: node_modules/tinymce) en staat niet in git.
+public/vendor/
+
+# Lokale buildcache voor `docker compose build` (cache_from/cache_to).
+.docker-cache/
+
 .deploy.lock
 logs

@@ -3,8 +3,13 @@
 # ==============================================================================

 # --- DATABASE (High Performance Pooling & Strict Timeouts) ---
-DATABASE_URL="mysql://user:password@localhost:3306/dbname?charset=utf8mb4&connection_limit=150&connect_timeout=5"
-DATABASE_POOL_SIZE=150
+# The pool size is governed by DATABASE_POOL_SIZE (src/lib/db.ts); the
+# `connection_limit` in the URL is only honoured by tools that read the URL
+# directly (drizzle-kit, scripts). Keep both in step and keep them well below
+# MariaDB's `max_connections` (151 by default) or the emulator and any second
+# CMS instance get "Too many connections". README §performance: pool size 25.
+DATABASE_URL="mysql://user:password@localhost:3306/dbname?charset=utf8mb4&connection_limit=25&connect_timeout=5"
+DATABASE_POOL_SIZE=25
 DATABASE_IDLE_TIMEOUT_MS=60000
 DATABASE_CONNECT_TIMEOUT_MS=5000

@@ -59,6 +64,10 @@ AUTH_SECRET=your-super-secret-auth-key-change-this-min-32-chars
 APP_KEY=base64:your-app-key-here=
 # Bcrypt cost factor for new password hashes.
 BCRYPT_COST=12
+# Password-length policy for every new password (register, password reset and
+# staff-created accounts). Minimum: 5-30. Maximum: 30-128.
+PASSWORD_MIN_LENGTH=12
+PASSWORD_MAX_LENGTH=128

 # --- ANTI-DDOS (app-layer gate, production only) ---
 # On by default in production. Set to "false" to disable (not recommended).
@@ -57,6 +57,9 @@ blob-report/
 build-reports/
 !/docs/performance-budgets.md

+# Local buildcache (docker compose cache_from/cache_to)
+.docker-cache/
+
 # One-off local snapshots (o.a. catalog-integrity/pre-fix.json): runtime-werk,
 # geen bron. Per map opgeslagen om een incident terug te kunnen lezen.
 backups/
@@ -3,21 +3,43 @@ FROM node:26.10.0-alpine AS migrations
 WORKDIR /app
 ENV NEXT_TELEMETRY_DISABLED=1

-# Installeer git, bash en pnpm v12. bash is nodig voor
+# Installeer git, bash en corepack. bash is nodig voor
 # scripts/with-memory-cap.sh (gebruikt bashisme zoals arrays en BASH_REMATCH);
 # Alpine levert geen bash mee.
+#
+# pnpm komt niet meer uit een losgepind npm-pakket, maar uit corepack: die
+# leest de versie én de sha512-hash uit de `packageManager`-pin van
+# package.json. Daarmee kan de image nooit uit sync raken met het lockfile
+# (vroeger stond hier [email protected] terwijl package.json 12.11.2 voorschreef)
+# en wordt de gedownloade pnpm-binary ook in de runtime-image bewaard.
 RUN --mount=type=cache,target=/var/cache/apk \
+    --mount=type=cache,target=/root/.npm \
    apk add --no-cache git bash \
-    && npm install -g [email protected]
+    && npm install -g [email protected] \
+    && corepack enable pnpm
+
+# corepack bewaart de gedownloade pnpm buiten de cache-mount, zodat de runtime
+# (`docker run --entrypoint pnpm <migrations-image> db:migrate`) pnpm ook
+# zonder netwerk kan gebruiken.
+ENV COREPACK_HOME="/usr/local/share/corepack"
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0

 # Stel het PATH zo in dat Alpine pnpm gegarandeerd overal herkent
 ENV PNPM_HOME="/usr/local/share/pnpm"
 ENV PATH="$PNPM_HOME:/usr/local/bin:$PATH"

+# Alleen package.json: de `packageManager`-pin bepaalt welke pnpm corepack
+# installeert. Deze laag blijft gecachet wanneer alleen de lockfile verandert.
+COPY package.json ./
+RUN corepack install
+
 COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml* .npmrc* ./

-# Voer de installatie uit met de pnpm v12 store cache-mount
-RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
+# Voer de installatie uit met de pnpm v12 store cache-mount. De mount moet op
+# de store staan die pnpm ook echt gebruikt ($PNPM_HOME/store/v11); met het
+# oude pad (/root/.local/share/pnpm/store) cache'te de mount niets en
+# downloadde elke build alle packages opnieuw.
+RUN --mount=type=cache,target=/usr/local/share/pnpm/store \
    pnpm install --frozen-lockfile --ignore-scripts

 COPY . .
@@ -18,7 +18,7 @@ Features a premium animated homepage (typewriter hero, floating orbs, scroll cou
 | Docker          | 24+            | Optional — for containerized deployment  |
 | Valkey          | 8.x+           | Optional — caching, rate limiting, SSE   |

-Core stack: **Next.js 16.4.1** (App Router) · **React 19.3.1** · **TypeScript 7.0.2** · **Drizzle ORM 0.45.4** · **Zod 4.6.7** · **Vitest 5.0.4** · **Biome 2.5.15** · **Playwright 1.64.1**.
+Core stack: **Next.js 16.4.2** (App Router) · **React 19.3.1** · **TypeScript 7.0.2** · **Drizzle ORM 0.45.4** · **Zod 4.6.7** · **Vitest 5.0.5** · **Biome 2.5.15** · **Playwright 1.64.1**.

 > Builds must run through the `pnpm` scripts. This host has no swap and
 > `vm.overcommit_memory=0`, so an uncapped `next build` gets OOM-killed by the
@@ -307,6 +307,46 @@ responsibility. Docker uses the committed pnpm lockfile and pinned Node version.
 The build cache can stay enabled: copying changed source invalidates the
 application build layer. Deleting all Docker cache is not an update mechanism.

+#### Build toolchain and cache
+
+The image never installs a pinned pnpm of its own. The Dockerfile installs
+[corepack](https://nodejs.org/api/corepack.html) and lets it resolve the pnpm
+version *and* its sha256/sha512 hash from the `packageManager` field in
+`package.json`. One pin therefore drives the Docker build, the CI runner and
+the host — the image can no longer drift away from the lockfile, and a tampered
+package tarball is rejected instead of silently installed. Bumping pnpm is a
+single edit in `package.json` (plus the README version table, checked by
+`pnpm readme:versions:check`).
+
+Two caches make repeated builds cheap:
+
+- **pnpm store** — a BuildKit cache mount on `$PNPM_HOME/store` keeps the
+  downloaded packages between builds. A lockfile change then re-uses the store
+  (`reused 493, downloaded 0`) instead of re-downloading every package.
+- **Local build cache** — `docker compose build` exports the build cache to
+  `.docker-cache/cms` and imports it again on the next build. Unlike the
+  daemon's own cache, this survives `scripts/docker-prune.sh`, which trims the
+  daemon cache to 4 GB after every deploy. The directory is ignored by both
+  Git and the build context; delete it to force a cold build.
+
+The CI has the same problem on a bigger scale: the runner workspace is wiped
+after every job and `scripts/docker-prune.sh` trims the daemon cache after
+every release, so the next build started with an empty cache and downloaded all
+493 packages again (measured: `reused 0, downloaded 493`). `scripts/ci-deploy.sh`
+and `scripts/ci-preflight.sh` therefore export the build cache to a directory
+outside the workspace — `/var/cache/epicnext-cms-buildcache` for the release and
+`/var/cache/epicnext-cms-preflight-cache` for branch preflights, so a branch can
+never feed the release cache. With that export in place the same build re-uses
+the frozen dependency layer (`reused 493, downloaded 0`) even after a full
+`docker builder prune`. Set `CMS_BUILD_CACHE_DIR` to another path to move the
+cache, or to an empty value to switch it off.
+
+The build context excludes `e2e/` and `integration/`. `next build` type-checks
+the whole project, so shipping the test suites inside the image made a type
+error in test code break the image build and pulled `@playwright/test`, `vitest`,
+`msw` and `testcontainers` into it. The CI runs those suites on the host
+(`pnpm test:ui`, `pnpm test:integration`).
+
 ### Volumes

 Only the CMS (and the optional avatar imager container, see [Avatar Imaging](#avatar-imaging)) run in Docker. The heavy client assets and gamedata stay on the host and are shared into the container so imports and uploads persist:
@@ -346,7 +386,13 @@ docker compose build --build-arg RUN_USER=1000

 The CMS container runs with `network_mode: host`. This lets the existing `127.0.0.1` references in `.env` keep working against host services — MariaDB (`3306`), Valkey/Redis (`6379`), the emulator RCON/API (`3003`/`3001`) and the avatar imager — without re-writing any environment variables. The container consequently listens **directly on the host's port 3002**, so stop any previous host-side CMS (e.g. `pm2 stop next`) that occupies that port before starting it.

-The **build** also runs on the host network (`build.network: host`) because this host disables Docker iptables (`/etc/docker/daemon.json`: `"iptables": false`), which would otherwise leave build containers without outbound NAT/DNS when fetching packages.
+The **build** deliberately does *not* use host networking. BuildKit (v0.26, Docker 29)
+refuses to grant host networking unless every caller passes
+`--allow=network.host`, and `docker compose build` has no such flag — asking for
+`build.network: host` therefore turned every rebuild into an immediate
+"additional privileges requested" failure. The build only needs outbound
+internet (apk, corepack/pnpm, next/font/google), which the default bridge
+provides.

 ### Health Check

@@ -595,7 +641,7 @@ URLs look like `https://<hotel>/imaging/avatarimage?figure=hd-180-1.ch-210-66&im

 ### Requirements (host)

- Docker (daemon with `build.network: host`, same as the CMS build — this host disables Docker iptables).
+- Docker (daemon with BuildKit; the CMS build runs on the default bridge, not on host networking — see [Networking](#networking)).
 - An nginx that serves `/gamedata/` (FigureData/FigureMap/EffectMap…) and `/gamedata/bundled` (furniture bundle assets — `.hab` by default, the extension imports write and this deployment's client requests, plus any legacy `.nitro` still on disk; choose the written extension with `FURNI_BUNDLE_EXT`) over HTTP so the renderer can fetch them. The compose file points at `host.docker.internal:8081`.

 ### Configuration — `/docker/Polaris-imager/.env`
@@ -965,11 +1011,13 @@ there are two fixed slots, and each release lands in the idle one:
 | A | 3002 | `epicnext-cms-app` |
 | B | 3003 | `epicnext-cms-green` |

-`docker-compose.yml` defines both services (`cms`, and `cms-green` behind the
-`green` profile) from one shared YAML anchor so they cannot drift apart. Note
-that the CI deploy path deliberately uses `docker run` rather than compose, so
-the resource limits are declared in **both** places — limits that only existed
-in compose would never apply to a real release.
+`docker-compose.yml` defines a single `cms` service (the blue slot on 3002)
+behind the `cms` profile, so a bare `docker compose up -d` never starts it. The
+green slot (`epicnext-cms-green`, port 3003) only ever exists as a `docker run`
+container created by the CI deploy; compose does not define it, so the two paths
+cannot drift apart. Note that the CI deploy path deliberately uses `docker run`
+rather than compose, so the resource limits are declared in **both** places —
+limits that only existed in compose would never apply to a real release.

 ### Compose on a CI host

@@ -977,9 +1025,14 @@ Compose and CI both want port 3002, so only one of them can own a host. A stray
 compose replica (`docker compose up`, or the daily `scripts/docker-update.sh`
 cron) parked an `epicnext-cms` container on the blue slot while nginx served the
 green slot, and every later release stopped on "Port 3002 is already in use" —
-after the build, the migrations and the browser gate. Two guards now prevent
+after the build, the migrations and the browser gate. Three guards now prevent
 that:

+- The `cms` service sits behind the `cms` profile, so a bare `docker compose up
+  -d` starts only byparr and can never claim 3002. The service starts only when
+  it is named explicitly (`docker compose up -d cms`), which is what the
+  installer/updater already do; Compose enables the profile automatically for an
+  explicitly named service.
 - `scripts/docker-update.sh` refuses to run on a CI host. It used to test only
  `epicnext-cms-app`, but after a cutover to the green slot that container is
  stopped and deleted, so the guard stopped firing while the host stayed
@@ -1,5 +1,20 @@
 # ─────────────────────────────────────────────────────────────────────────────
-# Next.js CMS — blue/green
+# Next.js CMS — single slot on port 3002
+#
+# ── Eigenaar van poort 3002 ─────────────────────────────────────────────────
+# Deze repo kent twee deploy-paden die allebei op poort 3002 willen:
+#   * `scripts/ci-deploy.sh` (blue/green, docker run) — de eigenaar op een
+#     CI-host. Elke push naar main bouwt daar een nieuwe image, draait de
+#     migrations en zet nginx pas om na health + e2e + imaging.
+#   * deze compose-`cms`-service — bedoeld voor een LOSSE host zonder CI.
+#
+# Ze kunnen niet naast elkaar draaien: wie op 3002 zit, blokkeert de ander met
+# `EADDRINUSE`. Daarom staat `cms` achter een profile. Een bloot
+# `docker compose up -d` start dus alleen byparr en kan nooit de live CI-release
+# van de site drukken. De service start alleen als je hem expliciet noemt
+# (`docker compose up -d cms`, `docker compose build cms`, ...): Compose schakelt
+# het profile van een expliciet genoemde service vanzelf in. Op een CI-host wil
+# je dat dus juist NOOIT doen.
 # ─────────────────────────────────────────────────────────────────────────────
 x-cms: &cms
  image: epicnext-cms:${CMS_RELEASE:-local}
@@ -14,8 +29,20 @@ x-cms: &cms
    dockerfile: Dockerfile
    args:
      NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}
-  # Runtime host networking IS required: blue/green needs per-release host ports
-  # (3002/3003) and nginx reaches the slot over 127.0.0.1.
+    # Lokale buildcache op schijf. `scripts/docker-prune.sh` brengt de
+    # daemon-cache na elke deploy terug tot 4GB, waardoor de lagen van de
+    # vorige release verdwijnen. Deze export overleeft die prune: een rebuild
+    # na een lockfile-wijziging hergebruikt dan de al gedownloade packages
+    # (pnpm store) in plaats van ze opnieuw te downloaden.
+    # De map ligt binnen de buildcontext, zodat buildx een ontbrekende
+    # cachemap stilzwijgend negeert i.p.v. de build te laten falen; zowel
+    # .dockerignore als .gitignore sluiten de map uit.
+    cache_from:
+      - type=local,src=.docker-cache/cms
+    cache_to:
+      - type=local,dest=.docker-cache/cms,mode=max
+  # Runtime host networking IS required: nginx reaches the CMS over 127.0.0.1
+  # on the single port that is actually served (3002).
  network_mode: host
  stop_grace_period: 15s
  restart: unless-stopped
@@ -28,8 +55,8 @@ x-cms: &cms
    - /var/www/Gamedata:/var/www/Gamedata

  # ── Resource limits ──
-  mem_limit: 6g
-  memswap_limit: 7g
+  mem_limit: 2g
+  memswap_limit: 2g
  cpus: 2.0
  pids_limit: 512

@@ -43,21 +70,19 @@ x-cms: &cms
 services:
  cms:
    <<: *cms
+    # Alleen starten als je deze host bewust compose-only beheert.
+    profiles: ["cms"]
    container_name: epicnext-cms
    environment:
      - HOSTNAME=0.0.0.0
      - PORT=3002

-  cms-green:
-    <<: *cms
-    container_name: epicnext-cms-green
-    profiles: ["green"]
-    environment:
-      - HOSTNAME=0.0.0.0
-      - PORT=3003
-
  byparr:
    image: ghcr.io/thephaseless/byparr:latest
+    # `latest` is een drijvende tag. Zonder pull_policy haalt compose de
+    # bestaande image nooit opnieuw op en blijft byparr hangen op de eerste
+    # versie die ooit werd binnengehaald.
+    pull_policy: always
    container_name: byparr
    network_mode: host
    restart: unless-stopped
@@ -81,7 +81,7 @@ The direct template intentionally records the CDN/edge socket address when place

 ### Local verification and deployment boundary

-`pnpm exec vitest run --coverage.enabled=false scripts/proxy-config.test.mjs` runs the installed Docker Compose CLI against a disposable clone configuration, without contacting Docker Engine, building images or reading the real `.env`. It verifies selection through `.env`, loopback/port override precedence, the IPv4 healthcheck and preservation of mounts, release selection and host networking. It explicitly skips when Compose is unavailable. This is not a container-start or network-isolation test.
+`pnpm exec vitest run --coverage.enabled=false scripts/proxy-config.test.mjs` runs the installed Docker Compose CLI against a disposable clone configuration, without contacting Docker Engine, building images or reading the real `.env`. It verifies selection through `.env`, loopback/port override precedence, the IPv4 healthcheck and preservation of mounts, release selection and host networking. The `cms` service is behind the `cms` profile (so a bare `docker compose up -d` cannot claim port 3002 on a CI-managed host), so the test renders the configuration with `--profile cms`. It explicitly skips when Compose is unavailable. This is not a container-start or network-isolation test.

 `pnpm test:integration` additionally starts disposable Nginx containers from the actual templates, supplies a temporary test certificate, and sends real HTTPS requests with forged identity headers. It checks direct-mode replacement even with an inherited real-IP rule, rejection of untrusted peers, and acceptance through an explicitly trusted peer. This requires Docker Engine and the OpenSSL CLI and does not read deployment credentials. The templates must still pass `nginx -t` on the intended host after its hostname/certificate substitution, then the listener and trusted-header checks above; the disposable fixture cannot certify that host or its firewall.

@@ -158,7 +158,15 @@ const nextConfig: NextConfig = {
 	},

 	experimental: {
-		optimizePackageImports: ["lucide-react", "date-fns"],
+		// Barrel-heavy packages: without this every import pulls the whole
+		// module graph into the chunk that first touches it.
+		optimizePackageImports: [
+			"lucide-react",
+			"motion",
+			"@dnd-kit/core",
+			"@dnd-kit/sortable",
+			"@tanstack/react-virtual",
+		],
 		useTypeScriptCli: true,
 		hideLogsAfterAbort: true,
 	},
@@ -18,8 +18,8 @@
 		"format": "biome format --write .",
 		"diag:permissions": "tsx scripts/diagnose-permission-page.ts",
 		"jobs:worker": "node --conditions=react-server --import tsx scripts/jobs-worker.ts",
-		"test": "bash scripts/with-memory-cap.sh 8g vitest run --coverage.enabled=false",
-		"test:coverage": "bash scripts/with-memory-cap.sh 8g vitest run",
+		"test": "bash scripts/with-memory-cap.sh 8g vitest run",
+		"test:coverage": "bash scripts/with-memory-cap.sh 8g vitest run --coverage.enabled=true",
 		"typecheck": "bash scripts/with-memory-cap.sh 6g tsc --noEmit",
 		"db:generate": "drizzle-kit generate",
 		"db:introspect": "drizzle-kit introspect",
@@ -34,7 +34,7 @@
 		"db:studio": "drizzle-kit studio",
 		"gamedata:compress": "node scripts/compress-gamedata.mjs",
 		"hk:matrix:check": "tsx scripts/verify-housekeeping-matrix.ts",
-		"test:housekeeping": "bash scripts/with-memory-cap.sh 8g vitest run --coverage.enabled=false src/features/housekeeping src/lib/admin-theme-source-audit.test.ts src/lib/admin/authorization-contract.test.ts",
+		"test:housekeeping": "bash scripts/with-memory-cap.sh 8g vitest run src/features/housekeeping src/lib/admin-theme-source-audit.test.ts src/lib/admin/authorization-contract.test.ts",
 		"assets:editor": "node scripts/copy-editor-assets.mjs",
 		"deps:audit": "pnpm audit --audit-level=high",
 		"analyze": "pnpm assets:editor && bash scripts/with-memory-cap.sh 10g next build --webpack && node scripts/performance-report.mjs --output-dir build-reports",
@@ -55,10 +55,10 @@
 		"@dnd-kit/core": "6.3.1",
 		"@dnd-kit/sortable": "10.0.0",
 		"@dnd-kit/utilities": "3.2.2",
-		"@formatjs/icu-messageformat-parser": "3.5.21",
-		"@hookform/resolvers": "5.9.1",
-		"@tanstack/react-query": "5.104.3",
-		"@tanstack/react-virtual": "3.14.19",
+		"@formatjs/icu-messageformat-parser": "3.5.22",
+		"@hookform/resolvers": "6.0.0",
+		"@tanstack/react-query": "5.104.5",
+		"@tanstack/react-virtual": "3.14.21",
 		"class-variance-authority": "0.7.1",
 		"clsx": "2.1.1",
 		"cmdk": "1.1.1",
@@ -66,16 +66,16 @@
 		"drizzle-orm": "0.45.4",
 		"hash-wasm": "4.12.0",
 		"ioredis": "6.0.0",
-		"isomorphic-dompurify": "^4.5.0",
+		"isomorphic-dompurify": "^4.6.0",
 		"jpeg-js": "0.4.4",
 		"jsonc-parser": "3.3.1",
 		"jszip": "3.10.2",
-		"lucide-react": "1.57.0",
+		"lucide-react": "1.61.0",
 		"lzma-wasm": "1.0.7",
-		"motion": "14.2.0",
-		"music-metadata": "12.2.1",
+		"motion": "14.5.0",
+		"music-metadata": "12.2.3",
 		"mysql2": "3.24.6",
-		"next": "16.4.1",
+		"next": "16.4.2",
 		"next-auth": "5.0.0-beta.32",
 		"next-intl": "4.14.9",
 		"otplib": "13.5.0",
@@ -83,7 +83,7 @@
 		"react": "19.3.1",
 		"react-dom": "19.3.1",
 		"react-hook-form": "7.90.0",
-		"resend": "6.33.0",
+		"resend": "6.34.1",
 		"server-only": "0.0.1",
 		"sharp": "^0.35.5",
 		"sonner": "2.0.8",
@@ -92,9 +92,9 @@
 		"zod": "4.6.7"
 	},
 	"devDependencies": {
-		"@axe-core/playwright": "4.13.0",
+		"@axe-core/playwright": "4.14.0",
 		"@babel/parser": "8.0.7",
-		"@biomejs/biome": "2.5.15",
+		"@biomejs/biome": "2.6.2",
 		"@playwright/test": "1.64.1",
 		"@tailwindcss/forms": "0.5.11",
 		"@tailwindcss/postcss": "4.3.3",
@@ -102,17 +102,17 @@
 		"@types/node": "26.6.5",
 		"@types/react": "19.3.0",
 		"@types/react-dom": "19.3.0",
-		"@vitest/coverage-v8": "5.0.4",
+		"@vitest/coverage-v8": "5.0.5",
 		"drizzle-kit": "0.31.11",
 		"esbuild": "0.28.2",
 		"msw": "^3.0.3",
 		"pino-pretty": "13.2.0",
-		"postcss": "8.5.30",
+		"postcss": "8.5.31",
 		"tailwindcss": "4.3.3",
 		"testcontainers": "12.2.1",
 		"tsx": "4.23.15",
 		"typescript": "7.0.2",
-		"vite": "8.3.4",
-		"vitest": "5.0.4"
+		"vite": "8.3.5",
+		"vitest": "5.0.5"
 	}
 }
@@ -1,8 +1,24 @@
+import { randomInt } from "node:crypto";
 import { defineConfig } from "@playwright/test";

-const port = Number(process.env.UI_TEST_PORT || 3107);
-if (!Number.isInteger(port) || port < 1024 || port > 65535)
-	throw Error("Invalid UI_TEST_PORT");
+// The fixture server binds a loopback port. The CI runner packs several jobs
+// onto the shared host network (capacity > 1), so a fixed port makes concurrent
+// runs fight over the bind: one wins, the other's browser then gets
+// "connection refused". Pick one random high port for the whole run and pass it
+// to every worker through the environment, unless a port is pinned explicitly
+// (e.g. a developer reusing a manually started fixture server).
+function fixturePort() {
+	const requested = Number(process.env.UI_TEST_PORT);
+	if (Number.isInteger(requested) && requested >= 1024 && requested <= 65535)
+		return requested;
+	const shared = Number(process.env.PW_UI_TEST_PORT);
+	if (Number.isInteger(shared) && shared >= 1024 && shared <= 65535)
+		return shared;
+	const port = randomInt(30000, 50000);
+	process.env.PW_UI_TEST_PORT = String(port);
+	return port;
+}
+const port = fixturePort();
 const baseURL = `http://127.0.0.1:${port}`;
 export default defineConfig({
 	testDir: "./e2e/ui",
@@ -65,7 +81,7 @@ export default defineConfig({
 		command: "node e2e/ui/fixture-server.mjs",
 		url: `${baseURL}/health`,
 		timeout: 120000,
-		reuseExistingServer: true,
+		reuseExistingServer: !process.env.CI,
 		env: { UI_TEST_PORT: String(port) },
 	},
 });
@@ -186,17 +186,17 @@ importers:
        specifier: 3.2.2
        version: 3.2.2([email protected])
      '@formatjs/icu-messageformat-parser':
-        specifier: 3.5.21
-        version: 3.5.21
+        specifier: 3.5.22
+        version: 3.5.22
      '@hookform/resolvers':
-        specifier: 5.9.1
-        version: 5.9.1([email protected](@types/[email protected])([email protected]))([email protected])
+        specifier: 6.0.0
+        version: 6.0.0([email protected](@types/[email protected])([email protected]))([email protected])
      '@tanstack/react-query':
-        specifier: 5.104.3
-        version: 5.104.3([email protected])
+        specifier: 5.104.5
+        version: 5.104.5(@types/[email protected])([email protected])
      '@tanstack/react-virtual':
-        specifier: 3.14.19
-        version: 3.14.19([email protected]([email protected]))([email protected])
+        specifier: 3.14.21
+        version: 3.14.21([email protected]([email protected]))([email protected])
      class-variance-authority:
        specifier: 0.7.1
        version: 0.7.1
@@ -219,8 +219,8 @@ importers:
        specifier: 6.0.0
        version: 6.0.0
      isomorphic-dompurify:
-        specifier: ^4.5.0
-        version: 4.5.0(@noble/[email protected])
+        specifier: ^4.6.0
+        version: 4.6.0(@noble/[email protected])
      jpeg-js:
        specifier: 0.4.4
        version: 0.4.4
@@ -231,29 +231,29 @@ importers:
        specifier: 3.10.2
        version: 3.10.2
      lucide-react:
-        specifier: 1.57.0
-        version: 1.57.0(@types/[email protected])([email protected])
+        specifier: 1.61.0
+        version: 1.61.0(@types/[email protected])([email protected])
      lzma-wasm:
        specifier: 1.0.7
        version: 1.0.7
      motion:
-        specifier: 14.2.0
-        version: 14.2.0([email protected]([email protected]))([email protected])
+        specifier: 14.5.0
+        version: 14.5.0([email protected]([email protected]))([email protected])
      music-metadata:
-        specifier: 12.2.1
-        version: 12.2.1
+        specifier: 12.2.3
+        version: 12.2.3
      mysql2:
        specifier: 3.24.6
        version: 3.24.6(@types/[email protected])
      next:
-        specifier: 16.4.1
-        version: 16.4.1(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected])
+        specifier: 16.4.2
+        version: 16.4.2(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected])
      next-auth:
        specifier: 5.0.0-beta.32
-        version: 5.0.0-beta.32([email protected].1(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected]))([email protected])
+        version: 5.0.0-beta.32([email protected].2(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected]))([email protected])
      next-intl:
        specifier: 4.14.9
-        version: 4.14.9(@swc/[email protected])(@types/[email protected])([email protected].1(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected]))([email protected])
+        version: 4.14.9(@swc/[email protected])(@types/[email protected])([email protected].2(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected]))([email protected])
      otplib:
        specifier: 13.5.0
        version: 13.5.0
@@ -270,8 +270,8 @@ importers:
        specifier: 7.90.0
        version: 7.90.0(@types/[email protected])([email protected])
      resend:
-        specifier: 6.33.0
-        version: 6.33.0
+        specifier: 6.34.1
+        version: 6.34.1
      server-only:
        specifier: 0.0.1
        version: 0.0.1
@@ -292,14 +292,14 @@ importers:
        version: 4.6.7
    devDependencies:
      '@axe-core/playwright':
-        specifier: 4.13.0
-        version: 4.13.0([email protected])
+        specifier: 4.14.0
+        version: 4.14.0([email protected])
      '@babel/parser':
        specifier: 8.0.7
        version: 8.0.7
      '@biomejs/biome':
-        specifier: 2.5.15
-        version: 2.5.15
+        specifier: 2.6.2
+        version: 2.6.2
      '@playwright/test':
        specifier: 1.64.1
        version: 1.64.1
@@ -322,8 +322,8 @@ importers:
        specifier: 19.3.0
        version: 19.3.0(@types/[email protected])
      '@vitest/coverage-v8':
-        specifier: 5.0.4
-        version: 5.0.4([email protected].4)
+        specifier: 5.0.5
+        version: 5.0.5([email protected].5)
      drizzle-kit:
        specifier: 0.31.11
        version: 0.31.11
@@ -332,13 +332,13 @@ importers:
        version: 0.28.2
      msw:
        specifier: ^3.0.3
-        version: 3.0.3(@types/[email protected])([email protected])([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))
+        version: 3.0.3(@types/[email protected])([email protected])([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))
      pino-pretty:
        specifier: 13.2.0
        version: 13.2.0
      postcss:
-        specifier: 8.5.30
-        version: 8.5.30
+        specifier: 8.5.31
+        version: 8.5.31
      tailwindcss:
        specifier: 4.3.3
        version: 4.3.3
@@ -352,11 +352,11 @@ importers:
        specifier: 7.0.2
        version: 7.0.2
      vite:
-        specifier: 8.3.4
-        version: 8.3.4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])
+        specifier: 8.3.5
+        version: 8.3.5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])
      vitest:
-        specifier: 5.0.4
-        version: 5.0.4(@types/[email protected])(@vitest/[email protected].4)([email protected](@noble/[email protected]))([email protected](@types/[email protected])([email protected])([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])))([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))
+        specifier: 5.0.5
+        version: 5.0.5(@types/[email protected])(@vitest/[email protected].5)([email protected](@noble/[email protected]))([email protected](@types/[email protected])([email protected])([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])))([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))

 packages:

@@ -386,8 +386,9 @@ packages:
      nodemailer:
        optional: true

-  '@axe-core/[email protected]3.0':
-    resolution: {integrity: sha512-6YLx+kxXu5GJceG4ozFg+33a2EMTdjYwWGloJ3sb9Kta5pp+ZNS53uxGVog5JetIY8s++P5UrtX+cri+u0VAVg==}
+  '@axe-core/[email protected]4.0':
+    resolution: {integrity: sha512-SGUhG5PIHd2eMdpgBF2PyQLOhX+qyDR2PT4cmoS4Qk2ak+jX/rrSvst9l0PGv5WTHolKpUMvVmoHpr4cZgf1RQ==}
+    engines: {node: '>=22.12.0'}
    peerDependencies:
      playwright-core: '>= 1.0.0'

@@ -462,59 +463,71 @@ packages:
    resolution: {integrity: sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==}
    engines: {node: '>=18'}

-  '@biomejs/biome@2.5.15':
-    resolution: {integrity: sha512-WZTW4slm/pdkh92K6t/3aEN++44JD1PQ7squ7RCMLI1flHGl43DVOIGXvCjHiZgBMO1V4uYxoFNtqrIA4qGuIQ==}
+  '@biomejs/biome@2.6.2':
+    resolution: {integrity: sha512-JLTFAFF9vfJcWwLhwuL4ZHflLg+XfTEC4IUnAlJRX1cMRt57++Xd1Ysb9Fdmlh9YUrvyCXfPEHjjEIqKJGdPKw==}
    engines: {node: '>=14.21.3'}
    hasBin: true

-  '@biomejs/cli-darwin-arm64@2.5.15':
-    resolution: {integrity: sha512-BZVzFhJ/mUvTLMYbc9x6el0o2Uv5zP7bACYyhFb6fSc1giroXm7PL0a5KqMJ9F+/BnkYRjagD/ROSDVOZ6eapg==}
+  '@biomejs/cli-android-arm64@2.6.2':
+    resolution: {integrity: sha512-dMpdpH7zFEL5FxuIA9LJW+RoNyC3oeDB7PJyjqVVwtMNoKB5uo8OZYmrVSBikn71txzYwy/3xga7UME6bJQZ6A==}
+    engines: {node: '>=14.21.3'}
+    cpu: [arm64]
+    os: [android]
+
+  '@biomejs/[email protected]':
+    resolution: {integrity: sha512-XCwEhPBGYzuRA502dRkCcQ+5cefQwuxQR7f9wa4do92dvIcuBL6VMLMFB/fL9hlpZ4dGSfHdpGFSIDlp52mg0A==}
+    engines: {node: '>=14.21.3'}
+    cpu: [x64]
+    os: [android]
+
+  '@biomejs/[email protected]':
+    resolution: {integrity: sha512-rpXtabRgyZNz3aCjd/cRoSZGYi92R9eAXdUUe1sigIsRDyfMwgThaa98Yxt1fiZ7mxquqkAyIHIo08N/e1ToBA==}
    engines: {node: '>=14.21.3'}
    cpu: [arm64]
    os: [darwin]

-  '@biomejs/cli-darwin-x64@2.5.15':
-    resolution: {integrity: sha512-V5Kw63V+fVGNFhFrizDxMbGXAzZCh8kYzJpy3GI6gTapWDg7bZK9oYC9CbVgQSEdTnupz0U5Efz8Ev+5vdBBXw==}
+  '@biomejs/cli-darwin-x64@2.6.2':
+    resolution: {integrity: sha512-7GGzlm1GxUKoQ9CNV8tQZ+XXad4sz+v+uzNsWlhaGjsnZqUOVBw1OmAMpG3uNV/Mr0UrCpRJvSK0qvfuqSQOjg==}
    engines: {node: '>=14.21.3'}
    cpu: [x64]
    os: [darwin]

-  '@biomejs/cli-linux-arm64-musl@2.5.15':
-    resolution: {integrity: sha512-tGzZUTcJCV7tj5Adh/Gn6nR4MycqA3iohq2LEcrarAgRBkU0h0OKd2UzCRkOsOYOuUGaUJb4YmqRqyy2feGGSw==}
+  '@biomejs/cli-linux-arm64-musl@2.6.2':
+    resolution: {integrity: sha512-I+FYCLVSmR3cYfKcQ+KNeLOZ5w0wRd9fQFlw3JbSvy7bkegvTqdHaBRRcJzHQB/1ldldTLIcG21ka6X2cTWmJw==}
    engines: {node: '>=14.21.3'}
    cpu: [arm64]
    os: [linux]
    libc: [musl]

-  '@biomejs/cli-linux-arm64@2.5.15':
-    resolution: {integrity: sha512-XaG7P7eeSLYETD3K9grfB0mQmpLQZjygdbsxekWBJAg4am79fGAtRpfRyNnTvXB2fZFNnJZG3nXm7HBat0+VUw==}
+  '@biomejs/cli-linux-arm64@2.6.2':
+    resolution: {integrity: sha512-Qs4CofCE8MdkjZFfEjswh2NAcbyQ7IVYtGSzQBvLqFlla/CSXroGbktUFndWG/kVSTywadauzAspYWtSfqAc2g==}
    engines: {node: '>=14.21.3'}
    cpu: [arm64]
    os: [linux]
    libc: [glibc]

-  '@biomejs/cli-linux-x64-musl@2.5.15':
-    resolution: {integrity: sha512-IlxUcyxilVGPsE008x13pWdkTbU3nQpP2i9b5UrbOYj6goBkKsRX1XB7yJLcV+O1H9LBchIIm4adOaVLZBX0ZQ==}
+  '@biomejs/cli-linux-x64-musl@2.6.2':
+    resolution: {integrity: sha512-wnjEXAK2pDd2j8r9gKI3L+44sIxjkYzS5aHmD1+K57RNJ3sFyT4n22NH6QFPqqeVdRBxN54H3kckUUCrFKCcJw==}
    engines: {node: '>=14.21.3'}
    cpu: [x64]
    os: [linux]
    libc: [musl]

-  '@biomejs/cli-linux-x64@2.5.15':
-    resolution: {integrity: sha512-xE4iEW/3LqlYj9GFgGrFsFSH51dEEpUbYWBfeOv0q87WkUDxK2o/HhreSb7qMJqck70RVM6Lg96hgedcAYcOkA==}
+  '@biomejs/cli-linux-x64@2.6.2':
+    resolution: {integrity: sha512-FJKsb95418139xDdbv9XnNJsIIwvsgR21Of0aE9B9U+nQlOtRq5gJl2ps0jZUmYBxTaOlP9BKo8N+Ff8+Rui1g==}
    engines: {node: '>=14.21.3'}
    cpu: [x64]
    os: [linux]
    libc: [glibc]

-  '@biomejs/cli-win32-arm64@2.5.15':
-    resolution: {integrity: sha512-2kPKzhNlm8C+Ru3GcO0Me2ODkCBLrVOUNuyi84RJyWDVKAA4+Kjj3jMjL938lF6BRfvltC4vB2nPY9SvN51Ovg==}
+  '@biomejs/cli-win32-arm64@2.6.2':
+    resolution: {integrity: sha512-/PEOo6evlgrQOfKhMNtC/4Gk8ai3hySXXEtjUzCqZe/4iAbMdqelpp7qvZEDyLxlZS+BjOMQFpq2gXI/BPaAqw==}
    engines: {node: '>=14.21.3'}
    cpu: [arm64]
    os: [win32]

-  '@biomejs/cli-win32-x64@2.5.15':
-    resolution: {integrity: sha512-yAzh4UqEImV6Hcy0zjUqNfJAsUhoD64FBQCdTG8Md/Z2wQeVP/ZmJ3XRYAs1g8J9fjTFyl2fCtc5FB5til47+g==}
+  '@biomejs/cli-win32-x64@2.6.2':
+    resolution: {integrity: sha512-FVlWD+mDDz8nN5LWKRWUhhb7wKIK0VE3oXQvQBX7Fwwj00CvqMVhMyiz1iz8O5aZGmnkhFlKSwJPrUvMh5prQw==}
    engines: {node: '>=14.21.3'}
    cpu: [x64]
    os: [win32]
@@ -944,6 +957,9 @@ packages:
  '@formatjs/[email protected]':
    resolution: {integrity: sha512-Vnl7IOSyMRaP4Pjv48etkT2nlcIwzh4QWIa3hewzGlZZPBbft+TbMir4MijpDViOLN/1hvkGC10oYMuilsG+fw==}

+  '@formatjs/[email protected]':
+    resolution: {integrity: sha512-YuwN+dDKgssfuYwtOyGQD0CSn7K46g9cv1Fp0VgKpjZDDFvv8b8crzP990IcJhRPWHhKzCGsbUSJVIguyyFA5A==}
+
  '@formatjs/[email protected]':
    resolution: {integrity: sha512-j8cUmOJzVgkHuS0QiQ6ga76UIoLOFSAMWhs7aZJztH3aAdCOAE6vpC8KVvFB4cU10ON0y2/5oOVmPJ43s2lTwA==}

@@ -967,8 +983,8 @@ packages:
    engines: {node: '>=6'}
    hasBin: true

-  '@hookform/resolvers@5.9.1':
-    resolution: {integrity: sha512-7b7vsbraJxKgjVSA1Nur9tLwj539WGJUBLA7QNvXnFoT2pM5Z7G+6rlukk4B2/QrTZy6huRtH6wKeESPKuIr6w==}
+  '@hookform/resolvers@6.0.0':
+    resolution: {integrity: sha512-6iBzQnB+YwAveVc8HUi6QYLITn5X+xNKRMFIcNXHZlvp2aTI7yWbj4n/JodXxirMCcBc4VCjb2aYAJh4x07mVw==}
    peerDependencies:
      '@sinclair/typebox': '>=0.25.24'
      '@standard-schema/spec': ^1.0.0
@@ -978,11 +994,11 @@ packages:
      ajv-errors: ^3.0.0
      ajv-formats: ^2.1.1
      arktype: ^2.0.0
-      ata-validator: ^1.2.0
+      ata-validator: ^1.23.0
      class-transformer: '>=0.4.0'
      class-validator: '>=0.12.0'
      computed-types: ^1.0.0
-      effect: ^3.10.3
+      effect: ^4.0.0
      fluentvalidation-ts: ^3.0.0
      fp-ts: ^2.7.0
      io-ts: ^2.0.0
@@ -1278,57 +1294,57 @@ packages:
    resolution: {integrity: sha512-lZBylf8kTt096RGnnVfHq+5w4DTRgmFjf59/IVMPBBwKrViumV1l95LZ/LrWt1LZlsJymHOSnoP8mX/kPXZPWw==}
    engines: {node: '>=22'}

-  '@next/[email protected].1':
-    resolution: {integrity: sha512-5sUUrrSvs/2/2LnLoesybMGx12EtPB46fdZ6RhAw0XDGSPxU2LFyQBB7yuEiOFFJPKmBY6+q2jTr1/AMbnp0/g==}
+  '@next/[email protected].2':
+    resolution: {integrity: sha512-nTUTFH7G5/J/fmpkjVLegOkqyKOP0CEsJcMsyO4UCYeN1su+YMW/MfaSErnJskL7XM+UDK6aTvslxsRCyya/sA==}

-  '@next/[email protected].1':
-    resolution: {integrity: sha512-U+hQ5Gj3fpzf4fveTIF3dpUFYhaSW8vHhdAnbiIomzXzg7boreYFgBqprepXFtW4sw+aTttiNmg0gew/iFNhbg==}
+  '@next/[email protected].2':
+    resolution: {integrity: sha512-ONkhFvZNFWlsEHOM/81AtxdyuJP2KRYKYR0JxPwvcu1AuPMMMgcL+wW2luldJvMtZwKtUxoSkCychW5wIeoYSw==}
    engines: {node: '>= 10'}
    cpu: [arm64]
    os: [darwin]

-  '@next/[email protected].1':
-    resolution: {integrity: sha512-/hqC3V1XLUjhMASf/WridKdO9FXoEgN3HBWmtKbj00MPgnltutfraWJ3bYTpCRIgEIpbjJyOVLpYgAhh/BkdcQ==}
+  '@next/[email protected].2':
+    resolution: {integrity: sha512-luPCMbOsCoaF+kXJEUjmjmOZg1lC3BflhmUu+ZmW4tBu2vW/4AXak8JBFvePizGkxVmNiAw/r9ra+6UviCWtWQ==}
    engines: {node: '>= 10'}
    cpu: [x64]
    os: [darwin]

-  '@next/[email protected].1':
-    resolution: {integrity: sha512-GHzncHbcaS9g95kcvTNtKQW3aCLoR+xc3Jm7qrkpk1R+D2BjMHIPyvQGRPKCdMX95BsH/421jBUK06q9tEwzjw==}
+  '@next/[email protected].2':
+    resolution: {integrity: sha512-xhwFTAncJyaCNy5KqKKuKaIIdCy1/1ZV1s5S1G0hhT7wGMkDTlfJ6aQbfRFnIG/s3/kDrxQ8aycVe+c5QnP8ow==}
    engines: {node: '>= 10'}
    cpu: [arm64]
    os: [linux]
    libc: [glibc]

-  '@next/[email protected].1':
-    resolution: {integrity: sha512-1SuJyDxW/PR9dHJat/ZRgcYLhuSZ+1psP4DlKb2tKIuXbjygqpLrJWRSq+onZQBv8LcmU67EIrmb6c3XTaJLjw==}
+  '@next/[email protected].2':
+    resolution: {integrity: sha512-T1PNmfbPcxr5ndtWUL/3wQtLXsz808lq6sc2GrNT5k2oquF7UyqZddHSuAewHVsWsGXe6nsl9HoN1YNriVjuSg==}
    engines: {node: '>= 10'}
    cpu: [arm64]
    os: [linux]
    libc: [musl]

-  '@next/[email protected].1':
-    resolution: {integrity: sha512-Istng1hMGp9TGO4lUqeKLd70MPN/OOkucVTP2Nmj+gLkwBgmPqUw8CJYBCC7nbl/B/23bBCcjCI5Hsh6hazC1A==}
+  '@next/[email protected].2':
+    resolution: {integrity: sha512-N9cDUOCGtkJG5PNKDFZUF3xXndrJJcpLp121uAGjIGvO/U2p9tfdNOM9htj7+5f72l0m8rMw/cvYacUJBQoudg==}
    engines: {node: '>= 10'}
    cpu: [x64]
    os: [linux]
    libc: [glibc]

-  '@next/[email protected].1':
-    resolution: {integrity: sha512-aSC9wMNiZRRFVpPkPWBzRwLQxIGm/CiQcXyFF1XNcgodb+uMxdk7aSSGGpDXCbnvZdf4itjHxpOd5h7i7zaiYw==}
+  '@next/[email protected].2':
+    resolution: {integrity: sha512-yY2uh1YhX6ufuYy2FCbw1dqblbhI57GLYAJfCkqD9auTv6pLrH67Uccjc3QMKBeCYAG6lkgu08ExmX1bbjejjQ==}
    engines: {node: '>= 10'}
    cpu: [x64]
    os: [linux]
    libc: [musl]

-  '@next/[email protected].1':
-    resolution: {integrity: sha512-t/myvwFDlypMUjRvbBf8qLPyuaB0iXYYdBtwMt6DM6f+60wtGr4bSYholdPqNeV5VUXZhrpMwfza829kmhS3iA==}
+  '@next/[email protected].2':
+    resolution: {integrity: sha512-j/ArWRIHpMMB6wYLMhr2puTguBt70lNU/Cmjl9p6dTDE8DGknYJMP9PdwPk2dqpCNL/KIX9yfngDvIesxJPmsg==}
    engines: {node: '>= 10'}
    cpu: [arm64]
    os: [win32]

-  '@next/[email protected].1':
-    resolution: {integrity: sha512-6ICqPo9awCkrtYNPhwkx1uU7rlFWrZRrIboDHS2LU+jv088UBYQtmJ25h6pCp27/+FZjF6BQ4Te4ErugyMeuBg==}
+  '@next/[email protected].2':
+    resolution: {integrity: sha512-AA4edyWHDko3NCSo0x6GomsdgFb0oR1J3MXU1b5xt6FRFg4AucrMPW3S0hCe/9onU0O1BbpGQBsqo1r0Gneu1g==}
    engines: {node: '>= 10'}
    cpu: [x64]
    os: [win32]
@@ -1952,22 +1968,26 @@ packages:
    peerDependencies:
      tailwindcss: '>=3.0.0 || >=4.0.0 || insiders'

-  '@tanstack/[email protected].3':
-    resolution: {integrity: sha512-DZY9TuJAOgU3UyHUhXb4CcTYEHNZszlwkPg4VViIwTxOKzLprPUU+rbaPZQd3srqkGOtpaDdKpW972UV/LKlcg==}
+  '@tanstack/[email protected].5':
+    resolution: {integrity: sha512-Q94gI8Opd+CbdVNOdj8ZCyV8WqLYitrDq1t96Xc8WZT6lY0r5iRnJLXYDxMex7EEf2v+mXvn4FcjaBKSxXZQ9A==}

-  '@tanstack/[email protected].3':
-    resolution: {integrity: sha512-5Ts1ImwJKqoJgPkLxl9WrPQy1JEoEmti3MaaODCfBamHUGFk57IFrc+AIksPq+BAm10EsroX56qm398Z42LG7w==}
+  '@tanstack/[email protected].5':
+    resolution: {integrity: sha512-RORgFe052U+93weaNuqg7qHq7vNVNzXN/VrXqD4bbAuQCWUqOl2lV5Ui9flWk5CVvMyL/Bh27QWhzwH0aaOx9g==}
    peerDependencies:
+      '@types/react': ^18 || ^19
      react: ^18 || ^19
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true

-  '@tanstack/[email protected]9':
-    resolution: {integrity: sha512-zmVdJO8DDqHphZ2H6SnTmgpVXcUy5DprB+clZF0ik679/d0MQ1UPEb2jtaX6F5VTAX4o3ozSLQaRCnybS2KYLA==}
+  '@tanstack/[email protected].21':
+    resolution: {integrity: sha512-wWE/ZJDNNDp18JHWy7n5PQooqerHePVkEEu6Op0twKQ2InF9DPhYMQptQY0syDEviMd3/r8D0OUvKJibDGm9HQ==}
    peerDependencies:
      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0

-  '@tanstack/[email protected].4':
-    resolution: {integrity: sha512-ygZ3O99Il18dl0gG0q7sH78iSkb96F07G+xK9V83eCgV8NQbcNd7R+cgcJJMFO7llBoebd0A82sCCstQq2Vp6Q==}
+  '@tanstack/[email protected].6':
+    resolution: {integrity: sha512-CsTW892z23gy7IyxYTTorVu1uZWB+0N349rSMgKz4rFLPpLza7F7TpcCKeI5iUAwYQCt8QUlOU67J+KXCxtpGw==}

  '@tokenizer/[email protected]':
    resolution: {integrity: sha512-56U2O6fDLFtqokwWh597IdeUgtM7j+TT9tb1soybhgA6cy163gAcVmoQr8H4Ud/CkgCkViwcuLyqtn6wYqw59Q==}
@@ -2146,11 +2166,11 @@ packages:
    cpu: [x64]
    os: [win32]

-  '@vitest/[email protected].4':
-    resolution: {integrity: sha512-P5YcQY8Y6RmoE9xRXI38rT8pssbcubEzqtYTM2XQoxOXMDn04nRaTI1SM8qCl9/NfW3ag9GlzdSXu7IwO5Ft8A==}
+  '@vitest/[email protected].5':
+    resolution: {integrity: sha512-4KpkGdIrSqBihx/JyP/e+S+IKB98etg1XDQiLAxksLfcShnwi1VReGeOT9NI43hLHbknosKp/1CCLn9Zgcs8mg==}
    peerDependencies:
-      '@vitest/browser': 5.0.4
-      vitest: 5.0.4
+      '@vitest/browser': 5.0.5
+      vitest: 5.0.5
    peerDependenciesMeta:
      '@vitest/browser':
        optional: true
@@ -2163,8 +2183,8 @@ packages:
    resolution: {integrity: sha512-gUsfXZJbzPamoIY5TvHFiMMoXESBrUMo+xqaj+rYrWI69+EnvRlYBlP96ZnHPY4vX8kyUpgAnFUCg5wZG/HkDQ==}
    engines: {node: '>=22'}

-  '@vitest/[email protected].4':
-    resolution: {integrity: sha512-tqAlrYWce4iUxhr3ncNohejtCTOcHeE8XWrSNZY3OhPoDn01yeGv+gnaBy64ATp7o6pb03eIbBAjzmibpc9vIQ==}
+  '@vitest/[email protected].5':
+    resolution: {integrity: sha512-xLL3lkDegJZw+MGoGaCCsFayDZthGgpAtr3Vziyfc4p7xH89K7KRPcRBBh/kEYm0Aqkt5DtTmkYpBtRV/FrHZg==}
    peerDependencies:
      msw: ^2.4.9 || ^3.0.0
      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -2174,8 +2194,8 @@ packages:
      vite:
        optional: true

-  '@vitest/[email protected].4':
-    resolution: {integrity: sha512-MZKk/gSkm2q+ICobMxCpH1mA+cCAWm8WV7UhxlqGjq/sJ3AGc1BqFOs5CRVXxH78wQtme9q/NAAgBquj4AcyMw==}
+  '@vitest/[email protected].5':
+    resolution: {integrity: sha512-lwJRExuH417257Q5wv9QYugN9IMJkoxcrKrYxGPQkBzl7wlNpTUxD/5yNX4ESKVUIShKPgkGchYPFMWOOk0wzw==}

  [email protected]:
    resolution: {integrity: sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==}
@@ -2233,8 +2253,8 @@ packages:
    resolution: {integrity: sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g==}
    engines: {node: '>= 6.0.0'}

-  [email protected]3.0:
-    resolution: {integrity: sha512-UzGt8zg7Ny8djbYMhxl2zuEevVa7r2gJjYY5Lwr1xM7+XU2nd6CkIWFTVcCIbAP63vSz71NaVyyuSk9lHKcy0A==}
+  [email protected]4.0:
+    resolution: {integrity: sha512-9WTZxEjsZ7b13TH8JPmbV2z8CHbl80/2hm3XPEG4JgNdQLK81IBRXmSxHfMAOkSqQeRxT/0dwNDz2GOm3zzpcQ==}
    engines: {node: '>=4'}

  [email protected]:
@@ -2669,8 +2689,8 @@ packages:
    resolution: {integrity: sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==}
    engines: {node: '>=14'}

-  framer-motion@14.2.0:
-    resolution: {integrity: sha512-cD2gfFujHt4r/+dZpcn5yziu7VRwQAQDakwIm/bICYXbafnpHCYokV+PnEXqErnSdv6Eh28a+SRF+f3ndGcMsQ==}
+  framer-motion@14.5.0:
+    resolution: {integrity: sha512-pXIj1m9JX//3XExUgQIpS0f5iWcjenO14ekdg9S++Rr0VzfnAaveoNzonigRarD/+AM3umTGS3K/RANGQJitCQ==}
    peerDependencies:
      react: ^18.0.0 || ^19.0.0
      react-dom: ^18.0.0 || ^19.0.0
@@ -2783,8 +2803,8 @@ packages:
  [email protected]:
    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}

-  isomorphic-dompurify@4.5.0:
-    resolution: {integrity: sha512-5bUPydvGp1pJx27Cff7ScHsgJkETjliiSqpQjPZHMBO6hgqZem38qsXF4TkUYu83yBlbb3rYhypgoo6mMvz48w==}
+  isomorphic-dompurify@4.6.0:
+    resolution: {integrity: sha512-ZLYxxq2efNUsaUMViQXML/HMBkaJSd8WAFcNJQfWOGi+KLGQyZA8Ewpcj7yWur6KzMHlrZNXTXr8trbx/bkZRw==}
    engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}

  [email protected]:
@@ -2995,8 +3015,8 @@ packages:
    resolution: {integrity: sha512-5J9ysMYUpYIg9RF2vJpy9SinEmSviFSe0GyPpCQ4L5QSkLAgeLXlTAOu2ZwWUU5m+0SBl6gUU1R1ZQB3aKypfA==}
    engines: {bun: '>=1.0.0', deno: '>=1.30.0', node: '>=8.0.0'}

-  lucide-react@1.57.0:
-    resolution: {integrity: sha512-bXFZEucYhAzLD62Jse76AbTR6LiSLTn3Tqir2f1n8rZrWAdLodYy7jnRZSPIT89dRLk/IseMOUWG82wJtTyTTw==}
+  lucide-react@1.61.0:
+    resolution: {integrity: sha512-v2SQPPPNjnr+BlhL9Spuzmo5yR+hLkftfuE4E3jaxdNPgSH0hJKPcLJBP7yAta87jQNPsSERS59PJjCJ/CorBA==}
    peerDependencies:
      '@types/react': '*'
      react: ^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0
@@ -3051,14 +3071,14 @@ packages:
    engines: {node: '>=10'}
    hasBin: true

-  motion-dom@14.2.0:
-    resolution: {integrity: sha512-TDdxnjAavh2Qm4lQCQI3uoTx9IR/Id2PI8JNEXW3AcwwV2yvhoimAX3/TnE+x82gDHfPq2yx/cJ58TTw5mMr0A==}
+  motion-dom@14.5.0:
+    resolution: {integrity: sha512-GAdnk1AgdtyrD3I09ZxEpV+Nt5QgwUsxN55qQV8mfk082dFQpcoT07wXkQAHRZjvZWUEBYhBVNeoXvtkYdL8jA==}

  [email protected]:
    resolution: {integrity: sha512-3VvN5Uvf8B6qG+OfOui6Nht5EWp+vLuU3IqcAj7ItZGKqtmTjCebl5sGZF7/08gEHRnEl1AP/fIwbcEyVrcQGQ==}

-  motion@14.2.0:
-    resolution: {integrity: sha512-45cDwjZh0yOMZtnX3hIFPIPmzCWz/RC2bD/niWVIssGBjJlMmosbDILG9a+ZyoP635Z5xrbKvuo10spv9dBdnw==}
+  motion@14.5.0:
+    resolution: {integrity: sha512-A0MinYYhYU12CHELw4+9jKPVreI43yDOprC4kAATHhF1rLfMFMhfpBR0GvdRR/IWEuKsHDnVn4fT+R2gQRyulw==}
    peerDependencies:
      react: ^18.0.0 || ^19.0.0
      react-dom: ^18.0.0 || ^19.0.0
@@ -3087,8 +3107,8 @@ packages:
      vite:
        optional: true

-  [email protected].1:
-    resolution: {integrity: sha512-JB/bnmQAa8HiKHuIg9dupGFjCKpdsocm9nJrTQe31f5zTaKfJmTwJwOvH1yVL91/jwFNKTOAOIPrHo3L5XwGfQ==}
+  [email protected].3:
+    resolution: {integrity: sha512-YN0oQcaIhXyIW8lmmjErhegZhqpyO325oQu9ZjtOFXb/QfwgGjxpzIQUmEGHBpLlrCix42OmrlvUZFkfv+Eecw==}
    engines: {node: '>=22'}

  [email protected]:
@@ -3146,8 +3166,8 @@ packages:
      '@types/react':
        optional: true

-  [email protected].1:
-    resolution: {integrity: sha512-uc657V62E34fOI6W5NtG9IzwsPcms0Z60grz2MJGtglgD+pTFnNt4Yw2PzaU622tfX4vhrDgLZzicE2YlhI20Q==}
+  [email protected].2:
+    resolution: {integrity: sha512-r+oBJojfefUjOiWkBhXgLS+igxX/7BWyK59uHnyOyplMSLtBZ+QLP3okrdYTbrfrbrmNTVWLBPaHDX9KRaIt3w==}
    engines: {node: '>=20.9.0'}
    hasBin: true
    peerDependencies:
@@ -3256,8 +3276,8 @@ packages:
    resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==}
    engines: {node: ^10 || ^12 || >=14}

-  [email protected]0:
-    resolution: {integrity: sha512-zkd+e9S1AQHhmaBKye9zlFHWjOwVgqXl1q3ECYy8561K7qxR2cREf/STLskulBFd78k6AOFeA+ff1TtEzk9bAA==}
+  [email protected]1:
+    resolution: {integrity: sha512-YUbWYCgErwnMAVkjUnYa+KlMBzGpHwiIt/DE7f0G33AuX2LH9UcTk6KgWxd3zRU+pN3u/C+Xl3EnMLM4Hea7Sg==}
    engines: {node: ^10 || ^12 || >=14}

  [email protected]:
@@ -3380,8 +3400,8 @@ packages:
  [email protected]:
    resolution: {integrity: sha512-XGoLeRAVzUTcJ1qkxPQhDJyIZ5d6zzZD9nT7AEZOaaU9UbWclhycElmhO+VD5bFeLuzhPBaOV2oXC8uG35ZSpg==}

-  [email protected]3.0:
-    resolution: {integrity: sha512-sbpWLrwlaIDZuGHRYNX6101CWtXLqRNcT1S9c8BB357Ab2+IUJ7dNpYffVmGh2C11/4AfcFvM4ltURH8NJlPGw==}
+  [email protected]4.1:
+    resolution: {integrity: sha512-3jo/j1WAW7CBkE6pzK4qLjZCfHRLIhY3ph3x/wzU+MN51cSw3EtReGce8S1cA1R0ipNDOdFYU5Lmt5r563lvYw==}
    engines: {node: '>=20'}
    peerDependencies:
      '@react-email/render': '*'
@@ -3542,8 +3562,8 @@ packages:
    resolution: {integrity: sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==}
    engines: {node: '>=14.16'}

-  strtok3@10.5.0:
-    resolution: {integrity: sha512-PgAsgIuizbZN/r4+g4UNvbVCTpJWdoIdI71kIWwKmdIH0vJ0q7ylMVGU8PWj2s9O98y4MtFWiDTIrtNukZMMgQ==}
+  strtok3@10.6.2:
+    resolution: {integrity: sha512-BkdixFFUt7r7LsX6aGNPVyYMLjW+M1USLlKPNbZsrZEmLFh5tGqhdfckKo6xgsZIJqdDD0CZGkeCJJwNWQIKQA==}
    engines: {node: '>=18'}

  [email protected]:
@@ -3716,13 +3736,13 @@ packages:
  [email protected]:
    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}

-  [email protected].4:
-    resolution: {integrity: sha512-IftLE8phJhdNRIGNEV4JCCvfNScoZQVfcXaN8TQropWGJtOHcu+iAB9pHcuGvmEb/kddw0LBe/jS8ztdC6xdiQ==}
+  [email protected].5:
+    resolution: {integrity: sha512-z1YpjieJ9g0ebTmQpLBv/oq9E3F9EIlOe+7LahW8SrE3LTiG3udBRUXQOlYXP9b+IC2q2phHeVxj9xGlw34OEQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    hasBin: true
    peerDependencies:
      '@types/node': ^20.19.0 || >=22.12.0
-      '@vitejs/devtools': ^0.7.1
+      '@vitejs/devtools': ^0.7.1 || ^0.8.0
      esbuild: ^0.27.0 || ^0.28.0
      jiti: '>=1.21.0'
      less: ^4.0.0
@@ -3759,20 +3779,20 @@ packages:
      yaml:
        optional: true

-  [email protected].4:
-    resolution: {integrity: sha512-z0WxZRV2Sg48wF0FSgMq3TFG8JS38/Qr96vZVZdX6+Em9raQTvnXQvdTFJe2m3rfyJnEHeHQ/snceIdi8D1pVg==}
+  [email protected].5:
+    resolution: {integrity: sha512-cPODOMF8YnkiiYtDdHo6n4wWmBrOBBbOIYH2d33M4l3CdNn72h+qMmO6uXffUN6A5AZFXNND/d+krS9mgkXRfg==}
    engines: {node: ^22.12.0 || ^24.0.0 || >=26.0.0}
    hasBin: true
    peerDependencies:
      '@edge-runtime/vm': '*'
      '@opentelemetry/api': ^1.9.0
      '@types/node': ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 5.0.4
-      '@vitest/browser-preview': 5.0.4
+      '@vitest/browser-playwright': 5.0.5
+      '@vitest/browser-preview': 5.0.5
      '@vitest/browser-webdriverio': ^5.0.0-beta.5 || >=5.0.0
-      '@vitest/coverage-istanbul': 5.0.4
-      '@vitest/coverage-v8': 5.0.4
-      '@vitest/ui': 5.0.4
+      '@vitest/coverage-istanbul': 5.0.5
+      '@vitest/coverage-v8': 5.0.5
+      '@vitest/ui': 5.0.5
      happy-dom: '*'
      jsdom: '*'
      vite: ^6.4.0 || ^7.0.0 || ^8.0.0
@@ -3906,9 +3926,9 @@ snapshots:
      preact: 10.24.3
      preact-render-to-string: 6.5.11([email protected])

-  '@axe-core/[email protected]3.0([email protected])':
+  '@axe-core/[email protected]4.0([email protected])':
    dependencies:
-      axe-core: 4.13.0
+      axe-core: 4.14.0
      playwright-core: 1.64.1

  '@babel/[email protected]': {}
@@ -3966,39 +3986,47 @@ snapshots:

  '@bcoe/[email protected]': {}

-  '@biomejs/biome@2.5.15':
+  '@biomejs/biome@2.6.2':
    optionalDependencies:
-      '@biomejs/cli-darwin-arm64': 2.5.15
-      '@biomejs/cli-darwin-x64': 2.5.15
-      '@biomejs/cli-linux-arm64': 2.5.15
-      '@biomejs/cli-linux-arm64-musl': 2.5.15
-      '@biomejs/cli-linux-x64': 2.5.15
-      '@biomejs/cli-linux-x64-musl': 2.5.15
-      '@biomejs/cli-win32-arm64': 2.5.15
-      '@biomejs/cli-win32-x64': 2.5.15
+      '@biomejs/cli-android-arm64': 2.6.2
+      '@biomejs/cli-android-x64': 2.6.2
+      '@biomejs/cli-darwin-arm64': 2.6.2
+      '@biomejs/cli-darwin-x64': 2.6.2
+      '@biomejs/cli-linux-arm64': 2.6.2
+      '@biomejs/cli-linux-arm64-musl': 2.6.2
+      '@biomejs/cli-linux-x64': 2.6.2
+      '@biomejs/cli-linux-x64-musl': 2.6.2
+      '@biomejs/cli-win32-arm64': 2.6.2
+      '@biomejs/cli-win32-x64': 2.6.2

-  '@biomejs/cli-darwin-arm64@2.5.15':
+  '@biomejs/cli-android-arm64@2.6.2':
    optional: true

-  '@biomejs/cli-darwin-x64@2.5.15':
+  '@biomejs/cli-android-x64@2.6.2':
    optional: true

-  '@biomejs/cli-[email protected]':
+  '@biomejs/cli-[email protected]':
    optional: true

-  '@biomejs/cli-linux-arm64@2.5.15':
+  '@biomejs/cli-darwin-x64@2.6.2':
    optional: true

-  '@biomejs/cli-linux-x64-musl@2.5.15':
+  '@biomejs/cli-linux-arm64-musl@2.6.2':
    optional: true

-  '@biomejs/cli-linux-x64@2.5.15':
+  '@biomejs/cli-linux-arm64@2.6.2':
    optional: true

-  '@biomejs/cli-win[email protected]':
+  '@biomejs/cli-lin[email protected]':
    optional: true

-  '@biomejs/cli-win32-x64@2.5.15':
+  '@biomejs/cli-linux-x64@2.6.2':
+    optional: true
+
+  '@biomejs/[email protected]':
+    optional: true
+
+  '@biomejs/[email protected]':
    optional: true

  '@borewit/[email protected]': {}
@@ -4261,6 +4289,10 @@ snapshots:
    dependencies:
      '@formatjs/icu-skeleton-parser': 2.1.12

+  '@formatjs/[email protected]':
+    dependencies:
+      '@formatjs/icu-skeleton-parser': 2.1.12
+
  '@formatjs/[email protected]': {}

  '@formatjs/[email protected]': {}
@@ -4288,7 +4320,7 @@ snapshots:
      protobufjs: 7.6.6
      yargs: 17.7.3

-  '@hookform/resolvers@5.9.1([email protected](@types/[email protected])([email protected]))([email protected])':
+  '@hookform/resolvers@6.0.0([email protected](@types/[email protected])([email protected]))([email protected])':
    dependencies:
      '@standard-schema/utils': 0.3.0
      react-hook-form: 7.90.0(@types/[email protected])([email protected])
@@ -4472,30 +4504,30 @@ snapshots:
    transitivePeerDependencies:
      - supports-color

-  '@next/[email protected].1': {}
+  '@next/[email protected].2': {}

-  '@next/[email protected].1':
+  '@next/[email protected].2':
    optional: true

-  '@next/[email protected].1':
+  '@next/[email protected].2':
    optional: true

-  '@next/[email protected].1':
+  '@next/[email protected].2':
    optional: true

-  '@next/[email protected].1':
+  '@next/[email protected].2':
    optional: true

-  '@next/[email protected].1':
+  '@next/[email protected].2':
    optional: true

-  '@next/[email protected].1':
+  '@next/[email protected].2':
    optional: true

-  '@next/[email protected].1':
+  '@next/[email protected].2':
    optional: true

-  '@next/[email protected].1':
+  '@next/[email protected].2':
    optional: true

  '@noble/[email protected]': {}
@@ -4944,7 +4976,7 @@ snapshots:
      '@alloc/quick-lru': 5.3.0
      '@tailwindcss/node': 4.3.3
      '@tailwindcss/oxide': 4.3.3
-      postcss: 8.5.30
+      postcss: 8.5.31
      tailwindcss: 4.3.3

  '@tailwindcss/[email protected]([email protected])':
@@ -4952,20 +4984,22 @@ snapshots:
      postcss-selector-parser: 7.1.6
      tailwindcss: 4.3.3

-  '@tanstack/[email protected].3': {}
+  '@tanstack/[email protected].5': {}

-  '@tanstack/[email protected].3([email protected])':
+  '@tanstack/[email protected].5(@types/[email protected])([email protected])':
    dependencies:
-      '@tanstack/query-core': 5.104.3
+      '@tanstack/query-core': 5.104.5
      react: 19.3.1
+    optionalDependencies:
+      '@types/react': 19.3.0

-  '@tanstack/[email protected]9([email protected]([email protected]))([email protected])':
+  '@tanstack/[email protected].21([email protected]([email protected]))([email protected])':
    dependencies:
-      '@tanstack/virtual-core': 3.19.4
+      '@tanstack/virtual-core': 3.19.6
      react: 19.3.1
      react-dom: 19.3.1([email protected])

-  '@tanstack/[email protected].4': {}
+  '@tanstack/[email protected].6': {}

  '@tokenizer/[email protected]':
    dependencies:
@@ -5098,7 +5132,7 @@ snapshots:
  '@typescript/[email protected]':
    optional: true

-  '@vitest/[email protected].4([email protected].4)':
+  '@vitest/[email protected].5([email protected].5)':
    dependencies:
      '@bcoe/v8-coverage': 1.0.2
      '@vitest/istanbul-lib-coverage': 1.0.2
@@ -5108,7 +5142,7 @@ snapshots:
      obug: 3.0.0
      std-env: 4.3.0
      tinyrainbow: 3.2.0
-      vitest: 5.0.4(@types/[email protected])(@vitest/[email protected].4)([email protected](@noble/[email protected]))([email protected](@types/[email protected])([email protected])([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])))([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))
+      vitest: 5.0.5(@types/[email protected])(@vitest/[email protected].5)([email protected](@noble/[email protected]))([email protected](@types/[email protected])([email protected])([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])))([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))

  '@vitest/[email protected]': {}

@@ -5116,17 +5150,17 @@ snapshots:
    dependencies:
      '@vitest/istanbul-lib-coverage': 1.0.2

-  '@vitest/[email protected].4([email protected](@types/[email protected])([email protected])([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])))([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))':
+  '@vitest/[email protected].5([email protected](@types/[email protected])([email protected])([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])))([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))':
    dependencies:
      '@jridgewell/trace-mapping': 0.3.31
-      '@vitest/spy': 5.0.4
+      '@vitest/spy': 5.0.5
      estree-walker: 3.0.3
      magic-string: 1.4.3
    optionalDependencies:
-      msw: 3.0.3(@types/[email protected])([email protected])([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))
-      vite: 8.3.4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])
+      msw: 3.0.3(@types/[email protected])([email protected])([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))
+      vite: 8.3.5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])

-  '@vitest/[email protected].4': {}
+  '@vitest/[email protected].5': {}

  [email protected]:
    dependencies:
@@ -5190,7 +5224,7 @@ snapshots:

  [email protected]: {}

-  [email protected]3.0: {}
+  [email protected]4.0: {}

  [email protected]: {}

@@ -5544,7 +5578,7 @@ snapshots:
  [email protected]:
    dependencies:
      '@tokenizer/inflate': 0.5.1
-      strtok3: 10.5.0
+      strtok3: 10.6.2
      token-types: 6.1.2
      uint8array-extras: 1.6.0
    transitivePeerDependencies:
@@ -5555,9 +5589,9 @@ snapshots:
      cross-spawn: 7.0.6
      signal-exit: 4.1.0

-  framer-motion@14.2.0([email protected]([email protected]))([email protected]):
+  framer-motion@14.5.0([email protected]([email protected]))([email protected]):
    dependencies:
-      motion-dom: 14.2.0
+      motion-dom: 14.5.0
      motion-utils: 14.1.1
      tslib: 2.8.1
    optionalDependencies:
@@ -5657,7 +5691,7 @@ snapshots:

  [email protected]: {}

-  isomorphic-dompurify@4.5.0(@noble/[email protected]):
+  isomorphic-dompurify@4.6.0(@noble/[email protected]):
    dependencies:
      dompurify: 3.4.17
      jsdom: 30.1.3(@noble/[email protected])
@@ -5829,7 +5863,7 @@ snapshots:

  [email protected]: {}

-  lucide-react@1.57.0(@types/[email protected])([email protected]):
+  lucide-react@1.61.0(@types/[email protected])([email protected]):
    dependencies:
      react: 19.3.1
    optionalDependencies:
@@ -5873,15 +5907,15 @@ snapshots:

  [email protected]: {}

-  motion-dom@14.2.0:
+  motion-dom@14.5.0:
    dependencies:
      motion-utils: 14.1.1

  [email protected]: {}

-  motion@14.2.0([email protected]([email protected]))([email protected]):
+  motion@14.5.0([email protected]([email protected]))([email protected]):
    dependencies:
-      framer-motion: 14.2.0([email protected]([email protected]))([email protected])
+      framer-motion: 14.5.0([email protected]([email protected]))([email protected])
      tslib: 2.8.1
    optionalDependencies:
      react: 19.3.1
@@ -5889,7 +5923,7 @@ snapshots:

  [email protected]: {}

-  [email protected](@types/[email protected])([email protected])([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])):
+  [email protected](@types/[email protected])([email protected])([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])):
    dependencies:
      '@inquirer/confirm': 6.3.3(@types/[email protected])
      '@msw/url': 0.1.2
@@ -5905,12 +5939,12 @@ snapshots:
      yargs: 18.2.0
    optionalDependencies:
      typescript: 7.0.2
-      vite: 8.3.4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])
+      vite: 8.3.5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])
    transitivePeerDependencies:
      - '@types/node'
      - supports-color

-  [email protected].1:
+  [email protected].3:
    dependencies:
      '@borewit/text-codec': 0.2.2
      '@tokenizer/token': 0.3.0
@@ -5918,7 +5952,7 @@ snapshots:
      debug: 4.4.3
      file-type: 22.2.0
      media-typer: 2.0.0
-      strtok3: 10.5.0
+      strtok3: 10.6.2
      token-types: 6.1.2
      uint8array-extras: 1.6.0
      win-guid: 0.2.1
@@ -5951,15 +5985,15 @@ snapshots:
    dependencies:
      content-type: 2.1.0

-  [email protected]([email protected].1(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected]))([email protected]):
+  [email protected]([email protected].2(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected]))([email protected]):
    dependencies:
      '@auth/core': 0.41.3
-      next: 16.4.1(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected])
+      next: 16.4.2(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected])
      react: 19.3.1

  [email protected]: {}

-  [email protected](@swc/[email protected])(@types/[email protected])([email protected].1(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected]))([email protected]):
+  [email protected](@swc/[email protected])(@types/[email protected])([email protected].2(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected]))([email protected]):
    dependencies:
      '@eloqnt/config': 0.1.1
      '@eloqnt/format-json': 0.1.0
@@ -5969,7 +6003,7 @@ snapshots:
      '@swc/core': 1.16.18(@swc/[email protected])
      icu-minify: 4.14.9
      negotiator: 1.1.0
-      next: 16.4.1(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected])
+      next: 16.4.2(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected])
      next-intl-swc-plugin-extractor: 4.14.9
      react: 19.3.1
      use-intl: 4.14.9(@types/[email protected])([email protected])
@@ -5978,9 +6012,9 @@ snapshots:
    transitivePeerDependencies:
      - '@swc/helpers'

-  [email protected].1(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected]):
+  [email protected].2(@playwright/[email protected])(@types/[email protected])([email protected]([email protected]))([email protected]):
    dependencies:
-      '@next/env': 16.4.1
+      '@next/env': 16.4.2
      '@swc/helpers': 0.5.23
      baseline-browser-mapping: 2.11.28
      caniuse-lite: 1.0.30001816
@@ -5989,14 +6023,14 @@ snapshots:
      react-dom: 19.3.1([email protected])
      styled-jsx: 5.1.6([email protected])
    optionalDependencies:
-      '@next/swc-darwin-arm64': 16.4.1
-      '@next/swc-darwin-x64': 16.4.1
-      '@next/swc-linux-arm64-gnu': 16.4.1
-      '@next/swc-linux-arm64-musl': 16.4.1
-      '@next/swc-linux-x64-gnu': 16.4.1
-      '@next/swc-linux-x64-musl': 16.4.1
-      '@next/swc-win32-arm64-msvc': 16.4.1
-      '@next/swc-win32-x64-msvc': 16.4.1
+      '@next/swc-darwin-arm64': 16.4.2
+      '@next/swc-darwin-x64': 16.4.2
+      '@next/swc-linux-arm64-gnu': 16.4.2
+      '@next/swc-linux-arm64-musl': 16.4.2
+      '@next/swc-linux-x64-gnu': 16.4.2
+      '@next/swc-linux-x64-musl': 16.4.2
+      '@next/swc-win32-arm64-msvc': 16.4.2
+      '@next/swc-win32-x64-msvc': 16.4.2
      '@playwright/test': 1.64.1
      sharp: 0.35.5(@types/[email protected])
    transitivePeerDependencies:
@@ -6105,7 +6139,7 @@ snapshots:
      picocolors: 1.1.1
      source-map-js: 1.2.2

-  [email protected]0:
+  [email protected]1:
    dependencies:
      nanoid: 3.3.20
      picocolors: 1.1.1
@@ -6237,7 +6271,7 @@ snapshots:

  [email protected]: {}

-  [email protected]3.0:
+  [email protected]4.1:
    dependencies:
      postal-mime: 2.7.6
      standardwebhooks: 1.1.1
@@ -6423,7 +6457,7 @@ snapshots:

  [email protected]: {}

-  strtok3@10.5.0:
+  strtok3@10.6.2:
    dependencies:
      '@tokenizer/token': 0.3.0

@@ -6631,11 +6665,11 @@ snapshots:

  [email protected]: {}

-  [email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected]):
+  [email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected]):
    dependencies:
      lightningcss: 1.33.0
      picomatch: 4.0.7
-      postcss: 8.5.30
+      postcss: 8.5.31
      rolldown: 1.2.14
      tinyglobby: 0.2.17
    optionalDependencies:
@@ -6646,10 +6680,10 @@ snapshots:
      tsx: 4.23.15
      yaml: 2.9.1

-  [email protected].4(@types/[email protected])(@vitest/[email protected].4)([email protected](@noble/[email protected]))([email protected](@types/[email protected])([email protected])([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])))([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])):
+  [email protected].5(@types/[email protected])(@vitest/[email protected].5)([email protected](@noble/[email protected]))([email protected](@types/[email protected])([email protected])([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])))([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])):
    dependencies:
      '@types/chai': 5.2.3
-      '@vitest/mocker': 5.0.4([email protected](@types/[email protected])([email protected])([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])))([email protected].4(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))
+      '@vitest/mocker': 5.0.5([email protected](@types/[email protected])([email protected])([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])))([email protected].5(@types/[email protected])([email protected])([email protected])([email protected])([email protected]))
      chai: 6.3.0
      es-module-lexer: 2.3.2
      expect-type: 1.4.0
@@ -6660,11 +6694,11 @@ snapshots:
      tinybench: 6.2.2
      tinyexec: 1.3.1
      tinyglobby: 0.2.17
-      vite: 8.3.4(@types/[email protected])([email protected])([email protected])([email protected])([email protected])
+      vite: 8.3.5(@types/[email protected])([email protected])([email protected])([email protected])([email protected])
      why-is-node-running: 3.2.1
    optionalDependencies:
      '@types/node': 26.6.5
-      '@vitest/coverage-v8': 5.0.4([email protected].4)
+      '@vitest/coverage-v8': 5.0.5([email protected].5)
      jsdom: 30.1.3(@noble/[email protected])
    transitivePeerDependencies:
      - msw
@@ -61,7 +61,7 @@
 			"enabled": false
 		},
 		{
-			"description": "De pnpm packageManager-pin is afgestemd op Docker en de runner-toolchain; niet automatisch bumpen",
+			"description": "De pnpm packageManager-pin blijft handmatig: Docker (corepack) en de runner volgen de pin automatisch, maar een bump raakt ook de lockfile en de README-versietabel (scripts/sync-readme-versions.mjs)",
 			"matchPackageNames": ["pnpm"],
 			"enabled": false
 		}
@@ -416,9 +416,26 @@ pnpm install --frozen-lockfile
 pnpm exec playwright install chromium firefox webkit

 echo "Building $image"
+# Duurzame buildcache buiten de werkboom. De CI-werkboom wordt na elke job
+# gewist en `docker builder prune` gooit de buildcache weg, waarna de hele
+# pnpm-laag opnieuw gedownload moet worden. Een lokale cache-export overleeft
+# allebei. Een lege CMS_BUILD_CACHE_DIR schakelt de cache uit.
+build_cache_dir="${CMS_BUILD_CACHE_DIR-/var/cache/epicnext-cms-buildcache}"
+build_cache_flags=()
+if [ -n "$build_cache_dir" ]; then
+  if mkdir -p "$build_cache_dir" 2>/dev/null && [ -w "$build_cache_dir" ]; then
+    build_cache_flags=(
+      --cache-from "type=local,src=$build_cache_dir"
+      --cache-to "type=local,dest=$build_cache_dir,mode=max"
+    )
+  else
+    echo "Warning: buildcache $build_cache_dir is niet beschrijfbaar; build zonder hergebruikte cache." >&2
+  fi
+fi
 # No --network=host: BuildKit only grants it via --allow=network.host, and the
 # build needs nothing but outbound internet (apk, pnpm, next/font/google).
 DOCKER_BUILDKIT=1 docker build --progress=plain --cache-from epicnext-cms:latest \
+  ${build_cache_flags[@]+"${build_cache_flags[@]}"} \
  --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" .
 check_current
 # Read reports from the already-built image; do not start an extra application.
@@ -39,6 +39,23 @@ pnpm exec playwright install chromium
 export NEWS_E2E_IMAGE="$image"
 export NEWS_E2E_RELEASE="$sha"
 build_attempted=1
+# Duurzame buildcache buiten de tijdelijke werkmap, zodat de lagen van een
+# vorige preflight hergebruikt worden in plaats van opnieuw gedownload. Eigen
+# map, gescheiden van de release-cache: een branch-preflight mag nooit de cache
+# van de release-build voeden. Een lege CMS_BUILD_CACHE_DIR schakelt het uit.
+build_cache_dir="${CMS_BUILD_CACHE_DIR-/var/cache/epicnext-cms-preflight-cache}"
+build_cache_flags=()
+if [ -n "$build_cache_dir" ]; then
+  if mkdir -p "$build_cache_dir" 2>/dev/null && [ -w "$build_cache_dir" ]; then
+    build_cache_flags=(
+      --cache-from "type=local,src=$build_cache_dir"
+      --cache-to "type=local,dest=$build_cache_dir,mode=max"
+    )
+  else
+    echo "Warning: buildcache $build_cache_dir is niet beschrijfbaar; build zonder hergebruikte cache." >&2
+  fi
+fi
 DOCKER_BUILDKIT=1 docker build --progress=plain \
+  ${build_cache_flags[@]+"${build_cache_flags[@]}"} \
  --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" .
 NEWS_E2E_IMAGE="$image" NEWS_E2E_RELEASE="$sha" node --import tsx e2e/news-real/run.ts
@@ -126,7 +126,9 @@ if [[ -n "${CMS_IMAGE_REPOSITORY:-}" ]]; then
  docker tag "$app_reference" "epicnext-cms:$CMS_RELEASE"
  docker tag "$remote_migration_image" "$migration_image"
 else
-  docker build --target migrations --build-arg NEXT_DEPLOYMENT_ID="$CMS_RELEASE" -t "$migration_image" . >>"$LOG_FILE" 2>&1
+  docker build --target migrations --build-arg NEXT_DEPLOYMENT_ID="$CMS_RELEASE" \
+    --cache-from type=local,src=.docker-cache/cms \
+    -t "$migration_image" . >>"$LOG_FILE" 2>&1
  docker compose build --build-arg NEXT_DEPLOYMENT_ID="$CMS_RELEASE" cms >>"$LOG_FILE" 2>&1
 fi
 expected_image="$(docker image inspect --format '{{.Id}}' "epicnext-cms:$CMS_RELEASE")"
@@ -2,6 +2,11 @@
 	"schemaVersion": 1,
 	"mode": "enforce",
 	"routes": [
+		{
+			"route": "/",
+			"maxInitialRawBytes": 716800,
+			"maxInitialGzipBytes": 225280
+		},
 		{
 			"route": "/me",
 			"maxInitialRawBytes": 716800,
@@ -18,7 +18,7 @@ const hasCompose =
 	}).status === 0;

 it.skipIf(!hasCompose)(
-	"loads the loopback profile from .env for bare Compose commands without changing mounts or host networking",
+	"loads the loopback override from .env for the cms service without changing mounts or host networking",
 	() => {
 		const directory = mkdtempSync(path.join(tmpdir(), "cms-proxy-config-"));
 		try {
@@ -50,9 +50,12 @@ it.skipIf(!hasCompose)(
 					["CMS_RELEASE", "HOSTNAME", "PORT"].includes(key)
 				)
 					delete environment[key];
+			// `cms` is behind the `cms` profile so a bare `docker compose up -d`
+			// can never squat port 3002 on a CI-managed host. Selecting the
+			// profile here keeps the loopback/port-override contract under test.
 			const result = spawnSync(
 				"docker",
-				["compose", "config", "--format", "json"],
+				["compose", "--profile", "cms", "config", "--format", "json"],
 				{ cwd: directory, env: environment, encoding: "utf8", timeout: 15_000 },
 			);
 			expect(result.status, result.stderr).toBe(0);
@@ -60,7 +60,6 @@ export async function uploadBadge(formData: FormData): Promise<void> {
 	try {
 		const buffer = Buffer.from(await file.arrayBuffer());
 		const gif = await toBadgeGif(buffer);
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await writeFile(target, gif);
 	} catch {
 		back("error", "Could not process or write the badge file");
@@ -32,7 +32,7 @@ async function upsertSetting(key: string, value: string): Promise<void> {
 		.values({
 			key,
 			value,
-			// eslint-disable-next-line security/detect-object-injection -- key is one of 3 known const values
+			// key is one of 3 known const values
 			comment: COMMENTS[key] ?? null,
 		})
 		.onDuplicateKeyUpdate({ set: { value } });
@@ -71,10 +71,10 @@ export async function savePoints(formData: FormData): Promise<void> {
 			POINTS_KEYS.map((key) =>
 				db
 					.insert(WebsiteSetting)
-					// eslint-disable-next-line security/detect-object-injection -- key from POINTS_KEYS const
+					// key from POINTS_KEYS const
 					.values({ key, value: values[key], comment: "Radio points" })
 					.onDuplicateKeyUpdate({
-						// eslint-disable-next-line security/detect-object-injection -- key from POINTS_KEYS const
+						// key from POINTS_KEYS const
 						set: { value: values[key] },
 					}),
 			),
@@ -112,7 +112,7 @@ export async function saveTheme(formData: FormData): Promise<void> {
 export async function applyPreset(formData: FormData): Promise<void> {
 	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const name = String(formData.get("preset") ?? "").normalize("NFC");
-	// eslint-disable-next-line security/detect-object-injection -- guarded by null check below
+	// guarded by null check below
 	const preset = PRESETS[name];
 	if (!preset) redirect("/admin/theme");

@@ -6,6 +6,7 @@ import { redirect } from "next/navigation";
 import { env } from "@/env";
 import { invalidateLoginCache } from "@/lib/auth/login-core";
 import { hashPassword } from "@/lib/auth/password";
+import { passwordPolicy } from "@/lib/auth/password-policy";
 import { revokeUserCredentials } from "@/lib/auth/session-revocation";
 import { db, PasswordReset, User } from "@/lib/db";
 import { logger } from "@/lib/logger";
@@ -109,7 +110,11 @@ export async function resetPassword(formData: FormData): Promise<void> {
 	}

 	let error: "password" | "invalid" | "failed" | null = null;
-	if (password.length < 12) error = "password";
+	if (
+		password.length < passwordPolicy.minLength ||
+		password.length > passwordPolicy.maxLength
+	)
+		error = "password";

 	if (!error) {
 		try {
@@ -5,6 +5,7 @@ import { after } from "next/server";
 import { z } from "zod";
 import { sendVerification } from "@/lib/auth/email-verification";
 import { hashPassword } from "@/lib/auth/password";
+import { passwordPolicy } from "@/lib/auth/password-policy";
 import { DEFAULT_AVATAR_FIGURE } from "@/lib/avatar-figure";
 import { invalidateKey } from "@/lib/cached-db";
 import { db, User } from "@/lib/db";
@@ -83,6 +84,11 @@ function hasDisposableEmailDomain(email: string): boolean {
 	return domain ? DISPOSABLE_EMAIL_DOMAINS.has(domain) : false;
 }

+// Rendered into the schema below and mapped back to a locale-independent code
+// via `ZOD_MESSAGE_CODES`, so the length always reflects the configured policy.
+const PASSWORD_MIN_MESSAGE = `Password must be at least ${passwordPolicy.minLength} characters`;
+const PASSWORD_MAX_MESSAGE = "Password is too long";
+
 const registerSchema = z
 	.object({
 		username: z
@@ -105,8 +111,8 @@ const registerSchema = z
 			),
 		password: z
 			.string()
-			.min(12, "Password must be at least 12 characters") // Increased min length
-			.max(128, "Password is too long") // Added max length
+			.min(passwordPolicy.minLength, PASSWORD_MIN_MESSAGE)
+			.max(passwordPolicy.maxLength, PASSWORD_MAX_MESSAGE)
 			.regex(/[A-Z]/, "Password must contain at least one uppercase letter")
 			.regex(/[a-z]/, "Password must contain at least one lowercase letter")
 			.regex(/[0-9]/, "Password must contain at least one digit")
@@ -160,8 +166,8 @@ const ZOD_MESSAGE_CODES: Record<string, RegisterErrorCode> = {
 	"This username is reserved": "usernameReserved",
 	"Enter a valid email address": "emailValid",
 	"Temporary email domains are not allowed": "emailDisposable",
-	"Password must be at least 12 characters": "passwordMinLength",
-	"Password is too long": "passwordMaxLength",
+	[PASSWORD_MIN_MESSAGE]: "passwordMinLength",
+	[PASSWORD_MAX_MESSAGE]: "passwordMaxLength",
 	"Password must contain at least one uppercase letter": "passwordUpper",
 	"Password must contain at least one lowercase letter": "passwordLower",
 	"Password must contain at least one digit": "passwordDigit",
@@ -31,9 +31,7 @@ export async function saveFavicon(
 		}

 		const buffer = upload.bytes;
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await mkdir(baseDir, { recursive: true });
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await writeFile(filePath, buffer);

 		const url = `/api/media/favicon/${filename}`;
@@ -46,7 +44,6 @@ export async function saveFavicon(
 				const oldPath = path.resolve(baseDir, oldName);
 				if (oldPath.startsWith(baseDir + path.sep)) {
 					try {
-						// eslint-disable-next-line security/detect-non-literal-fs-filename
 						await unlink(oldPath);
 					} catch {
 						/* ignore if file doesn't exist */
@@ -85,7 +82,6 @@ export async function deleteFavicon(): Promise<{
 				const oldPath = path.resolve(baseDir, oldName);
 				if (oldPath.startsWith(baseDir + path.sep)) {
 					try {
-						// eslint-disable-next-line security/detect-non-literal-fs-filename
 						await unlink(oldPath);
 					} catch {
 						/* ignore */
@@ -29,9 +29,7 @@ export async function saveLogo(
 		}

 		const buffer = upload.bytes;
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await mkdir(baseDir, { recursive: true });
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await writeFile(filePath, buffer);

 		const url = `/api/media/logo/${filename}`;
@@ -278,14 +278,12 @@ export async function uploadBackground(formData: FormData): Promise<void> {

 	let uploaded = false;
 	try {
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await mkdir(MEDIA_ROOT, { recursive: true });
 		const ext = file.name.split(".").pop() ?? "png";
 		const name = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
 		const bytes = await file.arrayBuffer();
 		const filePath = resolveMediaPath(name);
 		if (filePath.startsWith(MEDIA_ROOT + path.sep)) {
-			// eslint-disable-next-line security/detect-non-literal-fs-filename
 			await writeFile(filePath, Buffer.from(bytes));
 			await writeSetting("background_image", `/api/media/${name}`);
 			await writeSetting(
@@ -319,7 +317,7 @@ export async function applyPresetManager(formData: FormData): Promise<void> {
 	const name = String(formData.get("preset") ?? "")
 		.normalize("NFC")
 		.trim();
-	// eslint-disable-next-line security/detect-object-injection -- guarded by null check below
+	// guarded by null check below
 	const preset = PRESETS[name];
 	if (!preset) redirect(MANAGER_PATH);

@@ -142,7 +142,6 @@ export default async function ApplyStaffPage({
 							<article key={String(position.id)} className="content-card">
 								<div className="content-card-head">
 									{team?.badge ? (
-										/* eslint-disable-next-line @next/next/no-img-element */
 										<img
 											src={`${BADGE_IMG_BASE}=${encodeURIComponent(team.badge)}`}
 											alt={rankName}
@@ -120,7 +120,6 @@ export default async function ApplyTeamPage({
 							<article key={String(team.id)} className="content-card">
 								<div className="content-card-head">
 									{team.badge ? (
-										/* eslint-disable-next-line @next/next/no-img-element */
 										<img
 											src={`${BADGE_IMG_BASE}=${encodeURIComponent(team.badge)}`}
 											alt={team.rankName}
@@ -48,7 +48,6 @@ export default async function BadgesPage() {
 									alignItems: "flex-start",
 								}}
 							>
-								{/* eslint-disable-next-line @next/next/no-img-element */}
 								<img
 									src={`${BADGE_IMG_BASE}=${encodeURIComponent(badge.badgeKey)}`}
 									alt={badge.badgeName}
@@ -190,7 +190,6 @@ export default async function DrawBadgePage({
 											{b.badgeUrl ? (
 												// Badge images are arbitrary external URLs stored by the
 												// draw-badge tool, so a plain <img> is correct here.
-												// eslint-disable-next-line @next/next/no-img-element
 												<img
 													src={b.badgeUrl}
 													alt=""
@@ -149,7 +149,6 @@ export default async function GuildPage({
 					style={{ display: "flex", gap: "1.25rem", alignItems: "flex-start" }}
 				>
 					{guild.badge ? (
-						// eslint-disable-next-line @next/next/no-img-element
 						<img
 							src={`https://habbo-stories-content.s3.amazonaws.com/badge-part-images/${guild.badge}.gif`}
 							alt={`${guild.name} badge`}
@@ -74,7 +74,6 @@ export default async function GuildsPage() {
 								}}
 							>
 								{g.badge ? (
-									// eslint-disable-next-line @next/next/no-img-element
 									<img
 										src={`https://habbo-stories-content.s3.amazonaws.com/badge-part-images/${g.badge}.gif`}
 										alt={`${g.name} badge`}
@@ -110,7 +110,6 @@ export default async function HelpCategoryPage({

 			<ContentCard icon="❓" title={title} subtitle={t("topicSubtitle")}>
 				{imageSrc ? (
-					// eslint-disable-next-line @next/next/no-img-element
 					<img
 						src={imageSrc}
 						alt=""
@@ -159,7 +159,6 @@ export default async function HelpCenterPage() {
 									}}
 								>
 									{c.imageUrl ? (
-										// eslint-disable-next-line @next/next/no-img-element
 										<img
 											src={c.imageUrl}
 											alt=""
@@ -1,4 +1,5 @@
 import dynamic from "next/dynamic";
+import { headers } from "next/headers";
 import { NextIntlClientProvider } from "next-intl";
 import { getLocale, getMessages } from "next-intl/server";
 import type { ReactNode } from "react";
@@ -34,28 +35,43 @@ export default async function SiteLayout({
 }: {
 	children: ReactNode;
 }) {
-	const [session, locale, messages] = await Promise.all([
+	const [session, locale, messages, h] = await Promise.all([
 		auth(),
 		getLocale(),
 		getMessages(),
+		headers(),
 	]);
 	const clientMessages = publicClientMessages(messages);

+	// The landing pages render their own AuthTopBar (logo + live online), so the
+	// global site banner / navigation is hidden there to keep them clean and
+	// avoid showing the same chrome twice. Everything else keeps the chrome.
+	const pathname = h.get("x-pathname");
+	const isLandingPage =
+		pathname === "/" || pathname === "/login" || pathname === "/register";
+
 	return (
 		<NextIntlClientProvider locale={locale} messages={clientMessages}>
 			<CloudsField />
 			{/* Site chrome is public: hiding it all for anonymous visitors used to
 			    strand them — from /news, /leaderboard or /shop there was no way to
-			    reach any other page at all. */}
+			    reach any other page at all. Only the standalone landing pages opt
+			    out, because they carry their own header. */}
+			{!isLandingPage && (
 				<div data-theme-block="top_header">
 					<TopHeader session={session} />
 				</div>
+			)}
+			{!isLandingPage && (
 				<div data-theme-block="site_header">
 					<SiteHeader />
 				</div>
+			)}
+			{!isLandingPage && (
 				<div data-theme-block="navigation">
 					<Navigation session={session} />
 				</div>
+			)}
 			<main>
 				<div
 					data-theme-block="content_grid"
@@ -171,7 +171,7 @@ export default async function LeaderboardPage({
 	const rows = await (active === "credits"
 		? loadCreditsRows()
 		: active === "diamonds" || active === "duckets"
-			? // eslint-disable-next-line security/detect-object-injection -- active validated as "diamonds"|"duckets" in this branch
+			? // active validated as "diamonds"|"duckets" in this branch
 				loadCurrencyRows(CURRENCY_TYPE[active])
 			: loadSettingsRows(
 					SETTINGS_FIELD[active as keyof typeof SETTINGS_FIELD],
@@ -1,24 +1,14 @@
-import { desc, eq } from "drizzle-orm";
 import type { Metadata } from "next";
-import { headers } from "next/headers";
-import Image from "next/image";
 import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
+import { AuthAlert } from "@/components/auth/auth-alert";
 import {
-	AuthPageFrame,
-	AuthUsersCards,
-} from "@/components/auth/auth-page-frame";
+	AuthLandingView,
+	loadAuthLanding,
+} from "@/components/auth/auth-landing";
 import { LoginForm } from "@/components/auth/login-form";
-import { SurfaceCard } from "@/components/surface-card";
 import { auth } from "@/lib/auth";
 import { safeRedirectPath } from "@/lib/auth/safe-redirect";
-import { cached } from "@/lib/cache";
-
-import { db, User } from "@/lib/db";
-import { resolveHotelName } from "@/lib/hotel-name";
-import { captchaConfig } from "@/lib/services/captcha";
-import { cachedOnlineCount } from "@/lib/services/public-counters";
-import { siteSettings } from "@/lib/services/site-settings";

 export async function generateMetadata(): Promise<Metadata> {
 	const t = await getTranslations("pages.login");
@@ -43,13 +33,6 @@ export default async function LoginPage({
 	}>;
 }) {
 	const t = await getTranslations("pages.login");
-	const [hotelName, cfg, logo] = await Promise.all([
-		resolveHotelName(),
-		captchaConfig(),
-		siteSettings.get("cms_logo", ""),
-	]);
-	const nonce = (await headers()).get("x-nonce") ?? undefined;
-
 	const sp = await searchParams;
 	const redirectTo = safeRedirectPath(sp.from);

@@ -58,165 +41,44 @@ export default async function LoginPage({
 	const session = await auth();
 	if (session?.user?.id) redirect(redirectTo);

-	const [online, recentUsers, latestUsers] = await Promise.all([
-		cachedOnlineCount().catch(() => 0),
-		cached(
-			"auth_online_users",
-			10_000,
-			() =>
-				db
-					.select({ id: User.id, username: User.username, look: User.look })
-					.from(User)
-					.where(eq(User.online, "1"))
-					.limit(8),
-			{ staleMs: 30000 },
-		).catch(() => []),
-		cached(
-			"auth_latest_users",
-			30_000,
-			() =>
-				db
-					.select({ id: User.id, username: User.username, look: User.look })
-					.from(User)
-					.orderBy(desc(User.accountCreated))
-					.limit(8),
-			{ staleMs: 60000 },
-		).catch(() => []),
-	]);
+	const data = await loadAuthLanding();

 	// `/login?registered=1` is where the sign-up form lands when it could not
 	// auto sign-in (e-mail verification still pending). Without this notice the
 	// visitor would only see an empty login form and no sign their account
-	// exists.
+	// exists. `?reset=1` comes from a successful password reset; saying so
+	// matters because a silent form reads like the reset failed.
 	const notice =
 		sp.registered === "1" ? (
-			<p
-				role="status"
-				className="auth-alert auth-alert--success animate-fade-in-up m-0 mb-4"
-			>
+			<AuthAlert variant="success" className="mb-4">
 				{t("registeredSuccess")}
-			</p>
+			</AuthAlert>
 		) : sp.reset === "1" ? (
-			// `?reset=1` comes from a successful password reset; saying so matters
-			// because the visitor just changed their password and a silent form
-			// reads like the reset failed.
-			<p
-				role="status"
-				className="auth-alert auth-alert--success animate-fade-in-up m-0 mb-4"
-			>
+			<AuthAlert variant="success" className="mb-4">
 				{t("passwordChanged")}
-			</p>
+			</AuthAlert>
 		) : undefined;

 	return (
-		<AuthPageFrame
-			hotelName={hotelName}
-			logo={logo}
-			title={t("title")}
-			subtitle={t("subtitle")}
-			notice={notice}
+		<AuthLandingView
+			data={data}
+			copy={{
+				title: t("title"),
+				subtitle: t("subtitle"),
+				notice,
+				promoTitle: t("welcomeBack"),
+				promoSubtitle: t("welcomeBackSub", { hotelName: data.hotelName }),
+				usersOnlineLabel: t("usersOnline", { count: data.online }),
+				whoIsOnlineLabel: t("whoIsOnline"),
+				newestCitizensLabel: t("newestCitizens"),
+			}}
 			form={
 				<LoginForm
 					redirectTo={redirectTo}
-					captcha={{
-						provider: cfg.provider,
-						siteKey: cfg.siteKey || undefined,
-						field: cfg.field || undefined,
-					}}
-					nonce={nonce}
+					captcha={data.captcha}
+					nonce={data.nonce}
 				/>
 			}
-		>
-			<SurfaceCard
-				className="card-glow relative overflow-hidden p-6 text-center"
-				style={{
-					borderColor:
-						"color-mix(in srgb, var(--color-primary) 20%, transparent)",
-				}}
-			>
-				<div
-					className="absolute inset-0"
-					style={{
-						background:
-							"linear-gradient(135deg, color-mix(in srgb, var(--color-primary) 10%, transparent), color-mix(in srgb, var(--color-accent) 10%, transparent))",
-					}}
 		/>
-				<div aria-hidden="true" className="absolute inset-0 overflow-hidden">
-					<div className="brand-halo left-1/2 top-0 h-64 w-[460px] max-w-full -translate-x-1/2 -translate-y-1/2" />
-					<div
-						className="aurora-blob -left-16 top-10 h-56 w-56"
-						style={{
-							background:
-								"color-mix(in srgb, var(--color-primary) 45%, transparent)",
-						}}
-					/>
-					<div
-						className="aurora-blob -right-16 bottom-0 h-56 w-56"
-						style={{
-							background:
-								"color-mix(in srgb, var(--color-accent) 40%, transparent)",
-							animationDelay: "-8s",
-						}}
-					/>
-				</div>
-				<div className="relative">
-					<div className="brand-halo left-1/2 top-8 h-52 w-52 -translate-x-1/2" />
-					<Image
-						src="/assets/images/FrankwithBag.gif"
-						alt="Frank"
-						width={130}
-						height={170}
-						className="relative object-contain mx-auto drop-shadow-xl animate-float"
-						unoptimized
-					/>
-					<div
-						className="inline-flex items-center gap-2 px-3.5 py-1 rounded-full text-xs font-bold uppercase tracking-wider mt-4 mb-3 border"
-						style={{
-							borderColor:
-								"color-mix(in srgb, var(--color-primary) 30%, transparent)",
-							background:
-								"color-mix(in srgb, var(--color-surface) 72%, transparent)",
-							color: "var(--color-primary-readable, var(--color-primary))",
-							boxShadow:
-								"0 8px 20px -12px color-mix(in srgb, var(--color-primary) 70%, transparent)",
-						}}
-					>
-						<span className="relative flex h-2 w-2">
-							<span
-								className="animate-ping absolute inline-flex h-full w-full rounded-full opacity-75"
-								style={{ background: "var(--color-primary)" }}
-							/>
-							<span
-								className="relative inline-flex rounded-full h-2 w-2"
-								style={{ background: "var(--color-primary)" }}
-							/>
-						</span>
-						{t("usersOnline", { count: online })}
-					</div>
-					<h1
-						className="text-xl font-black"
-						style={{
-							color: "var(--color-text-readable)",
-							fontFamily: "var(--font-nunito)",
-						}}
-					>
-						{t("welcomeBack")}
-					</h1>
-					<p
-						className="text-xs mt-1.5 mx-auto max-w-[220px] leading-relaxed"
-						style={{ color: "var(--color-text-muted)" }}
-					>
-						{t("welcomeBackSub", { hotelName })}
-					</p>
-				</div>
-			</SurfaceCard>
-
-			<AuthUsersCards
-				recentUsers={recentUsers}
-				latestUsers={latestUsers}
-				recentTitle={t("whoIsOnline")}
-				latestTitle={t("newestCitizens")}
-			/>
-		</AuthPageFrame>
 	);
 }
@@ -191,7 +191,6 @@ async function ArticlePage({
 				}
 			>
 				{article.image ? (
-					// eslint-disable-next-line @next/next/no-img-element
 					<img
 						src={article.image}
 						alt=""
@@ -7,22 +7,20 @@ import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import type { CSSProperties, ReactNode } from "react";
 import { AnimatedCounter } from "@/components/animated-counter";
+import { AuthTopBar } from "@/components/auth/auth-top-bar";
 import { LoginForm } from "@/components/auth/login-form";
-import { Clock } from "@/components/clock";
-import { LanguageSwitcher } from "@/components/language-switcher";
 import Link from "@/components/link";
-import { LiveOnlineCounter } from "@/components/live-online-counter";
 import { Reveal } from "@/components/motion-reveal";
 import { PublicLoadError } from "@/components/public/load-error";
 import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
 import { SpotlightCard } from "@/components/spotlight-card";
-import { ThemeSwitcher } from "@/components/theme-switcher";
 import { TypewriterText } from "@/components/typewriter-text";
 import { auth } from "@/lib/auth";
 import { cached } from "@/lib/cache";
 import { CameraWeb, db, User } from "@/lib/db";
 import { formatDate } from "@/lib/format-date";
 import { resolveHotelName } from "@/lib/hotel-name";
+import { withPublicPagePerformance } from "@/lib/public-page-performance";
 import { captchaConfig } from "@/lib/services/captcha";
 import { getNewsList } from "@/lib/services/news-list";
 import { loadProfilePrivacyMap } from "@/lib/services/profile-privacy";
@@ -40,7 +38,6 @@ import {
 	ICON_CAMERA,
 	ICON_CATALOG,
 	ICON_FRIENDS,
-	ICON_LIGHTHOUSE,
 	ICON_NAV_GOODY,
 	ICON_NAV_ME,
 } from "@/lib/site-icons";
@@ -238,7 +235,7 @@ async function getHotelData() {
 	};
 }

-export default async function Home() {
+async function Home() {
 	const session = await auth();
 	if (session?.user?.id) redirect("/me");

@@ -404,88 +401,10 @@ export default async function Home() {

 	return (
 		<div className="flex w-full flex-col gap-14 pb-16 pt-2 md:gap-20 md:pb-24">
-			{/* ── Top bar ── */}
-			<Reveal className="mx-auto w-full max-w-7xl">
-				<div
-					className="flex items-center justify-between rounded-full border px-3 py-2.5 sm:px-5"
-					style={{
-						background:
-							"linear-gradient(90deg, color-mix(in srgb, var(--color-surface) 62%, transparent), color-mix(in srgb, var(--color-primary) 7%, transparent))",
-						backdropFilter: "blur(14px)",
-						WebkitBackdropFilter: "blur(14px)",
-						borderColor:
-							"color-mix(in srgb, var(--color-text-muted) 10%, transparent)",
-						boxShadow:
-							"0 1px 3px rgba(0,0,0,0.04), 0 0 0 0.5px color-mix(in srgb, var(--color-text-muted) 6%, transparent)",
-					}}
-				>
-					<div className="flex items-center gap-2 sm:gap-3">
-						{logo ? (
-							<Image
-								src={logo}
-								alt={hotelName}
-								width={100}
-								height={28}
-								className="shrink-0 object-contain"
-								unoptimized
-								style={{ maxHeight: 26, width: "auto", height: "auto" }}
-							/>
-						) : (
-							<div
-								className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full"
-								style={{
-									background:
-										"linear-gradient(135deg, var(--color-primary), color-mix(in srgb, var(--color-accent) 60%, var(--color-primary)))",
-									boxShadow:
-										"0 4px 16px -4px color-mix(in srgb, var(--color-primary) 60%, transparent)",
-								}}
-							>
-								<Image
-									src={ICON_LIGHTHOUSE}
-									alt=""
-									width={18}
-									height={18}
-									className="shrink-0"
-									unoptimized
-									style={{ filter: "brightness(0) invert(1)" }}
-								/>
+			{/* ── Top bar: logo + live online + language/clock/theme ── */}
+			<div className="mx-auto w-full max-w-7xl">
+				<AuthTopBar hotelName={hotelName} logo={logo} online={online} />
 			</div>
-						)}
-						<span
-							className="hidden text-sm font-extrabold uppercase tracking-wide sm:inline"
-							style={{ color: "var(--color-text-readable)" }}
-						>
-							{hotelName}
-						</span>
-					</div>
-					<div
-						className="flex items-center gap-1 sm:gap-1.5 rounded-full px-1.5 py-1"
-						style={{
-							background:
-								"color-mix(in srgb, var(--color-text-muted) 5%, transparent)",
-						}}
-					>
-						<LanguageSwitcher />
-						<div
-							className="hidden w-px h-5 sm:block"
-							style={{
-								background:
-									"color-mix(in srgb, var(--color-text-muted) 12%, transparent)",
-							}}
-						/>
-						<Clock />
-						<div
-							className="w-px h-5"
-							style={{
-								background:
-									"color-mix(in srgb, var(--color-text-muted) 12%, transparent)",
-							}}
-						/>
-						<ThemeSwitcher />
-					</div>
-				</div>
-			</Reveal>
-
 			{/* ── Cinematic hero ── */}
 			<Reveal className="-mx-3 sm:-mx-4 md:-mx-6">
 				<div className="relative overflow-hidden">
@@ -534,50 +453,7 @@ export default async function Home() {
 						style={{ opacity: 0.5, zIndex: 1 }}
 					/>
 					<div className="relative z-10 mx-auto flex min-h-[540px] w-full max-w-6xl flex-col items-center justify-center px-4 py-24 text-center sm:min-h-[580px] lg:min-h-[640px]">
-						<span
-							className="glass-chip gap-2.5 px-4 py-2"
-							style={{
-								fontWeight: 800,
-								letterSpacing: "0.14em",
-								textTransform: "uppercase",
-							}}
-						>
-							<span className="relative flex h-2 w-2">
-								<span
-									className="absolute inline-flex h-full w-full animate-ping rounded-full opacity-70"
-									style={{ background: "var(--color-primary)" }}
-								/>
-								<span
-									className="relative inline-flex h-2 w-2 rounded-full"
-									style={{ background: "var(--color-primary)" }}
-								/>
-							</span>
-							<span
-								className="text-[10px] font-black sm:text-xs"
-								style={{ color: "var(--color-text-readable)" }}
-							>
-								{tp("onlineNow")}
-							</span>
-							{online === null ? (
-								<span className="text-xs">{te("unavailable")}</span>
-							) : (
-								<span
-									className="text-sm sm:text-base"
-									style={{
-										color:
-											"var(--color-primary-readable, var(--color-primary))",
-										fontWeight: 900,
-									}}
-								>
-									<LiveOnlineCounter initial={online} />
-								</span>
-							)}
-						</span>
-
-						<h1
-							className="mt-7 sm:mt-8"
-							style={{ fontFamily: "var(--font-nunito)" }}
-						>
+						<h1 style={{ fontFamily: "var(--font-nunito)" }}>
 							<span
 								className="mb-3 block text-xs font-extrabold uppercase tracking-[0.32em] sm:text-sm"
 								style={{ color: "rgba(255,255,255,0.72)" }}
@@ -596,37 +472,6 @@ export default async function Home() {
 							{tp("welcomeBody")}
 						</p>

-						{recentUsers !== null && recentUsers.length > 0 && (
-							<div
-								className="animate-fade-in-up mt-7 inline-flex items-center gap-3 rounded-full border px-3 py-1.5"
-								style={{
-									background: "rgba(255,255,255,0.08)",
-									borderColor: "rgba(255,255,255,0.22)",
-									backdropFilter: "blur(12px)",
-									WebkitBackdropFilter: "blur(12px)",
-									animationDelay: "0.08s",
-								}}
-							>
-								<div className="flex -space-x-2.5">
-									{recentUsers.slice(0, 4).map((u) => (
-										<UserAvatarThumbnail
-											key={u.username}
-											figure={u.look}
-											alt={u.username}
-											options={{ direction: 2 }}
-											className="h-9 w-9 rounded-full ring-2 ring-white/70 shadow-lg"
-										/>
-									))}
-								</div>
-								<span
-									className="pr-1 text-[10px] font-extrabold uppercase tracking-[0.22em]"
-									style={{ color: "rgba(255,255,255,0.75)" }}
-								>
-									{tp("recentUsers")}
-								</span>
-							</div>
-						)}
-
 						<div
 							className="animate-fade-in-up mt-9 flex flex-wrap items-center justify-center gap-3"
 							style={{ animationDelay: "0.2s" }}
@@ -1148,3 +993,5 @@ export default async function Home() {
 		</div>
 	);
 }
+
+export default withPublicPagePerformance("/", Home);
@@ -108,7 +108,6 @@ export default async function RareCategoryPage({
 						}}
 					>
 						{badgeSrc ? (
-							// eslint-disable-next-line @next/next/no-img-element
 							<img
 								src={badgeSrc}
 								alt={`${cat.name} badge`}
@@ -150,7 +149,6 @@ export default async function RareCategoryPage({
 										<tr key={String(r.id)}>
 											<td>
 												{iconSrc ? (
-													// eslint-disable-next-line @next/next/no-img-element
 													<img
 														src={iconSrc}
 														alt=""
@@ -88,7 +88,6 @@ export default async function RareValuesPage() {
 							>
 								<div className="content-card-head">
 									{badgeSrc ? (
-										// eslint-disable-next-line @next/next/no-img-element
 										<img
 											src={badgeSrc}
 											alt={`${c.name} badge`}
@@ -1,23 +1,13 @@
-import { desc, eq } from "drizzle-orm";
 import type { Metadata } from "next";
-import { headers } from "next/headers";
-import Image from "next/image";
 import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import {
-	AuthPageFrame,
-	AuthUsersCards,
-} from "@/components/auth/auth-page-frame";
+	AuthLandingView,
+	loadAuthLanding,
+} from "@/components/auth/auth-landing";
 import { RegisterForm } from "@/components/auth/register-form";
-import { SurfaceCard } from "@/components/surface-card";
 import { auth } from "@/lib/auth";
-import { cached } from "@/lib/cache";
-
-import { db, User } from "@/lib/db";
-import { resolveHotelName } from "@/lib/hotel-name";
-import { captchaConfig } from "@/lib/services/captcha";
-import { cachedOnlineCount } from "@/lib/services/public-counters";
-import { siteSettings } from "@/lib/services/site-settings";
+import { passwordPolicy } from "@/lib/auth/password-policy";

 export async function generateMetadata(): Promise<Metadata> {
 	const t = await getTranslations("pages.register");
@@ -31,158 +21,40 @@ export async function generateMetadata(): Promise<Metadata> {
 }

 export default async function RegisterPage() {
-	const tpr = await getTranslations("pages.register");
-	const [hotelName, cfg, logo] = await Promise.all([
-		resolveHotelName(),
-		captchaConfig(),
-		siteSettings.get("cms_logo", ""),
-	]);
-	const nonce = (await headers()).get("x-nonce") ?? undefined;
+	const t = await getTranslations("pages.register");

 	// An account already exists in this browser — there is nothing to sign up.
 	const session = await auth();
 	if (session?.user?.id) redirect("/me");

-	const [online, recentUsers, latestUsers] = await Promise.all([
-		cachedOnlineCount().catch(() => 0),
-		cached(
-			"auth_online_users",
-			10_000,
-			() =>
-				db
-					.select({ id: User.id, username: User.username, look: User.look })
-					.from(User)
-					.where(eq(User.online, "1"))
-					.limit(8),
-			{ staleMs: 30000 },
-		).catch(() => []),
-		cached(
-			"auth_latest_users",
-			30_000,
-			() =>
-				db
-					.select({ id: User.id, username: User.username, look: User.look })
-					.from(User)
-					.orderBy(desc(User.accountCreated))
-					.limit(8),
-			{ staleMs: 60000 },
-		).catch(() => []),
-	]);
+	const data = await loadAuthLanding();

 	return (
-		<AuthPageFrame
-			hotelName={hotelName}
-			logo={logo}
-			title={tpr("title")}
-			subtitle={tpr("subtitle")}
+		<AuthLandingView
+			data={data}
+			copy={{
+				title: t("title"),
+				subtitle: t("subtitle"),
+				promoTitle: (
+					<>
+						{t("title")} —{" "}
+						<span className="gradient-text">{data.hotelName}</span>
+					</>
+				),
+				promoSubtitle: t("subtitle"),
+				usersOnlineLabel: t("usersOnline", { count: data.online }),
+				whoIsOnlineLabel: t("whoIsOnline"),
+				newestCitizensLabel: t("newestCitizens"),
+			}}
 			form={
 				<RegisterForm
-					hotelName={hotelName}
-					captcha={{
-						provider: cfg.provider,
-						siteKey: cfg.siteKey || undefined,
-					}}
-					nonce={nonce}
+					hotelName={data.hotelName}
+					captcha={data.captcha}
+					nonce={data.nonce}
+					passwordMinLength={passwordPolicy.minLength}
+					passwordMaxLength={passwordPolicy.maxLength}
 				/>
 			}
-		>
-			<SurfaceCard
-				className="card-glow relative overflow-hidden p-6"
-				style={{
-					borderColor:
-						"color-mix(in srgb, var(--color-primary) 20%, transparent)",
-				}}
-			>
-				<div
-					className="absolute inset-0"
-					style={{
-						background:
-							"linear-gradient(135deg, color-mix(in srgb, var(--color-primary) 10%, transparent), color-mix(in srgb, var(--color-accent) 10%, transparent))",
-					}}
 		/>
-				<div aria-hidden="true" className="absolute inset-0 overflow-hidden">
-					<div className="brand-halo left-1/2 top-0 h-64 w-[460px] max-w-full -translate-x-1/2 -translate-y-1/2" />
-					<div
-						className="aurora-blob -left-16 top-6 h-56 w-56"
-						style={{
-							background:
-								"color-mix(in srgb, var(--color-primary) 45%, transparent)",
-						}}
-					/>
-					<div
-						className="aurora-blob -right-16 bottom-0 h-56 w-56"
-						style={{
-							background:
-								"color-mix(in srgb, var(--color-accent) 40%, transparent)",
-							animationDelay: "-8s",
-						}}
-					/>
-				</div>
-				<div className="relative">
-					<div className="flex items-center gap-4">
-						<div className="shrink-0 animate-float">
-							<div className="brand-halo left-1/2 top-1/2 h-52 w-52 -translate-x-1/2 -translate-y-1/2" />
-							<Image
-								src="/assets/images/FrankwithBag.gif"
-								alt="Frank"
-								width={110}
-								height={145}
-								className="relative object-contain drop-shadow-xl"
-								unoptimized
-							/>
-						</div>
-						<div className="flex-1">
-							<div
-								className="inline-flex items-center gap-2 px-3 py-1 rounded-full text-xs font-bold uppercase tracking-wider mb-2 border"
-								style={{
-									borderColor:
-										"color-mix(in srgb, var(--color-primary) 30%, transparent)",
-									background:
-										"color-mix(in srgb, var(--color-surface) 72%, transparent)",
-									color: "var(--color-primary-readable, var(--color-primary))",
-									boxShadow:
-										"0 8px 20px -12px color-mix(in srgb, var(--color-primary) 70%, transparent)",
-								}}
-							>
-								<span className="relative flex h-2 w-2">
-									<span
-										className="animate-ping absolute inline-flex h-full w-full rounded-full opacity-75"
-										style={{ background: "var(--color-primary)" }}
-									/>
-									<span
-										className="relative inline-flex rounded-full h-2 w-2"
-										style={{ background: "var(--color-primary)" }}
-									/>
-								</span>
-								{tpr("usersOnline", { count: online })}
-							</div>
-							<h1
-								className="text-lg font-black leading-tight"
-								style={{
-									color: "var(--color-text-readable)",
-									fontFamily: "var(--font-nunito)",
-								}}
-							>
-								{tpr("title")} —{" "}
-								<span className="gradient-text">{hotelName}</span>
-							</h1>
-							<p
-								className="text-xs mt-1.5 leading-relaxed"
-								style={{ color: "var(--color-text-muted)" }}
-							>
-								{tpr("subtitle")}
-							</p>
-						</div>
-					</div>
-				</div>
-			</SurfaceCard>
-
-			<AuthUsersCards
-				recentUsers={recentUsers}
-				latestUsers={latestUsers}
-				recentTitle={tpr("whoIsOnline")}
-				latestTitle={tpr("newestCitizens")}
-			/>
-		</AuthPageFrame>
 	);
 }
@@ -3,6 +3,7 @@ import { getTranslations } from "next-intl/server";
 import { resetPassword } from "@/actions/password-reset";
 import Link from "@/components/link";
 import { ContentCard } from "@/components/public/ui";
+import { passwordPolicy } from "@/lib/auth/password-policy";

 export async function generateMetadata(): Promise<Metadata> {
 	const t = await getTranslations("pages.reset");
@@ -41,8 +42,12 @@ export default async function ResetPage({
 					<input
 						name="password"
 						type="password"
-						placeholder={t("passwordPlaceholder")}
+						placeholder={t("passwordPlaceholder", {
+							min: passwordPolicy.minLength,
+						})}
 						autoComplete="new-password"
+						minLength={passwordPolicy.minLength}
+						maxLength={passwordPolicy.maxLength}
 						required
 					/>
 					<button type="submit" className="btn btn-primary">
@@ -58,7 +63,7 @@ export default async function ResetPage({
 							marginBottom: 0,
 						}}
 					>
-						{t(errorKey)}
+						{t(errorKey, { min: passwordPolicy.minLength })}
 					</p>
 				) : null}
 				<p
@@ -16,7 +16,7 @@ const STATE_LABELS: Record<string, { label: string; icon: string }> = {
 };

 function describeState(state: string): { label: string; icon: string } {
-	// eslint-disable-next-line security/detect-object-injection -- STATE_LABELS has known keys, fallback provided
+	// STATE_LABELS has known keys, fallback provided
 	return STATE_LABELS[state] ?? { label: state || "Unknown", icon: "🚪" };
 }

@@ -249,7 +249,6 @@ export default async function ShopPage({
 										}}
 									>
 										{a.iconUrl ? (
-											// eslint-disable-next-line @next/next/no-img-element
 											<img
 												src={a.iconUrl}
 												alt=""
@@ -366,7 +366,6 @@ async function ProfilePage({
 						flexWrap: "wrap",
 					}}
 				>
-					{/* eslint-disable-next-line @next/next/no-img-element */}
 					<ProfileImage
 						src={avatar}
 						alt={user.username}
@@ -1,4 +1,6 @@
 import { notFound } from "next/navigation";
+import { NextIntlClientProvider } from "next-intl";
+import { getLocale, getMessages } from "next-intl/server";
 import type { ReactNode } from "react";
 import { env } from "@/env";
 import { isHousekeepingPreviewEnabled } from "@/features/housekeeping/foundation/preview-gate";
@@ -27,5 +29,13 @@ export default async function AdminNextLayout({
 		notFound();
 	}

-	return children;
+	// Staff tree: re-install the full catalogue the root layout scopes down to
+	// the public subset (nested providers replace the parent set).
+	const [locale, messages] = await Promise.all([getLocale(), getMessages()]);
+
+	return (
+		<NextIntlClientProvider locale={locale} messages={messages}>
+			{children}
+		</NextIntlClientProvider>
+	);
 }
@@ -49,7 +49,6 @@ export function AdsTable({ ads }: { ads: AdRow[] }) {
 					{ads.map((ad) => (
 						<tr key={ad.id}>
 							<td>
-								{/* eslint-disable-next-line @next/next/no-img-element */}
 								<img
 									src={ad.image}
 									alt=""
@@ -103,7 +103,6 @@ export default async function AdminCalendarCampaign({

 			<div className="admin-card flex items-center gap-5 mb-6">
 				{campaign.image ? (
-					// eslint-disable-next-line @next/next/no-img-element
 					<img
 						className="w-24 h-24 object-cover"
 						src={campaign.image}
@@ -98,7 +98,6 @@ export default async function AdminCalendar() {
 								className="admin-card hover article"
 							>
 								{c.image ? (
-									// eslint-disable-next-line @next/next/no-img-element
 									<img className="article-img" src={c.image} alt={c.name} />
 								) : (
 									<div className="article-img" />
@@ -96,7 +96,6 @@ export default async function AdminGuildDetailPage({
 			<div className="flex flex-wrap items-start justify-between gap-4">
 				<div className="flex items-center gap-4">
 					{guild.badge ? (
-						// eslint-disable-next-line @next/next/no-img-element
 						<img
 							src={`https://habbo-stories-content.s3.amazonaws.com/badge-part-images/${guild.badge}.gif`}
 							alt=""
@@ -155,7 +155,6 @@ export default async function AdminGuildsPage({
 											<td className="muted">{g.id}</td>
 											<td>
 												{g.badge ? (
-													// eslint-disable-next-line @next/next/no-img-element
 													<img
 														src={`https://habbo-stories-content.s3.amazonaws.com/badge-part-images/${g.badge}.gif`}
 														alt=""
@@ -1,7 +1,8 @@
 import { eq } from "drizzle-orm";
 import { LogOut } from "lucide-react";
 import { redirect } from "next/navigation";
-import { getTranslations } from "next-intl/server";
+import { NextIntlClientProvider } from "next-intl";
+import { getLocale, getMessages, getTranslations } from "next-intl/server";
 import type { ReactNode } from "react";
 import { AdminHubChrome } from "@/components/admin/admin-hub-chrome";
 import { AdminMobileWrapper } from "@/components/admin/admin-mobile-wrapper";
@@ -40,8 +41,13 @@ export default async function AdminLayout({
 		if (!u?.twoFactorConfirmedAt) redirect("/settings/2fa?error=staffrequired");
 	}

+	// The root layout ships the reduced catalogue so public pages do not carry
+	// the ~195 KB of staff-tool strings. Nested providers replace the parent
+	// set rather than merging, so staff route groups re-install the full one.
+	const [locale, messages] = await Promise.all([getLocale(), getMessages()]);
+
 	return (
-		<>
+		<NextIntlClientProvider locale={locale} messages={messages}>
 			{csrfToken ? <meta name="csrf-token" content={csrfToken} /> : null}
 			<AdminMobileWrapper sidebar={<Sidebar staff={staff} />}>
 				<div
@@ -56,7 +62,7 @@ export default async function AdminLayout({
 				</div>
 			</AdminMobileWrapper>
 			<AdminToaster />
-		</>
+		</NextIntlClientProvider>
 	);
 }

@@ -94,7 +94,6 @@ export default async function AdminPhotos({
 									className="admin-card"
 									style={{ padding: 0, overflow: "hidden" }}
 								>
-									{/* eslint-disable-next-line @next/next/no-img-element */}
 									<img
 										src={p.url}
 										alt={t("photoAlt", { id: String(p.id) })}
@@ -62,7 +62,7 @@ function isRecord(v: unknown): v is Record<string, unknown> {
 }

 function pickString(obj: Record<string, unknown>, key: string): string | null {
-	// eslint-disable-next-line security/detect-object-injection -- only called with hardcoded keys
+	// only called with hardcoded keys
 	const v = obj[key];
 	return typeof v === "string" && v.trim() !== "" ? v.trim() : null;
 }
@@ -112,7 +112,7 @@ function findNumberDeep(
 	if (typeof value === "number" && Number.isFinite(value)) return value;
 	if (!isRecord(value)) return null;
 	for (const key of keys) {
-		// eslint-disable-next-line security/detect-object-injection -- keys from hardcoded array
+		// keys from hardcoded array
 		const v = value[key];
 		if (typeof v === "number" && Number.isFinite(v)) return v;
 		if (
@@ -577,7 +577,6 @@ export function FurniClient({ room, items = [], canEdit }: Props) {
 														)}
 														<TableCell>
 															{icon ? (
-																// eslint-disable-next-line @next/next/no-img-element
 																<img
 																	src={icon}
 																	alt={item.name}
@@ -733,7 +732,6 @@ export function FurniClient({ room, items = [], canEdit }: Props) {
 												>
 													<TableCell>
 														{icon ? (
-															// eslint-disable-next-line @next/next/no-img-element
 															<img
 																src={icon}
 																alt={g.base.name}
@@ -493,7 +493,7 @@ export default async function AdminTheme({
 												width: 20,
 												height: 20,
 												borderRadius: 4,
-												// eslint-disable-next-line security/detect-object-injection -- k from fixed theme color key list
+												// k from fixed theme color key list
 												background: theme.settings[k] ?? "#64748b",
 												boxShadow: "inset 0 0 0 1px rgba(0,0,0,0.2)",
 											}}
@@ -356,7 +356,7 @@ export async function GET(req: Request) {
 					]);

 				const rarity = Object.fromEntries(
-					// eslint-disable-next-line security/detect-object-injection -- rk from rarityKeys const, i is array index
+					// rk from rarityKeys const, i is array index
 					rarityKeys.map((rk, i) => [rk, rarityBoards[i]]),
 				) as Record<BadgeRarityKey, BoardCore>;

@@ -398,7 +398,7 @@ export async function GET(req: Request) {
 			totalBadgesViewer = tb;
 			achievementViewer = ach;
 			rarityViewer = Object.fromEntries(
-				// eslint-disable-next-line security/detect-object-injection -- rk from rarityKeys const, i is array index
+				// rk from rarityKeys const, i is array index
 				rarityKeys.map((rk, i) => [rk, rvs[i]]),
 			) as Record<BadgeRarityKey, Partial<BadgeLeaderboardEntry> | undefined>;
 		}
@@ -414,7 +414,7 @@ export async function GET(req: Request) {
 					viewerEntry: achievementViewer,
 				},
 				rarity: Object.fromEntries(
-					// eslint-disable-next-line security/detect-object-injection -- rk from rarityKeys const
+					// rk from rarityKeys const
 					rarityKeys.map((rk) => [
 						rk,
 						{ ...global.rarity[rk], viewerEntry: rarityViewer[rk] },
@@ -110,7 +110,7 @@ export async function GET(req: Request) {
 			async () =>
 				type === "credits"
 					? await loadCreditsRows()
-					: // eslint-disable-next-line security/detect-object-injection -- type validated to "diamonds"|"duckets"
+					: // type validated to "diamonds"|"duckets"
 						await loadCurrencyRows(CURRENCY_TYPE[type]),
 			// Rankings are re-sorted on every read; serving the previous order for a
 			// minute keeps a busy leaderboard off the database.
@@ -51,7 +51,6 @@ export async function GET(
 				headers: SECURITY_HEADERS,
 			});
 		}
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		if (!existsSync(filePath)) {
 			return new NextResponse("Not found", {
 				status: 404,
@@ -59,7 +58,6 @@ export async function GET(
 			});
 		}

-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		const bytes = await readFile(filePath);
 		const mime: Record<string, string> = {
 			".png": "image/png",
@@ -76,7 +74,7 @@ export async function GET(
 			headers: {
 				...SECURITY_HEADERS,
 				...(ext === ".svg" ? { "Content-Disposition": "attachment" } : {}),
-				// eslint-disable-next-line security/detect-object-injection -- ext validated against ALLOWED_EXT
+				// ext validated against ALLOWED_EXT
 				"Content-Type": mime[ext] ?? "application/octet-stream",
 				"Cache-Control": "public, max-age=3600, must-revalidate",
 			},
@@ -12,11 +12,9 @@ import { PERMS } from "@/lib/permissions";
 */
 export const GET = withAdmin({ permission: PERMS.PAGES_EDIT }, async () => {
 	const dir = MEDIA_ROOT;
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
 	if (!existsSync(dir)) {
 		return apiOk({ files: [] });
 	}
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
 	const files = readdirSync(dir)
 		.filter((f) => /\.(png|jpg|jpeg|gif|webp|svg|bmp)$/i.test(f))
 		.map((f) => {
@@ -35,7 +35,7 @@ function findCount(value: unknown, depth = 0): number | null {
 		"count",
 	];
 	for (const key of keys) {
-		// eslint-disable-next-line security/detect-object-injection -- keys from hardcoded array
+		// keys from hardcoded array
 		const v = value[key];
 		if (typeof v === "number" && Number.isFinite(v)) return v;
 		if (
@@ -2893,6 +2893,20 @@ html {
 		0 0 0 3px color-mix(in srgb, var(--color-primary) 16%, transparent),
 		0 0 24px -8px color-mix(in srgb, var(--color-primary) 60%, transparent);
 }
+.auth-input[aria-invalid="true"]:not(:focus) {
+	border-color: color-mix(in srgb, var(--color-danger) 60%, transparent);
+	background: color-mix(
+		in srgb,
+		var(--color-danger) 6%,
+		color-mix(in srgb, var(--color-background) 88%, var(--color-surface))
+	);
+}
+.auth-input[aria-invalid="true"]:focus {
+	border-color: var(--color-danger);
+	box-shadow:
+		0 0 0 3px color-mix(in srgb, var(--color-danger) 18%, transparent),
+		0 0 24px -8px color-mix(in srgb, var(--color-danger) 55%, transparent);
+}
 .auth-input:disabled {
 	opacity: 0.55;
 	cursor: not-allowed;
@@ -13,6 +13,7 @@ import { ThemeVars } from "@/components/theme-vars";
 import { enforceSiteAccess } from "@/lib/access-guard";
 import { getDefaultFaviconDataUri } from "@/lib/default-favicon";
 import { resolveHotelName } from "@/lib/hotel-name";
+import { publicClientMessages } from "@/lib/i18n-client-messages";
 import { siteSettings } from "@/lib/services/site-settings";
 import "./globals.css";

@@ -68,7 +69,11 @@ export default async function RootLayout({
 }) {
 	await enforceSiteAccess();
 	const locale = await getLocale();
-	const messages = await getMessages();
+	// Only the namespaces non-staff routes can reach: the full catalogue is
+	// ~254 KB and would otherwise be serialised into every public page's RSC
+	// payload. `/admin`, `/admin-next` and `/mod` install a nested provider
+	// seeded with the full set (see i18n-client-messages).
+	const messages = publicClientMessages(await getMessages());
 	const defaultDark = await siteSettings.getBool("default_dark", false);
 	const nitroUrl = await siteSettings.get("nitro_client_url", "");
 	const nonce = (await headers()).get("x-nonce") ?? undefined;
@@ -10,7 +10,8 @@ import {
 	Users,
 } from "lucide-react";
 import { redirect } from "next/navigation";
-import { getTranslations } from "next-intl/server";
+import { NextIntlClientProvider } from "next-intl";
+import { getLocale, getMessages, getTranslations } from "next-intl/server";
 import type { ReactNode } from "react";
 import { LanguageSwitcher } from "@/components/language-switcher";
 import Link from "@/components/link";
@@ -81,8 +82,13 @@ export default async function ModLayout({ children }: { children: ReactNode }) {
 		{ href: "/mod/team", label: t("nav.team"), icon: Users, show: showTeam },
 	].filter((item) => item.show);

+	// The root layout ships the reduced catalogue so public pages do not carry
+	// the ~195 KB of staff-tool strings. Nested providers replace the parent
+	// set rather than merging, so staff route groups re-install the full one.
+	const [locale, messages] = await Promise.all([getLocale(), getMessages()]);
+
 	return (
-		<>
+		<NextIntlClientProvider locale={locale} messages={messages}>
 			{csrfToken ? <meta name="csrf-token" content={csrfToken} /> : null}
 			<div
 				data-admin
@@ -140,6 +146,6 @@ export default async function ModLayout({ children }: { children: ReactNode }) {
 				</header>
 				<main className="mx-auto max-w-6xl p-4 sm:p-6">{children}</main>
 			</div>
-		</>
+		</NextIntlClientProvider>
 	);
 }
@@ -45,7 +45,6 @@ export function ArticleCard({
 		<div className="admin-card overflow-hidden flex flex-col">
 			{confirmDialog}
 			<div className="relative w-full aspect-[16/9] bg-[var(--admin-canvas)]">
-				{/* eslint-disable-next-line @next/next/no-img-element */}
 				<img
 					src={image || ""}
 					alt={title}
@@ -296,7 +296,6 @@ export function ArticleForm({
 						/>
 					</div>
 					{image && !imageError ? (
-						// eslint-disable-next-line @next/next/no-img-element
 						<img
 							src={image}
 							alt={t("imagePreview")}
@@ -715,7 +715,6 @@ function FurniThumb({
 			className="flex items-center justify-center rounded bg-muted/50"
 			style={{ width: size, height: size }}
 		>
-			{/* eslint-disable-next-line @next/next/no-img-element */}
 			<img
 				src={primary}
 				alt={item.itemName}
@@ -893,7 +893,7 @@ export function SortableTree({
 			handleToggleEnabled,
 			handleAddSubpage,
 		],
-	); // eslint-disable-line react-hooks/exhaustive-deps
+	);

 	return (
 		<div
@@ -34,7 +34,6 @@ export function FurniIcon({

 	return (
 		<div className="w-10 h-10 rounded bg-muted/50 flex items-center justify-center overflow-hidden">
-			{/* eslint-disable-next-line @next/next/no-img-element */}
 			<img
 				src={localUrl}
 				alt={classname}
@@ -231,7 +231,6 @@ function FurniThumb({

 	return (
 		<div className="flex h-10 w-10 shrink-0 items-center justify-center rounded bg-muted/50">
-			{/* eslint-disable-next-line @next/next/no-img-element */}
 			<img
 				src={primary}
 				alt={classname}
@@ -192,7 +192,6 @@ export function ShopFurniIcon({
 	}

 	return (
-		// eslint-disable-next-line @next/next/no-img-element
 		<img
 			src={primary}
 			alt={classname}
@@ -226,7 +226,6 @@ export function AdminMediaGrid() {
 								}}
 							>
 								<div className="relative">
-									{/* eslint-disable-next-line @next/next/no-img-element */}
 									<img
 										src={validImageUrl(f.url)}
 										alt={f.name}
@@ -156,7 +156,6 @@ export function MediaPicker({
 													e.currentTarget.style.borderColor = "transparent";
 											}}
 										>
-											{/* eslint-disable-next-line @next/next/no-img-element */}
 											<img
 												src={validImageUrl(f.url)}
 												alt={f.name}
@@ -51,7 +51,6 @@ export function FurniThumb({
 			className="flex items-center justify-center rounded bg-muted/50"
 			style={{ width: size, height: size }}
 		>
-			{/* eslint-disable-next-line @next/next/no-img-element */}
 			<img
 				src={primary}
 				alt={item.itemName}
@@ -405,7 +405,7 @@ export function ThemeManagerPanel({
 												width: 14,
 												height: 14,
 												borderRadius: 3,
-												// eslint-disable-next-line security/detect-object-injection -- k from fixed key list
+												// k from fixed key list
 												background: palette.light[k],
 												boxShadow: "inset 0 0 0 1px rgba(0,0,0,0.15)",
 												marginLeft: -3,
@@ -0,0 +1,38 @@
+"use client";
+
+import type { ReactNode } from "react";
+
+interface AuthAlertProps {
+	children: ReactNode;
+	/** Tint of the box: red for errors, green for confirmations. */
+	variant?: "error" | "success";
+	/** Extra classes, e.g. spacing (`mb-4`) or entrance animation. */
+	className?: string;
+	/** Optional id so inputs can point at the message via `aria-describedby`. */
+	id?: string;
+}
+
+/**
+ * The single status/error banner for the auth forms. Uses `role="alert"` for
+ * failures (screen readers announce them immediately) and `role="status"` for
+ * confirmations, so the two are wired correctly instead of every caller
+ * repeating the markup and risking an unannounced message.
+ */
+export function AuthAlert({
+	children,
+	variant = "error",
+	className = "",
+	id,
+}: AuthAlertProps) {
+	return (
+		<p
+			id={id}
+			role={variant === "error" ? "alert" : "status"}
+			className={`auth-alert animate-fade-in-up m-0 ${
+				variant === "success" ? "auth-alert--success" : ""
+			} ${className}`}
+		>
+			{children}
+		</p>
+	);
+}
@@ -0,0 +1,112 @@
+"use client";
+
+import type { LucideIcon } from "lucide-react";
+import type { CSSProperties, ReactNode, Ref } from "react";
+
+const ICON_CLASS =
+	"pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2";
+
+export interface AuthFieldProps {
+	id: string;
+	name: string;
+	label: string;
+	icon: LucideIcon;
+	type?: string;
+	/** Controlled value; omit both `value` and `onChange` for an uncontrolled field. */
+	value?: string;
+	onChange?: (value: string) => void;
+	placeholder?: string;
+	autoComplete?: string;
+	inputMode?:
+		| "none"
+		| "text"
+		| "tel"
+		| "url"
+		| "email"
+		| "numeric"
+		| "decimal"
+		| "search";
+	required?: boolean;
+	disabled?: boolean;
+	minLength?: number;
+	maxLength?: number;
+	/** Marks the field with `aria-invalid` and a danger border. */
+	invalid?: boolean;
+	/** id of the element describing this field (e.g. an error banner). */
+	describedBy?: string;
+	iconColor?: string;
+	inputStyle?: CSSProperties;
+	/** Absolutely positioned control inside the input, e.g. `PasswordToggle`. */
+	trailing?: ReactNode;
+	/** Content rendered below the field: strength meter, policy hints, mismatch. */
+	children?: ReactNode;
+	/** Extra classes on the wrapping `space-y` container. */
+	className?: string;
+	inputRef?: Ref<HTMLInputElement>;
+}
+
+/**
+ * One labelled, icon-prefixed auth input. Login and register repeat this markup
+ * seven times; centralising it keeps the icon, focus and `aria-describedby`
+ * behaviour identical everywhere.
+ */
+export function AuthField({
+	id,
+	name,
+	label,
+	icon: Icon,
+	type = "text",
+	value,
+	onChange,
+	placeholder,
+	autoComplete,
+	inputMode,
+	required,
+	disabled,
+	minLength,
+	maxLength,
+	invalid,
+	describedBy,
+	iconColor = "var(--color-text-muted)",
+	inputStyle,
+	trailing,
+	children,
+	className = "",
+	inputRef,
+}: AuthFieldProps) {
+	return (
+		<div className={`space-y-1.5 ${className}`}>
+			<label htmlFor={id} className="auth-label">
+				{label}
+			</label>
+			<div className="relative">
+				<Icon
+					aria-hidden="true"
+					className={ICON_CLASS}
+					style={{ color: iconColor }}
+				/>
+				<input
+					ref={inputRef}
+					id={id}
+					name={name}
+					type={type}
+					value={value}
+					onChange={onChange ? (e) => onChange(e.target.value) : undefined}
+					placeholder={placeholder}
+					autoComplete={autoComplete}
+					inputMode={inputMode}
+					required={required}
+					disabled={disabled}
+					minLength={minLength}
+					maxLength={maxLength}
+					aria-invalid={invalid ? true : undefined}
+					aria-describedby={describedBy}
+					className={`auth-input has-icon ${trailing ? "has-action" : ""}`}
+					style={inputStyle}
+				/>
+				{trailing}
+			</div>
+			{children}
+		</div>
+	);
+}
@@ -0,0 +1,125 @@
+import { desc, eq } from "drizzle-orm";
+import { headers } from "next/headers";
+import type { ReactNode } from "react";
+import {
+	AuthPageFrame,
+	AuthUsersCards,
+	type PublicUser,
+} from "@/components/auth/auth-page-frame";
+import { AuthPromoCard } from "@/components/auth/auth-promo-card";
+import type { CaptchaPublicConfig } from "@/components/auth/captcha-widget";
+import { cached } from "@/lib/cache";
+import { db, User } from "@/lib/db";
+import { resolveHotelName } from "@/lib/hotel-name";
+import { captchaConfig } from "@/lib/services/captcha";
+import { cachedOnlineCount } from "@/lib/services/public-counters";
+import { siteSettings } from "@/lib/services/site-settings";
+
+export interface AuthLandingData {
+	hotelName: string;
+	logo: string | null;
+	nonce?: string;
+	/** Ready to spread onto a form's `captcha` prop (secrets never included). */
+	captcha: CaptchaPublicConfig;
+	online: number;
+	recentUsers: PublicUser[];
+	latestUsers: PublicUser[];
+}
+
+/**
+ * Everything `/login` and `/register` need around their form: hotel identity,
+ * captcha config, the CSP nonce and the "who is online" / "newest citizens"
+ * rails. The rosters are memoised, so both pages share one cache entry. Kept in
+ * one place because the two landing pages are otherwise identical.
+ */
+export async function loadAuthLanding(): Promise<AuthLandingData> {
+	const [hotelName, cfg, logo] = await Promise.all([
+		resolveHotelName(),
+		captchaConfig(),
+		siteSettings.get("cms_logo", ""),
+	]);
+	const captcha: CaptchaPublicConfig = {
+		provider: cfg.provider,
+		siteKey: cfg.siteKey || undefined,
+		field: cfg.field || undefined,
+	};
+	const nonce = (await headers()).get("x-nonce") ?? undefined;
+
+	const [online, recentUsers, latestUsers] = await Promise.all([
+		cachedOnlineCount().catch(() => 0),
+		cached(
+			"auth_online_users",
+			10_000,
+			() =>
+				db
+					.select({ id: User.id, username: User.username, look: User.look })
+					.from(User)
+					.where(eq(User.online, "1"))
+					.limit(8),
+			{ staleMs: 30000 },
+		).catch(() => []),
+		cached(
+			"auth_latest_users",
+			30_000,
+			() =>
+				db
+					.select({ id: User.id, username: User.username, look: User.look })
+					.from(User)
+					.orderBy(desc(User.accountCreated))
+					.limit(8),
+			{ staleMs: 60000 },
+		).catch(() => []),
+	]);
+
+	return { hotelName, captcha, logo, nonce, online, recentUsers, latestUsers };
+}
+
+/** Locale-resolved strings the landing frame needs, keyed to the page. */
+export interface AuthLandingCopy {
+	title: string;
+	subtitle: ReactNode;
+	/** Optional success notice rendered above the form (e.g. "registered"). */
+	notice?: ReactNode;
+	promoTitle: ReactNode;
+	promoSubtitle: ReactNode;
+	usersOnlineLabel: string;
+	whoIsOnlineLabel: string;
+	newestCitizensLabel: string;
+}
+
+interface AuthLandingViewProps {
+	data: AuthLandingData;
+	copy: AuthLandingCopy;
+	form: ReactNode;
+}
+
+/**
+ * Presentational shell shared by the auth landing pages: top bar, promo panel
+ * and user rails around a caller-supplied form. All data and copy come from the
+ * page so this component stays free of queries and translations.
+ */
+export function AuthLandingView({ data, copy, form }: AuthLandingViewProps) {
+	return (
+		<AuthPageFrame
+			hotelName={data.hotelName}
+			logo={data.logo}
+			online={data.online}
+			title={copy.title}
+			subtitle={copy.subtitle}
+			notice={copy.notice}
+			form={form}
+		>
+			<AuthPromoCard
+				onlineLabel={copy.usersOnlineLabel}
+				title={copy.promoTitle}
+				subtitle={copy.promoSubtitle}
+			/>
+			<AuthUsersCards
+				recentUsers={data.recentUsers}
+				latestUsers={data.latestUsers}
+				recentTitle={copy.whoIsOnlineLabel}
+				latestTitle={copy.newestCitizensLabel}
+			/>
+		</AuthPageFrame>
+	);
+}
@@ -128,6 +128,8 @@ function AvatarGrid({
 interface AuthPageFrameProps {
 	hotelName: string;
 	logo?: string | null;
+	/** Live online count shown in the top bar; omit to hide it. */
+	online?: number;
 	/** Title of the form card on the right. */
 	title: string;
 	/** One-line intro above the form. */
@@ -148,6 +150,7 @@ interface AuthPageFrameProps {
 export function AuthPageFrame({
 	hotelName,
 	logo,
+	online,
 	title,
 	subtitle,
 	notice,
@@ -158,7 +161,7 @@ export function AuthPageFrame({
 		<div className="mx-auto w-full max-w-6xl flex flex-col gap-8 pb-16">
 			<div className="relative">
 				<AuthAurora />
-				<AuthTopBar hotelName={hotelName} logo={logo} />
+				<AuthTopBar hotelName={hotelName} logo={logo} online={online} />
 			</div>

 			<Reveal>
@@ -0,0 +1,107 @@
+import Image from "next/image";
+import type { ReactNode } from "react";
+import { SurfaceCard } from "@/components/surface-card";
+
+interface AuthPromoCardProps {
+	/** Fully formatted "N users online" label. */
+	onlineLabel: string;
+	title: ReactNode;
+	subtitle: ReactNode;
+}
+
+/**
+ * The single promo panel both `/login` and `/register` show above the form:
+ * Frank, the online badge and a short welcome. Keeping it in one place means
+ * the two auth pages can never drift apart visually again.
+ */
+export function AuthPromoCard({
+	onlineLabel,
+	title,
+	subtitle,
+}: AuthPromoCardProps) {
+	return (
+		<SurfaceCard
+			className="card-glow relative overflow-hidden p-6 text-center"
+			style={{
+				borderColor:
+					"color-mix(in srgb, var(--color-primary) 20%, transparent)",
+			}}
+		>
+			<div
+				className="absolute inset-0"
+				style={{
+					background:
+						"linear-gradient(135deg, color-mix(in srgb, var(--color-primary) 10%, transparent), color-mix(in srgb, var(--color-accent) 10%, transparent))",
+				}}
+			/>
+			<div aria-hidden="true" className="absolute inset-0 overflow-hidden">
+				<div className="brand-halo left-1/2 top-0 h-64 w-[460px] max-w-full -translate-x-1/2 -translate-y-1/2" />
+				<div
+					className="aurora-blob -left-16 top-10 h-56 w-56"
+					style={{
+						background:
+							"color-mix(in srgb, var(--color-primary) 45%, transparent)",
+					}}
+				/>
+				<div
+					className="aurora-blob -right-16 bottom-0 h-56 w-56"
+					style={{
+						background:
+							"color-mix(in srgb, var(--color-accent) 40%, transparent)",
+						animationDelay: "-8s",
+					}}
+				/>
+			</div>
+			<div className="relative">
+				<div className="brand-halo left-1/2 top-8 h-52 w-52 -translate-x-1/2" />
+				<Image
+					src="/assets/images/FrankwithBag.gif"
+					alt="Frank"
+					width={130}
+					height={170}
+					className="relative object-contain mx-auto drop-shadow-xl animate-float"
+					unoptimized
+				/>
+				<div
+					className="inline-flex items-center gap-2 px-3.5 py-1 rounded-full text-xs font-bold uppercase tracking-wider mt-4 mb-3 border"
+					style={{
+						borderColor:
+							"color-mix(in srgb, var(--color-primary) 30%, transparent)",
+						background:
+							"color-mix(in srgb, var(--color-surface) 72%, transparent)",
+						color: "var(--color-primary-readable, var(--color-primary))",
+						boxShadow:
+							"0 8px 20px -12px color-mix(in srgb, var(--color-primary) 70%, transparent)",
+					}}
+				>
+					<span className="relative flex h-2 w-2">
+						<span
+							className="animate-ping absolute inline-flex h-full w-full rounded-full opacity-75"
+							style={{ background: "var(--color-primary)" }}
+						/>
+						<span
+							className="relative inline-flex rounded-full h-2 w-2"
+							style={{ background: "var(--color-primary)" }}
+						/>
+					</span>
+					{onlineLabel}
+				</div>
+				<h1
+					className="text-xl font-black"
+					style={{
+						color: "var(--color-text-readable)",
+						fontFamily: "var(--font-nunito)",
+					}}
+				>
+					{title}
+				</h1>
+				<p
+					className="text-xs mt-1.5 mx-auto max-w-[240px] leading-relaxed"
+					style={{ color: "var(--color-text-muted)" }}
+				>
+					{subtitle}
+				</p>
+			</div>
+		</SurfaceCard>
+	);
+}
@@ -1,29 +1,32 @@
 import Image from "next/image";
 import { Clock } from "@/components/clock";
 import { LanguageSwitcher } from "@/components/language-switcher";
+import { LiveOnlineCount } from "@/components/live-online-count";
 import { Reveal } from "@/components/motion-reveal";
 import { ThemeSwitcher } from "@/components/theme-switcher";
 import { ICON_LIGHTHOUSE } from "@/lib/site-icons";

 /**
- * Shared frosted-glass top bar for the public auth pages (login, register,
- * etc.). Shows the hotel logo + name on the left and language / clock / theme
- * controls on the right. Defaults mirror the homepage top bar so auth pages
- * share one consistent look.
+ * Shared frosted-glass top bar for the public pages (index, login, register).
+ * Shows the hotel logo on the left and the live "online" counter (which carries
+ * the hotel name), language / clock / theme controls on the right. One
+ * component so every public page keeps the exact same chrome instead of
+ * duplicating it.
 */
 export function AuthTopBar({
 	hotelName,
 	logo,
-	showHotelName = true,
+	online,
 }: {
 	hotelName: string;
 	logo?: string | null;
-	showHotelName?: boolean;
+	/** Live online count; omit (or pass null) to hide the indicator. */
+	online?: number | null;
 }) {
 	return (
 		<Reveal>
 			<div
-				className="relative flex items-center justify-between rounded-full border px-3 py-2.5 sm:px-5"
+				className="relative flex items-center justify-between gap-3 rounded-full border px-3 py-2.5 sm:px-5"
 				style={{
 					background:
 						"linear-gradient(90deg, color-mix(in srgb, var(--color-surface) 62%, transparent), color-mix(in srgb, var(--color-primary) 7%, transparent))",
@@ -35,7 +38,7 @@ export function AuthTopBar({
 						"0 1px 3px rgba(0,0,0,0.04), 0 0 0 0.5px color-mix(in srgb, var(--color-text-muted) 6%, transparent)",
 				}}
 			>
-				<div className="flex items-center gap-2 sm:gap-3">
+				<div className="flex min-w-0 items-center gap-2 sm:gap-3">
 					{logo ? (
 						<Image
 							src={logo}
@@ -67,14 +70,6 @@ export function AuthTopBar({
 							/>
 						</div>
 					)}
-					{showHotelName ? (
-						<span
-							className="hidden text-sm font-extrabold uppercase tracking-wide sm:inline"
-							style={{ color: "var(--color-text-readable)" }}
-						>
-							{hotelName}
-						</span>
-					) : null}
 				</div>
 				<div
 					className="flex items-center gap-1 sm:gap-1.5 rounded-full px-1.5 py-1 sm:px-2"
@@ -83,6 +78,31 @@ export function AuthTopBar({
 							"color-mix(in srgb, var(--color-text-muted) 5%, transparent)",
 					}}
 				>
+					{typeof online === "number" && (
+						<span
+							className="flex items-center gap-1.5 px-1"
+							style={{ color: "var(--color-text-readable)" }}
+						>
+							<span className="relative flex h-2 w-2 shrink-0">
+								<span
+									className="absolute inline-flex h-full w-full animate-ping rounded-full opacity-70"
+									style={{ background: "var(--color-primary)" }}
+								/>
+								<span
+									className="relative inline-flex h-2 w-2 rounded-full"
+									style={{ background: "var(--color-primary)" }}
+								/>
+							</span>
+							<span
+								className="text-xs font-black tabular-nums"
+								style={{
+									color: "var(--color-primary-readable, var(--color-primary))",
+								}}
+							>
+								<LiveOnlineCount initial={online} hotelName={hotelName} />
+							</span>
+						</span>
+					)}
 					<LanguageSwitcher />
 					<div
 						className="hidden sm:block w-px h-5"
@@ -3,8 +3,10 @@
 import { KeyRound, Lock, UserRound } from "lucide-react";
 import { signIn } from "next-auth/react";
 import { useTranslations } from "next-intl";
-import { type FormEvent, useId, useState } from "react";
+import { type FormEvent, useEffect, useId, useRef, useState } from "react";
 import { precheckLogin } from "@/actions/auth-precheck";
+import { AuthAlert } from "@/components/auth/auth-alert";
+import { AuthField } from "@/components/auth/auth-field";
 import {
 	type CaptchaPublicConfig,
 	CaptchaWidget,
@@ -51,8 +53,17 @@ export function LoginForm({
 	const [unverified, setUnverified] = useState(false);
 	const [pending, setPending] = useState(false);
 	const [locked, setLocked] = useState(false);
+	const codeRef = useRef<HTMLInputElement>(null);
+
+	// The 2FA field only exists after the pre-check asks for a code; move focus
+	// there automatically so the visitor can keep typing without reaching for
+	// the mouse (the lint rule rules out a bare `autoFocus`).
+	useEffect(() => {
+		if (needs2fa) codeRef.current?.focus();
+	}, [needs2fa]);

 	const showFooter = variant === "page";
+	const compact = variant === "compact";
 	const lockCredentials =
 		needs2fa || locked ? "opacity-50 pointer-events-none" : "";

@@ -115,7 +126,9 @@ export function LoginForm({
 		<>
 			{needs2fa && (
 				<p
-					className="animate-fade-in-up mb-4 rounded-xl border px-3 py-2.5 text-sm font-semibold"
+					className={`animate-fade-in-up rounded-xl border px-3 py-2.5 text-sm font-semibold ${
+						compact ? "mb-3" : "mb-4"
+					}`}
 					style={{
 						color: "var(--color-text-readable)",
 						background:
@@ -131,105 +144,76 @@ export function LoginForm({
 			<form
 				onSubmit={onSubmit}
 				aria-label={t("signIn")}
-				className="relative flex flex-col gap-4"
+				className={`relative flex flex-col ${compact ? "gap-3" : "gap-4"}`}
 			>
-				<div className={`space-y-1.5 ${lockCredentials}`}>
-					<label htmlFor={`${fieldId}-username`} className="auth-label">
-						{t("username")}
-					</label>
-					<div className="relative">
-						<UserRound
-							aria-hidden="true"
-							className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
-							style={{ color: "var(--color-text-muted)" }}
-						/>
-						<input
+				<AuthField
 					id={`${fieldId}-username`}
 					name="username"
-							type="text"
+					label={t("username")}
+					icon={UserRound}
 					value={username}
-							onChange={(e) => setUsername(e.target.value)}
+					onChange={setUsername}
 					placeholder={t("usernamePlaceholder")}
 					autoComplete="username"
-							disabled={needs2fa}
+					disabled={needs2fa || pending}
 					required
-							className="auth-input has-icon"
+					invalid={!!error}
+					describedBy={error ? `${fieldId}-error` : undefined}
+					className={lockCredentials}
 				/>
-					</div>
-				</div>

-				<div className={`space-y-1.5 ${lockCredentials}`}>
-					<label htmlFor={`${fieldId}-password`} className="auth-label">
-						{t("password")}
-					</label>
-					<div className="relative">
-						<Lock
-							aria-hidden="true"
-							className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
-							style={{ color: "var(--color-text-muted)" }}
-						/>
-						<input
+				<AuthField
 					id={`${fieldId}-password`}
 					name="password"
+					label={t("password")}
+					icon={Lock}
 					type={showPassword ? "text" : "password"}
 					value={password}
-							onChange={(e) => setPassword(e.target.value)}
+					onChange={setPassword}
 					placeholder={t("passwordPlaceholder")}
 					autoComplete="current-password"
-							disabled={needs2fa}
+					disabled={needs2fa || pending}
 					required
-							className="auth-input has-icon has-action"
-						/>
+					invalid={!!error}
+					describedBy={error ? `${fieldId}-error` : undefined}
+					className={lockCredentials}
+					trailing={
 						<PasswordToggle
 							show={showPassword}
 							onToggle={() => setShowPassword((v) => !v)}
 							labelShow={t("showPassword")}
 							labelHide={t("hidePassword")}
 						/>
-					</div>
-				</div>
+					}
+				/>

 				{needs2fa ? (
-					<div className="animate-scale-in space-y-1.5">
-						<label htmlFor={`${fieldId}-2fa`} className="auth-label">
-							{t("codePlaceholder")}
-						</label>
-						<div className="relative">
-							<KeyRound
-								aria-hidden="true"
-								className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
-								style={{ color: "var(--color-primary)" }}
-							/>
-							<input
+					<AuthField
 						id={`${fieldId}-2fa`}
 						name="code"
-								type="text"
+						label={t("codePlaceholder")}
+						icon={KeyRound}
+						iconColor="var(--color-primary)"
 						value={code}
-								onChange={(e) => setCode(e.target.value)}
+						onChange={setCode}
 						placeholder={t("codePlaceholder")}
 						inputMode="numeric"
 						autoComplete="one-time-code"
-								className="auth-input has-icon"
-								style={{
+						disabled={pending}
+						invalid={!!error}
+						describedBy={error ? `${fieldId}-error` : undefined}
+						className="animate-scale-in"
+						inputRef={codeRef}
+						inputStyle={{
 							borderColor:
 								"color-mix(in srgb, var(--color-primary) 45%, transparent)",
 						}}
 					/>
-						</div>
-					</div>
 				) : (
 					<CaptchaWidget captcha={captcha} nonce={nonce} />
 				)}

-				{error && (
-					<p
-						role="alert"
-						aria-live="polite"
-						className="auth-alert animate-fade-in-up m-0"
-					>
-						{error}
-					</p>
-				)}
+				{error && <AuthAlert id={`${fieldId}-error`}>{error}</AuthAlert>}

 				{unverified && (
 					<p
@@ -249,7 +233,9 @@ export function LoginForm({
 				<button
 					type="submit"
 					disabled={pending || locked}
-					className="btn-brand btn-shine w-full cursor-pointer py-3.5 text-sm font-extrabold uppercase tracking-wider disabled:opacity-60"
+					className={`btn-brand btn-shine w-full cursor-pointer text-sm font-extrabold uppercase tracking-wider disabled:opacity-60 ${
+						compact ? "py-3" : "py-3.5"
+					}`}
 				>
 					{pending ? (
 						<span className="inline-flex items-center justify-center gap-2">
@@ -4,6 +4,7 @@ import {
 	Check,
 	KeyRound,
 	Lock,
+	type LucideIcon,
 	Mail,
 	ShieldCheck,
 	UserRound,
@@ -18,6 +19,8 @@ import {
 	type RegisterState,
 	register,
 } from "@/actions/register";
+import { AuthAlert } from "@/components/auth/auth-alert";
+import { AuthField } from "@/components/auth/auth-field";
 import { PasswordToggle } from "@/components/auth/password-toggle";
 import Link from "@/components/link";
 import { signInWithTransientRetry } from "@/lib/auth/sign-in-retry";
@@ -27,19 +30,23 @@ interface RegisterFormProps {
 	captcha: { provider: string; siteKey?: string };
 	error?: string;
 	nonce?: string;
+	/** Effective policy from `PASSWORD_MIN_LENGTH` / `PASSWORD_MAX_LENGTH`. */
+	passwordMinLength: number;
+	passwordMaxLength: number;
 }

 function passwordStrength(
 	pw: string,
 	t: (key: string) => string,
+	minLength: number,
 ): {
 	score: number;
 	label: string;
 	color: string;
 } {
 	let score = 0;
-	if (pw.length >= 8) score += 1;
-	if (pw.length >= 12) score += 1;
+	if (pw.length >= minLength) score += 1;
+	if (pw.length >= minLength + 4) score += 1;
 	if (/[a-z]/.test(pw) && /[A-Z]/.test(pw)) score += 1;
 	if (/\d/.test(pw)) score += 1;
 	if (/[^a-zA-Z0-9]/.test(pw)) score += 1;
@@ -50,11 +57,58 @@ function passwordStrength(
 	return { score: 5, label: t("strengthStrong"), color: "#16a34a" };
 }

+/** The numbered section rule above each group of fields ("01 Account", ...). */
+function AuthSectionHeader({
+	icon: Icon,
+	label,
+	step,
+}: {
+	icon: LucideIcon;
+	label: string;
+	step: string;
+}) {
+	const accent = "var(--color-primary-readable, var(--color-primary))";
+	return (
+		<div className="flex items-center gap-2.5">
+			<span
+				aria-hidden="true"
+				className="flex h-7 w-7 shrink-0 items-center justify-center rounded-lg"
+				style={{
+					background:
+						"color-mix(in srgb, var(--color-primary) 12%, transparent)",
+					boxShadow:
+						"inset 0 0 0 1px color-mix(in srgb, var(--color-primary) 22%, transparent)",
+				}}
+			>
+				<Icon className="h-3.5 w-3.5" style={{ color: accent }} />
+			</span>
+			<span
+				className="text-[11px] font-black uppercase tracking-widest"
+				style={{ color: accent }}
+			>
+				{label}
+			</span>
+			<span
+				className="h-px flex-1"
+				style={{
+					background:
+						"linear-gradient(90deg, color-mix(in srgb, var(--color-text-muted) 18%, transparent), transparent)",
+				}}
+			/>
+			<span aria-hidden="true" className="number-mark text-lg">
+				{step}
+			</span>
+		</div>
+	);
+}
+
 export function RegisterForm({
 	hotelName,
 	captcha,
 	error,
 	nonce,
+	passwordMinLength,
+	passwordMaxLength,
 }: RegisterFormProps) {
 	const t = useTranslations("pages.register");
 	const showCaptcha = captcha.provider !== "none" && !!captcha.siteKey;
@@ -90,7 +144,7 @@ export function RegisterForm({
 	);
 	const autoLoginStartedRef = useRef(false);
 	const [referralCode, setReferralCode] = useState("");
-	const strength = passwordStrength(password, t);
+	const strength = passwordStrength(password, t, passwordMinLength);

 	/**
 	 * The password policy the server enforces, evaluated live so the visitor can
@@ -98,7 +152,10 @@ export function RegisterForm({
 	 * single error back.
 	 */
 	const requirements = [
-		{ label: t("passwordMinLength"), met: password.length >= 12 },
+		{
+			label: t("passwordMinLength", { min: passwordMinLength }),
+			met: password.length >= passwordMinLength,
+		},
 		{ label: t("passwordUpper"), met: /[A-Z]/.test(password) },
 		{ label: t("passwordLower"), met: /[a-z]/.test(password) },
 		{ label: t("passwordDigit"), met: /\d/.test(password) },
@@ -183,15 +240,7 @@ export function RegisterForm({
 				}}
 				className="flex flex-col gap-6"
 			>
-				{errorMessage && (
-					<p
-						role="alert"
-						aria-live="polite"
-						className="auth-alert animate-fade-in-up m-0"
-					>
-						{errorMessage}
-					</p>
-				)}
+				{errorMessage && <AuthAlert>{errorMessage}</AuthAlert>}

 				{referralCode && (
 					<div
@@ -212,156 +261,65 @@ export function RegisterForm({

 				{/* Username & Email */}
 				<div className="space-y-2">
-					<div className="flex items-center gap-2.5">
-						<span
-							aria-hidden="true"
-							className="flex h-7 w-7 shrink-0 items-center justify-center rounded-lg"
-							style={{
-								background:
-									"color-mix(in srgb, var(--color-primary) 12%, transparent)",
-								boxShadow:
-									"inset 0 0 0 1px color-mix(in srgb, var(--color-primary) 22%, transparent)",
-							}}
-						>
-							<UserRound
-								className="h-3.5 w-3.5"
-								style={{
-									color: "var(--color-primary-readable, var(--color-primary))",
-								}}
+					<AuthSectionHeader
+						icon={UserRound}
+						label={t("accountDetails")}
+						step="01"
 					/>
-						</span>
-						<span
-							className="text-[11px] font-black uppercase tracking-widest"
-							style={{
-								color: "var(--color-primary-readable, var(--color-primary))",
-							}}
-						>
-							{t("accountDetails")}
-						</span>
-						<span
-							className="h-px flex-1"
-							style={{
-								background:
-									"linear-gradient(90deg, color-mix(in srgb, var(--color-text-muted) 18%, transparent), transparent)",
-							}}
-						/>
-						<span aria-hidden="true" className="number-mark text-lg">
-							01
-						</span>
-					</div>
 					<div className="grid grid-cols-1 md:grid-cols-2 gap-4 stagger-children">
-						<div className="space-y-1.5">
-							<label htmlFor="username" className="auth-label">
-								{t("username")}
-							</label>
-							<div className="relative">
-								<UserRound
-									aria-hidden="true"
-									className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
-									style={{ color: "var(--color-text-muted)" }}
-								/>
-								<input
+						<AuthField
 							id="username"
 							name="username"
-									type="text"
+							label={t("username")}
+							icon={UserRound}
 							placeholder={t("usernamePlaceholder")}
 							autoComplete="username"
-									className="auth-input has-icon"
 							required
 						/>
-							</div>
-						</div>
-						<div className="space-y-1.5">
-							<label htmlFor="mail" className="auth-label">
-								{t("email")}
-							</label>
-							<div className="relative">
-								<Mail
-									aria-hidden="true"
-									className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
-									style={{ color: "var(--color-text-muted)" }}
-								/>
-								<input
+						<AuthField
 							id="mail"
 							name="mail"
+							label={t("email")}
+							icon={Mail}
 							type="email"
 							placeholder={t("emailPlaceholder")}
 							autoComplete="email"
-									className="auth-input has-icon"
 						/>
 					</div>
 				</div>
-					</div>
-				</div>

 				{/* Password & Confirm */}
 				<div className="space-y-2">
-					<div className="flex items-center gap-2.5">
-						<span
-							aria-hidden="true"
-							className="flex h-7 w-7 shrink-0 items-center justify-center rounded-lg"
-							style={{
-								background:
-									"color-mix(in srgb, var(--color-primary) 12%, transparent)",
-								boxShadow:
-									"inset 0 0 0 1px color-mix(in srgb, var(--color-primary) 22%, transparent)",
-							}}
-						>
-							<KeyRound
-								className="h-3.5 w-3.5"
-								style={{
-									color: "var(--color-primary-readable, var(--color-primary))",
-								}}
+					<AuthSectionHeader
+						icon={KeyRound}
+						label={t("credentials")}
+						step="02"
 					/>
-						</span>
-						<span
-							className="text-[11px] font-black uppercase tracking-widest"
-							style={{
-								color: "var(--color-primary-readable, var(--color-primary))",
-							}}
-						>
-							{t("credentials")}
-						</span>
-						<span
-							className="h-px flex-1"
-							style={{
-								background:
-									"linear-gradient(90deg, color-mix(in srgb, var(--color-text-muted) 18%, transparent), transparent)",
-							}}
-						/>
-						<span aria-hidden="true" className="number-mark text-lg">
-							02
-						</span>
-					</div>
 					<div className="grid grid-cols-1 md:grid-cols-2 gap-4 stagger-children">
-						<div className="space-y-1.5">
-							<label htmlFor="password" className="auth-label">
-								{t("password")}
-							</label>
-							<div className="relative">
-								<Lock
-									aria-hidden="true"
-									className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
-									style={{ color: "var(--color-text-muted)" }}
-								/>
-								<input
+						<AuthField
 							id="password"
 							name="password"
+							label={t("password")}
+							icon={Lock}
 							type={showPassword ? "text" : "password"}
-									placeholder={t("passwordPlaceholder")}
-									autoComplete="new-password"
 							value={password}
-									onChange={(e) => setPassword(e.target.value)}
-									className="auth-input has-icon has-action"
+							onChange={setPassword}
+							placeholder={t("passwordPlaceholder", {
+								min: passwordMinLength,
+							})}
+							autoComplete="new-password"
 							required
-								/>
+							minLength={passwordMinLength}
+							maxLength={passwordMaxLength}
+							trailing={
 								<PasswordToggle
 									show={showPassword}
 									onToggle={() => setShowPassword((v) => !v)}
 									labelShow={t("showPassword")}
 									labelHide={t("hidePassword")}
 								/>
-							</div>
+							}
+						>
 							{password.length > 0 && (
 								<div className="animate-fade-in-up space-y-1.5 pt-0.5">
 									<div className="flex gap-1.5">
@@ -417,35 +375,27 @@ export function RegisterForm({
 									</li>
 								))}
 							</ul>
-						</div>
-						<div className="space-y-1.5">
-							<label htmlFor="password_confirmation" className="auth-label">
-								{t("confirmPassword")}
-							</label>
-							<div className="relative">
-								<Lock
-									aria-hidden="true"
-									className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
-									style={{ color: "var(--color-text-muted)" }}
-								/>
-								<input
+						</AuthField>
+						<AuthField
 							id="password_confirmation"
 							name="password_confirmation"
+							label={t("confirmPassword")}
+							icon={Lock}
 							type={showConfirm ? "text" : "password"}
+							value={confirmPassword}
+							onChange={setConfirmPassword}
 							placeholder={t("confirmPasswordPlaceholder")}
 							autoComplete="new-password"
-									value={confirmPassword}
-									onChange={(e) => setConfirmPassword(e.target.value)}
-									className="auth-input has-icon has-action"
 							required
-								/>
+							trailing={
 								<PasswordToggle
 									show={showConfirm}
 									onToggle={() => setShowConfirm((v) => !v)}
 									labelShow={t("showPassword")}
 									labelHide={t("hidePassword")}
 								/>
-							</div>
+							}
+						>
 							{mismatch && (
 								<p
 									className="animate-fade-in-up text-xs font-bold"
@@ -454,7 +404,7 @@ export function RegisterForm({
 									{t("passwordsDontMatch")}
 								</p>
 							)}
-						</div>
+						</AuthField>
 					</div>
 				</div>

@@ -44,7 +44,7 @@ export function NavbarColorPicker() {
 	const [mounted, setMounted] = useState(false);

 	function apply(index: number) {
-		// eslint-disable-next-line security/detect-object-injection -- index validated by findIndex + Math.max, guard below
+		// index validated by findIndex + Math.max, guard below
 		const c = COLORS[index];
 		if (!c) return;
 		document.documentElement.style.setProperty("--color-navbar", c.value);
@@ -29,7 +29,7 @@ export function PhotoLightbox({ photos }: { photos: LightboxPhoto[] }) {
 	// has to hold the overlay itself.
 	const [closing, setClosing] = useState(false);
 	const exitTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
-	// eslint-disable-next-line security/detect-object-injection -- openIndex is numeric array index, guarded by null check
+	// openIndex is numeric array index, guarded by null check
 	const active = openIndex !== null ? photos[openIndex] : null;

 	const close = useCallback(() => {
@@ -97,7 +97,6 @@ export function PhotoLightbox({ photos }: { photos: LightboxPhoto[] }) {
 						}}
 						aria-label={p.alt}
 					>
-						{/* eslint-disable-next-line @next/next/no-img-element */}
 						<img
 							src={p.url}
 							alt={p.alt}
@@ -180,7 +179,6 @@ export function PhotoLightbox({ photos }: { photos: LightboxPhoto[] }) {
 							cursor: "default",
 						}}
 					>
-						{/* eslint-disable-next-line @next/next/no-img-element */}
 						<img
 							src={active.url}
 							alt={active.alt}
@@ -59,7 +59,7 @@ function scanCharWidths(

 		const w = end - start;
 		if (w > 0) {
-			// eslint-disable-next-line security/detect-object-injection -- ci increments within CHAR_ORDER bounds
+			// ci increments within CHAR_ORDER bounds
 			chars.push({ char: CHAR_ORDER[ci], x: start, w });
 			ci++;
 		}
@@ -31,7 +31,6 @@ export function AvatarImage({
 		(options?.headOnly ? "l" : max <= 40 ? "s" : max <= 80 ? "m" : "l");

 	return (
-		// eslint-disable-next-line @next/next/no-img-element
 		<img
 			src={getAvatarUrl(figure, { ...options, size: autoSize })}
 			alt={alt}
@@ -11,7 +11,7 @@ const compactCallSites = new Map<string, number>([
 	["src/app/(site)/leaderboard/page.tsx", 1],
 	["src/app/(site)/me/page.tsx", 1],
 	["src/app/(site)/messages/page.tsx", 2],
-	["src/app/(site)/page.tsx", 2],
+	["src/app/(site)/page.tsx", 1],
 	["src/app/(site)/radio/leaderboard/page.tsx", 1],
 	["src/app/(site)/radio/shouts/page.tsx", 1],
 	["src/app/(site)/rankings/page.tsx", 1],
@@ -71,6 +71,11 @@ const schema = z

 		// bcrypt cost factor used for new password hashes.
 		BCRYPT_COST: z.coerce.number().int().min(4).max(31).default(12),
+		// Password-length policy for every new password (register, password reset
+		// and staff-created accounts). The minimum may be set between 5 and 30
+		// characters, the maximum between 30 and 128, so min always fits under max.
+		PASSWORD_MIN_LENGTH: z.coerce.number().int().min(5).max(30).default(12),
+		PASSWORD_MAX_LENGTH: z.coerce.number().int().min(30).max(128).default(128),
 		// Filesystem dir the badge uploader writes <code>.gif into (the emulator's
 		// badge image folder, e.g. .../assets/c_images/album1584). Upload is disabled
 		// when unset.
@@ -41,6 +41,8 @@ const routeMocks = vi.hoisted(() => {
 			}
 			return translate;
 		}),
+		getLocale: vi.fn(async () => "en"),
+		getMessages: vi.fn(async () => ({})),
 		notFound: vi.fn((): never => {
 			throw new Error("NEXT_NOT_FOUND");
 		}),
@@ -58,6 +60,8 @@ vi.mock("next/navigation", () => ({
 }));
 vi.mock("next-intl/server", () => ({
 	getTranslations: routeMocks.getTranslations,
+	getLocale: routeMocks.getLocale,
+	getMessages: routeMocks.getMessages,
 }));
 vi.mock("@/features/housekeeping/foundation/server-capability-context", () => ({
 	getHousekeepingCapabilityContext: routeMocks.getHousekeepingCapabilityContext,
@@ -1,6 +1,7 @@
 import { eq } from "drizzle-orm";
 import NextAuth from "next-auth";
 import Credentials from "next-auth/providers/credentials";
+import { cache } from "react";
 import { env } from "@/env";
 import { getCachedJwtVersion } from "@/lib/auth/jwt-version-cache";
 import {
@@ -25,7 +26,7 @@ import { db, User } from "@/lib/db";
 import { logger } from "@/lib/logger";
 import { clientIp, rateLimit } from "@/lib/rate-limit";

-export const { handlers, signOut, auth } = NextAuth({
+const nextAuth = NextAuth({
 	trustHost: true,
 	secret: env.AUTH_SECRET,
 	session: { strategy: "jwt", maxAge: 24 * 60 * 60 },
@@ -161,3 +162,15 @@ export const { handlers, signOut, auth } = NextAuth({
 		},
 	},
 });
+
+export const { handlers, signOut } = nextAuth;
+
+/**
+ * `auth()` re-parses the session cookie, decodes and HMAC-verifies the JWT and
+ * runs the `jwt`/`session` callbacks on every call. A single authenticated
+ * render calls it from the access guard, the site layout, both permission
+ * loaders and the page itself — 4-5 times on the critical path. React's
+ * `cache` scopes the memo to the current request, so those all share one
+ * verification. Outside a render (scripts, worker) it is a pass-through.
+ */
+export const auth = cache(nextAuth.auth);
@@ -0,0 +1,27 @@
+import { env } from "@/env";
+
+/** Hard floor/ceiling so a bad env value can never lock accounts out. */
+const ABSOLUTE_MIN_LENGTH = 5;
+const ABSOLUTE_MAX_LENGTH = 128;
+
+function toLength(value: unknown, fallback: number): number {
+	const parsed = typeof value === "number" ? value : Number(value);
+	return Number.isFinite(parsed) ? Math.trunc(parsed) : fallback;
+}
+
+/**
+ * Effective password-length policy. `PASSWORD_MIN_LENGTH` / `PASSWORD_MAX_LENGTH`
+ * drive the bounds; the values are clamped to a sane window so a typo in the env
+ * can neither accept empty passwords nor reject every possible one.
+ */
+export const passwordPolicy = (() => {
+	const minLength = Math.min(
+		ABSOLUTE_MAX_LENGTH,
+		Math.max(ABSOLUTE_MIN_LENGTH, toLength(env.PASSWORD_MIN_LENGTH, 12)),
+	);
+	const maxLength = Math.max(
+		minLength,
+		Math.min(ABSOLUTE_MAX_LENGTH, toLength(env.PASSWORD_MAX_LENGTH, 128)),
+	);
+	return { minLength, maxLength };
+})();
@@ -29,6 +29,7 @@ function simulate(
 	scenario: string,
 	previous = "epicnext-cms-app",
 	both = false,
+	extraEnv: Record<string, string> = {},
 ) {
 	const dir = mkdtempSync(join(tmpdir(), "cms-deploy-test-"));
 	try {
@@ -58,6 +59,9 @@ function simulate(
 				TEST_SHA: sha,
 				SCENARIO: scenario,
 				DEPLOY_BRANCH: "main",
+				// Standaard uit: de tests rimen geen cache-map aan op de host.
+				CMS_BUILD_CACHE_DIR: "",
+				...extraEnv,
 			},
 		});
 		if (result.error) throw result.error;
@@ -180,6 +184,24 @@ describe("deployment transaction", () => {
 		expect(result.calls).not.toContain("pnpm db:migrate");
 		expect(result.calls).not.toContain("docker run");
 	});
+	// `docker builder prune` (na elke release) gooit de buildcache weg. Zonder
+	// duurzame export downloadt de volgende build alle packages opnieuw.
+	it("bouwt met een duurzame buildcache buiten de werkboom", () => {
+		const cacheDirectory = mkdtempSync(join(tmpdir(), "cms-deploy-cache-"));
+		try {
+			const cache = join(cacheDirectory, "cache");
+			const result = simulate("success", "epicnext-cms-app", false, {
+				CMS_BUILD_CACHE_DIR: cache,
+			});
+			expect(result.status, result.output).toBe(0);
+			expect(result.calls).toContain(`--cache-from type=local,src=${cache}`);
+			expect(result.calls).toContain(
+				`--cache-to type=local,dest=${cache},mode=max`,
+			);
+		} finally {
+			rmSync(cacheDirectory, { recursive: true, force: true });
+		}
+	});
 });

 describe("legacy and CI container coexistence", () => {
@@ -248,6 +270,8 @@ function simulateBlueGreen(scenario: string, livePort = 3002) {
 				TEST_SHA: sha,
 				SCENARIO: scenario,
 				DEPLOY_BRANCH: "main",
+				// Standaard uit: de tests rimen geen cache-map aan op de host.
+				CMS_BUILD_CACHE_DIR: "",
 			},
 		});
 		if (result.error) throw result.error;
@@ -25,7 +25,7 @@ const bash =
 				.find(existsSync) ?? "bash")
 		: "bash";
 const sha = "d".repeat(40);
-function simulate(scenario: string) {
+function simulate(scenario: string, extraEnv: Record<string, string> = {}) {
 	const directory = mkdtempSync(join(tmpdir(), "cms-preflight-test-"));
 	try {
 		writeFileSync(
@@ -48,6 +48,9 @@ function simulate(scenario: string) {
 				SCENARIO: scenario,
 				CMS_DEPLOY_DIR: "/must-not-read-production",
 				DATABASE_URL: "must-not-use-production",
+				// Standaard uit: de tests rimen geen cache-map aan op de host.
+				CMS_BUILD_CACHE_DIR: "",
+				...extraEnv,
 			},
 		});
 		if (result.error) throw result.error;
@@ -103,6 +106,24 @@ describe("isolated branch preflight", () => {
 		expect(result.remaining).toEqual([]);
 	});

+	it("hergebruikt een duurzame buildcache buiten de tijdelijke werkmap", () => {
+		const cacheDirectory = mkdtempSync(join(tmpdir(), "cms-preflight-cache-"));
+		try {
+			const cache = join(cacheDirectory, "cache");
+			const result = simulate("success", { CMS_BUILD_CACHE_DIR: cache });
+			expect(result.status, result.output).toBe(0);
+			expect(result.calls).toContain(`--cache-from type=local,src=${cache}`);
+			expect(result.calls).toContain(
+				`--cache-to type=local,dest=${cache},mode=max`,
+			);
+			// De cache mag nooit in de tijdelijke werkmap van de preflight
+			// belanden: die wordt na de run geleegd.
+			expect(result.remaining).toEqual([]);
+		} finally {
+			rmSync(cacheDirectory, { recursive: true, force: true });
+		}
+	});
+
 	it("stops after a failed build and cleans only its own attempted image", () => {
 		const result = simulate("build-failure");
 		expect(result.status).not.toBe(0);
@@ -80,3 +80,23 @@ it("no longer publishes container images in CI", () => {
 	expect(workflow).not.toContain("publish-container");
 	expect(workflow).not.toContain("publish-container.sh");
 });
+
+it("keeps een duurzame buildcache buiten de CI-werkboom", () => {
+	const preflight = readFileSync("scripts/ci-preflight.sh", "utf8");
+	for (const script of [deploy, preflight]) {
+		// `docker builder prune` gooit de buildcache weg en de CI-werkboom wordt
+		// na elke job gewist. Zonder duurzame export downloadt de volgende build
+		// alle 493 packages opnieuw; gemeten: reused 0 / downloaded 493.
+		expect(script).toContain('--cache-from "type=local,src=$build_cache_dir"');
+		expect(script).toContain(
+			'--cache-to "type=local,dest=$build_cache_dir,mode=max"',
+		);
+		expect(script).toContain("CMS_BUILD_CACHE_DIR");
+		// Zonder schrijftoegang bouwen we gewoon zonder cache; dat mag de
+		// release niet blokkeren.
+		expect(script).toContain("build zonder hergebruikte cache");
+	}
+	// Eigen map voor de preflight: een branch mag de release-cache nooit voeden.
+	expect(deploy).toContain("/var/cache/epicnext-cms-buildcache");
+	expect(preflight).toContain("/var/cache/epicnext-cms-preflight-cache");
+});
@@ -1,5 +1,6 @@
 // @ts-nocheck
-import { readFileSync } from "node:fs";
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import { describe, expect, it } from "vitest";

 const dockerfile = readFileSync("Dockerfile", "utf8");
@@ -47,6 +48,17 @@ it("passes a compiled release to both the application build and final image", ()
 	expect(compose).toContain("NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}");
 });

+it("keeps the compose CMS opt-in and inside the 2 GB limit", () => {
+	const compose = readFileSync("docker-compose.yml", "utf8");
+	// A bare `docker compose up -d` starts only byparr. On a CI-managed host the
+	// CMS owns port 3002 through ci-deploy.sh; letting compose claim the same
+	// port again produces an endless EADDRINUSE crash loop.
+	expect(compose).toContain('profiles: ["cms"]');
+	expect(compose).not.toContain("cms-green");
+	expect(compose).toContain("mem_limit: 2g");
+	expect(compose).toContain("memswap_limit: 2g");
+});
+
 it("builds with fixtures and excludes installation secrets from every stage", () => {
 	const ignored = readFileSync(".dockerignore", "utf8");
 	expect(ignored).toMatch(/^\.env$/m);
@@ -76,3 +88,74 @@ it("does not prerender installation metadata into a shared image", () => {
 		);
 	}
 });
+
+it("resolves pnpm from the packageManager pin instead of a hardcoded version", () => {
+	// Een vastgepind pnpm-pakket in de Dockerfile loopt altijd uit sync met de
+	// packageManager-pin in package.json (12.10.1 vs 12.11.2).
+	expect(dockerfile).not.toMatch(/npm install -g pnpm@/);
+	expect(dockerfile).toContain("corepack enable pnpm");
+	expect(dockerfile).toContain("corepack install");
+
+	// De gedownloade pnpm moet in de image staan, anders kan de runtime
+	// (`docker run --entrypoint pnpm <migrations-image> db:migrate`) pnpm niet
+	// gebruiken. Een cache-mount verdwijnt na de build.
+	const corepackHome = dockerfile.match(/ENV COREPACK_HOME="([^"]+)"/)?.[1];
+	expect(corepackHome).toBeTruthy();
+	expect(dockerfile).not.toContain(`--mount=type=cache,target=${corepackHome}`);
+});
+
+it("caches the pnpm store on the path pnpm actually uses", () => {
+	const pnpmHome = dockerfile.match(/ENV PNPM_HOME="([^"]+)"/)?.[1];
+	expect(pnpmHome).toBeTruthy();
+	const cacheMounts = [
+		...dockerfile.matchAll(/--mount=type=cache,target=([^\s\\]+)/g),
+	].map((match) => match[1]);
+	const storeMounts = cacheMounts.filter((target) => target.includes("pnpm"));
+	expect(storeMounts.length).toBeGreaterThan(0);
+	// Met een ander pad (bv. /root/.local/share/pnpm/store) cache't de mount
+	// niets en downloadt elke build alle packages opnieuw.
+	for (const target of storeMounts) {
+		expect(target).toBe(`${pnpmHome}/store`);
+	}
+});
+
+it("keeps volatile and regenerated files out of the build context", () => {
+	const ignored = readFileSync(".dockerignore", "utf8");
+	// `backups/` (dagelijkse rotatie, ~232MB) maakte elke buildcontext groot
+	// en invalideerde bij elke rotatie de `COPY . .`-laag.
+	expect(ignored).toMatch(/^backups\/?$/m);
+	// public/vendor/tinymce wordt tijdens de build opnieuw gegenereerd door
+	// `pnpm assets:editor` en staat niet in git.
+	expect(ignored).toMatch(/^public\/vendor\/?$/m);
+});
+
+it("keeps de testsuites buiten de buildcontext", () => {
+	const ignored = readFileSync(".dockerignore", "utf8");
+	// `next build` typecheckt het hele project. Met e2e/ en integration/ in de
+	// context faalt de image-build op een typefout in testcode en sleurt hij
+	// @playwright/test, vitest, msw en testcontainers mee. De CI draait die
+	// suites op de host (pnpm test:ui / test:integration).
+	expect(ignored).toMatch(/^e2e\/?$/m);
+	expect(ignored).toMatch(/^integration\/?$/m);
+	// Geen applicatiecode mag naar die mappen importeren: dan zou de build in
+	// de image breken zodra ze uit de context verdwijnen.
+	const offenders: string[] = [];
+	for (const entry of readdirSync("src", { recursive: true })) {
+		if (!/\.tsx?$/.test(entry)) continue;
+		const source = readFileSync(join("src", entry), "utf8");
+		if (/from\s+["'][^"']*\/(?:e2e|integration)\//.test(source)) {
+			offenders.push(entry);
+		}
+	}
+	expect(offenders).toEqual([]);
+});
+
+it("keeps a local build cache that survives the daemon cache prune", () => {
+	const compose = readFileSync("docker-compose.yml", "utf8");
+	expect(compose).toContain("cache_from:");
+	expect(compose).toContain("cache_to:");
+	expect(compose).toContain("type=local");
+	// De cache-map mag niet in de buildcontext of in git terechtkomen.
+	expect(readFileSync(".dockerignore", "utf8")).toMatch(/^\.docker-cache\/?$/m);
+	expect(readFileSync(".gitignore", "utf8")).toMatch(/^\.docker-cache\/?$/m);
+});
@@ -85,7 +85,12 @@ describe("publicClientMessages", () => {
 			if (key === "admin") continue;
 			expect(result[key]).toBeDefined();
 		}
-		expect(result.pages.admin).toBeUndefined();
+		// `pages.admin` survives only in the shape the shared server-action hook
+		// needs: the generic `actions` copy, nothing staff-specific.
+		expect(Object.keys(result.pages.admin)).toEqual(["actions"]);
+		expect(result.pages.admin.actions.saved).toBe(en.pages.admin.actions.saved);
+		expect(result.pages.admin.nav).toBeUndefined();
+		expect(result.pages.admin.catalog).toBeUndefined();
 	});

 	it("actually shrinks the catalogue", async () => {
@@ -111,3 +116,59 @@ describe("publicClientMessages", () => {
 		expect(en.pages.admin).toBeDefined();
 	});
 });
+
+/**
+ * Scoping only works if the reduced catalogue goes to the client *and* every
+ * staff route group re-installs the full one. These two halves drift silently:
+ * narrowing the root without adding a staff provider renders raw keys in the
+ * admin panel, and the reverse just costs bytes. Both are asserted here.
+ */
+describe("client catalogue scoping is wired up", () => {
+	const STAFF_LAYOUTS = [
+		"src/app/admin/layout.tsx",
+		"src/app/admin-next/layout.tsx",
+		"src/app/mod/layout.tsx",
+	];
+
+	it("the root layout feeds the reduced catalogue to its provider", () => {
+		const src = readFileSync(join(process.cwd(), "src/app/layout.tsx"), "utf8");
+		expect(src).toContain("publicClientMessages(await getMessages())");
+	});
+
+	for (const layout of STAFF_LAYOUTS) {
+		it(`${layout} re-installs the full catalogue`, () => {
+			const src = readFileSync(join(process.cwd(), layout), "utf8");
+			expect(src).toContain("NextIntlClientProvider");
+			expect(src).toContain("getMessages()");
+		});
+	}
+});
+
+/**
+ * A client component that reads `admin.*` / `pages.admin.*` outside a staff
+ * route group would fall back to raw keys once the root catalogue is scoped,
+ * because the provider it inherits no longer carries them. Staff trees are the
+ * ones that install the full catalogue; the allowlist holds shared code that
+ * deliberately runs on public pages too.
+ */
+describe("staff namespace consumers sit in a staff tree", () => {
+	const STAFF_TREE =
+		/^src[\\/](app[\\/](admin|admin-next|mod)[\\/]|components[\\/]admin[\\/]|features[\\/](catalog|operations|history|housekeeping)[\\/])/;
+	const ALLOWLIST = new Set(["src/hooks/use-server-action.ts"]);
+	const CLIENT_STAFF_NS = /useTranslations\((["`])((admin)|(pages\.admin))/;
+
+	it("there is source to scan", () => {
+		expect(sourceFiles(join(process.cwd(), "src")).length).toBeGreaterThan(500);
+	});
+
+	it("no stray consumer of a staff namespace", () => {
+		const offenders: string[] = [];
+		for (const file of sourceFiles(join(process.cwd(), "src"))) {
+			const rel = file.slice(process.cwd().length + 1).replaceAll("\\", "/");
+			if (rel.includes(".test.")) continue;
+			if (STAFF_TREE.test(rel) || ALLOWLIST.has(rel)) continue;
+			if (CLIENT_STAFF_NS.test(readFileSync(file, "utf8"))) offenders.push(rel);
+		}
+		expect(offenders).toEqual([]);
+	});
+});
@@ -3,22 +3,35 @@ import type { AbstractIntlMessages } from "next-intl";
 /**
 * Client-side message scoping.
 *
- * `getMessages()` hands back the whole catalogue, and the root layout feeds all
- * of it to `NextIntlClientProvider`, which serialises every message into the RSC
- * payload of every page. The catalogue is ~235 KB of which `pages.admin` and
- * `admin` together are ~177 KB — and no public page ever reads either.
+ * `getMessages()` hands back the whole catalogue, and the root layout feeds it
+ * to `NextIntlClientProvider`, which serialises every message into the RSC
+ * payload of every page. The catalogue is ~254 KB of which `pages.admin` and
+ * `admin` together are ~195 KB — and no public page ever reads either.
 *
 * Nested `NextIntlClientProvider`s REPLACE the parent's messages rather than
 * merging them (see use-intl's IntlProvider: `messages ?? parent.messages`), so
- * a segment cannot ask for "just my part". Instead the public layout installs a
- * provider seeded with the public subset, which shrinks the payload for every
- * public page while leaving /admin, /mod, /client and /admin-next on the full set.
+ * a segment cannot ask for "just my part". The root layout therefore installs
+ * the reduced catalogue, and the staff route groups (`/admin`, `/admin-next`,
+ * `/mod`) each install a nested provider seeded with the full one, which keeps
+ * staff tools complete while public pages ship ~59 KB instead of ~254 KB.
 */

 /** Top-level namespaces plus `pages.*` sub-namespaces reserved for staff tools. */
 const ADMIN_ONLY_NAMESPACES = new Set(["admin"]);
 const ADMIN_ONLY_PAGE_NAMESPACES = new Set(["admin"]);

+/**
+ * `pages.admin` sub-namespaces that are NOT staff-only because a shared
+ * client component reads them on public pages too.
+ *
+ * `useServerAction` (src/hooks/use-server-action.ts) resolves its default
+ * success/error toast copy from `pages.admin.actions` and is used by
+ * `/events/[slugOrId]` and `/polls/[id]`, so that one sub-namespace has to
+ * survive the filter — the strings in it are generic ("Saved successfully."),
+ * not staff-tool copy.
+ */
+const PUBLIC_PAGE_NAMESPACES = new Set(["actions"]);
+
 /**
 * Drop the staff-tool namespaces from a full catalogue.
 *
@@ -43,8 +56,21 @@ export function publicClientMessages(
 		for (const [pageKey, pageValue] of Object.entries(
 			value as AbstractIntlMessages,
 		)) {
-			if (ADMIN_ONLY_PAGE_NAMESPACES.has(pageKey)) continue;
+			if (!ADMIN_ONLY_PAGE_NAMESPACES.has(pageKey)) {
 				pages[pageKey] = pageValue;
+				continue;
+			}
+			// Staff-only page namespace: keep only the sub-namespaces that a
+			// shared client component reads on public pages as well.
+			const shared: AbstractIntlMessages = {};
+			for (const [sharedKey, sharedValue] of Object.entries(
+				pageValue as AbstractIntlMessages,
+			)) {
+				if (PUBLIC_PAGE_NAMESPACES.has(sharedKey)) {
+					shared[sharedKey] = sharedValue;
+				}
+			}
+			if (Object.keys(shared).length > 0) pages[pageKey] = shared;
 		}
 		result.pages = pages;
 	}
@@ -4,6 +4,7 @@ import { collectPerformance } from "./performance-diagnostics";
 import { type PerformanceSample, recordPerformance } from "./performance-store";

 type PublicRoute =
+	| "/"
 	| "/me"
 	| "/news"
 	| "/news/[slug]"
Author	SHA1	Message	Date
remco	04493309be	chore(deps): update all non-major dependencies CI / check (push) Skipped CI / tests-unit (push) Skipped renovate/stability-days Updates have not met minimum release age requirement Details CI / tests-integration (push) Skipped CI / tests-ui (push) Skipped CI / preflight (push) Skipped CI / check (pull_request) Failing after 20s Details CI / tests-unit (pull_request) Skipped Details CI / tests-integration (pull_request) Skipped Details CI / tests-ui (pull_request) Skipped Details CI / tests-imaging-browsers (pull_request) Skipped Details CI / tests-quality (pull_request) Skipped Details CI / preflight (pull_request) Skipped Details CI / deploy (pull_request) Skipped Details	2026-10-22 02:01:13 +00:00
openhands	ecd8e5852c	perf(build): keep test suites out of the image and cache CI builds durably CI / check (push) Successful in 30s Details CI / tests-unit (push) Successful in 1m53s Details CI / tests-integration (push) Successful in 1m54s Details CI / tests-imaging-browsers (push) Successful in 2m26s Details CI / tests-quality (push) Successful in 2m19s Details CI / tests-ui (push) Successful in 4m31s Details CI / preflight (push) Skipped Details CI / deploy (push) Failing after 3m9s Details Three build-time improvements, all measured on this host. The build context no longer ships the test suites. `next build` type-checks the whole project, so `e2e/` and `integration/` in the context made the image build fail on a type error in test code and pulled @playwright/test, vitest, msw, testcontainers and drizzle-kit into the image. The CI runs those suites on the host. Type-check time in the build drops from 2.2s to 1.3s, and a contract test now fails if application code ever imports from those folders. The CI now exports the build cache to a directory outside the runner workspace: /var/cache/epicnext-cms-buildcache for the release and a separate map for branch preflights, so a branch can never feed the release cache. The workspace is wiped after every job and `docker builder prune` runs after every release, so the next build started with an empty cache and downloaded all 493 packages again (measured: reused 0, downloaded 493). With the durable export the frozen dependency layer is reused (measured: reused 493, downloaded 0) even after a full prune. A cache directory that is not writable only produces a warning; the release is never blocked. Investigated the remaining ~30s of Next.js build tracing: excluding the dev-only packages with `outputFileTracingExcludes` made it slower (35s vs 30s), because the traced output was already minimal (5 packages). The cost is Next's own page-config collection and file tracing over 329 routes, not the dependency set, so no configuration was kept.	2026-10-21 19:29:50 +02:00
openhands	8ca538f99f	perf(build): resolve pnpm from the pin and reuse the real pnpm store CI / check (push) Successful in 29s Details CI / tests-integration (push) Successful in 2m13s Details CI / tests-unit (push) Successful in 2m28s Details CI / tests-imaging-browsers (push) Successful in 2m29s Details CI / tests-quality (push) Successful in 55s Details CI / tests-ui (push) Successful in 5m10s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 3m47s Details The Docker build was slower than it needed to be and could drift away from the lockfile. Three separate causes, fixed together. The image installed a pinned [email protected].1 while package.json pins 12.11.2 through `packageManager`. pnpm silently self-managed the difference at build time: it downloaded the right version into an uncached location and never verified the sha512 hash. Install corepack instead and let it resolve version and hash from the pin, so the image can no longer diverge and a tampered tarball is rejected. The resolved pnpm lives in COREPACK_HOME inside the image, so the migrations image still runs pnpm offline (`docker run --entrypoint pnpm ... db:migrate`). The pnpm store cache-mount pointed at /root/.local/share/pnpm/store, but pnpm keeps its store in $PNPM_HOME/store/v11. The mount was a no-op: every build re-downloaded all 493 packages ("reused 0, downloaded 493"). Mounting the store where pnpm actually keeps it turns that into "reused 493, downloaded 0". The build context carried backups/ (232MB of rotating database dumps) and public/vendor/ (regenerated by `pnpm assets:editor` from node_modules). Both grew the context and invalidated the `COPY . .` layer on every daily backup rotation, forcing a full Next.js rebuild. Excluding them takes the context from 276MB to 23MB. Compose now also exports the build cache to .docker-cache/cms and imports it again, so the cache survives `scripts/docker-prune.sh`, which trims the daemon cache to 4GB after every deploy. Verified by pruning the entire daemon cache: the next build restored every layer from the local export and downloaded nothing. Also: byparr's floating `:latest` tag is now pulled on every start, the migrations build in scripts/docker-update.sh imports the same local cache, the README no longer claims the build needs host networking or an iptables-disabled daemon, the pnpm rationale in renovate.json reflects that Docker follows the pin automatically, and contract tests pin the new invariants so the store path cannot drift back.	2026-10-21 18:51:17 +02:00
openhands	1e81cac504	test(ui): isolate the fixture port so parallel runs stop colliding CI / check (push) Successful in 29s Details CI / tests-imaging-browsers (push) Successful in 1m37s Details CI / tests-unit (push) Successful in 2m4s Details CI / tests-integration (push) Successful in 2m12s Details CI / tests-quality (push) Successful in 55s Details CI / tests-ui (push) Successful in 4m31s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 3m39s Details The self-hosted CI runner packs several jobs onto the shared host network (capacity 4). The UI suite pinned the fixture server to 127.0.0.1:3107 and set reuseExistingServer: true, so overlapping runs fought over the bind: one job won it, and every browser in the other got "connection refused" on all four projects. Pass one random high port per run through the environment (shared by the main process and its worker) and only reuse an existing server outside CI. Verified with the full ui suite: 150 passed, 2 skipped.	2026-10-19 20:16:28 +02:00
openhands	3bc218ba16	chore(deps): dedupe the lockfile to the newest transitive versions CI / check (push) Successful in 33s Details CI / tests-integration (push) Successful in 1m58s Details CI / tests-unit (push) Successful in 2m6s Details CI / tests-quality (push) Successful in 52s Details CI / tests-imaging-browsers (push) Successful in 1m5s Details CI / tests-ui (push) Failing after 6m11s Details CI / preflight (push) Skipped Details CI / deploy (push) Skipped Details `pnpm dedupe --check` still flagged strtok3 10.5.0 (via file-type 22.2.0) against the 10.6.2 already in the graph. Collapse it so the lockfile resolves every transitive dependency to the highest version its parents allow; the check is now clean and the full unit suite still passes.	2026-10-19 19:55:41 +02:00
openhands	61f4db2a00	chore(deps): update dependencies to the latest releases CI / check (push) Successful in 28s Details CI / tests-imaging-browsers (push) Successful in 1m42s Details CI / tests-integration (push) Successful in 2m30s Details CI / tests-unit (push) Successful in 2m55s Details CI / tests-quality (push) Successful in 1m20s Details CI / tests-ui (push) Successful in 6m1s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 21s Details Bump every direct dependency to the newest published version, including the @hookform/resolvers 5 -> 6 major. The zodResolver API used by the admin room and user edit forms is unchanged, and typecheck plus the full unit suite pass on the new resolver. Highlights: next 16.4.2, react-query 5.104.4, react-virtual 3.14.21, motion 14.4.0, lucide-react 1.59.0, isomorphic-dompurify 4.6.0, resend 6.34.1, music-metadata 12.2.3, vitest / coverage-v8 5.0.5, postcss 8.5.31 and @axe-core/playwright 4.14.0. README core-stack versions are re-synced.	2026-10-19 19:52:08 +02:00
openhands	597287fce5	fix(compose): keep the CMS opt-in so it cannot claim the CI port CI / check (push) Successful in 36s Details CI / tests-imaging-browsers (push) Successful in 1m49s Details CI / tests-integration (push) Successful in 1m59s Details CI / tests-unit (push) Successful in 2m4s Details CI / tests-quality (push) Successful in 42s Details CI / tests-ui (push) Successful in 4m39s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 3m20s Details On a CI-managed host scripts/ci-deploy.sh owns port 3002 through the blue/green slots, so a compose replica of the cms service could only ever crash-loop on EADDRINUSE — it never serves traffic, because nginx points at a slot container. Gate the service behind the `cms` profile so a bare `docker compose up -d` starts only byparr. Naming the service explicitly (`docker compose up -d cms`, which is what the installer and updater already do) still enables the profile automatically, so the compose-only install path keeps working. Keep the one port that is actually served (3002) and make the 2 GB ceiling hard by capping swap at 2g as well. Drop the green compose service (3003): the green slot only ever exists as a docker run container created by CI, so compose no longer defines it and the two paths cannot drift apart. The loopback override contract stays covered: proxy-config.test.mjs now renders the configuration with --profile cms, and a new build-contract test pins the profile and the memory limits so neither can be dropped by accident.	2026-10-19 19:00:07 +02:00
openhands	5c428c4526	feat(home): label the top-bar online counter with the hotel name CI / check (push) Successful in 33s Details CI / tests-integration (push) Successful in 1m58s Details CI / tests-unit (push) Successful in 2m1s Details CI / tests-imaging-browsers (push) Successful in 1m24s Details CI / tests-quality (push) Successful in 50s Details CI / tests-ui (push) Successful in 4m34s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 3m12s Details Use the shared LiveOnlineCount so the landing top bar reads "0 <hotel> online" instead of a bare number, and drop the hotel name from the left (the logo stays) so it is not shown twice.	2026-10-18 20:16:23 +02:00
openhands	e7a6b2b602	style(home): tidy hero spacing and top-bar online badge CI / check (push) Successful in 28s Details CI / tests-imaging-browsers (push) Successful in 1m32s Details CI / tests-integration (push) Successful in 1m49s Details CI / tests-unit (push) Successful in 1m55s Details CI / tests-quality (push) Successful in 50s Details CI / tests-ui (push) Successful in 5m1s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 2m24s Details Drop the orphaned h1 margin left over from the removed hero online chip, and the stray title attribute on the top-bar online indicator.	2026-10-18 20:09:54 +02:00
openhands	4b25292ecc	feat(site): hide global chrome on landing pages CI / check (push) Successful in 28s Details CI / tests-imaging-browsers (push) Successful in 2m7s Details CI / tests-unit (push) Successful in 2m23s Details CI / tests-integration (push) Successful in 2m22s Details CI / tests-quality (push) Successful in 52s Details CI / tests-ui (push) Successful in 5m14s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 3m43s Details The index, login and register render their own AuthTopBar, so the shared TopHeader / SiteHeader banner / Navigation duplicated the same chrome. Hide the global chrome on those three standalone landing pages only.	2026-10-18 19:58:53 +02:00
openhands	b40293bd06	feat(home): clean shared top bar with live online counter CI / check (push) Successful in 28s Details CI / tests-imaging-browsers (push) Successful in 1m34s Details CI / tests-integration (push) Successful in 1m57s Details CI / tests-unit (push) Successful in 2m1s Details CI / tests-quality (push) Successful in 50s Details CI / tests-ui (push) Successful in 4m39s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 3m29s Details The homepage duplicated the online count and recent-user avatars (hero plus community sidebar), and the public pages each kept their own chrome. Put one AuthTopBar at the top of index, login and register — logo + hotel name plus a live online indicator and the language/clock/theme controls — and drop the duplicated hero rows.	2026-10-18 19:38:32 +02:00
openhands	9cf1eb615c	feat(auth): make password length configurable via env (min 5–30, max 30–128) CI / check (push) Successful in 29s Details CI / tests-imaging-browsers (push) Successful in 1m46s Details CI / tests-integration (push) Successful in 1m47s Details CI / tests-unit (push) Successful in 1m49s Details CI / tests-quality (push) Successful in 44s Details CI / tests-ui (push) Successful in 4m38s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 3m38s Details Add PASSWORD_MIN_LENGTH / PASSWORD_MAX_LENGTH (validated in src/env.ts) and a shared passwordPolicy helper. The policy drives the zod schemas in register, password reset and the admin create-user dialog, plus the live requirement checks and strength meter in the register form. Locale messages now interpolate the configured minimum via {min} instead of hard-coding 12.	2026-10-18 19:20:38 +02:00
openhands	aef0939ee9	refactor(auth): share the auth landing and extract AuthField CI / check (push) Successful in 36s Details CI / tests-imaging-browsers (push) Successful in 1m36s Details CI / tests-integration (push) Successful in 1m52s Details CI / tests-unit (push) Successful in 1m57s Details CI / tests-quality (push) Successful in 52s Details CI / tests-ui (push) Successful in 4m46s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 3m40s Details The login and register pages were near-identical after the previous cleanup, and both forms repeated the same labelled, icon-prefixed input seven times. Move the data loading and page shell into auth-landing.tsx (loadAuthLanding + AuthLandingView) and the input markup into a single AuthField, so the pages become thin compositions and every field shares one focus, icon and aria implementation. The numbered section headers collapse into AuthSectionHeader. No behaviour change.	2026-10-18 19:01:40 +02:00
openhands	c6e5e0b1a9	feat(auth): unify and polish login, register and homepage auth UI CI / check (push) Successful in 35s Details CI / tests-imaging-browsers (push) Successful in 1m34s Details CI / tests-integration (push) Successful in 2m1s Details CI / tests-unit (push) Successful in 2m11s Details CI / tests-quality (push) Successful in 52s Details CI / tests-ui (push) Successful in 5m7s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 4m11s Details Login and register each carried their own copy of the promo panel and the error banner, so the two pages drifted apart and every caller had to wire role="alert" by hand. Extract a shared AuthPromoCard and AuthAlert, use them in both forms and for the login notices, and link errors to their fields via aria-invalid / aria-describedby. Focus now lands on the 2FA code field the moment it appears, the credential fields lock while a request is in flight, and invalid inputs get a danger tint. The homepage top bar was a byte-for-byte duplicate of AuthTopBar; it now renders the shared component, and the compact homepage login uses the tighter spacing its comment already promised.	2026-10-18 18:49:18 +02:00
openhands	2249303dbd	chore(lint): remove dead eslint-disable directives CI / check (push) Successful in 30s Details CI / tests-imaging-browsers (push) Successful in 1m31s Details CI / tests-unit (push) Successful in 1m45s Details CI / tests-integration (push) Successful in 1m49s Details CI / tests-quality (push) Successful in 47s Details CI / tests-ui (push) Successful in 4m24s Details CI / preflight (push) Skipped Details CI / deploy (push) Successful in 3m39s Details The project lints with Biome only, so none of these 78 directives across 57 files ever suppressed anything. Directives that carried the rationale for a flagged dynamic index access keep that rationale as a plain comment.	2026-10-18 14:50:51 +02:00
openhands	07c5904879	test: make coverage opt-in and ratchet thresholds to the measured floor Coverage was enabled by default, which forced v8 instrumentation on every run and made a focused `vitest run <file>` fail the global thresholds that a single file can never satisfy. `pnpm test:coverage` now opts in explicitly while `pnpm test` stays fast. Thresholds ratcheted from 36/29/30/37 to the measured full-suite floor of 37/30/31/38, so a drop in coverage fails again. Also drops a stale comment about a parent Laravel repo and a dead .next.prev exclude from the config.	2026-10-18 14:50:50 +02:00
openhands	4776a41c01	fix(env): align suggested DB pool size with MariaDB max_connections The example .env suggested DATABASE_POOL_SIZE=150 and connection_limit=150. MariaDB defaults max_connections to 151, so a single CMS instance could claim the server's entire connection budget, starving the emulator and any second instance. The README already documents a pool size of 25; the example now matches and notes that DATABASE_POOL_SIZE is the value that actually applies.	2026-10-18 14:50:33 +02:00
openhands	a32cf6119b	perf(build): measure the homepage and fix optimizePackageImports / is the highest-traffic route but was missing from both the public-route instrumentation and the JS size budgets, so a payload regression there could never fail the build. It is now wrapped in withPublicPagePerformance and budgeted alongside the other public routes. optimizePackageImports listed date-fns, which is not a dependency (a no-op), while omitting the barrel-heavy packages that are actually imported: motion, @dnd-kit/core, @dnd-kit/sortable and @tanstack/react-virtual.	2026-10-18 14:50:32 +02:00
openhands	bb3799f705	perf(i18n): stop serializing the full catalogue on public pages The root layout fed the entire ~254 KB message catalogue to NextIntlClientProvider, which serializes it into the RSC payload of every page. A public page only reads ~59 KB of it; the ~195 KB difference is staff tool copy that only /admin, /admin-next and /mod ever render. The root provider now installs the reduced catalogue and each staff route group re-installs the full one, since a nested NextIntlClientProvider replaces the parent message set rather than merging into it. pages.admin.actions stays public because the shared useServerAction hook runs on public pages too. Measured: 253 KB -> 59 KB of messages per public page (raw JSON). Guard tests cover all three halves: the root keeps using the reduced catalogue, every staff layout installs its own full provider, and no public tree reads a staff-only namespace.	2026-10-18 14:50:26 +02:00
openhands	d28dde459a	perf(auth): memoize auth() per request with React cache A single authenticated render called auth() 4-5 times (access guard, site layout, both permission loaders, the page itself), and every call re-parsed the session cookie, decoded and HMAC-verified the JWT and ran the jwt/session callbacks. Wrapping NextAuth's handler in React's cache scopes that work to one verification per request. Outside a render (scripts, jobs worker) React's cache is a pass-through, so those call sites behave exactly as before.	2026-10-18 14:49:34 +02:00