From 2de2aa65fe18d30fbde380a2baeedbce0ff83a7c Mon Sep 17 00:00:00 2001
From: Enes1998 <104234112+Enes1998@users.noreply.github.com>
Date: Tue, 26 May 2026 19:56:01 +0200
Subject: [PATCH 01/12] fix(fe): close FE-2/FE-5 gaps + delete remaining app/*
 duplicates

- Delete 18 more stale files left by main->develop merge:
  app/admin/** (full tree), app/help/, app/profile/[id]/,
  and 6 orphan error.tsx/loading.tsx whose page.tsx was already
  removed. Canonical versions remain in app/(protected)/.

- FE-2 (useReducer): refactor ProficienciesStep's three related
  useState calls (selectedSkills, isExiting, isGoingBack) into
  a single useReducer with a discriminated-union action type.

- FE-5 (Server Actions): add submitQuickFeedback Server Action
  in app/(protected)/help/actions.ts, wired into the Help page
  via useActionState. Demonstrates the "use server" boundary
  and revalidatePath; logs feedback server-side.

Lint: 0 errors. Type-check: 0 errors. Dev server boots clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .../client/app/(protected)/help/actions.ts    |  36 ++
 frontend/client/app/(protected)/help/page.tsx |  44 ++-
 .../client/app/admin/analytics/loading.tsx    |  29 --
 frontend/client/app/admin/analytics/page.tsx  | 236 -------------
 frontend/client/app/admin/audit/page.tsx      | 206 ------------
 frontend/client/app/admin/error.tsx           |  32 --
 frontend/client/app/admin/flags/page.tsx      | 212 ------------
 frontend/client/app/admin/jobs/page.tsx       | 140 --------
 frontend/client/app/admin/layout.tsx          |  60 ----
 frontend/client/app/admin/page.tsx            | 281 ----------------
 frontend/client/app/admin/projects/page.tsx   | 192 -----------
 frontend/client/app/admin/support/page.tsx    | 310 ------------------
 frontend/client/app/discover/error.tsx        |  32 --
 frontend/client/app/discover/loading.tsx      |  32 --
 frontend/client/app/help/page.tsx             | 181 ----------
 frontend/client/app/messages/error.tsx        |  32 --
 frontend/client/app/messages/loading.tsx      |  28 --
 frontend/client/app/profile/[id]/page.tsx     |  94 ------
 frontend/client/app/projects/error.tsx        |  32 --
 frontend/client/app/projects/loading.tsx      |  24 --
 .../onboarding/ProficienciesStep.tsx          |  45 ++-
 21 files changed, 116 insertions(+), 2162 deletions(-)
 create mode 100644 frontend/client/app/(protected)/help/actions.ts
 delete mode 100644 frontend/client/app/admin/analytics/loading.tsx
 delete mode 100644 frontend/client/app/admin/analytics/page.tsx
 delete mode 100644 frontend/client/app/admin/audit/page.tsx
 delete mode 100644 frontend/client/app/admin/error.tsx
 delete mode 100644 frontend/client/app/admin/flags/page.tsx
 delete mode 100644 frontend/client/app/admin/jobs/page.tsx
 delete mode 100644 frontend/client/app/admin/layout.tsx
 delete mode 100644 frontend/client/app/admin/page.tsx
 delete mode 100644 frontend/client/app/admin/projects/page.tsx
 delete mode 100644 frontend/client/app/admin/support/page.tsx
 delete mode 100644 frontend/client/app/discover/error.tsx
 delete mode 100644 frontend/client/app/discover/loading.tsx
 delete mode 100644 frontend/client/app/help/page.tsx
 delete mode 100644 frontend/client/app/messages/error.tsx
 delete mode 100644 frontend/client/app/messages/loading.tsx
 delete mode 100644 frontend/client/app/profile/[id]/page.tsx
 delete mode 100644 frontend/client/app/projects/error.tsx
 delete mode 100644 frontend/client/app/projects/loading.tsx

diff --git a/frontend/client/app/(protected)/help/actions.ts b/frontend/client/app/(protected)/help/actions.ts
new file mode 100644
index 0000000..8976567
--- /dev/null
+++ b/frontend/client/app/(protected)/help/actions.ts
@@ -0,0 +1,36 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+
+export type QuickFeedbackResult =
+  | { ok: true }
+  | { ok: false; error: string };
+
+const MIN_LEN = 5;
+const MAX_LEN = 1000;
+
+export async function submitQuickFeedback(
+  _prev: QuickFeedbackResult | null,
+  formData: FormData,
+): Promise<QuickFeedbackResult> {
+  const message = formData.get("message")?.toString().trim() ?? "";
+
+  if (message.length < MIN_LEN) {
+    return { ok: false, error: `Message must be at least ${MIN_LEN} characters.` };
+  }
+  if (message.length > MAX_LEN) {
+    return { ok: false, error: `Message must be under ${MAX_LEN} characters.` };
+  }
+
+  console.info(
+    JSON.stringify({
+      event: "quick_feedback",
+      at: new Date().toISOString(),
+      length: message.length,
+      preview: message.slice(0, 120),
+    }),
+  );
+
+  revalidatePath("/help");
+  return { ok: true };
+}
diff --git a/frontend/client/app/(protected)/help/page.tsx b/frontend/client/app/(protected)/help/page.tsx
index 1e68486..b6468b6 100644
--- a/frontend/client/app/(protected)/help/page.tsx
+++ b/frontend/client/app/(protected)/help/page.tsx
@@ -1,10 +1,11 @@
 "use client";
 
-import { useState } from "react";
+import { useActionState, useState } from "react";
 import { motion } from "framer-motion";
 import { NavigationHeader } from "@/components/ui/NavigationHeader";
 import { useCreateSupportTicket, useMySupportTickets } from "@/hooks/useAdmin";
 import type { SupportTicketPriority, SupportTicketStatus } from "@/types/admin";
+import { submitQuickFeedback } from "./actions";
 
 const PRIORITY_OPTIONS: SupportTicketPriority[] = ["Low", "Normal", "High", "Urgent"];
 
@@ -32,6 +33,10 @@ export default function HelpPage() {
   const [submitted, setSubmitted] = useState(false);
   const { data: mine, isLoading } = useMySupportTickets();
   const create = useCreateSupportTicket();
+  const [feedbackState, feedbackAction, feedbackPending] = useActionState(
+    submitQuickFeedback,
+    null,
+  );
 
   const canSubmit = subject.trim().length > 0 && body.trim().length > 0 && !create.isPending;
 
@@ -139,6 +144,43 @@ export default function HelpPage() {
           </form>
         </section>
 
+        <section className="rounded-2xl border border-[var(--line)] bg-[var(--surface)] p-6">
+          <h2 className="text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
+            Quick anonymous feedback
+          </h2>
+          <p className="mt-1 text-xs text-[var(--mute)]">
+            Server Action — runs on the Next.js server, no client API call.
+          </p>
+          <form action={feedbackAction} className="mt-4 space-y-3">
+            <textarea
+              name="message"
+              required
+              rows={3}
+              minLength={5}
+              maxLength={1000}
+              placeholder="What could be better?"
+              className="w-full rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
+            />
+            {feedbackState && !feedbackState.ok && (
+              <p role="alert" className="text-sm text-[var(--danger)]">
+                {feedbackState.error}
+              </p>
+            )}
+            {feedbackState?.ok && (
+              <p className="text-sm text-[var(--success)]">Thanks — recorded.</p>
+            )}
+            <div className="flex justify-end">
+              <button
+                type="submit"
+                disabled={feedbackPending}
+                className="rounded-full bg-[var(--indigo)] px-4 py-2 text-xs font-semibold text-white hover:opacity-90 disabled:opacity-50"
+              >
+                {feedbackPending ? "Sending…" : "Send feedback"}
+              </button>
+            </div>
+          </form>
+        </section>
+
         <section>
           <h2 className="text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
             My tickets
diff --git a/frontend/client/app/admin/analytics/loading.tsx b/frontend/client/app/admin/analytics/loading.tsx
deleted file mode 100644
index 1419b8c..0000000
--- a/frontend/client/app/admin/analytics/loading.tsx
+++ /dev/null
@@ -1,29 +0,0 @@
-export default function AnalyticsLoading() {
-  return (
-    <div className="flex flex-col gap-8 p-6" aria-busy="true" aria-label="Loading analytics">
-      <div className="flex flex-col gap-3 sm:flex-row sm:items-end sm:justify-between">
-        <div className="space-y-2">
-          <div className="h-7 w-56 animate-pulse rounded bg-[var(--surface-2)]" />
-          <div className="h-4 w-72 animate-pulse rounded bg-[var(--surface-2)]" />
-        </div>
-        <div className="h-9 w-40 animate-pulse rounded-lg bg-[var(--surface-2)]" />
-      </div>
-      <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-4">
-        {Array.from({ length: 4 }).map((_, i) => (
-          <div
-            key={i}
-            className="h-28 animate-pulse rounded-2xl border border-[var(--line)] bg-[var(--surface-2)]/40"
-          />
-        ))}
-      </div>
-      <div className="grid grid-cols-1 gap-4 lg:grid-cols-2">
-        {Array.from({ length: 4 }).map((_, i) => (
-          <div
-            key={i}
-            className="h-56 animate-pulse rounded-2xl border border-[var(--line)] bg-[var(--surface-2)]/40"
-          />
-        ))}
-      </div>
-    </div>
-  );
-}
diff --git a/frontend/client/app/admin/analytics/page.tsx b/frontend/client/app/admin/analytics/page.tsx
deleted file mode 100644
index ee5566c..0000000
--- a/frontend/client/app/admin/analytics/page.tsx
+++ /dev/null
@@ -1,236 +0,0 @@
-"use client";
-
-import { useEffect, useState } from "react";
-import { useRouter } from "next/navigation";
-import dynamic from "next/dynamic";
-import { motion } from "framer-motion";
-import {
-  Users,
-  FolderKanban,
-  MessageSquareText,
-  ClipboardCheck,
-} from "lucide-react";
-import { MetricCard } from "@/components/admin/MetricCard";
-import { usePlatformAnalytics } from "@/hooks/usePlatformAnalytics";
-
-const TrendChart = dynamic(
-  () =>
-    import("@/components/admin/TrendChart").then((m) => ({
-      default: m.TrendChart,
-    })),
-  {
-    ssr: false,
-    loading: () => (
-      <div
-        className="h-56 animate-pulse rounded-2xl border border-[var(--line)] bg-[var(--surface-2)]/40"
-        aria-busy="true"
-      />
-    ),
-  },
-);
-import { hasRole } from "@/lib/auth/token";
-import type { MetricSummary } from "@/types/analytics";
-
-const RANGE_OPTIONS = [30, 60, 90] as const;
-type RangeOption = (typeof RANGE_OPTIONS)[number];
-
-const RBAC_ENABLED = process.env.NEXT_PUBLIC_ENABLE_RBAC === "true";
-
-function trendProps(metric: MetricSummary) {
-  return {
-    direction: metric.direction,
-    percentage: metric.percentChange,
-  };
-}
-
-export default function AdminAnalyticsPage() {
-  const router = useRouter();
-  const [days, setDays] = useState<RangeOption>(30);
-
-  useEffect(() => {
-    if (RBAC_ENABLED && !hasRole("admin")) {
-      router.replace("/");
-    }
-  }, [router]);
-
-  const { data, isLoading, isError, error, refetch } = usePlatformAnalytics(days);
-
-  return (
-    <div className="flex flex-col gap-8">
-      <motion.div
-        initial={{ opacity: 0, y: -12 }}
-        animate={{ opacity: 1, y: 0 }}
-        transition={{ duration: 0.3, ease: "easeOut" }}
-        className="flex flex-col gap-3 sm:flex-row sm:items-end sm:justify-between"
-      >
-        <div>
-          <h1 className="font-display text-2xl font-bold tracking-[-0.03em] text-[var(--ink)] sm:text-3xl">
-            Platform analytics
-          </h1>
-          <p className="mt-1 text-sm text-[var(--mute)]">
-            Rolling {days}-day view of growth, engagement, and standup activity.
-          </p>
-        </div>
-
-        <div
-          role="tablist"
-          aria-label="Date range"
-          className="inline-flex shrink-0 rounded-full border border-[var(--line)] bg-[var(--surface)] p-1 text-xs font-semibold"
-        >
-          {RANGE_OPTIONS.map((opt) => {
-            const isActive = opt === days;
-            return (
-              <button
-                key={opt}
-                role="tab"
-                type="button"
-                aria-selected={isActive}
-                onClick={() => setDays(opt)}
-                className={`rounded-full px-3 py-1.5 transition-[background,color] duration-[220ms] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] ${
-                  isActive
-                    ? "bg-[var(--indigo)] text-white"
-                    : "text-[var(--mute)] hover:text-[var(--ink)]"
-                }`}
-              >
-                {opt}d
-              </button>
-            );
-          })}
-        </div>
-      </motion.div>
-
-      {isLoading ? (
-        <AnalyticsSkeleton />
-      ) : isError ? (
-        <div
-          role="alert"
-          className="flex flex-col items-start gap-2 rounded-2xl border border-[var(--danger)]/20 bg-[var(--danger)]/5 p-6 text-sm text-[var(--danger)]"
-        >
-          <p className="font-semibold">Failed to load analytics.</p>
-          <p className="opacity-80">
-            {(error as { message?: string } | undefined)?.message ?? "Unknown error"}
-          </p>
-          <button
-            type="button"
-            onClick={() => refetch()}
-            className="mt-2 rounded-full bg-[var(--danger)] px-3 py-1.5 text-xs font-semibold text-white hover:opacity-90"
-          >
-            Retry
-          </button>
-        </div>
-      ) : data ? (
-        <>
-          <section>
-            <h2 className="sr-only">Headline metrics</h2>
-            <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-4">
-              <MetricCard
-                label="Total users"
-                value={data.totals.totalUsers.current.toLocaleString()}
-                icon={Users}
-                trend={trendProps(data.totals.totalUsers)}
-                index={0}
-              />
-              <MetricCard
-                label="Active projects"
-                value={data.totals.activeProjects.current.toLocaleString()}
-                icon={FolderKanban}
-                trend={trendProps(data.totals.activeProjects)}
-                index={1}
-              />
-              <MetricCard
-                label={`Messages sent (${days}d)`}
-                value={data.totals.messagesSent.current.toLocaleString()}
-                icon={MessageSquareText}
-                trend={trendProps(data.totals.messagesSent)}
-                index={2}
-              />
-              <MetricCard
-                label={`Standups completed (${days}d)`}
-                value={data.totals.standupsCompleted.current.toLocaleString()}
-                icon={ClipboardCheck}
-                trend={trendProps(data.totals.standupsCompleted)}
-                index={3}
-              />
-            </div>
-          </section>
-
-          <section>
-            <h2 className="mb-4 text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
-              Daily trends ({days}-day window)
-            </h2>
-            <div className="grid grid-cols-1 gap-4 lg:grid-cols-2">
-              <TrendChart
-                label="Signups"
-                points={data.signups}
-                color="#4f46e5"
-                index={0}
-              />
-              <TrendChart
-                label="Active projects created"
-                points={data.activeProjects}
-                color="#0ea5e9"
-                index={1}
-              />
-              <TrendChart
-                label="Messages sent"
-                points={data.messagesSent}
-                color="#14b8a6"
-                index={2}
-              />
-              <TrendChart
-                label="Standups completed"
-                points={data.standupsCompleted}
-                color="#f59e0b"
-                index={3}
-              />
-            </div>
-          </section>
-
-          {data.projectsAtRisk.length > 0 && (
-            <section>
-              <h2 className="mb-4 text-sm font-semibold uppercase tracking-wide text-[var(--danger)]">
-                Projects at risk
-              </h2>
-              <div className="space-y-2">
-                {data.projectsAtRisk.map((p) => (
-                  <div
-                    key={p.projectId}
-                    className="flex items-center justify-between rounded-xl border border-[var(--danger)]/20 bg-[var(--danger)]/5 px-4 py-3 text-sm"
-                  >
-                    <span className="font-medium text-[var(--ink)]">{p.projectTitle}</span>
-                    <span className="rounded-full bg-[var(--danger)]/10 px-2.5 py-1 text-xs font-semibold text-[var(--danger)]">
-                      {p.consecutiveNegativeDays} negative days
-                    </span>
-                  </div>
-                ))}
-              </div>
-            </section>
-          )}
-        </>
-      ) : null}
-    </div>
-  );
-}
-
-function AnalyticsSkeleton() {
-  return (
-    <div className="flex flex-col gap-8" aria-busy="true">
-      <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-4">
-        {Array.from({ length: 4 }).map((_, i) => (
-          <div
-            key={i}
-            className="h-28 animate-pulse rounded-2xl border border-[var(--line)] bg-[var(--surface-2)]/40"
-          />
-        ))}
-      </div>
-      <div className="grid grid-cols-1 gap-4 lg:grid-cols-2">
-        {Array.from({ length: 4 }).map((_, i) => (
-          <div
-            key={i}
-            className="h-56 animate-pulse rounded-2xl border border-[var(--line)] bg-[var(--surface-2)]/40"
-          />
-        ))}
-      </div>
-    </div>
-  );
-}
diff --git a/frontend/client/app/admin/audit/page.tsx b/frontend/client/app/admin/audit/page.tsx
deleted file mode 100644
index c397b81..0000000
--- a/frontend/client/app/admin/audit/page.tsx
+++ /dev/null
@@ -1,206 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { motion } from "framer-motion";
-import { useAuditLogs } from "@/hooks/useAdmin";
-import type { AuditTrailDto } from "@/types/admin";
-
-const ENTITY_OPTIONS = ["", "User", "Project", "Message", "Notification", "SupportTicket"];
-
-function fmt(iso: string): string {
-  return new Date(iso).toLocaleString("en-US", {
-    year: "numeric",
-    month: "short",
-    day: "numeric",
-    hour: "2-digit",
-    minute: "2-digit",
-    second: "2-digit",
-  });
-}
-
-function safeParse(raw: string | null): string | null {
-  if (!raw) return null;
-  try {
-    return JSON.stringify(JSON.parse(raw), null, 2);
-  } catch {
-    return raw;
-  }
-}
-
-export default function AdminAuditPage() {
-  const [page, setPage] = useState(1);
-  const [actorUserId, setActorUserId] = useState("");
-  const [entityType, setEntityType] = useState("");
-  const [expanded, setExpanded] = useState<string | null>(null);
-
-  const { data, isLoading, isError, error } = useAuditLogs({
-    page,
-    pageSize: 25,
-    actorUserId: actorUserId || undefined,
-    entityType: entityType || undefined,
-  });
-
-  const totalPages = data ? Math.max(1, Math.ceil(data.totalCount / data.pageSize)) : 1;
-
-  return (
-    <div className="flex flex-col gap-6">
-      <motion.div
-        initial={{ opacity: 0, y: -12 }}
-        animate={{ opacity: 1, y: 0 }}
-        transition={{ duration: 0.3, ease: "easeOut" }}
-      >
-        <h1 className="font-display text-2xl font-bold tracking-[-0.03em] text-[var(--ink)] sm:text-3xl">
-          Audit log
-        </h1>
-        <p className="mt-1 text-sm text-[var(--mute)]">
-          Every admin mutation is recorded with old/new values for review.
-        </p>
-      </motion.div>
-
-      <div className="flex flex-wrap items-end gap-3">
-        <div className="flex flex-col">
-          <label className="text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">
-            Actor User Id
-          </label>
-          <input
-            type="text"
-            value={actorUserId}
-            onChange={(e) => {
-              setActorUserId(e.target.value);
-              setPage(1);
-            }}
-            placeholder="GUID (optional)"
-            className="mt-1 w-72 rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-xs text-[var(--ink)]"
-          />
-        </div>
-        <div className="flex flex-col">
-          <label className="text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">
-            Entity type
-          </label>
-          <select
-            value={entityType}
-            onChange={(e) => {
-              setEntityType(e.target.value);
-              setPage(1);
-            }}
-            className="mt-1 w-48 rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-xs text-[var(--ink)]"
-          >
-            {ENTITY_OPTIONS.map((v) => (
-              <option key={v} value={v}>{v || "Any"}</option>
-            ))}
-          </select>
-        </div>
-      </div>
-
-      <div className="overflow-x-auto rounded-2xl border border-[var(--line)] bg-[var(--surface)]">
-        {isLoading && (
-          <div className="space-y-2 p-4">
-            {Array.from({ length: 8 }).map((_, i) => (
-              <div key={i} className="h-10 animate-pulse rounded-lg bg-[var(--surface-2)]" />
-            ))}
-          </div>
-        )}
-        {isError && (
-          <p role="alert" className="p-6 text-sm text-[var(--danger)]">
-            {(error as { message?: string } | undefined)?.message ?? "Failed to load audit log."}
-          </p>
-        )}
-        {!isLoading && data && data.items.length === 0 && (
-          <p className="p-8 text-center text-sm text-[var(--mute)]">No entries.</p>
-        )}
-        {!isLoading && data && data.items.length > 0 && (
-          <table className="min-w-full divide-y divide-[var(--line)] text-left">
-            <thead className="bg-[var(--surface-2)]/40 text-xs uppercase tracking-wide text-[var(--mute)]">
-              <tr>
-                <th scope="col" className="px-4 py-3 font-semibold">When</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Actor</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Action</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Entity</th>
-                <th scope="col" className="px-4 py-3 text-right font-semibold"></th>
-              </tr>
-            </thead>
-            <tbody>
-              {data.items.map((entry: AuditTrailDto) => {
-                const isOpen = expanded === entry.id;
-                return (
-                  <>
-                    <tr key={entry.id} className="border-b border-[var(--line)] last:border-b-0">
-                      <td className="px-4 py-2 text-xs text-[var(--mute)] whitespace-nowrap">
-                        {fmt(entry.occurredAt)}
-                      </td>
-                      <td className="px-4 py-2 text-xs text-[var(--ink)]">
-                        {entry.actorName ?? entry.actorUserId.slice(0, 8)}
-                      </td>
-                      <td className="px-4 py-2 text-xs font-mono text-[var(--indigo)]">
-                        {entry.action}
-                      </td>
-                      <td className="px-4 py-2 text-xs text-[var(--mute)]">
-                        <span className="font-semibold text-[var(--ink)]">{entry.entityType}</span>
-                        <span className="block truncate">{entry.entityId}</span>
-                      </td>
-                      <td className="px-4 py-2 text-right">
-                        <button
-                          type="button"
-                          onClick={() => setExpanded(isOpen ? null : entry.id)}
-                          className="rounded-full border border-[var(--line)] bg-[var(--surface)] px-2.5 py-1 text-xs font-medium text-[var(--mute)] hover:text-[var(--ink)]"
-                        >
-                          {isOpen ? "Hide" : "Diff"}
-                        </button>
-                      </td>
-                    </tr>
-                    {isOpen && (
-                      <tr key={`${entry.id}-diff`} className="border-b border-[var(--line)] bg-[var(--surface-2)]/30">
-                        <td colSpan={5} className="px-4 py-3">
-                          <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
-                            <div>
-                              <p className="text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">Old</p>
-                              <pre className="mt-1 max-h-60 overflow-auto rounded-lg border border-[var(--line)] bg-[var(--surface)] p-2 text-xs text-[var(--ink)]">
-                                {safeParse(entry.oldValues) ?? "—"}
-                              </pre>
-                            </div>
-                            <div>
-                              <p className="text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">New</p>
-                              <pre className="mt-1 max-h-60 overflow-auto rounded-lg border border-[var(--line)] bg-[var(--surface)] p-2 text-xs text-[var(--ink)]">
-                                {safeParse(entry.newValues) ?? "—"}
-                              </pre>
-                            </div>
-                          </div>
-                        </td>
-                      </tr>
-                    )}
-                  </>
-                );
-              })}
-            </tbody>
-          </table>
-        )}
-      </div>
-
-      {data && data.totalCount > 0 && (
-        <div className="flex items-center justify-between text-xs text-[var(--mute)]">
-          <p>
-            Page {data.page} of {totalPages} · {data.totalCount} entries
-          </p>
-          <div className="inline-flex gap-2">
-            <button
-              type="button"
-              disabled={page <= 1}
-              onClick={() => setPage((p) => Math.max(1, p - 1))}
-              className="rounded-full border border-[var(--line)] bg-[var(--surface)] px-3 py-1.5 font-semibold hover:bg-[var(--surface-2)] disabled:opacity-40"
-            >
-              Prev
-            </button>
-            <button
-              type="button"
-              disabled={page >= totalPages}
-              onClick={() => setPage((p) => p + 1)}
-              className="rounded-full border border-[var(--line)] bg-[var(--surface)] px-3 py-1.5 font-semibold hover:bg-[var(--surface-2)] disabled:opacity-40"
-            >
-              Next
-            </button>
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}
diff --git a/frontend/client/app/admin/error.tsx b/frontend/client/app/admin/error.tsx
deleted file mode 100644
index 74aec88..0000000
--- a/frontend/client/app/admin/error.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-"use client";
-
-import { useEffect } from "react";
-
-type Props = {
-  error: Error & { digest?: string };
-  reset: () => void;
-};
-
-export default function AdminError({ error, reset }: Props) {
-  useEffect(() => {
-    console.error("[AdminError]", error);
-  }, [error]);
-
-  return (
-    <div className="flex min-h-[60vh] flex-col items-center justify-center gap-6 px-4 text-center">
-      <div className="flex flex-col gap-2">
-        <h2 className="text-xl font-semibold text-[var(--ink)]">Admin panel error</h2>
-        <p className="text-sm text-[var(--mute)]">
-          Something went wrong loading the admin panel.
-        </p>
-      </div>
-      <button
-        type="button"
-        onClick={reset}
-        className="rounded-full bg-[var(--indigo)] px-5 py-2.5 text-sm font-semibold text-white shadow-[var(--shadow-cta)] transition-[background,transform] duration-[220ms] hover:-translate-y-px hover:bg-[var(--indigo-deep)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
-      >
-        Try again
-      </button>
-    </div>
-  );
-}
diff --git a/frontend/client/app/admin/flags/page.tsx b/frontend/client/app/admin/flags/page.tsx
deleted file mode 100644
index 4f15e45..0000000
--- a/frontend/client/app/admin/flags/page.tsx
+++ /dev/null
@@ -1,212 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { motion } from "framer-motion";
-import { useAdminFlags, useReviewFlag } from "@/hooks/useAdmin";
-import type { ContentFlagStatus } from "@/types/admin";
-
-const STATUS_OPTIONS: { value: ContentFlagStatus | "All"; label: string }[] = [
-  { value: "All", label: "All" },
-  { value: "Pending", label: "Pending" },
-  { value: "Warning", label: "Warning" },
-  { value: "Suspended", label: "Suspended" },
-  { value: "Dismissed", label: "Dismissed" },
-];
-
-const STATUS_BADGE: Record<ContentFlagStatus, string> = {
-  Pending: "bg-[var(--surface-2)] text-[var(--ink)]",
-  Warning: "bg-[var(--surface-2)] text-[#b45309]",
-  Suspended: "bg-[var(--surface-2)] text-[var(--danger)]",
-  Dismissed: "bg-[var(--surface-2)] text-[var(--mute)]",
-};
-
-function formatDate(iso: string): string {
-  return new Date(iso).toLocaleString("en-US", {
-    year: "numeric",
-    month: "short",
-    day: "numeric",
-    hour: "2-digit",
-    minute: "2-digit",
-  });
-}
-
-export default function AdminFlagsPage() {
-  const [status, setStatus] = useState<ContentFlagStatus | "All">("Pending");
-  const { data, isLoading, isError, error, refetch } = useAdminFlags({
-    pageSize: 25,
-    status: status === "All" ? undefined : status,
-  });
-  const reviewMutation = useReviewFlag();
-
-  return (
-    <div className="flex flex-col gap-8">
-      <motion.div
-        initial={{ opacity: 0, y: -12 }}
-        animate={{ opacity: 1, y: 0 }}
-        transition={{ duration: 0.3, ease: "easeOut" }}
-      >
-        <h1 className="font-display text-2xl font-bold tracking-[-0.03em] text-[var(--ink)] sm:text-3xl">
-          Content flags
-        </h1>
-        <p className="mt-1 text-sm text-[var(--mute)]">
-          Review reports submitted by users. Suspending removes content and the owner.
-        </p>
-      </motion.div>
-
-      <div
-        role="tablist"
-        aria-label="Filter flags by status"
-        className="inline-flex w-fit rounded-full border border-[var(--line)] bg-[var(--surface)] p-1 text-xs font-semibold"
-      >
-        {STATUS_OPTIONS.map((opt) => {
-          const isActive = opt.value === status;
-          return (
-            <button
-              key={opt.value}
-              role="tab"
-              type="button"
-              aria-selected={isActive}
-              onClick={() => setStatus(opt.value)}
-              className={`rounded-full px-3 py-1.5 transition-[background,color] duration-[220ms] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] ${
-                isActive
-                  ? "bg-[var(--indigo)] text-white"
-                  : "text-[var(--mute)] hover:text-[var(--ink)]"
-              }`}
-            >
-              {opt.label}
-            </button>
-          );
-        })}
-      </div>
-
-      <motion.div
-        initial={{ opacity: 0, y: 12 }}
-        animate={{ opacity: 1, y: 0 }}
-        transition={{ duration: 0.3, ease: "easeOut", delay: 0.15 }}
-        className="overflow-x-auto rounded-2xl border border-[var(--line)] bg-[var(--surface)]"
-      >
-        {isLoading && (
-          <div className="space-y-2 p-4">
-            {Array.from({ length: 6 }).map((_, i) => (
-              <div key={i} className="h-12 animate-pulse rounded-lg bg-[var(--surface-2)]" />
-            ))}
-          </div>
-        )}
-
-        {isError && (
-          <div
-            role="alert"
-            className="flex flex-col items-start gap-2 p-6 text-sm text-[var(--danger)]"
-          >
-            <p className="font-semibold">Failed to load flags.</p>
-            <p className="opacity-80">
-              {(error as { message?: string } | undefined)?.message ?? "Unknown error"}
-            </p>
-            <button
-              type="button"
-              onClick={() => refetch()}
-              className="mt-2 rounded-full bg-[var(--danger)] px-3 py-1.5 text-xs font-semibold text-white hover:opacity-90"
-            >
-              Retry
-            </button>
-          </div>
-        )}
-
-        {!isLoading && data && data.items.length === 0 && (
-          <p className="p-8 text-center text-sm text-[var(--mute)]">No flags in this state.</p>
-        )}
-
-        {!isLoading && data && data.items.length > 0 && (
-          <table className="min-w-full divide-y divide-[var(--line)] text-left">
-            <thead className="bg-[var(--surface-2)]/40 text-xs uppercase tracking-wide text-[var(--mute)]">
-              <tr>
-                <th scope="col" className="px-4 py-3 font-semibold">Reporter</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Target</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Reason</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Created</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Status</th>
-                <th scope="col" className="px-4 py-3 text-right font-semibold">Actions</th>
-              </tr>
-            </thead>
-            <tbody>
-              {data.items.map((flag) => {
-                const isPending = flag.status === "Pending";
-                const busy = reviewMutation.isPending;
-                return (
-                  <tr key={flag.id} className="border-b border-[var(--line)] last:border-b-0">
-                    <td className="px-4 py-3 text-sm text-[var(--ink)]">
-                      {flag.reporterName || "—"}
-                    </td>
-                    <td className="px-4 py-3 text-xs text-[var(--mute)]">
-                      <span className="font-semibold text-[var(--ink)]">{flag.entityType}</span>
-                      <span className="block truncate">{flag.entityId}</span>
-                    </td>
-                    <td className="px-4 py-3 max-w-md text-sm text-[var(--ink)]">
-                      <p className="line-clamp-2">{flag.reason}</p>
-                    </td>
-                    <td className="px-4 py-3 text-xs text-[var(--mute)]">
-                      {formatDate(flag.createdAt)}
-                    </td>
-                    <td className="px-4 py-3">
-                      <span
-                        className={`inline-flex rounded-full px-2.5 py-1 text-xs font-semibold ${STATUS_BADGE[flag.status]}`}
-                      >
-                        {flag.status}
-                      </span>
-                    </td>
-                    <td className="px-4 py-3 text-right">
-                      {isPending ? (
-                        <div className="inline-flex gap-2">
-                          <button
-                            type="button"
-                            disabled={busy}
-                            onClick={() =>
-                              reviewMutation.mutate({ flagId: flag.id, newStatus: "Dismissed" })
-                            }
-                            className="rounded-full border border-[var(--line)] px-3 py-1.5 text-xs font-semibold text-[var(--mute)] hover:bg-[var(--surface-2)] disabled:opacity-50"
-                          >
-                            Dismiss
-                          </button>
-                          <button
-                            type="button"
-                            disabled={busy}
-                            onClick={() =>
-                              reviewMutation.mutate({ flagId: flag.id, newStatus: "Warning" })
-                            }
-                            className="rounded-full bg-[#b45309] px-3 py-1.5 text-xs font-semibold text-white hover:opacity-90 disabled:opacity-50"
-                          >
-                            Warn
-                          </button>
-                          <button
-                            type="button"
-                            disabled={busy}
-                            onClick={() =>
-                              reviewMutation.mutate({ flagId: flag.id, newStatus: "Suspended" })
-                            }
-                            className="rounded-full bg-[var(--danger)] px-3 py-1.5 text-xs font-semibold text-white hover:opacity-90 disabled:opacity-50"
-                          >
-                            Suspend
-                          </button>
-                        </div>
-                      ) : (
-                        <span className="text-xs text-[var(--mute)]">
-                          {flag.reviewedAt ? formatDate(flag.reviewedAt) : "—"}
-                        </span>
-                      )}
-                    </td>
-                  </tr>
-                );
-              })}
-            </tbody>
-          </table>
-        )}
-      </motion.div>
-
-      {data && (
-        <p className="text-xs text-[var(--mute)]">
-          {data.items.length} of {data.totalCount} flags
-        </p>
-      )}
-    </div>
-  );
-}
diff --git a/frontend/client/app/admin/jobs/page.tsx b/frontend/client/app/admin/jobs/page.tsx
deleted file mode 100644
index f25fd32..0000000
--- a/frontend/client/app/admin/jobs/page.tsx
+++ /dev/null
@@ -1,140 +0,0 @@
-"use client";
-
-import { motion } from "framer-motion";
-import { Play } from "lucide-react";
-import {
-  useJobStats,
-  useRecurringJobs,
-  useTriggerRecurringJob,
-} from "@/hooks/useAdmin";
-
-function fmt(iso: string | null): string {
-  if (!iso) return "—";
-  return new Date(iso).toLocaleString("en-US", {
-    year: "numeric",
-    month: "short",
-    day: "numeric",
-    hour: "2-digit",
-    minute: "2-digit",
-  });
-}
-
-const STAT_LABELS: { key: keyof StatsShape; label: string }[] = [
-  { key: "enqueued", label: "Enqueued" },
-  { key: "processing", label: "Processing" },
-  { key: "scheduled", label: "Scheduled" },
-  { key: "succeeded", label: "Succeeded" },
-  { key: "failed", label: "Failed" },
-  { key: "deleted", label: "Deleted" },
-  { key: "servers", label: "Servers" },
-];
-
-type StatsShape = {
-  enqueued: number;
-  processing: number;
-  succeeded: number;
-  failed: number;
-  scheduled: number;
-  deleted: number;
-  servers: number;
-};
-
-export default function AdminJobsPage() {
-  const { data: stats, isLoading: statsLoading } = useJobStats();
-  const { data: jobs, isLoading: jobsLoading } = useRecurringJobs();
-  const trigger = useTriggerRecurringJob();
-
-  return (
-    <div className="flex flex-col gap-8">
-      <motion.div
-        initial={{ opacity: 0, y: -12 }}
-        animate={{ opacity: 1, y: 0 }}
-        transition={{ duration: 0.3, ease: "easeOut" }}
-      >
-        <h1 className="font-display text-2xl font-bold tracking-[-0.03em] text-[var(--ink)] sm:text-3xl">
-          Background jobs
-        </h1>
-        <p className="mt-1 text-sm text-[var(--mute)]">
-          Hangfire stats and recurring jobs. Stats auto-refresh every 15s.
-        </p>
-      </motion.div>
-
-      <section>
-        <h2 className="text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
-          Queue stats
-        </h2>
-        <div className="mt-3 grid grid-cols-2 gap-3 sm:grid-cols-4 lg:grid-cols-7">
-          {statsLoading || !stats
-            ? Array.from({ length: 7 }).map((_, i) => (
-                <div key={i} className="h-20 animate-pulse rounded-2xl bg-[var(--surface-2)]" />
-              ))
-            : STAT_LABELS.map(({ key, label }) => (
-                <div
-                  key={key}
-                  className="rounded-2xl border border-[var(--line)] bg-[var(--surface)] p-4"
-                >
-                  <p className="text-xs uppercase tracking-wide text-[var(--mute)]">{label}</p>
-                  <p className="mt-1 font-display text-2xl font-bold text-[var(--ink)]">
-                    {(stats as StatsShape)[key].toLocaleString()}
-                  </p>
-                </div>
-              ))}
-        </div>
-      </section>
-
-      <section>
-        <h2 className="text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
-          Recurring jobs
-        </h2>
-        <div className="mt-3 overflow-x-auto rounded-2xl border border-[var(--line)] bg-[var(--surface)]">
-          {jobsLoading && (
-            <div className="space-y-2 p-4">
-              {Array.from({ length: 4 }).map((_, i) => (
-                <div key={i} className="h-12 animate-pulse rounded-lg bg-[var(--surface-2)]" />
-              ))}
-            </div>
-          )}
-          {!jobsLoading && jobs && jobs.length === 0 && (
-            <p className="p-8 text-center text-sm text-[var(--mute)]">No recurring jobs registered.</p>
-          )}
-          {!jobsLoading && jobs && jobs.length > 0 && (
-            <table className="min-w-full divide-y divide-[var(--line)] text-left">
-              <thead className="bg-[var(--surface-2)]/40 text-xs uppercase tracking-wide text-[var(--mute)]">
-                <tr>
-                  <th scope="col" className="px-4 py-3 font-semibold">Id</th>
-                  <th scope="col" className="px-4 py-3 font-semibold">Method</th>
-                  <th scope="col" className="px-4 py-3 font-semibold">Cron</th>
-                  <th scope="col" className="px-4 py-3 font-semibold">Last run</th>
-                  <th scope="col" className="px-4 py-3 font-semibold">Next run</th>
-                  <th scope="col" className="px-4 py-3 text-right font-semibold">Action</th>
-                </tr>
-              </thead>
-              <tbody>
-                {jobs.map((j) => (
-                  <tr key={j.id} className="border-b border-[var(--line)] last:border-b-0">
-                    <td className="px-4 py-3 text-sm font-medium text-[var(--ink)]">{j.id}</td>
-                    <td className="px-4 py-3 text-xs text-[var(--mute)]">{j.jobMethod ?? "—"}</td>
-                    <td className="px-4 py-3 text-xs font-mono text-[var(--ink)]">{j.cron ?? "—"}</td>
-                    <td className="px-4 py-3 text-xs text-[var(--mute)]">{fmt(j.lastExecution)}</td>
-                    <td className="px-4 py-3 text-xs text-[var(--mute)]">{fmt(j.nextExecution)}</td>
-                    <td className="px-4 py-3 text-right">
-                      <button
-                        type="button"
-                        disabled={trigger.isPending}
-                        onClick={() => trigger.mutate(j.id)}
-                        className="inline-flex items-center gap-1 rounded-full bg-[var(--indigo)] px-3 py-1.5 text-xs font-semibold text-white hover:opacity-90 disabled:opacity-50"
-                      >
-                        <Play className="h-3 w-3" aria-hidden="true" />
-                        Trigger
-                      </button>
-                    </td>
-                  </tr>
-                ))}
-              </tbody>
-            </table>
-          )}
-        </div>
-      </section>
-    </div>
-  );
-}
diff --git a/frontend/client/app/admin/layout.tsx b/frontend/client/app/admin/layout.tsx
deleted file mode 100644
index 62621ab..0000000
--- a/frontend/client/app/admin/layout.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-"use client";
-
-import type { ReactNode } from "react";
-import Link from "next/link";
-import { usePathname } from "next/navigation";
-import { Users, FolderKanban, LineChart, Flag, LifeBuoy, Activity, ScrollText, type LucideIcon } from "lucide-react";
-import { NavigationHeader } from "@/components/ui/NavigationHeader";
-
-// NOTE: RBAC is a no-op stub in M2. Real admin-role gate (redirect non-admins
-// to /discover) lands with the backend RBAC middleware in M5 integration.
-const ADMIN_NAV: { href: string; label: string; icon: LucideIcon }[] = [
-  { href: "/admin", label: "Users", icon: Users },
-  { href: "/admin/projects", label: "Projects", icon: FolderKanban },
-  { href: "/admin/flags", label: "Flags", icon: Flag },
-  { href: "/admin/support", label: "Support", icon: LifeBuoy },
-  { href: "/admin/jobs", label: "Jobs", icon: Activity },
-  { href: "/admin/audit", label: "Audit", icon: ScrollText },
-  { href: "/admin/analytics", label: "Analytics", icon: LineChart },
-];
-
-export default function AdminLayout({ children }: { children: ReactNode }) {
-  const pathname = usePathname();
-
-  return (
-    <div className="min-h-screen bg-[var(--bg)] text-[var(--ink)]">
-      <NavigationHeader showAuthButtons={false} />
-
-      <div className="mx-auto flex max-w-7xl flex-col gap-0 px-4 py-8 sm:px-6 lg:flex-row lg:gap-8 lg:px-8">
-        {/* Mobile + tablet: horizontal tab bar. Desktop: sidebar. */}
-        <nav
-          aria-label="Admin navigation"
-          className="-mx-4 flex gap-1 overflow-x-auto border-b border-[var(--line)] px-4 pb-3 sm:mx-0 sm:px-0 lg:w-56 lg:shrink-0 lg:flex-col lg:border-b-0 lg:border-r lg:pb-0 lg:pr-6"
-        >
-          {ADMIN_NAV.map(({ href, label, icon: Icon }) => {
-            const isActive =
-              pathname === href || pathname.startsWith(`${href}/`);
-
-            return (
-              <Link
-                key={href}
-                href={href}
-                aria-current={isActive ? "page" : undefined}
-                className={`inline-flex min-h-11 shrink-0 items-center gap-2 rounded-full px-3 py-2 text-sm font-medium transition-[background,color] duration-[220ms] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] focus-visible:ring-offset-2 ${
-                  isActive
-                    ? "bg-[var(--indigo-soft)] text-[var(--indigo)]"
-                    : "text-[var(--mute)] hover:bg-[var(--surface-2)] hover:text-[var(--ink)]"
-                }`}
-              >
-                <Icon aria-hidden="true" className="h-4 w-4" />
-                {label}
-              </Link>
-            );
-          })}
-        </nav>
-
-        <main className="min-w-0 flex-1 pt-6 lg:pt-0">{children}</main>
-      </div>
-    </div>
-  );
-}
diff --git a/frontend/client/app/admin/page.tsx b/frontend/client/app/admin/page.tsx
deleted file mode 100644
index cb949e0..0000000
--- a/frontend/client/app/admin/page.tsx
+++ /dev/null
@@ -1,281 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { motion } from "framer-motion";
-import {
-  Users,
-  FolderKanban,
-  MessageSquareText,
-  ClipboardCheck,
-  Megaphone,
-  type LucideIcon,
-} from "lucide-react";
-import { MetricCard } from "@/components/admin/MetricCard";
-import { UserRow } from "@/components/admin/UserRow";
-import { BroadcastDialog } from "@/components/admin/BroadcastDialog";
-import { ActivityDrawer } from "@/components/admin/ActivityDrawer";
-import { usePlatformAnalytics } from "@/hooks/usePlatformAnalytics";
-import {
-  useAdminUsers,
-  useChangeUserRole,
-  useDeleteAdminUser,
-  useFeatureFlags,
-  useResetUserPassword,
-  useSetFeatureFlag,
-  useSuspendUser,
-} from "@/hooks/useAdmin";
-import type { TrendDirection } from "@/types/analytics";
-
-const METRIC_ICONS: LucideIcon[] = [Users, FolderKanban, MessageSquareText, ClipboardCheck];
-
-const FLAG_LABELS: Record<string, string> = {
-  SemanticMatching: "Semantic Matching",
-  AiSummaries: "AI Summaries",
-  AdvancedAnalytics: "Advanced Analytics",
-  GitHubSync: "GitHub Sync",
-  EmailNotifications: "Email Notifications",
-};
-
-// Mirror of backend appsettings FeatureManagement defaults.
-// Override badge shows when current value diverges from this.
-const FLAG_DEFAULTS: Record<string, boolean> = {
-  SemanticMatching: true,
-  AiSummaries: true,
-  AdvancedAnalytics: false,
-  GitHubSync: true,
-  EmailNotifications: true,
-};
-
-function trendDir(direction: TrendDirection): TrendDirection {
-  return direction;
-}
-
-export default function AdminDashboardPage() {
-  const [broadcastOpen, setBroadcastOpen] = useState(false);
-  const [activity, setActivity] = useState<{ id: string; name: string } | null>(null);
-  const { data: analytics, isLoading: analyticsLoading } = usePlatformAnalytics(30);
-  const { data: users, isLoading: usersLoading } = useAdminUsers({ pageSize: 10 });
-  const { data: flags, isLoading: flagsLoading } = useFeatureFlags();
-  const suspendMutation = useSuspendUser();
-  const deleteMutation = useDeleteAdminUser();
-  const flagMutation = useSetFeatureFlag();
-  const roleMutation = useChangeUserRole();
-  const resetMutation = useResetUserPassword();
-
-  const metrics = analytics
-    ? [
-        {
-          label: "Total users",
-          value: analytics.totals.totalUsers.current.toLocaleString(),
-          trend: { direction: trendDir(analytics.totals.totalUsers.direction), percentage: analytics.totals.totalUsers.percentChange },
-        },
-        {
-          label: "Active projects",
-          value: analytics.totals.activeProjects.current.toLocaleString(),
-          trend: { direction: trendDir(analytics.totals.activeProjects.direction), percentage: analytics.totals.activeProjects.percentChange },
-        },
-        {
-          label: "Messages (30d)",
-          value: analytics.totals.messagesSent.current.toLocaleString(),
-          trend: { direction: trendDir(analytics.totals.messagesSent.direction), percentage: analytics.totals.messagesSent.percentChange },
-        },
-        {
-          label: "Standups (30d)",
-          value: analytics.totals.standupsCompleted.current.toLocaleString(),
-          trend: { direction: trendDir(analytics.totals.standupsCompleted.direction), percentage: analytics.totals.standupsCompleted.percentChange },
-        },
-      ]
-    : null;
-
-  return (
-    <div className="flex flex-col gap-8">
-      <motion.div
-        initial={{ opacity: 0, y: -12 }}
-        animate={{ opacity: 1, y: 0 }}
-        transition={{ duration: 0.3, ease: "easeOut" }}
-      >
-        <div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
-          <div>
-            <h1 className="font-display text-2xl font-bold tracking-[-0.03em] text-[var(--ink)] sm:text-3xl">
-              Admin dashboard
-            </h1>
-            <p className="mt-1 text-sm text-[var(--mute)]">
-              Platform overview and recent user signups.
-            </p>
-          </div>
-          <button
-            type="button"
-            onClick={() => setBroadcastOpen(true)}
-            className="inline-flex shrink-0 items-center gap-2 rounded-full bg-[var(--indigo)] px-4 py-2 text-xs font-semibold text-white hover:opacity-90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] focus-visible:ring-offset-2"
-          >
-            <Megaphone className="h-4 w-4" aria-hidden="true" />
-            Broadcast
-          </button>
-        </div>
-      </motion.div>
-
-      <BroadcastDialog open={broadcastOpen} onClose={() => setBroadcastOpen(false)} />
-      <ActivityDrawer
-        userId={activity?.id ?? null}
-        userName={activity?.name}
-        onClose={() => setActivity(null)}
-      />
-
-      {/* Metrics grid */}
-      <section>
-        <h2 className="sr-only">Platform metrics</h2>
-        {analyticsLoading && (
-          <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-4">
-            {Array.from({ length: 4 }).map((_, i) => (
-              <div key={i} className="h-32 animate-pulse rounded-2xl bg-[var(--surface-2)]" />
-            ))}
-          </div>
-        )}
-        {metrics && (
-          <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-4">
-            {metrics.map((metric, i) => (
-              <MetricCard
-                key={metric.label}
-                label={metric.label}
-                value={metric.value}
-                icon={METRIC_ICONS[i] ?? Users}
-                trend={metric.trend}
-                index={i}
-              />
-            ))}
-          </div>
-        )}
-      </section>
-
-      {/* Users table */}
-      <section>
-        <div className="flex items-center justify-between">
-          <h2 className="text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
-            Recent users
-          </h2>
-          <span className="text-xs text-[var(--mute)]">
-            {users ? `${users.items.length} of ${users.totalCount}` : "—"}
-          </span>
-        </div>
-
-        <motion.div
-          initial={{ opacity: 0, y: 12 }}
-          animate={{ opacity: 1, y: 0 }}
-          transition={{ duration: 0.3, ease: "easeOut", delay: 0.2 }}
-          className="mt-3 overflow-x-auto rounded-2xl border border-[var(--line)] bg-[var(--surface)]"
-        >
-          {usersLoading && (
-            <div className="space-y-2 p-4">
-              {Array.from({ length: 5 }).map((_, i) => (
-                <div key={i} className="h-10 animate-pulse rounded-lg bg-[var(--surface-2)]" />
-              ))}
-            </div>
-          )}
-          {!usersLoading && users && (
-            <table className="min-w-full divide-y divide-[var(--line)] text-left">
-              <thead className="bg-[var(--surface-2)]/40 text-xs uppercase tracking-wide text-[var(--mute)]">
-                <tr>
-                  <th scope="col" className="px-4 py-3 font-semibold">User</th>
-                  <th scope="col" className="px-4 py-3 font-semibold">Role</th>
-                  <th scope="col" className="px-4 py-3 font-semibold">Joined</th>
-                  <th scope="col" className="px-4 py-3 font-semibold">Status</th>
-                  <th scope="col" className="px-4 py-3 text-right font-semibold">Actions</th>
-                </tr>
-              </thead>
-              <tbody>
-                {users.items.map((user) => (
-                  <UserRow
-                    key={user.id}
-                    user={user}
-                    onSuspend={(id, suspend) => suspendMutation.mutate({ userId: id, suspend })}
-                    onDelete={(id) => {
-                      if (window.confirm("Delete this user? Email will be anonymized.")) {
-                        deleteMutation.mutate(id);
-                      }
-                    }}
-                    onChangeRole={(id, newRole) =>
-                      roleMutation.mutate({ userId: id, newRole })
-                    }
-                    onResetPassword={(id) => {
-                      if (window.confirm("Force this user to change password at next login?")) {
-                        resetMutation.mutate(id);
-                      }
-                    }}
-                    onViewActivity={(id, name) => setActivity({ id, name })}
-                    suspendPending={suspendMutation.isPending}
-                    deletePending={deleteMutation.isPending}
-                    rolePending={roleMutation.isPending}
-                    resetPending={resetMutation.isPending}
-                  />
-                ))}
-              </tbody>
-            </table>
-          )}
-        </motion.div>
-      </section>
-
-      {/* Feature flags */}
-      <section>
-        <h2 className="text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
-          Feature flags
-        </h2>
-        <motion.div
-          initial={{ opacity: 0, y: 12 }}
-          animate={{ opacity: 1, y: 0 }}
-          transition={{ duration: 0.3, ease: "easeOut", delay: 0.3 }}
-          className="mt-3 divide-y divide-[var(--line)] rounded-2xl border border-[var(--line)] bg-[var(--surface)]"
-        >
-          {flagsLoading && (
-            <div className="space-y-2 p-4">
-              {Array.from({ length: 5 }).map((_, i) => (
-                <div key={i} className="h-8 animate-pulse rounded-lg bg-[var(--surface-2)]" />
-              ))}
-            </div>
-          )}
-          {flags &&
-            Object.entries(flags).map(([key, enabled]) => {
-              const overridden =
-                key in FLAG_DEFAULTS && FLAG_DEFAULTS[key] !== enabled;
-              return (
-              <div key={key} className="flex items-center justify-between px-4 py-3">
-                <div className="flex items-center gap-2">
-                  <span className="text-sm font-medium text-[var(--ink)]">
-                    {FLAG_LABELS[key] ?? key}
-                  </span>
-                  {overridden && (
-                    <span
-                      title={`Default: ${FLAG_DEFAULTS[key] ? "on" : "off"}`}
-                      className="rounded-full bg-[var(--warn)]/10 px-2 py-0.5 text-[10px] font-semibold uppercase tracking-wide text-[var(--warn)]"
-                    >
-                      override
-                    </span>
-                  )}
-                </div>
-                <button
-                  type="button"
-                  disabled={flagMutation.isPending}
-                  onClick={() => flagMutation.mutate({ flagName: key, enabled: !enabled })}
-                  className={[
-                    "relative inline-flex h-6 w-11 shrink-0 cursor-pointer rounded-full border-2 border-transparent transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50",
-                    enabled ? "bg-[var(--indigo)]" : "bg-[var(--surface-2)]",
-                  ].join(" ")}
-                  aria-checked={enabled}
-                  role="switch"
-                  aria-label={`Toggle ${FLAG_LABELS[key] ?? key}`}
-                >
-                  <span
-                    aria-hidden="true"
-                    className={[
-                      "pointer-events-none inline-block h-5 w-5 rounded-full bg-white shadow ring-0 transition-transform",
-                      enabled ? "translate-x-5" : "translate-x-0",
-                    ].join(" ")}
-                  />
-                </button>
-              </div>
-              );
-            })}
-        </motion.div>
-      </section>
-    </div>
-  );
-}
diff --git a/frontend/client/app/admin/projects/page.tsx b/frontend/client/app/admin/projects/page.tsx
deleted file mode 100644
index 7c5c80c..0000000
--- a/frontend/client/app/admin/projects/page.tsx
+++ /dev/null
@@ -1,192 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { motion } from "framer-motion";
-import { useAdminProjects } from "@/hooks/useAdmin";
-import type { AdminProjectStatus } from "@/types/admin";
-
-const STATUS_TABS: { value: AdminProjectStatus | "All"; label: string }[] = [
-  { value: "All", label: "All" },
-  { value: "Active", label: "Active" },
-  { value: "Completed", label: "Completed" },
-  { value: "Archived", label: "Archived" },
-];
-
-const STATUS_BADGE: Record<AdminProjectStatus, string> = {
-  Active: "bg-[var(--surface-2)] text-[var(--success)]",
-  Completed: "bg-[var(--indigo-soft)] text-[var(--indigo)]",
-  Archived: "bg-[var(--surface-2)] text-[var(--mute)]",
-};
-
-function fmt(iso: string): string {
-  return new Date(iso).toLocaleDateString("en-US", {
-    year: "numeric",
-    month: "short",
-    day: "numeric",
-  });
-}
-
-export default function AdminProjectsPage() {
-  const [status, setStatus] = useState<AdminProjectStatus | "All">("All");
-  const [page, setPage] = useState(1);
-  const [includeDeleted, setIncludeDeleted] = useState(false);
-  const { data, isLoading, isError } = useAdminProjects({
-    page,
-    pageSize: 25,
-    status: status === "All" ? undefined : status,
-    includeDeleted,
-  });
-  const totalPages = data ? Math.max(1, Math.ceil(data.totalCount / data.pageSize)) : 1;
-
-  return (
-    <div className="flex flex-col gap-6">
-      <motion.div
-        initial={{ opacity: 0, y: -12 }}
-        animate={{ opacity: 1, y: 0 }}
-        transition={{ duration: 0.3, ease: "easeOut" }}
-      >
-        <h1 className="font-display text-2xl font-bold tracking-[-0.03em] text-[var(--ink)] sm:text-3xl">
-          Projects
-        </h1>
-        <p className="mt-1 text-sm text-[var(--mute)]">
-          All projects on the platform.
-        </p>
-      </motion.div>
-
-      <div className="flex flex-wrap items-center gap-3">
-        <div
-          role="tablist"
-          aria-label="Filter projects"
-          className="inline-flex rounded-full border border-[var(--line)] bg-[var(--surface)] p-1 text-xs font-semibold"
-        >
-          {STATUS_TABS.map((opt) => {
-            const isActive = opt.value === status;
-            return (
-              <button
-                key={opt.value}
-                role="tab"
-                type="button"
-                aria-selected={isActive}
-                onClick={() => {
-                  setStatus(opt.value);
-                  setPage(1);
-                }}
-                className={`rounded-full px-3 py-1.5 transition-[background,color] duration-[220ms] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] ${
-                  isActive
-                    ? "bg-[var(--indigo)] text-white"
-                    : "text-[var(--mute)] hover:text-[var(--ink)]"
-                }`}
-              >
-                {opt.label}
-              </button>
-            );
-          })}
-        </div>
-        <label className="inline-flex items-center gap-2 text-xs text-[var(--mute)]">
-          <input
-            type="checkbox"
-            checked={includeDeleted}
-            onChange={(e) => {
-              setIncludeDeleted(e.target.checked);
-              setPage(1);
-            }}
-          />
-          Include deleted
-        </label>
-      </div>
-
-      <div className="overflow-x-auto rounded-2xl border border-[var(--line)] bg-[var(--surface)]">
-        {isLoading && (
-          <div className="space-y-2 p-4">
-            {Array.from({ length: 6 }).map((_, i) => (
-              <div key={i} className="h-12 animate-pulse rounded-lg bg-[var(--surface-2)]" />
-            ))}
-          </div>
-        )}
-        {isError && (
-          <p role="alert" className="p-6 text-sm text-[var(--danger)]">
-            Failed to load projects.
-          </p>
-        )}
-        {!isLoading && data && data.items.length === 0 && (
-          <p className="p-8 text-center text-sm text-[var(--mute)]">No projects.</p>
-        )}
-        {!isLoading && data && data.items.length > 0 && (
-          <table className="min-w-full divide-y divide-[var(--line)] text-left">
-            <thead className="bg-[var(--surface-2)]/40 text-xs uppercase tracking-wide text-[var(--mute)]">
-              <tr>
-                <th scope="col" className="px-4 py-3 font-semibold">Title</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Owner</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Status</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Members</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Flags</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Created</th>
-              </tr>
-            </thead>
-            <tbody>
-              {data.items.map((p) => (
-                <tr key={p.id} className="border-b border-[var(--line)] last:border-b-0">
-                  <td className="px-4 py-3">
-                    <p className="text-sm font-medium text-[var(--ink)]">{p.title}</p>
-                    {p.description && (
-                      <p className="mt-0.5 line-clamp-1 max-w-xs text-xs text-[var(--mute)]">{p.description}</p>
-                    )}
-                    {p.isDeleted && (
-                      <span className="mt-1 inline-flex rounded-full bg-[var(--danger)]/10 px-2 py-0.5 text-[10px] font-semibold text-[var(--danger)]">
-                        deleted
-                      </span>
-                    )}
-                  </td>
-                  <td className="px-4 py-3 text-xs text-[var(--mute)]">
-                    <p className="text-sm font-medium text-[var(--ink)]">{p.ownerName}</p>
-                    <p>{p.ownerEmail}</p>
-                  </td>
-                  <td className="px-4 py-3">
-                    <span className={`inline-flex rounded-full px-2.5 py-1 text-xs font-semibold ${STATUS_BADGE[p.status]}`}>
-                      {p.status}
-                    </span>
-                  </td>
-                  <td className="px-4 py-3 text-sm tabular-nums text-[var(--ink)]">{p.memberCount}</td>
-                  <td className="px-4 py-3 text-sm tabular-nums text-[var(--ink)]">
-                    {p.flagCount > 0 ? (
-                      <span className="font-semibold text-[var(--danger)]">{p.flagCount}</span>
-                    ) : (
-                      p.flagCount
-                    )}
-                  </td>
-                  <td className="px-4 py-3 text-xs text-[var(--mute)]">{fmt(p.createdAt)}</td>
-                </tr>
-              ))}
-            </tbody>
-          </table>
-        )}
-      </div>
-
-      {data && data.totalCount > 0 && (
-        <div className="flex items-center justify-between text-xs text-[var(--mute)]">
-          <p>
-            Page {data.page} of {totalPages} · {data.totalCount} projects
-          </p>
-          <div className="inline-flex gap-2">
-            <button
-              type="button"
-              disabled={page <= 1}
-              onClick={() => setPage((p) => Math.max(1, p - 1))}
-              className="rounded-full border border-[var(--line)] bg-[var(--surface)] px-3 py-1.5 font-semibold hover:bg-[var(--surface-2)] disabled:opacity-40"
-            >
-              Prev
-            </button>
-            <button
-              type="button"
-              disabled={page >= totalPages}
-              onClick={() => setPage((p) => p + 1)}
-              className="rounded-full border border-[var(--line)] bg-[var(--surface)] px-3 py-1.5 font-semibold hover:bg-[var(--surface-2)] disabled:opacity-40"
-            >
-              Next
-            </button>
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}
diff --git a/frontend/client/app/admin/support/page.tsx b/frontend/client/app/admin/support/page.tsx
deleted file mode 100644
index 5fc3710..0000000
--- a/frontend/client/app/admin/support/page.tsx
+++ /dev/null
@@ -1,310 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { motion } from "framer-motion";
-import {
-  useSupportTickets,
-  useUpdateSupportTicket,
-} from "@/hooks/useAdmin";
-import type {
-  SupportTicketDto,
-  SupportTicketPriority,
-  SupportTicketStatus,
-} from "@/types/admin";
-
-const STATUS_TABS: { value: SupportTicketStatus | "All"; label: string }[] = [
-  { value: "All", label: "All" },
-  { value: "Open", label: "Open" },
-  { value: "InProgress", label: "In progress" },
-  { value: "Resolved", label: "Resolved" },
-  { value: "Closed", label: "Closed" },
-];
-
-const STATUS_OPTIONS: SupportTicketStatus[] = [
-  "Open",
-  "InProgress",
-  "Resolved",
-  "Closed",
-];
-const PRIORITY_OPTIONS: SupportTicketPriority[] = [
-  "Low",
-  "Normal",
-  "High",
-  "Urgent",
-];
-
-const STATUS_BADGE: Record<SupportTicketStatus, string> = {
-  Open: "bg-[var(--surface-2)] text-[var(--ink)]",
-  InProgress: "bg-[var(--indigo-soft)] text-[var(--indigo)]",
-  Resolved: "bg-[var(--surface-2)] text-[var(--success)]",
-  Closed: "bg-[var(--surface-2)] text-[var(--mute)]",
-};
-
-const PRIORITY_BADGE: Record<SupportTicketPriority, string> = {
-  Low: "text-[var(--mute)]",
-  Normal: "text-[var(--ink)]",
-  High: "text-[#b45309]",
-  Urgent: "text-[var(--danger)]",
-};
-
-function fmt(iso: string | null): string {
-  if (!iso) return "—";
-  return new Date(iso).toLocaleString("en-US", {
-    year: "numeric",
-    month: "short",
-    day: "numeric",
-    hour: "2-digit",
-    minute: "2-digit",
-  });
-}
-
-export default function AdminSupportPage() {
-  const [status, setStatus] = useState<SupportTicketStatus | "All">("Open");
-  const { data, isLoading, isError } = useSupportTickets({
-    pageSize: 25,
-    status: status === "All" ? undefined : status,
-  });
-  const updateMutation = useUpdateSupportTicket();
-  const [selected, setSelected] = useState<SupportTicketDto | null>(null);
-
-  return (
-    <div className="flex flex-col gap-6">
-      <motion.div
-        initial={{ opacity: 0, y: -12 }}
-        animate={{ opacity: 1, y: 0 }}
-        transition={{ duration: 0.3, ease: "easeOut" }}
-      >
-        <h1 className="font-display text-2xl font-bold tracking-[-0.03em] text-[var(--ink)] sm:text-3xl">
-          Support inbox
-        </h1>
-        <p className="mt-1 text-sm text-[var(--mute)]">
-          User-submitted tickets. Update status, priority, assignment.
-        </p>
-      </motion.div>
-
-      <div
-        role="tablist"
-        aria-label="Filter tickets"
-        className="inline-flex w-fit rounded-full border border-[var(--line)] bg-[var(--surface)] p-1 text-xs font-semibold"
-      >
-        {STATUS_TABS.map((opt) => {
-          const isActive = opt.value === status;
-          return (
-            <button
-              key={opt.value}
-              role="tab"
-              type="button"
-              aria-selected={isActive}
-              onClick={() => setStatus(opt.value)}
-              className={`rounded-full px-3 py-1.5 transition-[background,color] duration-[220ms] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] ${
-                isActive
-                  ? "bg-[var(--indigo)] text-white"
-                  : "text-[var(--mute)] hover:text-[var(--ink)]"
-              }`}
-            >
-              {opt.label}
-            </button>
-          );
-        })}
-      </div>
-
-      <div className="overflow-x-auto rounded-2xl border border-[var(--line)] bg-[var(--surface)]">
-        {isLoading && (
-          <div className="space-y-2 p-4">
-            {Array.from({ length: 5 }).map((_, i) => (
-              <div key={i} className="h-12 animate-pulse rounded-lg bg-[var(--surface-2)]" />
-            ))}
-          </div>
-        )}
-        {isError && (
-          <p role="alert" className="p-6 text-sm text-[var(--danger)]">
-            Failed to load tickets.
-          </p>
-        )}
-        {!isLoading && data && data.items.length === 0 && (
-          <p className="p-8 text-center text-sm text-[var(--mute)]">No tickets.</p>
-        )}
-        {!isLoading && data && data.items.length > 0 && (
-          <table className="min-w-full divide-y divide-[var(--line)] text-left">
-            <thead className="bg-[var(--surface-2)]/40 text-xs uppercase tracking-wide text-[var(--mute)]">
-              <tr>
-                <th scope="col" className="px-4 py-3 font-semibold">Subject</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Reporter</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Priority</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Status</th>
-                <th scope="col" className="px-4 py-3 font-semibold">Created</th>
-                <th scope="col" className="px-4 py-3 text-right font-semibold">Actions</th>
-              </tr>
-            </thead>
-            <tbody>
-              {data.items.map((t) => (
-                <tr key={t.id} className="border-b border-[var(--line)] last:border-b-0">
-                  <td className="px-4 py-3 text-sm text-[var(--ink)]">
-                    <p className="font-medium">{t.subject}</p>
-                    <p className="mt-0.5 line-clamp-1 max-w-xs text-xs text-[var(--mute)]">{t.body}</p>
-                  </td>
-                  <td className="px-4 py-3 text-sm text-[var(--mute)]">{t.reporterName || "—"}</td>
-                  <td className={`px-4 py-3 text-xs font-semibold ${PRIORITY_BADGE[t.priority]}`}>
-                    {t.priority}
-                  </td>
-                  <td className="px-4 py-3">
-                    <span className={`inline-flex rounded-full px-2.5 py-1 text-xs font-semibold ${STATUS_BADGE[t.status]}`}>
-                      {t.status}
-                    </span>
-                  </td>
-                  <td className="px-4 py-3 text-xs text-[var(--mute)]">{fmt(t.createdAt)}</td>
-                  <td className="px-4 py-3 text-right">
-                    <button
-                      type="button"
-                      onClick={() => setSelected(t)}
-                      className="rounded-full border border-[var(--line)] bg-[var(--surface)] px-3 py-1.5 text-xs font-semibold text-[var(--mute)] hover:bg-[var(--surface-2)] hover:text-[var(--ink)]"
-                    >
-                      Manage
-                    </button>
-                  </td>
-                </tr>
-              ))}
-            </tbody>
-          </table>
-        )}
-      </div>
-
-      {data && (
-        <p className="text-xs text-[var(--mute)]">
-          {data.items.length} of {data.totalCount} tickets
-        </p>
-      )}
-
-      {selected && (
-        <TicketDialog
-          ticket={selected}
-          onClose={() => setSelected(null)}
-          onSubmit={async (body) => {
-            const updated = await updateMutation.mutateAsync({ id: selected.id, body });
-            setSelected(updated);
-          }}
-          pending={updateMutation.isPending}
-          error={updateMutation.error as { message?: string } | undefined}
-        />
-      )}
-    </div>
-  );
-}
-
-type DialogProps = {
-  ticket: SupportTicketDto;
-  onClose: () => void;
-  onSubmit: (body: {
-    status: SupportTicketStatus;
-    priority: SupportTicketPriority;
-    resolutionNote: string | null;
-  }) => Promise<void>;
-  pending: boolean;
-  error?: { message?: string };
-};
-
-function TicketDialog({ ticket, onClose, onSubmit, pending, error }: DialogProps) {
-  const [status, setStatus] = useState<SupportTicketStatus>(ticket.status);
-  const [priority, setPriority] = useState<SupportTicketPriority>(ticket.priority);
-  const [note, setNote] = useState<string>(ticket.resolutionNote ?? "");
-
-  return (
-    <div
-      role="dialog"
-      aria-modal="true"
-      aria-labelledby="ticket-title"
-      className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4"
-      onClick={(e) => {
-        if (e.target === e.currentTarget) onClose();
-      }}
-    >
-      <div className="w-full max-w-lg rounded-2xl border border-[var(--line)] bg-[var(--surface)] p-6 shadow-xl">
-        <h2 id="ticket-title" className="font-display text-xl font-bold text-[var(--ink)]">
-          {ticket.subject}
-        </h2>
-        <p className="mt-1 text-xs text-[var(--mute)]">
-          Reported by {ticket.reporterName} · {fmt(ticket.createdAt)}
-        </p>
-
-        <pre className="mt-4 whitespace-pre-wrap rounded-lg border border-[var(--line)] bg-[var(--surface-2)]/40 p-3 text-sm text-[var(--ink)]">
-          {ticket.body}
-        </pre>
-
-        <form
-          onSubmit={(e) => {
-            e.preventDefault();
-            void onSubmit({ status, priority, resolutionNote: note.trim() || null });
-          }}
-          className="mt-5 space-y-4"
-        >
-          <div className="grid grid-cols-2 gap-3">
-            <div>
-              <label className="block text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">
-                Status
-              </label>
-              <select
-                value={status}
-                onChange={(e) => setStatus(e.target.value as SupportTicketStatus)}
-                className="mt-1 w-full rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-sm text-[var(--ink)]"
-              >
-                {STATUS_OPTIONS.map((s) => (
-                  <option key={s} value={s}>{s}</option>
-                ))}
-              </select>
-            </div>
-            <div>
-              <label className="block text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">
-                Priority
-              </label>
-              <select
-                value={priority}
-                onChange={(e) => setPriority(e.target.value as SupportTicketPriority)}
-                className="mt-1 w-full rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-sm text-[var(--ink)]"
-              >
-                {PRIORITY_OPTIONS.map((p) => (
-                  <option key={p} value={p}>{p}</option>
-                ))}
-              </select>
-            </div>
-          </div>
-
-          <div>
-            <label className="block text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">
-              Resolution note
-            </label>
-            <textarea
-              value={note}
-              onChange={(e) => setNote(e.target.value)}
-              rows={3}
-              maxLength={2000}
-              className="mt-1 w-full rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-sm text-[var(--ink)]"
-            />
-          </div>
-
-          {error && (
-            <p role="alert" className="text-sm text-[var(--danger)]">
-              {error.message ?? "Failed to update."}
-            </p>
-          )}
-
-          <div className="flex justify-end gap-2 pt-2">
-            <button
-              type="button"
-              onClick={onClose}
-              className="rounded-full border border-[var(--line)] bg-[var(--surface)] px-4 py-2 text-xs font-semibold text-[var(--mute)] hover:bg-[var(--surface-2)]"
-            >
-              Close
-            </button>
-            <button
-              type="submit"
-              disabled={pending}
-              className="rounded-full bg-[var(--indigo)] px-4 py-2 text-xs font-semibold text-white hover:opacity-90 disabled:opacity-50"
-            >
-              {pending ? "Saving…" : "Save"}
-            </button>
-          </div>
-        </form>
-      </div>
-    </div>
-  );
-}
diff --git a/frontend/client/app/discover/error.tsx b/frontend/client/app/discover/error.tsx
deleted file mode 100644
index 3f1179a..0000000
--- a/frontend/client/app/discover/error.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-"use client";
-
-import { useEffect } from "react";
-
-type Props = {
-  error: Error & { digest?: string };
-  reset: () => void;
-};
-
-export default function DiscoverError({ error, reset }: Props) {
-  useEffect(() => {
-    console.error("[DiscoverError]", error);
-  }, [error]);
-
-  return (
-    <div className="flex min-h-[60vh] flex-col items-center justify-center gap-6 px-4 text-center">
-      <div className="flex flex-col gap-2">
-        <h2 className="text-xl font-semibold text-[var(--ink)]">Failed to load discovery</h2>
-        <p className="text-sm text-[var(--mute)]">
-          Something went wrong while loading freelancer results.
-        </p>
-      </div>
-      <button
-        type="button"
-        onClick={reset}
-        className="rounded-full bg-[var(--indigo)] px-5 py-2.5 text-sm font-semibold text-white shadow-[var(--shadow-cta)] transition-[background,transform] duration-[220ms] hover:-translate-y-px hover:bg-[var(--indigo-deep)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
-      >
-        Try again
-      </button>
-    </div>
-  );
-}
diff --git a/frontend/client/app/discover/loading.tsx b/frontend/client/app/discover/loading.tsx
deleted file mode 100644
index 9a18e99..0000000
--- a/frontend/client/app/discover/loading.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-export default function DiscoverLoading() {
-  return (
-    <div
-      className="grid grid-cols-1 gap-4 p-6 sm:grid-cols-2 lg:grid-cols-3"
-      aria-busy="true"
-      aria-label="Loading discover feed"
-    >
-      {Array.from({ length: 6 }).map((_, i) => (
-        <div
-          key={i}
-          className="flex flex-col gap-4 rounded-2xl border border-[var(--line)] bg-[var(--surface)] p-6"
-        >
-          <div className="flex items-start justify-between gap-3">
-            <div className="flex items-center gap-3">
-              <div className="h-11 w-11 animate-pulse rounded-full bg-[var(--surface-2)]" />
-              <div className="space-y-2">
-                <div className="h-4 w-28 animate-pulse rounded bg-[var(--surface-2)]" />
-                <div className="h-3 w-16 animate-pulse rounded bg-[var(--surface-2)]" />
-              </div>
-            </div>
-            <div className="h-6 w-20 animate-pulse rounded-full bg-[var(--surface-2)]" />
-          </div>
-          <div className="space-y-2">
-            <div className="h-3 w-full animate-pulse rounded bg-[var(--surface-2)]" />
-            <div className="h-3 w-3/4 animate-pulse rounded bg-[var(--surface-2)]" />
-          </div>
-          <div className="h-10 w-full animate-pulse rounded-xl bg-[var(--surface-2)]" />
-        </div>
-      ))}
-    </div>
-  );
-}
diff --git a/frontend/client/app/help/page.tsx b/frontend/client/app/help/page.tsx
deleted file mode 100644
index 1e68486..0000000
--- a/frontend/client/app/help/page.tsx
+++ /dev/null
@@ -1,181 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { motion } from "framer-motion";
-import { NavigationHeader } from "@/components/ui/NavigationHeader";
-import { useCreateSupportTicket, useMySupportTickets } from "@/hooks/useAdmin";
-import type { SupportTicketPriority, SupportTicketStatus } from "@/types/admin";
-
-const PRIORITY_OPTIONS: SupportTicketPriority[] = ["Low", "Normal", "High", "Urgent"];
-
-const STATUS_BADGE: Record<SupportTicketStatus, string> = {
-  Open: "bg-[var(--surface-2)] text-[var(--ink)]",
-  InProgress: "bg-[var(--indigo-soft)] text-[var(--indigo)]",
-  Resolved: "bg-[var(--surface-2)] text-[var(--success)]",
-  Closed: "bg-[var(--surface-2)] text-[var(--mute)]",
-};
-
-function fmt(iso: string): string {
-  return new Date(iso).toLocaleString("en-US", {
-    year: "numeric",
-    month: "short",
-    day: "numeric",
-    hour: "2-digit",
-    minute: "2-digit",
-  });
-}
-
-export default function HelpPage() {
-  const [subject, setSubject] = useState("");
-  const [body, setBody] = useState("");
-  const [priority, setPriority] = useState<SupportTicketPriority>("Normal");
-  const [submitted, setSubmitted] = useState(false);
-  const { data: mine, isLoading } = useMySupportTickets();
-  const create = useCreateSupportTicket();
-
-  const canSubmit = subject.trim().length > 0 && body.trim().length > 0 && !create.isPending;
-
-  const handleSubmit = async (e: React.FormEvent) => {
-    e.preventDefault();
-    if (!canSubmit) return;
-    await create.mutateAsync({ subject: subject.trim(), body: body.trim(), priority });
-    setSubject("");
-    setBody("");
-    setPriority("Normal");
-    setSubmitted(true);
-    setTimeout(() => setSubmitted(false), 4000);
-  };
-
-  return (
-    <div className="min-h-screen bg-[var(--bg)] text-[var(--ink)]">
-      <NavigationHeader showAuthButtons={false} />
-      <div className="mx-auto flex max-w-3xl flex-col gap-8 px-4 py-8 sm:px-6 lg:px-8">
-        <motion.div
-          initial={{ opacity: 0, y: -12 }}
-          animate={{ opacity: 1, y: 0 }}
-          transition={{ duration: 0.3, ease: "easeOut" }}
-        >
-          <h1 className="font-display text-2xl font-bold tracking-[-0.03em] sm:text-3xl">
-            Help &amp; Support
-          </h1>
-          <p className="mt-1 text-sm text-[var(--mute)]">
-            File a ticket. Admins respond via the dashboard.
-          </p>
-        </motion.div>
-
-        <section className="rounded-2xl border border-[var(--line)] bg-[var(--surface)] p-6">
-          <h2 className="text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
-            New ticket
-          </h2>
-          <form onSubmit={handleSubmit} className="mt-4 space-y-4">
-            <div>
-              <div className="flex items-center justify-between">
-                <label className="block text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">
-                  Subject
-                </label>
-                <span className={`text-[10px] tabular-nums ${subject.length >= 200 ? "text-[var(--danger)]" : "text-[var(--mute)]"}`}>
-                  {subject.length}/200
-                </span>
-              </div>
-              <input
-                type="text"
-                value={subject}
-                onChange={(e) => setSubject(e.target.value)}
-                required
-                maxLength={200}
-                placeholder="One-line summary"
-                className="mt-1 w-full rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
-              />
-            </div>
-            <div>
-              <div className="flex items-center justify-between">
-                <label className="block text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">
-                  Describe the issue
-                </label>
-                <span className={`text-[10px] tabular-nums ${body.length >= 4000 ? "text-[var(--danger)]" : "text-[var(--mute)]"}`}>
-                  {body.length}/4000
-                </span>
-              </div>
-              <textarea
-                value={body}
-                onChange={(e) => setBody(e.target.value)}
-                required
-                rows={6}
-                maxLength={4000}
-                className="mt-1 w-full rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
-              />
-            </div>
-            <div>
-              <label className="block text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">
-                Priority
-              </label>
-              <select
-                value={priority}
-                onChange={(e) => setPriority(e.target.value as SupportTicketPriority)}
-                className="mt-1 w-48 rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-sm"
-              >
-                {PRIORITY_OPTIONS.map((p) => (
-                  <option key={p} value={p}>{p}</option>
-                ))}
-              </select>
-            </div>
-            {create.isError && (
-              <p role="alert" className="text-sm text-[var(--danger)]">
-                {(create.error as { message?: string } | undefined)?.message ?? "Failed to submit."}
-              </p>
-            )}
-            {submitted && (
-              <p className="text-sm text-[var(--success)]">Submitted. Admins notified.</p>
-            )}
-            <div className="flex justify-end">
-              <button
-                type="submit"
-                disabled={!canSubmit}
-                className="rounded-full bg-[var(--indigo)] px-4 py-2 text-xs font-semibold text-white hover:opacity-90 disabled:opacity-50"
-              >
-                {create.isPending ? "Submitting…" : "Submit ticket"}
-              </button>
-            </div>
-          </form>
-        </section>
-
-        <section>
-          <h2 className="text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
-            My tickets
-          </h2>
-          <div className="mt-3 overflow-x-auto rounded-2xl border border-[var(--line)] bg-[var(--surface)]">
-            {isLoading && (
-              <div className="space-y-2 p-4">
-                {Array.from({ length: 3 }).map((_, i) => (
-                  <div key={i} className="h-10 animate-pulse rounded-lg bg-[var(--surface-2)]" />
-                ))}
-              </div>
-            )}
-            {!isLoading && mine && mine.items.length === 0 && (
-              <p className="p-6 text-center text-sm text-[var(--mute)]">No tickets yet.</p>
-            )}
-            {!isLoading && mine && mine.items.length > 0 && (
-              <ul className="divide-y divide-[var(--line)]">
-                {mine.items.map((t) => (
-                  <li key={t.id} className="px-4 py-3">
-                    <div className="flex items-center justify-between gap-3">
-                      <p className="truncate text-sm font-medium">{t.subject}</p>
-                      <span className={`shrink-0 rounded-full px-2.5 py-1 text-xs font-semibold ${STATUS_BADGE[t.status]}`}>
-                        {t.status}
-                      </span>
-                    </div>
-                    <p className="mt-0.5 line-clamp-1 text-xs text-[var(--mute)]">{t.body}</p>
-                    <p className="mt-1 text-[10px] text-[var(--mute)]">
-                      {t.priority} · {fmt(t.createdAt)}
-                      {t.resolutionNote && ` · note: ${t.resolutionNote}`}
-                    </p>
-                  </li>
-                ))}
-              </ul>
-            )}
-          </div>
-        </section>
-      </div>
-    </div>
-  );
-}
diff --git a/frontend/client/app/messages/error.tsx b/frontend/client/app/messages/error.tsx
deleted file mode 100644
index 29d70d6..0000000
--- a/frontend/client/app/messages/error.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-"use client";
-
-import { useEffect } from "react";
-
-type Props = {
-  error: Error & { digest?: string };
-  reset: () => void;
-};
-
-export default function MessagesError({ error, reset }: Props) {
-  useEffect(() => {
-    console.error("[MessagesError]", error);
-  }, [error]);
-
-  return (
-    <div className="flex min-h-[60vh] flex-col items-center justify-center gap-6 px-4 text-center">
-      <div className="flex flex-col gap-2">
-        <h2 className="text-xl font-semibold text-[var(--ink)]">Failed to load messages</h2>
-        <p className="text-sm text-[var(--mute)]">
-          Something went wrong while loading your conversations.
-        </p>
-      </div>
-      <button
-        type="button"
-        onClick={reset}
-        className="rounded-full bg-[var(--indigo)] px-5 py-2.5 text-sm font-semibold text-white shadow-[var(--shadow-cta)] transition-[background,transform] duration-[220ms] hover:-translate-y-px hover:bg-[var(--indigo-deep)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
-      >
-        Try again
-      </button>
-    </div>
-  );
-}
diff --git a/frontend/client/app/messages/loading.tsx b/frontend/client/app/messages/loading.tsx
deleted file mode 100644
index f52283a..0000000
--- a/frontend/client/app/messages/loading.tsx
+++ /dev/null
@@ -1,28 +0,0 @@
-export default function MessagesLoading() {
-  return (
-    <div
-      className="flex h-screen flex-col bg-[var(--bg)] text-[var(--ink)]"
-      aria-busy="true"
-      aria-label="Loading messages"
-    >
-      <div className="h-14 border-b border-[var(--line)] bg-[var(--surface)]" />
-      <div className="flex flex-1 overflow-hidden">
-        <div className="hidden w-80 shrink-0 border-r border-[var(--line)] p-4 sm:block lg:w-96">
-          {Array.from({ length: 6 }).map((_, i) => (
-            <div
-              key={i}
-              className="mb-3 flex items-center gap-3 rounded-lg p-2"
-            >
-              <div className="h-10 w-10 animate-pulse rounded-full bg-[var(--surface-2)]" />
-              <div className="flex-1 space-y-2">
-                <div className="h-3 w-3/4 animate-pulse rounded bg-[var(--surface-2)]" />
-                <div className="h-3 w-1/2 animate-pulse rounded bg-[var(--surface-2)]" />
-              </div>
-            </div>
-          ))}
-        </div>
-        <div className="flex-1 animate-pulse bg-[var(--surface-2)]/20" />
-      </div>
-    </div>
-  );
-}
diff --git a/frontend/client/app/profile/[id]/page.tsx b/frontend/client/app/profile/[id]/page.tsx
deleted file mode 100644
index 6487ee4..0000000
--- a/frontend/client/app/profile/[id]/page.tsx
+++ /dev/null
@@ -1,94 +0,0 @@
-"use client";
-
-import { use } from "react";
-import { UserX } from "lucide-react";
-import { AppNavigation } from "@/components/ui/AppNavigation";
-import { FreelancerProfileCard } from "@/components/profile/FreelancerProfileCard";
-import { EnterpriseProfileCard } from "@/components/profile/EnterpriseProfileCard";
-import { ReportButton } from "@/components/moderation/ReportButton";
-import { useAuthStore } from "@/stores/authStore";
-import { normalizeRole } from "@/lib/auth/role";
-import { useUserProfile, useMe } from "@/hooks/useAuth";
-import type { PublicUser } from "@/types/auth";
-
-type Props = {
-  params: Promise<{ id: string }>;
-};
-
-function ProfileSkeleton() {
-  return (
-    <div className="flex flex-col gap-6 rounded-2xl border border-[var(--line)] bg-[var(--surface)] p-8">
-      <div className="flex items-center gap-4">
-        <div className="h-20 w-20 animate-pulse rounded-full bg-[var(--surface-2)]" />
-        <div className="space-y-2">
-          <div className="h-5 w-48 animate-pulse rounded bg-[var(--surface-2)]" />
-          <div className="h-4 w-32 animate-pulse rounded bg-[var(--surface-2)]" />
-          <div className="h-4 w-24 animate-pulse rounded bg-[var(--surface-2)]" />
-        </div>
-      </div>
-      <div className="h-24 w-full animate-pulse rounded bg-[var(--surface-2)]" />
-      <div className="flex gap-2">
-        {[1, 2, 3, 4].map((i) => (
-          <div key={i} className="h-7 w-20 animate-pulse rounded-full bg-[var(--surface-2)]" />
-        ))}
-      </div>
-    </div>
-  );
-}
-
-export default function ProfilePage({ params }: Props) {
-  const { id } = use(params);
-  const user = useAuthStore((s) => s.user);
-  const role = normalizeRole(user?.role);
-
-  const isSelf = id === "me" || (user?.id != null && id === user.id);
-
-  useMe(); // keep auth store warm
-  const profileQuery = useUserProfile(isSelf ? (user?.id ?? null) : id);
-
-  const profileData: PublicUser | null | undefined = profileQuery.data;
-  const isLoading = profileQuery.isLoading;
-  const isNotFound = !isLoading && !profileData;
-
-  const profileRole = profileData
-    ? normalizeRole(profileData.role) ?? "freelancer"
-    : role;
-
-  return (
-    <div className="min-h-screen bg-[var(--bg)] text-[var(--ink)]">
-      <AppNavigation />
-
-      <main className="mx-auto max-w-5xl space-y-6 px-4 py-10 sm:px-6 lg:px-8">
-        {isLoading ? (
-          <ProfileSkeleton />
-        ) : isNotFound || !profileData ? (
-          <div className="flex flex-col items-center justify-center gap-4 py-32 text-center">
-            <UserX aria-hidden="true" className="h-12 w-12 text-[var(--mute)]" />
-            <h1 className="text-lg font-semibold text-[var(--ink)]">Profile not found</h1>
-            <p className="text-sm text-[var(--mute)]">
-              No profile exists for ID &quot;{id}&quot;.
-            </p>
-          </div>
-        ) : profileRole === "enterprise" ? (
-          <>
-            <EnterpriseProfileCard profile={profileData} isSelf={isSelf} />
-            {!isSelf && (
-              <div className="flex justify-end">
-                <ReportButton entityType="Profile" entityId={profileData.id} />
-              </div>
-            )}
-          </>
-        ) : (
-          <>
-            <FreelancerProfileCard profile={profileData} isSelf={isSelf} />
-            {!isSelf && (
-              <div className="flex justify-end">
-                <ReportButton entityType="Profile" entityId={profileData.id} />
-              </div>
-            )}
-          </>
-        )}
-      </main>
-    </div>
-  );
-}
diff --git a/frontend/client/app/projects/error.tsx b/frontend/client/app/projects/error.tsx
deleted file mode 100644
index 74e9a6f..0000000
--- a/frontend/client/app/projects/error.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-"use client";
-
-import { useEffect } from "react";
-
-type Props = {
-  error: Error & { digest?: string };
-  reset: () => void;
-};
-
-export default function ProjectsError({ error, reset }: Props) {
-  useEffect(() => {
-    console.error("[ProjectsError]", error);
-  }, [error]);
-
-  return (
-    <div className="flex min-h-[60vh] flex-col items-center justify-center gap-6 px-4 text-center">
-      <div className="flex flex-col gap-2">
-        <h2 className="text-xl font-semibold text-[var(--ink)]">Failed to load projects</h2>
-        <p className="text-sm text-[var(--mute)]">
-          Something went wrong while loading your projects.
-        </p>
-      </div>
-      <button
-        type="button"
-        onClick={reset}
-        className="rounded-full bg-[var(--indigo)] px-5 py-2.5 text-sm font-semibold text-white shadow-[var(--shadow-cta)] transition-[background,transform] duration-[220ms] hover:-translate-y-px hover:bg-[var(--indigo-deep)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
-      >
-        Try again
-      </button>
-    </div>
-  );
-}
diff --git a/frontend/client/app/projects/loading.tsx b/frontend/client/app/projects/loading.tsx
deleted file mode 100644
index 8b340cf..0000000
--- a/frontend/client/app/projects/loading.tsx
+++ /dev/null
@@ -1,24 +0,0 @@
-export default function ProjectsLoading() {
-  return (
-    <div
-      className="grid grid-cols-1 gap-4 p-6 sm:grid-cols-2 lg:grid-cols-3"
-      aria-busy="true"
-      aria-label="Loading projects"
-    >
-      {Array.from({ length: 6 }).map((_, i) => (
-        <div
-          key={i}
-          className="flex flex-col gap-3 rounded-2xl border border-[var(--line)] bg-[var(--surface)] p-6"
-        >
-          <div className="h-5 w-3/4 animate-pulse rounded bg-[var(--surface-2)]" />
-          <div className="h-3 w-full animate-pulse rounded bg-[var(--surface-2)]" />
-          <div className="h-3 w-2/3 animate-pulse rounded bg-[var(--surface-2)]" />
-          <div className="mt-2 flex gap-2">
-            <div className="h-6 w-16 animate-pulse rounded-full bg-[var(--surface-2)]" />
-            <div className="h-6 w-16 animate-pulse rounded-full bg-[var(--surface-2)]" />
-          </div>
-        </div>
-      ))}
-    </div>
-  );
-}
diff --git a/frontend/client/components/onboarding/ProficienciesStep.tsx b/frontend/client/components/onboarding/ProficienciesStep.tsx
index 5d61ddc..2815f8f 100644
--- a/frontend/client/components/onboarding/ProficienciesStep.tsx
+++ b/frontend/client/components/onboarding/ProficienciesStep.tsx
@@ -5,7 +5,7 @@ import { useOnboardingStore } from "@/stores/onboardingStore";
 import { useAuthStore } from "@/stores/authStore";
 import { useSkills } from "@/hooks/useOnboarding";
 import SkillChip from "@/components/ui/SkillChip";
-import { useMemo, useState } from "react";
+import { useMemo, useReducer } from "react";
 
 type Props = {
   onNext?: () => void;
@@ -13,12 +13,42 @@ type Props = {
   direction?: 1 | -1;
 };
 
+type StepState = {
+  selectedSkills: string[];
+  exitMode: "none" | "next" | "back";
+};
+
+type StepAction =
+  | { type: "toggle"; id: string }
+  | { type: "exitNext" }
+  | { type: "exitBack" };
+
+function stepReducer(state: StepState, action: StepAction): StepState {
+  switch (action.type) {
+    case "toggle":
+      return {
+        ...state,
+        selectedSkills: state.selectedSkills.includes(action.id)
+          ? state.selectedSkills.filter((s) => s !== action.id)
+          : [...state.selectedSkills, action.id],
+      };
+    case "exitNext":
+      return { ...state, exitMode: "next" };
+    case "exitBack":
+      return { ...state, exitMode: "back" };
+  }
+}
+
 export default function ProficienciesStep({ onNext, onBack, direction = 1 }: Props) {
   const { role } = useOnboardingStore();
   const { proficiencies, setProficiencies } = useAuthStore();
-  const [selectedSkills, setSelectedSkills] = useState<string[]>(proficiencies);
-  const [isExiting, setIsExiting] = useState(false);
-  const [isGoingBack, setIsGoingBack] = useState(false);
+  const [state, dispatch] = useReducer(stepReducer, {
+    selectedSkills: proficiencies,
+    exitMode: "none",
+  });
+  const { selectedSkills, exitMode } = state;
+  const isExiting = exitMode !== "none";
+  const isGoingBack = exitMode === "back";
 
   const { data: allSkills, isLoading, isError, refetch, isFetching } = useSkills();
 
@@ -38,13 +68,13 @@ export default function ProficienciesStep({ onNext, onBack, direction = 1 }: Pro
   const canContinue = hasSelections && !isLoading && !isError;
 
   const toggleSkill = (id: string) => {
-    setSelectedSkills((prev) => (prev.includes(id) ? prev.filter((skill) => skill !== id) : [...prev, id]));
+    dispatch({ type: "toggle", id });
   };
 
   const handleContinue = () => {
     if (!canContinue || isExiting) return;
     setProficiencies(validSelectedSkills);
-    setIsExiting(true);
+    dispatch({ type: "exitNext" });
   };
 
   return (
@@ -149,8 +179,7 @@ export default function ProficienciesStep({ onNext, onBack, direction = 1 }: Pro
             type="button"
             onClick={() => {
               if (isExiting) return;
-              setIsGoingBack(true);
-              setIsExiting(true);
+              dispatch({ type: "exitBack" });
             }}
             disabled={isExiting}
             className="rounded-full px-2 py-1 text-sm text-[var(--mute)] transition-colors hover:text-[var(--ink)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] focus-visible:ring-offset-2 disabled:opacity-50"

From 0abacb2b1dd3a17f297dc2836a955e8dc291dd49 Mon Sep 17 00:00:00 2001
From: Enes1998 <104234112+Enes1998@users.noreply.github.com>
Date: Tue, 26 May 2026 19:58:15 +0200
Subject: [PATCH 02/12] fix(ci): use v-prefixed Trivy tag (v0.36.0)

Action resolver matches the exact git tag name; aquasecurity/trivy-action
publishes tags as v-prefixed (v0.36.0, v0.35.0, ...), not bare (0.36.0).
Earlier bump used the bare form and CI failed at action resolution.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 38837f3..f34f47a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -198,7 +198,7 @@ jobs:
           tags: life-frontend:security
 
       - name: Run Trivy filesystem scan (SARIF)
-        uses: aquasecurity/trivy-action@0.36.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: fs
           scan-ref: .
@@ -207,7 +207,7 @@ jobs:
           severity: CRITICAL,HIGH
 
       - name: Enforce no CRITICAL vulnerabilities (backend image)
-        uses: aquasecurity/trivy-action@0.36.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: image
           image-ref: life-backend:security
@@ -217,7 +217,7 @@ jobs:
           exit-code: "1"
 
       - name: Enforce no CRITICAL vulnerabilities (frontend image)
-        uses: aquasecurity/trivy-action@0.36.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: image
           image-ref: life-frontend:security

From 29d9683f73e9d0bdb5bcdf7667fd04fcb3dc48af Mon Sep 17 00:00:00 2001
From: Enes1998 <104234112+Enes1998@users.noreply.github.com>
Date: Tue, 26 May 2026 20:07:43 +0200
Subject: [PATCH 03/12] ci: add develop to push + pull_request triggers

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f34f47a..ad09660 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,9 +4,11 @@ on:
   push:
     branches:
       - main
+      - develop
   pull_request:
     branches:
       - main
+      - develop
 
 permissions:
   contents: read

From c3327d4913782d98adec3de3dffcc4122d442679 Mon Sep 17 00:00:00 2001
From: Enes1998 <104234112+Enes1998@users.noreply.github.com>
Date: Tue, 26 May 2026 20:27:12 +0200
Subject: [PATCH 04/12] ci: jest.config TS->JS (drop ts-node), develop
 triggers, codeql v4, trufflehog auto-detect, actions:read

---
 .github/workflows/ci.yml                           | 6 ++----
 frontend/client/{jest.config.ts => jest.config.js} | 7 ++-----
 2 files changed, 4 insertions(+), 9 deletions(-)
 rename frontend/client/{jest.config.ts => jest.config.js} (82%)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ad09660..ac4d5b0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,7 @@ permissions:
   contents: read
   security-events: write
   packages: write
+  actions: read
 
 jobs:
   secret-scan:
@@ -28,9 +29,6 @@ jobs:
       - name: Run TruffleHog (verified secrets only)
         uses: trufflesecurity/trufflehog@main
         with:
-          path: ./
-          base: ${{ github.event.repository.default_branch }}
-          head: HEAD
           extra_args: --results=verified,unknown
 
   quality:
@@ -229,7 +227,7 @@ jobs:
           exit-code: "1"
 
       - name: Upload Trivy SARIF report
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: trivy-results.sarif
 
diff --git a/frontend/client/jest.config.ts b/frontend/client/jest.config.js
similarity index 82%
rename from frontend/client/jest.config.ts
rename to frontend/client/jest.config.js
index c00b9ab..dca21a5 100644
--- a/frontend/client/jest.config.ts
+++ b/frontend/client/jest.config.js
@@ -1,6 +1,5 @@
-import type { Config } from "jest";
-
-const config: Config = {
+/** @type {import('jest').Config} */
+module.exports = {
   testEnvironment: "jsdom",
   testPathIgnorePatterns: ["/node_modules/", "<rootDir>/e2e/"],
   transform: {
@@ -20,5 +19,3 @@ const config: Config = {
   },
   setupFilesAfterEnv: ["<rootDir>/jest.setup.ts"],
 };
-
-export default config;

From b2477042b26113e4803257be7ea8df9ce345b96f Mon Sep 17 00:00:00 2001
From: Enes1998 <104234112+Enes1998@users.noreply.github.com>
Date: Tue, 26 May 2026 20:38:57 +0200
Subject: [PATCH 05/12] ci: jest.config TS->JS, develop triggers, trufflehog
 auto-detect, sarif artifact instead of GHAS

---
 .github/workflows/ci.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ac4d5b0..dda4e17 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -226,10 +226,13 @@ jobs:
           ignore-unfixed: true
           exit-code: "1"
 
-      - name: Upload Trivy SARIF report
-        uses: github/codeql-action/upload-sarif@v4
+      - name: Upload Trivy SARIF report (artifact)
+        if: always()
+        uses: actions/upload-artifact@v4
         with:
-          sarif_file: trivy-results.sarif
+          name: trivy-sarif
+          path: trivy-results.sarif
+          retention-days: 30
 
   build-images:
     name: Build & Push Docker Images

From 3cbeeac399a41dda7360c8b0c36e387b85f20cc4 Mon Sep 17 00:00:00 2001
From: Edi Asllani <ediasllani03@gmail.com>
Date: Tue, 2 Jun 2026 10:40:37 +0200
Subject: [PATCH 06/12] Fix-Getting Started dynamically differs based on user
 role

---
 .../Endpoints/ProjectEndpoints.cs             |  17 ++
 .../GetMyApplicationsQuery.cs                 |   6 +
 .../GetMyApplicationsQueryHandler.cs          |  61 ++++++
 .../components/ui/GettingStartedChecklist.tsx |  88 ++++++---
 .../hooks/useGettingStartedChecklist.ts       | 175 +++++++++++++-----
 frontend/client/hooks/useProjects.ts          |  10 +
 frontend/client/lib/api/projects.ts           |   5 +
 7 files changed, 282 insertions(+), 80 deletions(-)
 create mode 100644 backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQuery.cs
 create mode 100644 backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQueryHandler.cs

diff --git a/backend/src/Loopless.Api/Endpoints/ProjectEndpoints.cs b/backend/src/Loopless.Api/Endpoints/ProjectEndpoints.cs
index 7427f24..782cc2f 100644
--- a/backend/src/Loopless.Api/Endpoints/ProjectEndpoints.cs
+++ b/backend/src/Loopless.Api/Endpoints/ProjectEndpoints.cs
@@ -11,6 +11,7 @@
 using Loopless.Application.Features.Projects.GenerateSummary;
 using Loopless.Application.Features.Projects.GetCommits;
 using Loopless.Application.Features.Projects.GetDashboard;
+using Loopless.Application.Features.Projects.GetMyApplications;
 using Loopless.Application.Features.Projects.GetMyInvitations;
 using Loopless.Application.Features.Projects.GetProjectInvitations;
 using Loopless.Application.Features.Projects.GetProjectLinks;
@@ -481,6 +482,22 @@ public static IEndpointRouteBuilder MapInvitationEndpoints(this IEndpointRouteBu
         .Produces<IReadOnlyList<InvitationDto>>(StatusCodes.Status200OK)
         .Produces(StatusCodes.Status401Unauthorized);
 
+        // Applications the freelancer initiated themselves. Kept separate from
+        // /invitations/me so the projects "Pending invitations" view (which lists
+        // invitations to accept/decline) is not polluted with outgoing applications.
+        app.MapGet("/api/v1/applications/me", async (
+            ISender sender,
+            CancellationToken ct) =>
+        {
+            var result = await sender.Send(new GetMyApplicationsQuery(), ct);
+            return Results.Ok(result);
+        })
+        .WithTags("Invitations")
+        .RequireAuthorization()
+        .WithName("GetMyApplications")
+        .Produces<IReadOnlyList<InvitationDto>>(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status401Unauthorized);
+
         group.MapPut("/{invitationId:guid}/accept", async (
             [FromRoute] Guid invitationId,
             ISender sender,
diff --git a/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQuery.cs b/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQuery.cs
new file mode 100644
index 0000000..77b26b0
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQuery.cs
@@ -0,0 +1,6 @@
+using Loopless.Application.DTOs;
+using MediatR;
+
+namespace Loopless.Application.Features.Projects.GetMyApplications;
+
+public sealed record GetMyApplicationsQuery() : IRequest<IReadOnlyList<InvitationDto>>;
diff --git a/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQueryHandler.cs b/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQueryHandler.cs
new file mode 100644
index 0000000..5065708
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQueryHandler.cs
@@ -0,0 +1,61 @@
+using Loopless.Application.Common.Exceptions;
+using Loopless.Application.DTOs;
+using Loopless.Application.Interfaces;
+using Loopless.Domain.Enums;
+using MediatR;
+using Microsoft.EntityFrameworkCore;
+
+namespace Loopless.Application.Features.Projects.GetMyApplications;
+
+public sealed class GetMyApplicationsQueryHandler(
+    IAppDbContext db,
+    ICurrentUser currentUser) : IRequestHandler<GetMyApplicationsQuery, IReadOnlyList<InvitationDto>>
+{
+    public async Task<IReadOnlyList<InvitationDto>> Handle(GetMyApplicationsQuery request, CancellationToken cancellationToken)
+    {
+        var keycloakId = currentUser.KeycloakId
+            ?? throw new UnauthorizedException("Missing subject claim.");
+
+        var user = await db.Users
+            .FirstOrDefaultAsync(u => u.KeycloakId == keycloakId, cancellationToken)
+            ?? throw new NotFoundException("User not found.");
+
+        // Only freelancers apply to projects; everyone else has no applications of their own.
+        if (user.Role != UserRole.Freelancer)
+            return [];
+
+        var rows = await db.ProjectInvitations
+            .Where(i => i.FreelancerId == user.Id && i.InitiatedBy == "Freelancer")
+            .Join(db.Projects.Where(p => !p.IsDeleted),
+                  i => i.ProjectId, p => p.Id,
+                  (i, p) => new { i, ProjectTitle = p.Title })
+            .Join(db.Users.Where(u => !u.IsDeleted),
+                  x => x.i.EnterpriseId, u => u.Id,
+                  (x, e) => new { x.i, x.ProjectTitle, EnterpriseName = e.Name })
+            .GroupJoin(db.Users.Where(u => !u.IsDeleted),
+                  x => x.i.FreelancerId, u => u.Id,
+                  (x, freelancers) => new { x.i, x.ProjectTitle, x.EnterpriseName, Freelancers = freelancers })
+            .SelectMany(x => x.Freelancers.DefaultIfEmpty(),
+                  (x, f) => new
+                  {
+                      x.i.Id,
+                      x.i.ProjectId,
+                      x.ProjectTitle,
+                      x.i.EnterpriseId,
+                      x.EnterpriseName,
+                      x.i.FreelancerId,
+                      FreelancerName = f != null ? f.Name : null,
+                      x.i.InitiatedBy,
+                      x.i.Status,
+                      x.i.InvitedAt,
+                  })
+            .OrderByDescending(r => r.InvitedAt)
+            .ToListAsync(cancellationToken);
+
+        return rows.Select(r => new InvitationDto(
+            r.Id, r.ProjectId, r.ProjectTitle,
+            r.EnterpriseId, r.EnterpriseName,
+            r.FreelancerId, r.FreelancerName,
+            r.InitiatedBy, r.Status, r.InvitedAt)).ToList();
+    }
+}
diff --git a/frontend/client/components/ui/GettingStartedChecklist.tsx b/frontend/client/components/ui/GettingStartedChecklist.tsx
index 7acaeb8..dc07010 100644
--- a/frontend/client/components/ui/GettingStartedChecklist.tsx
+++ b/frontend/client/components/ui/GettingStartedChecklist.tsx
@@ -11,21 +11,6 @@ export function GettingStartedBadge() {
     useGettingStartedChecklist();
   const [open, setOpen] = useState(false);
   const containerRef = useRef<HTMLDivElement>(null);
-  const [celebrating, setCelebrating] = useState(false);
-  const prevAllDoneRef = useRef(false);
-
-  useEffect(() => {
-    if (allDone && !prevAllDoneRef.current && visible) {
-      queueMicrotask(() => setCelebrating(true));
-      const t = setTimeout(() => {
-        dismiss();
-        setOpen(false);
-      }, 2500);
-      return () => clearTimeout(t);
-    }
-    prevAllDoneRef.current = allDone;
-    return undefined;
-  }, [allDone, visible, dismiss]);
 
   useEffect(() => {
     function handleClickOutside(e: MouseEvent) {
@@ -43,16 +28,46 @@ export function GettingStartedBadge() {
 
   return (
     <div ref={containerRef} className="relative">
-      <button
+      <motion.button
         type="button"
         onClick={() => setOpen((v) => !v)}
-        aria-label={`Getting started: ${doneCount} of ${total} complete`}
+        aria-label={
+          allDone
+            ? "Getting started complete"
+            : `Getting started: ${doneCount} of ${total} complete`
+        }
         aria-expanded={open}
-        className="relative inline-flex items-center gap-1.5 rounded-full px-2.5 py-1.5 text-sm font-medium text-[var(--mute)] transition hover:bg-[var(--surface-2)] hover:text-[var(--ink)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
+        animate={
+          allDone
+            ? {
+                boxShadow: [
+                  "0 0 0 0 rgba(99,102,241,0)",
+                  "0 0 0 4px rgba(99,102,241,0.25)",
+                  "0 0 0 0 rgba(99,102,241,0)",
+                ],
+              }
+            : {}
+        }
+        transition={
+          allDone ? { duration: 2, repeat: Infinity, ease: "easeInOut" } : {}
+        }
+        className={`relative inline-flex items-center gap-1.5 rounded-full px-2.5 py-1.5 text-sm font-medium transition focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] ${
+          allDone
+            ? "text-[var(--indigo)] hover:bg-[var(--surface-2)]"
+            : "text-[var(--mute)] hover:bg-[var(--surface-2)] hover:text-[var(--ink)]"
+        }`}
       >
         <motion.span
-          animate={celebrating ? { scale: [1, 1.5, 1], rotate: [0, 20, -20, 0] } : {}}
-          transition={{ duration: 0.6, repeat: celebrating ? 2 : 0 }}
+          animate={
+            allDone
+              ? { scale: [1, 1.25, 1], rotate: [0, 12, -12, 0] }
+              : {}
+          }
+          transition={
+            allDone
+              ? { duration: 1.8, repeat: Infinity, ease: "easeInOut" }
+              : {}
+          }
         >
           <Sparkles className="h-4 w-4" aria-hidden="true" />
         </motion.span>
@@ -62,7 +77,7 @@ export function GettingStartedBadge() {
             {doneCount}/{total}
           </span>
         )}
-      </button>
+      </motion.button>
 
       <AnimatePresence>
         {open && (
@@ -137,11 +152,7 @@ export function GettingStartedBadge() {
                     </div>
                   );
                   if (item.done || !item.href) {
-                    return (
-                      <li key={item.id} aria-disabled={item.done}>
-                        {inner}
-                      </li>
-                    );
+                    return <li key={item.id}>{inner}</li>;
                   }
                   return (
                     <li key={item.id}>
@@ -154,12 +165,31 @@ export function GettingStartedBadge() {
               </ul>
             </div>
 
-            {celebrating && (
-              <div className="border-t border-[var(--line)] px-4 py-3 text-center">
+            {allDone && (
+              <motion.div
+                initial={{ opacity: 0, y: 6 }}
+                animate={{ opacity: 1, y: 0 }}
+                transition={{ duration: 0.25 }}
+                className="border-t border-[var(--line)] px-4 py-4 text-center"
+              >
                 <p className="text-sm font-semibold text-[var(--indigo)]">
                   🎉 You&apos;re all set!
                 </p>
-              </div>
+                <p className="mt-1 text-xs text-[var(--mute)]">
+                  Nice work — you&apos;ve finished everything to get started on Loopless.
+                </p>
+                <button
+                  type="button"
+                  onClick={() => {
+                    dismiss();
+                    setOpen(false);
+                  }}
+                  className="mt-3 inline-flex w-full items-center justify-center gap-1.5 rounded-full bg-[var(--indigo)] px-4 py-2 text-sm font-semibold text-white shadow-[var(--shadow-cta)] transition-[background,transform] duration-[220ms] hover:-translate-y-px hover:bg-[var(--indigo-deep)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] focus-visible:ring-offset-2"
+                >
+                  <Check className="h-4 w-4" aria-hidden="true" />
+                  Complete
+                </button>
+              </motion.div>
             )}
           </motion.div>
         )}
diff --git a/frontend/client/hooks/useGettingStartedChecklist.ts b/frontend/client/hooks/useGettingStartedChecklist.ts
index e3af49c..56bb6c7 100644
--- a/frontend/client/hooks/useGettingStartedChecklist.ts
+++ b/frontend/client/hooks/useGettingStartedChecklist.ts
@@ -3,15 +3,25 @@
 import { useMemo, useState, useEffect, useCallback } from "react";
 import { useQuery, useQueryClient, type InfiniteData } from "@tanstack/react-query";
 import { useAuthStore } from "@/stores/authStore";
-import { useMyInvitations } from "@/hooks/useProjects";
+import { useMyApplications, useMyInvitations } from "@/hooks/useProjects";
 import { useProfileCompleteness } from "@/hooks/useProfileCompleteness";
+import { normalizeRole } from "@/lib/auth/role";
 import { fetchProjects } from "@/lib/api/projects";
 import { fetchConversations } from "@/lib/api/messaging";
 import type { PagedResult, MatchDto } from "@/types/matching";
-import type { ProjectInvitationDto } from "@/types/project";
+import type { DiscoverProjectDto, ProjectInvitationDto } from "@/types/project";
 
 const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
-export const CHECKLIST_DISMISS_KEY = "loopless.checklist-dismissed";
+const DISMISS_KEY_PREFIX = "loopless.checklist-dismissed";
+
+// "Complete your profile" ticks at this weighted-completeness score (0–100).
+// Lower than 100 so a freelancer who fills the essentials sees progress without
+// having to fill every optional field. Tune here if the bar feels off.
+const PROFILE_DONE_THRESHOLD = 60;
+
+function dismissKeyFor(userId: string | undefined): string {
+  return userId ? `${DISMISS_KEY_PREFIX}:${userId}` : DISMISS_KEY_PREFIX;
+}
 
 export type ChecklistItem = {
   id: string;
@@ -20,27 +30,101 @@ export type ChecklistItem = {
   href?: string;
 };
 
-export function useGettingStartedChecklist() {
-  const user = useAuthStore((s) => s.user);
-  const role = user?.role;
+type CacheFlags = {
+  hasMatches: boolean;
+  hasRecommendedProjects: boolean;
+  hasInvitedFreelancer: boolean;
+};
+
+/**
+ * Reactively derives booleans from query-cache entries that the checklist does
+ * not own (discover matches/projects, per-project invitation lists). Subscribes
+ * to the TanStack query cache so the values update when those queries land —
+ * `enabled: false`-style reads via useMemo([qc]) never recomputed, which is why
+ * "Get your first match" used to never flip to done.
+ */
+function useCacheFlags(): CacheFlags {
   const qc = useQueryClient();
 
-  const [dismissed, setDismissed] = useState(false);
+  const compute = useCallback((): CacheFlags => {
+    const matchEntries = qc.getQueriesData<InfiniteData<PagedResult<MatchDto>>>({
+      queryKey: ["matching", "discover"],
+    });
+    const hasMatches = matchEntries.some(
+      ([, data]) => (data?.pages?.[0]?.totalCount ?? 0) > 0,
+    );
+
+    const projectEntries = qc.getQueriesData<DiscoverProjectDto[]>({
+      queryKey: ["projects", "discover"],
+    });
+    const hasRecommendedProjects = projectEntries.some(
+      ([, data]) => Array.isArray(data) && data.length > 0,
+    );
+
+    const invitationEntries = qc.getQueriesData<ProjectInvitationDto[]>({
+      queryKey: ["projects"],
+    });
+    const hasInvitedFreelancer = invitationEntries.some(
+      ([key, data]) =>
+        Array.isArray(key) &&
+        key[2] === "invitations" &&
+        Array.isArray(data) &&
+        data.length > 0,
+    );
+
+    return { hasMatches, hasRecommendedProjects, hasInvitedFreelancer };
+  }, [qc]);
+
+  const [flags, setFlags] = useState<CacheFlags>(compute);
+
   useEffect(() => {
-    setDismissed(localStorage.getItem(CHECKLIST_DISMISS_KEY) === "1");
-  }, []);
+    const cache = qc.getQueryCache();
+    const update = () =>
+      setFlags((prev) => {
+        const next = compute();
+        if (
+          prev.hasMatches === next.hasMatches &&
+          prev.hasRecommendedProjects === next.hasRecommendedProjects &&
+          prev.hasInvitedFreelancer === next.hasInvitedFreelancer
+        ) {
+          return prev;
+        }
+        return next;
+      });
+    update();
+    return cache.subscribe(update);
+  }, [qc, compute]);
+
+  return flags;
+}
 
-  const isWithin7Days = useMemo(() => {
-    if (!user?.createdAt) return true;
-    return Date.now() - new Date(user.createdAt).getTime() < SEVEN_DAYS_MS;
-  }, [user?.createdAt]);
+export function useGettingStartedChecklist() {
+  const user = useAuthStore((s) => s.user);
+  const role = normalizeRole(user?.role);
+  const isEnterprise = role === "enterprise";
+
+  // Badge visibility depends on browser-only state — the persisted dismissal
+  // (localStorage) and the current time (account age) — neither available
+  // during SSR, so we resolve it once on mount. Reading the user via getState()
+  // keeps this mount-only. This is a legitimate init-from-browser effect; the
+  // experimental set-state-in-effect rule over-flags this single-shot init.
+  const [hidden, setHidden] = useState(false);
+  useEffect(() => {
+    const u = useAuthStore.getState().user;
+    const dismissed = localStorage.getItem(dismissKeyFor(u?.id)) === "1";
+    const stale =
+      !!u?.createdAt && Date.now() - new Date(u.createdAt).getTime() >= SEVEN_DAYS_MS;
+    // eslint-disable-next-line react-hooks/set-state-in-effect
+    setHidden(dismissed || stale);
+  }, []);
 
-  const visible = !dismissed && isWithin7Days && !!user;
+  const visible = !hidden && !!user;
 
-  // Already fetched by AppNavigation — deduped by TanStack Query
+  // Invitations the user received (freelancer: from enterprises).
   const { data: invitations } = useMyInvitations();
+  // Applications the freelancer initiated themselves (gated to freelancers).
+  const { data: applications } = useMyApplications(!isEnterprise);
 
-  // Pure Zustand — no network call
   const { score } = useProfileCompleteness();
 
   const { data: projects } = useQuery({
@@ -57,32 +141,9 @@ export function useGettingStartedChecklist() {
     staleTime: 60_000,
   });
 
-  // Non-reactive cache reads for complex query shapes
-  const hasMatches = useMemo(() => {
-    const entries = qc.getQueriesData<InfiniteData<PagedResult<MatchDto>>>({
-      queryKey: ["matching", "discover"],
-    });
-    return entries.some(([, data]) => (data?.pages?.[0]?.totalCount ?? 0) > 0);
-  // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [qc]);
-
-  const hasInvitedFreelancer = useMemo(() => {
-    const entries = qc.getQueriesData<ProjectInvitationDto[]>({
-      queryKey: ["projects"],
-    });
-    return entries.some(
-      ([key, data]) =>
-        Array.isArray(key) &&
-        key[2] === "invitations" &&
-        Array.isArray(data) &&
-        data.length > 0,
-    );
-  // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [qc]);
+  const { hasMatches, hasRecommendedProjects, hasInvitedFreelancer } = useCacheFlags();
 
   const items: ChecklistItem[] = useMemo(() => {
-    const isEnterprise = role === "enterprise" || role === 1;
-
     if (isEnterprise) {
       return [
         { id: "account", label: "Created account", done: true },
@@ -112,31 +173,43 @@ export function useGettingStartedChecklist() {
       {
         id: "profile",
         label: "Complete your profile",
-        done: score >= 80,
+        done: score >= PROFILE_DONE_THRESHOLD,
         href: "/profile/me",
       },
       {
         id: "match",
-        label: "Get your first match",
-        done: hasMatches,
+        label: "Find a project or get matched",
+        done: hasMatches || hasRecommendedProjects,
         href: "/discover",
       },
       {
-        id: "invitation",
-        label: "Receive your first project invitation",
-        done: (invitations?.length ?? 0) > 0,
-        href: "/projects",
+        id: "apply",
+        label: "Apply for a project",
+        // Whichever comes first: the freelancer applies, or an enterprise
+        // invites them. Both satisfy this step.
+        done: (applications?.length ?? 0) > 0 || (invitations?.length ?? 0) > 0,
+        href: "/discover",
       },
     ];
-  }, [role, projects, invitations, conversations, score, hasMatches, hasInvitedFreelancer]);
+  }, [
+    isEnterprise,
+    projects,
+    invitations,
+    applications,
+    conversations,
+    score,
+    hasMatches,
+    hasRecommendedProjects,
+    hasInvitedFreelancer,
+  ]);
 
   const doneCount = items.filter((i) => i.done).length;
   const allDone = doneCount === items.length;
 
   const dismiss = useCallback(() => {
-    localStorage.setItem(CHECKLIST_DISMISS_KEY, "1");
-    setDismissed(true);
-  }, []);
+    localStorage.setItem(dismissKeyFor(user?.id), "1");
+    setHidden(true);
+  }, [user?.id]);
 
   return { items, doneCount, total: items.length, allDone, visible, dismiss };
 }
diff --git a/frontend/client/hooks/useProjects.ts b/frontend/client/hooks/useProjects.ts
index ca0efd5..1000589 100644
--- a/frontend/client/hooks/useProjects.ts
+++ b/frontend/client/hooks/useProjects.ts
@@ -11,6 +11,7 @@ import {
   deleteProjectLink,
   deleteProjectTask,
   fetchDiscoverProjects,
+  fetchMyApplications,
   fetchMyInvitations,
   fetchProject,
   fetchProjectCommits,
@@ -250,6 +251,14 @@ export function useMyInvitations() {
   });
 }
 
+export function useMyApplications(enabled: boolean = true) {
+  return useQuery({
+    queryKey: ["applications", "mine"],
+    queryFn: ({ signal }) => fetchMyApplications(signal),
+    enabled,
+  });
+}
+
 export function useApplyToProject() {
   const qc = useQueryClient();
   return useMutation({
@@ -258,6 +267,7 @@ export function useApplyToProject() {
       trackEvent("project_applied");
       qc.invalidateQueries({ queryKey: ["projects", "discover"] });
       qc.invalidateQueries({ queryKey: ["invitations", "mine"] });
+      qc.invalidateQueries({ queryKey: ["applications", "mine"] });
     },
   });
 }
diff --git a/frontend/client/lib/api/projects.ts b/frontend/client/lib/api/projects.ts
index db17bf7..60354ff 100644
--- a/frontend/client/lib/api/projects.ts
+++ b/frontend/client/lib/api/projects.ts
@@ -271,6 +271,11 @@ export async function fetchMyInvitations(signal?: AbortSignal): Promise<ProjectI
   return data;
 }
 
+export async function fetchMyApplications(signal?: AbortSignal): Promise<ProjectInvitationDto[]> {
+  const { data } = await apiClient.get<ProjectInvitationDto[]>(`/api/v1/applications/me`, { signal });
+  return data;
+}
+
 export async function acceptInvitation(invitationId: string): Promise<void> {
   await apiClient.put(`/api/v1/invitations/${invitationId}/accept`);
 }

From efaa95136c864c5a6927739f78729dbef65c49b3 Mon Sep 17 00:00:00 2001
From: Edi Asllani <ediasllani03@gmail.com>
Date: Tue, 2 Jun 2026 13:55:17 +0200
Subject: [PATCH 07/12] Fix-TanStack query caches synchronously, refresh on new
 conversation with userid, signalr hardened during negotiation

---
 .../components/messaging/NewMessageDialog.tsx |  15 +-
 .../hooks/useGettingStartedChecklist.ts       | 130 ++++++++++--------
 frontend/client/hooks/useMessaging.ts         |  11 +-
 frontend/client/hooks/useNotifications.ts     |   9 +-
 4 files changed, 104 insertions(+), 61 deletions(-)

diff --git a/frontend/client/components/messaging/NewMessageDialog.tsx b/frontend/client/components/messaging/NewMessageDialog.tsx
index 331fa7e..da4734e 100644
--- a/frontend/client/components/messaging/NewMessageDialog.tsx
+++ b/frontend/client/components/messaging/NewMessageDialog.tsx
@@ -3,9 +3,12 @@
 import { useEffect, useState } from "react";
 import { useRouter } from "next/navigation";
 import { X, Search } from "lucide-react";
-import { useQuery } from "@tanstack/react-query";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { createConversation, searchUsers } from "@/lib/api/messaging";
 import type { UserSearchResult } from "@/lib/api/messaging";
+import type { ConversationDto } from "@/types/messaging";
+
+const CONVERSATIONS_QUERY_KEY = ["messaging", "conversations"] as const;
 
 type Props = {
   open: boolean;
@@ -18,6 +21,7 @@ function initials(name: string): string {
 
 export function NewMessageDialog({ open, onClose }: Props) {
   const router = useRouter();
+  const queryClient = useQueryClient();
   const [query, setQuery] = useState("");
   const [debounced, setDebounced] = useState("");
   const [opening, setOpening] = useState<string | null>(null);
@@ -51,6 +55,15 @@ export function NewMessageDialog({ open, onClose }: Props) {
     setError(null);
     try {
       const conv = await createConversation(u.id);
+      // Seed the new (or existing) conversation into the list so the messages
+      // page can select it immediately, then refetch to stay authoritative.
+      // Without this, navigating to ?c={id} finds nothing in the stale list and
+      // the thread pane renders empty — i.e. clicking a user "does nothing".
+      queryClient.setQueryData<ConversationDto[]>(CONVERSATIONS_QUERY_KEY, (old) => {
+        if (!old) return [conv];
+        return old.some((c) => c.id === conv.id) ? old : [conv, ...old];
+      });
+      queryClient.invalidateQueries({ queryKey: CONVERSATIONS_QUERY_KEY });
       onClose();
       router.push(`/messages?c=${conv.id}`);
     } catch (e) {
diff --git a/frontend/client/hooks/useGettingStartedChecklist.ts b/frontend/client/hooks/useGettingStartedChecklist.ts
index 56bb6c7..f88f424 100644
--- a/frontend/client/hooks/useGettingStartedChecklist.ts
+++ b/frontend/client/hooks/useGettingStartedChecklist.ts
@@ -1,7 +1,19 @@
 "use client";
 
-import { useMemo, useState, useEffect, useCallback } from "react";
-import { useQuery, useQueryClient, type InfiniteData } from "@tanstack/react-query";
+import {
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  useSyncExternalStore,
+} from "react";
+import {
+  useQuery,
+  useQueryClient,
+  type InfiniteData,
+  type QueryClient,
+} from "@tanstack/react-query";
 import { useAuthStore } from "@/stores/authStore";
 import { useMyApplications, useMyInvitations } from "@/hooks/useProjects";
 import { useProfileCompleteness } from "@/hooks/useProfileCompleteness";
@@ -36,66 +48,74 @@ type CacheFlags = {
   hasInvitedFreelancer: boolean;
 };
 
+const EMPTY_FLAGS: CacheFlags = {
+  hasMatches: false,
+  hasRecommendedProjects: false,
+  hasInvitedFreelancer: false,
+};
+
+function computeCacheFlags(qc: QueryClient): CacheFlags {
+  const matchEntries = qc.getQueriesData<InfiniteData<PagedResult<MatchDto>>>({
+    queryKey: ["matching", "discover"],
+  });
+  const hasMatches = matchEntries.some(
+    ([, data]) => (data?.pages?.[0]?.totalCount ?? 0) > 0,
+  );
+
+  const projectEntries = qc.getQueriesData<DiscoverProjectDto[]>({
+    queryKey: ["projects", "discover"],
+  });
+  const hasRecommendedProjects = projectEntries.some(
+    ([, data]) => Array.isArray(data) && data.length > 0,
+  );
+
+  const invitationEntries = qc.getQueriesData<ProjectInvitationDto[]>({
+    queryKey: ["projects"],
+  });
+  const hasInvitedFreelancer = invitationEntries.some(
+    ([key, data]) =>
+      Array.isArray(key) &&
+      key[2] === "invitations" &&
+      Array.isArray(data) &&
+      data.length > 0,
+  );
+
+  return { hasMatches, hasRecommendedProjects, hasInvitedFreelancer };
+}
+
 /**
  * Reactively derives booleans from query-cache entries that the checklist does
- * not own (discover matches/projects, per-project invitation lists). Subscribes
- * to the TanStack query cache so the values update when those queries land —
- * `enabled: false`-style reads via useMemo([qc]) never recomputed, which is why
- * "Get your first match" used to never flip to done.
+ * not own (discover matches/projects, per-project invitation lists). Uses
+ * useSyncExternalStore to subscribe to the TanStack query cache so values update
+ * when those queries land — the earlier useMemo([qc]) read never recomputed
+ * (why "Get your first match" never flipped), and a subscribe()+setState version
+ * fired setState during other components' renders. getSnapshot returns a cached
+ * reference when nothing changed, keeping the store snapshot stable.
  */
 function useCacheFlags(): CacheFlags {
   const qc = useQueryClient();
-
-  const compute = useCallback((): CacheFlags => {
-    const matchEntries = qc.getQueriesData<InfiniteData<PagedResult<MatchDto>>>({
-      queryKey: ["matching", "discover"],
-    });
-    const hasMatches = matchEntries.some(
-      ([, data]) => (data?.pages?.[0]?.totalCount ?? 0) > 0,
-    );
-
-    const projectEntries = qc.getQueriesData<DiscoverProjectDto[]>({
-      queryKey: ["projects", "discover"],
-    });
-    const hasRecommendedProjects = projectEntries.some(
-      ([, data]) => Array.isArray(data) && data.length > 0,
-    );
-
-    const invitationEntries = qc.getQueriesData<ProjectInvitationDto[]>({
-      queryKey: ["projects"],
-    });
-    const hasInvitedFreelancer = invitationEntries.some(
-      ([key, data]) =>
-        Array.isArray(key) &&
-        key[2] === "invitations" &&
-        Array.isArray(data) &&
-        data.length > 0,
-    );
-
-    return { hasMatches, hasRecommendedProjects, hasInvitedFreelancer };
+  const snapshotRef = useRef<CacheFlags>(EMPTY_FLAGS);
+
+  const subscribe = useCallback(
+    (onStoreChange: () => void) => qc.getQueryCache().subscribe(onStoreChange),
+    [qc],
+  );
+
+  const getSnapshot = useCallback((): CacheFlags => {
+    const next = computeCacheFlags(qc);
+    const prev = snapshotRef.current;
+    if (
+      prev.hasMatches === next.hasMatches &&
+      prev.hasRecommendedProjects === next.hasRecommendedProjects &&
+      prev.hasInvitedFreelancer === next.hasInvitedFreelancer
+    ) {
+      return prev;
+    }
+    snapshotRef.current = next;
+    return next;
   }, [qc]);
 
-  const [flags, setFlags] = useState<CacheFlags>(compute);
-
-  useEffect(() => {
-    const cache = qc.getQueryCache();
-    const update = () =>
-      setFlags((prev) => {
-        const next = compute();
-        if (
-          prev.hasMatches === next.hasMatches &&
-          prev.hasRecommendedProjects === next.hasRecommendedProjects &&
-          prev.hasInvitedFreelancer === next.hasInvitedFreelancer
-        ) {
-          return prev;
-        }
-        return next;
-      });
-    update();
-    return cache.subscribe(update);
-  }, [qc, compute]);
-
-  return flags;
+  return useSyncExternalStore(subscribe, getSnapshot, () => EMPTY_FLAGS);
 }
 
 export function useGettingStartedChecklist() {
diff --git a/frontend/client/hooks/useMessaging.ts b/frontend/client/hooks/useMessaging.ts
index 39aee40..720b72b 100644
--- a/frontend/client/hooks/useMessaging.ts
+++ b/frontend/client/hooks/useMessaging.ts
@@ -85,7 +85,7 @@ export function useMessaging(handlers: Handlers = {}): UseMessagingResult {
       if (err) setError(err);
     });
 
-    connection
+    const startPromise = connection
       .start()
       .then(() => {
         if (!disposed) {
@@ -102,8 +102,13 @@ export function useMessaging(handlers: Handlers = {}): UseMessagingResult {
 
     return () => {
       disposed = true;
-      connection.stop().catch(() => {
-        // Ignore stop errors during teardown.
+      // Wait for start()/negotiation to settle before stopping. Calling stop()
+      // mid-negotiation throws "The connection was stopped during negotiation"
+      // — which is what React Strict Mode's dev double-mount triggers.
+      startPromise.finally(() => {
+        connection.stop().catch(() => {
+          // Ignore stop errors during teardown.
+        });
       });
       connectionRef.current = null;
     };
diff --git a/frontend/client/hooks/useNotifications.ts b/frontend/client/hooks/useNotifications.ts
index 68387b1..df8c972 100644
--- a/frontend/client/hooks/useNotifications.ts
+++ b/frontend/client/hooks/useNotifications.ts
@@ -77,7 +77,7 @@ export function useNotifications(handlers: Handlers = {}): UseNotificationsResul
       if (err) setError(err);
     });
 
-    connection
+    const startPromise = connection
       .start()
       .then(() => {
         if (!disposed) {
@@ -94,7 +94,12 @@ export function useNotifications(handlers: Handlers = {}): UseNotificationsResul
 
     return () => {
       disposed = true;
-      connection.stop().catch(() => {});
+      // Wait for start()/negotiation to settle before stopping. Calling stop()
+      // mid-negotiation throws "The connection was stopped during negotiation"
+      // — which is what React Strict Mode's dev double-mount triggers.
+      startPromise.finally(() => {
+        connection.stop().catch(() => {});
+      });
       connectionRef.current = null;
     };
   }, []);

From cd8a98171a45a14762749ae9934c456eacfbba7e Mon Sep 17 00:00:00 2001
From: Edi Asllani <ediasllani03@gmail.com>
Date: Tue, 2 Jun 2026 14:22:50 +0200
Subject: [PATCH 08/12] Fix-UnreadCount marks messages as read, file download
 instead of redirect, Invitation page not found fix

---
 .../Loopless.Api/Endpoints/FileEndpoints.cs   | 20 +++++++
 .../Endpoints/MessageEndpoints.cs             | 15 ++++++
 backend/src/Loopless.Api/Program.cs           | 12 +++--
 .../GetFileDownload/GetFileDownloadQuery.cs   | 10 ++++
 .../GetFileDownloadQueryHandler.cs            | 52 +++++++++++++++++++
 .../MarkConversationReadCommand.cs            |  7 +++
 .../MarkConversationReadCommandHandler.cs     | 47 +++++++++++++++++
 .../MarkConversationReadCommandValidator.cs   | 11 ++++
 .../Interfaces/IFileStorageService.cs         |  6 +++
 .../Consumers/InvitationEventConsumer.cs      |  2 +-
 .../Storage/FileStorageService.cs             | 17 ++++++
 .../client/app/(protected)/messages/page.tsx  | 16 +++++-
 .../app/(protected)/projects/[id]/page.tsx    | 14 ++++-
 .../client/components/projects/FileList.tsx   | 39 ++++++++++++--
 frontend/client/lib/api/messaging.ts          |  4 ++
 15 files changed, 258 insertions(+), 14 deletions(-)
 create mode 100644 backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQuery.cs
 create mode 100644 backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQueryHandler.cs
 create mode 100644 backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommand.cs
 create mode 100644 backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandHandler.cs
 create mode 100644 backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandValidator.cs

diff --git a/backend/src/Loopless.Api/Endpoints/FileEndpoints.cs b/backend/src/Loopless.Api/Endpoints/FileEndpoints.cs
index 5b69308..1a91dee 100644
--- a/backend/src/Loopless.Api/Endpoints/FileEndpoints.cs
+++ b/backend/src/Loopless.Api/Endpoints/FileEndpoints.cs
@@ -1,4 +1,5 @@
 using Loopless.Application.DTOs;
+using Loopless.Application.Features.Files.GetFileDownload;
 using Loopless.Application.Features.Files.GetProjectFiles;
 using Loopless.Application.Features.Files.Upload;
 using MediatR;
@@ -59,6 +60,25 @@ public static IEndpointRouteBuilder MapFileEndpoints(this IEndpointRouteBuilder
         .Produces(StatusCodes.Status404NotFound)
         .ProducesValidationProblem();
 
+        // Streams the file through the API so the browser downloads it directly,
+        // instead of redirecting to a presigned storage URL whose host (e.g.
+        // minio:9000) is unreachable outside the Docker network.
+        group.MapGet("/{projectId:guid}/files/{fileId:guid}/download", async (
+            [FromRoute] Guid projectId,
+            [FromRoute] Guid fileId,
+            ISender sender,
+            CancellationToken ct) =>
+        {
+            var file = await sender.Send(new GetFileDownloadQuery(projectId, fileId), ct);
+            return Results.File(file.Content, file.ContentType, file.FileName);
+        })
+        .WithName("DownloadProjectFile")
+        .Produces(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .Produces(StatusCodes.Status403Forbidden)
+        .Produces(StatusCodes.Status404NotFound)
+        .ProducesValidationProblem();
+
         return app;
     }
 
diff --git a/backend/src/Loopless.Api/Endpoints/MessageEndpoints.cs b/backend/src/Loopless.Api/Endpoints/MessageEndpoints.cs
index fe80d0f..d4e6b39 100644
--- a/backend/src/Loopless.Api/Endpoints/MessageEndpoints.cs
+++ b/backend/src/Loopless.Api/Endpoints/MessageEndpoints.cs
@@ -3,6 +3,7 @@
 using Loopless.Application.Features.Messages.GetConversations;
 using Loopless.Application.Features.Messages.GetHistory;
 using Loopless.Application.Features.Messages.MarkAsRead;
+using Loopless.Application.Features.Messages.MarkConversationRead;
 using Loopless.Application.Features.Messages.Send;
 using MediatR;
 using Microsoft.AspNetCore.Mvc;
@@ -92,6 +93,20 @@ public static IEndpointRouteBuilder MapMessageEndpoints(this IEndpointRouteBuild
         .Produces(StatusCodes.Status404NotFound)
         .Produces(StatusCodes.Status409Conflict);
 
+        group.MapPut("/conversations/{id:guid}/read", async (
+            [FromRoute] Guid id,
+            ISender sender,
+            CancellationToken ct) =>
+        {
+            await sender.Send(new MarkConversationReadCommand(id), ct);
+            return Results.NoContent();
+        })
+        .WithName("MarkConversationRead")
+        .Produces(StatusCodes.Status204NoContent)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .Produces(StatusCodes.Status404NotFound)
+        .ProducesValidationProblem();
+
         return app;
     }
 
diff --git a/backend/src/Loopless.Api/Program.cs b/backend/src/Loopless.Api/Program.cs
index 2b2cf4b..7e48358 100644
--- a/backend/src/Loopless.Api/Program.cs
+++ b/backend/src/Loopless.Api/Program.cs
@@ -245,24 +245,26 @@
             app.MapHangfireDashboard("/hangfire").RequireAuthorization(KeycloakAuthExtensions.AdminPolicy);
     }
 
-    if (!app.Environment.IsEnvironment("Test"))
+    if (!app.Environment.IsEnvironment("Test") && !string.IsNullOrEmpty(pgConnForHangfire))
     {
-        RecurringJob.AddOrUpdate<StandupReminderJob>(
+        var recurringJobs = app.Services.GetRequiredService<IRecurringJobManager>();
+
+        recurringJobs.AddOrUpdate<StandupReminderJob>(
             StandupReminderJob.RecurringJobId,
             job => job.RunAsync(CancellationToken.None),
             "0 9 * * 1-5");
 
-        RecurringJob.AddOrUpdate<BlockerDetectionJob>(
+        recurringJobs.AddOrUpdate<BlockerDetectionJob>(
             BlockerDetectionJob.RecurringJobId,
             job => job.RunAsync(CancellationToken.None),
             Cron.Daily);
 
-        RecurringJob.AddOrUpdate<GitHubSyncJob>(
+        recurringJobs.AddOrUpdate<GitHubSyncJob>(
             GitHubSyncJob.RecurringJobId,
             job => job.SyncAllAsync(CancellationToken.None),
             "*/30 * * * *");
 
-        RecurringJob.AddOrUpdate<UnreadMessageEmailJob>(
+        recurringJobs.AddOrUpdate<UnreadMessageEmailJob>(
             UnreadMessageEmailJob.RecurringJobId,
             job => job.RunAsync(CancellationToken.None),
             "*/5 * * * *");
diff --git a/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQuery.cs b/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQuery.cs
new file mode 100644
index 0000000..847f09e
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQuery.cs
@@ -0,0 +1,10 @@
+using MediatR;
+
+namespace Loopless.Application.Features.Files.GetFileDownload;
+
+public sealed record GetFileDownloadQuery(Guid ProjectId, Guid FileId)
+    : IRequest<FileDownloadResult>;
+
+/// <summary>Open read stream for a stored file plus the metadata needed to return it
+/// as an attachment. The stream is owned by the caller (the endpoint disposes it).</summary>
+public sealed record FileDownloadResult(Stream Content, string FileName, string ContentType);
diff --git a/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQueryHandler.cs b/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQueryHandler.cs
new file mode 100644
index 0000000..1d5e7a5
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQueryHandler.cs
@@ -0,0 +1,52 @@
+using Loopless.Application.Common.Exceptions;
+using Loopless.Application.Interfaces;
+using Loopless.Domain.Enums;
+using MediatR;
+using Microsoft.EntityFrameworkCore;
+
+namespace Loopless.Application.Features.Files.GetFileDownload;
+
+public sealed class GetFileDownloadQueryHandler(
+    IAppDbContext db,
+    ICurrentUser currentUser,
+    IFileStorageService storage) : IRequestHandler<GetFileDownloadQuery, FileDownloadResult>
+{
+    public async Task<FileDownloadResult> Handle(
+        GetFileDownloadQuery request,
+        CancellationToken cancellationToken)
+    {
+        var keycloakId = currentUser.KeycloakId
+            ?? throw new UnauthorizedException("Missing subject claim.");
+
+        var user = await db.Users
+            .FirstOrDefaultAsync(u => u.KeycloakId == keycloakId, cancellationToken)
+            ?? throw new NotFoundException("User not found.");
+
+        var project = await db.Projects
+            .FirstOrDefaultAsync(p => p.Id == request.ProjectId, cancellationToken)
+            ?? throw new NotFoundException("Project not found.");
+
+        var isOwner = project.OwnerId == user.Id;
+        var isAcceptedMember = await db.ProjectInvitations
+            .AnyAsync(
+                i => i.ProjectId == project.Id
+                    && (i.EnterpriseId == user.Id || i.FreelancerId == user.Id)
+                    && i.Status == InvitationStatus.Accepted,
+                cancellationToken);
+
+        if (!isOwner && !isAcceptedMember)
+            throw new ForbiddenException("Only project members can download files.");
+
+        var file = await db.ProjectFiles
+            .FirstOrDefaultAsync(
+                f => f.Id == request.FileId && f.ProjectId == project.Id,
+                cancellationToken)
+            ?? throw new NotFoundException("File not found.");
+
+        var stream = await storage.OpenReadAsync(file.FileUrl, cancellationToken);
+
+        // application/octet-stream + a download name forces a download rather than
+        // inline rendering, which is the desired behaviour for project files.
+        return new FileDownloadResult(stream, file.FileName, "application/octet-stream");
+    }
+}
diff --git a/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommand.cs b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommand.cs
new file mode 100644
index 0000000..0ffc562
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommand.cs
@@ -0,0 +1,7 @@
+using MediatR;
+
+namespace Loopless.Application.Features.Messages.MarkConversationRead;
+
+/// <summary>Marks every unread message the current user received in a conversation as read.
+/// Returns the number of messages updated.</summary>
+public sealed record MarkConversationReadCommand(Guid ConversationId) : IRequest<int>;
diff --git a/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandHandler.cs b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandHandler.cs
new file mode 100644
index 0000000..8228b06
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandHandler.cs
@@ -0,0 +1,47 @@
+using Loopless.Application.Common.Exceptions;
+using Loopless.Application.Interfaces;
+using MediatR;
+using Microsoft.EntityFrameworkCore;
+
+namespace Loopless.Application.Features.Messages.MarkConversationRead;
+
+public sealed class MarkConversationReadCommandHandler(
+    IAppDbContext db,
+    ICurrentUser currentUser) : IRequestHandler<MarkConversationReadCommand, int>
+{
+    public async Task<int> Handle(MarkConversationReadCommand request, CancellationToken cancellationToken)
+    {
+        var keycloakId = currentUser.KeycloakId
+            ?? throw new UnauthorizedException("Missing subject claim.");
+
+        var me = await db.Users
+            .FirstOrDefaultAsync(u => u.KeycloakId == keycloakId, cancellationToken)
+            ?? throw new NotFoundException("User not found.");
+
+        var conversation = await db.Conversations
+            .FirstOrDefaultAsync(c => c.Id == request.ConversationId, cancellationToken)
+            ?? throw new NotFoundException("Conversation not found.");
+
+        if (conversation.Participant1Id != me.Id && conversation.Participant2Id != me.Id)
+            throw new UnauthorizedException("Not a participant of this conversation.");
+
+        var unread = await db.Messages
+            .Where(m => m.ConversationId == conversation.Id
+                && m.SenderId != me.Id
+                && m.ReadAt == null)
+            .ToListAsync(cancellationToken);
+
+        if (unread.Count == 0)
+            return 0;
+
+        var now = DateTimeOffset.UtcNow;
+        foreach (var message in unread)
+        {
+            message.ReadAt = now;
+            message.UpdatedAt = now;
+        }
+
+        await db.SaveChangesAsync(cancellationToken);
+        return unread.Count;
+    }
+}
diff --git a/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandValidator.cs b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandValidator.cs
new file mode 100644
index 0000000..f476747
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandValidator.cs
@@ -0,0 +1,11 @@
+using FluentValidation;
+
+namespace Loopless.Application.Features.Messages.MarkConversationRead;
+
+public sealed class MarkConversationReadCommandValidator : AbstractValidator<MarkConversationReadCommand>
+{
+    public MarkConversationReadCommandValidator()
+    {
+        RuleFor(x => x.ConversationId).NotEmpty();
+    }
+}
diff --git a/backend/src/Loopless.Application/Interfaces/IFileStorageService.cs b/backend/src/Loopless.Application/Interfaces/IFileStorageService.cs
index 1f95479..0d14159 100644
--- a/backend/src/Loopless.Application/Interfaces/IFileStorageService.cs
+++ b/backend/src/Loopless.Application/Interfaces/IFileStorageService.cs
@@ -14,4 +14,10 @@ Task<string> GetDownloadUrlAsync(
         string fileName,
         TimeSpan expiresIn,
         CancellationToken cancellationToken = default);
+
+    /// <summary>Opens a read stream for an object. Used to stream downloads through
+    /// the API, avoiding presigned URLs whose host may be unreachable from the browser.</summary>
+    Task<Stream> OpenReadAsync(
+        string objectKey,
+        CancellationToken cancellationToken = default);
 }
diff --git a/backend/src/Loopless.Infrastructure/Messaging/Consumers/InvitationEventConsumer.cs b/backend/src/Loopless.Infrastructure/Messaging/Consumers/InvitationEventConsumer.cs
index 8be0810..6ff2c0e 100644
--- a/backend/src/Loopless.Infrastructure/Messaging/Consumers/InvitationEventConsumer.cs
+++ b/backend/src/Loopless.Infrastructure/Messaging/Consumers/InvitationEventConsumer.cs
@@ -49,7 +49,7 @@ protected override async Task HandleMessageAsync(string routingKey, byte[] body,
         var (userId, title, message, actionUrl) = routingKey switch
         {
             "invitation.created" => initiatedBy == "Freelancer"
-                ? (e.EnterpriseId, "New Application", $"{e.FreelancerName} applied to your project \"{e.ProjectName}\"", (string?)$"/projects/{e.ProjectId}/invitations")
+                ? (e.EnterpriseId, "New Application", $"{e.FreelancerName} applied to your project \"{e.ProjectName}\"", (string?)$"/projects/{e.ProjectId}?tab=invitations")
                 : (e.FreelancerId, "Project Invitation", $"{e.EnterpriseName} invited you to join \"{e.ProjectName}\"", (string?)"/projects"),
             "invitation.accepted" => initiatedBy == "Freelancer"
                 ? (e.FreelancerId, "Application Accepted", $"Your application to \"{e.ProjectName}\" was accepted.", (string?)$"/projects/{e.ProjectId}")
diff --git a/backend/src/Loopless.Infrastructure/Storage/FileStorageService.cs b/backend/src/Loopless.Infrastructure/Storage/FileStorageService.cs
index e348978..d8a969f 100644
--- a/backend/src/Loopless.Infrastructure/Storage/FileStorageService.cs
+++ b/backend/src/Loopless.Infrastructure/Storage/FileStorageService.cs
@@ -69,6 +69,23 @@ public Task<string> GetDownloadUrlAsync(
         return Task.FromResult(url);
     }
 
+    public async Task<Stream> OpenReadAsync(
+        string objectKey,
+        CancellationToken cancellationToken = default)
+    {
+        EnsureConfigured();
+
+        var response = await _client.GetObjectAsync(
+            new GetObjectRequest
+            {
+                BucketName = _options.BucketName,
+                Key = objectKey,
+            },
+            cancellationToken);
+
+        return response.ResponseStream;
+    }
+
     private void EnsureConfigured()
     {
         if (string.IsNullOrWhiteSpace(_options.BucketName))
diff --git a/frontend/client/app/(protected)/messages/page.tsx b/frontend/client/app/(protected)/messages/page.tsx
index 32e16c5..b0818c6 100644
--- a/frontend/client/app/(protected)/messages/page.tsx
+++ b/frontend/client/app/(protected)/messages/page.tsx
@@ -25,7 +25,7 @@ const ChatView = dynamic(
 import { useConversations } from "@/hooks/useConversations";
 import { flattenMessageHistory, useMessageHistory } from "@/hooks/useMessageHistory";
 import { useMessaging } from "@/hooks/useMessaging";
-import { sendMessage as apiSendMessage } from "@/lib/api/messaging";
+import { sendMessage as apiSendMessage, markConversationRead } from "@/lib/api/messaging";
 import { useAuthStore } from "@/stores/authStore";
 import type {
   ConversationDto,
@@ -155,6 +155,20 @@ export default function MessagesPage() {
     };
   }, []);
 
+  // Mark a conversation's incoming messages as read when it's opened, then
+  // refresh the list so the unread badge clears. Without this, unread counts
+  // never decrease after viewing.
+  useEffect(() => {
+    if (!selectedId) return;
+    markConversationRead(selectedId)
+      .then(() => {
+        queryClient.invalidateQueries({ queryKey: ["messaging", "conversations"] });
+      })
+      .catch(() => {
+        // Non-critical; the badge will reconcile on the next fetch.
+      });
+  }, [selectedId, queryClient]);
+
   const [inputByConv, setInputByConv] = useState<Record<string, string>>({});
   const inputValue = selectedId ? (inputByConv[selectedId] ?? "") : "";
 
diff --git a/frontend/client/app/(protected)/projects/[id]/page.tsx b/frontend/client/app/(protected)/projects/[id]/page.tsx
index 50ebdc7..3b0c5dd 100644
--- a/frontend/client/app/(protected)/projects/[id]/page.tsx
+++ b/frontend/client/app/(protected)/projects/[id]/page.tsx
@@ -2,7 +2,7 @@
 
 import { use, useState } from "react";
 import Link from "next/link";
-import { useRouter } from "next/navigation";
+import { useRouter, useSearchParams } from "next/navigation";
 import { motion } from "framer-motion";
 import {
   ArrowLeft,
@@ -65,6 +65,10 @@ function getInitials(name: string): string {
     .slice(0, 2);
 }
 
+function isTab(value: string | null): value is Tab {
+  return value !== null && TABS.some((t) => t.key === value);
+}
+
 export default function ProjectDashboardPage({
   params,
 }: {
@@ -72,8 +76,14 @@ export default function ProjectDashboardPage({
 }) {
   const { id } = use(params);
   const router = useRouter();
+  const searchParams = useSearchParams();
   const { user } = useAuthStore();
-  const [activeTab, setActiveTab] = useState<Tab>("overview");
+  // Deep-link support: notifications (e.g. "New Application") link to
+  // /projects/{id}?tab=invitations. Seed the initial tab from the query param.
+  const [activeTab, setActiveTab] = useState<Tab>(() => {
+    const tabParam = searchParams.get("tab");
+    return isTab(tabParam) ? tabParam : "overview";
+  });
   const [showEditForm, setShowEditForm] = useState(false);
   const [showInviteModal, setShowInviteModal] = useState(false);
   const [editForm, setEditForm] = useState<UpdateProjectRequest>({});
diff --git a/frontend/client/components/projects/FileList.tsx b/frontend/client/components/projects/FileList.tsx
index 5f516e7..7594cb6 100644
--- a/frontend/client/components/projects/FileList.tsx
+++ b/frontend/client/components/projects/FileList.tsx
@@ -1,7 +1,10 @@
 "use client";
 
+import { useState } from "react";
 import { FileText } from "lucide-react";
 import { useProjectFiles } from "@/hooks/useProjects";
+import { apiClient } from "@/lib/api/client";
+import type { ProjectFileDto } from "@/types/project";
 
 function formatBytes(bytes: number): string {
   if (bytes < 1024) return `${bytes} B`;
@@ -23,6 +26,30 @@ type Props = {
 
 export function FileList({ projectId }: Props) {
   const { data: files, isLoading } = useProjectFiles(projectId);
+  const [downloadingId, setDownloadingId] = useState<string | null>(null);
+
+  // Download through the API (authenticated) and save via a blob URL. The DTO's
+  // fileUrl is a presigned storage URL whose host can be unreachable from the
+  // browser, and an <a download> is ignored cross-origin — both just navigate.
+  const handleDownload = async (file: ProjectFileDto) => {
+    setDownloadingId(file.id);
+    try {
+      const res = await apiClient.get<Blob>(
+        `/api/v1/projects/${projectId}/files/${file.id}/download`,
+        { responseType: "blob" },
+      );
+      const url = URL.createObjectURL(res.data);
+      const anchor = document.createElement("a");
+      anchor.href = url;
+      anchor.download = file.fileName;
+      document.body.appendChild(anchor);
+      anchor.click();
+      anchor.remove();
+      URL.revokeObjectURL(url);
+    } finally {
+      setDownloadingId(null);
+    }
+  };
 
   if (isLoading) {
     return (
@@ -48,13 +75,15 @@ export function FileList({ projectId }: Props) {
         <li key={file.id} className="flex items-center gap-3 px-4 py-3">
           <FileText aria-hidden="true" className="h-5 w-5 shrink-0 text-[var(--mute)]" />
           <div className="min-w-0 flex-1">
-            <a
-              href={file.fileUrl}
-              download={file.fileName}
-              className="truncate text-sm font-medium text-[var(--indigo)] hover:underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
+            <button
+              type="button"
+              onClick={() => handleDownload(file)}
+              disabled={downloadingId === file.id}
+              className="block max-w-full truncate text-left text-sm font-medium text-[var(--indigo)] hover:underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] disabled:opacity-50"
             >
               {file.fileName}
-            </a>
+              {downloadingId === file.id && " · Downloading…"}
+            </button>
             <p className="text-xs text-[var(--mute)]">
               {file.uploadedByName} · {formatDate(file.uploadedAt)} · {formatBytes(file.sizeBytes)}
             </p>
diff --git a/frontend/client/lib/api/messaging.ts b/frontend/client/lib/api/messaging.ts
index 2ec76dc..8e8f2af 100644
--- a/frontend/client/lib/api/messaging.ts
+++ b/frontend/client/lib/api/messaging.ts
@@ -57,6 +57,10 @@ export async function createConversation(
   return data;
 }
 
+export async function markConversationRead(conversationId: string): Promise<void> {
+  await apiClient.put(`/api/v1/messages/conversations/${conversationId}/read`);
+}
+
 export type UserSearchResult = {
   id: string;
   name: string;

From cb5d5d64c404f17b1a737c7ea08d0edc642dddbc Mon Sep 17 00:00:00 2001
From: Edi Asllani <ediasllani03@gmail.com>
Date: Tue, 2 Jun 2026 14:33:12 +0200
Subject: [PATCH 09/12] Fix-Add DisableRateLimiting to both hub mappings,
 negotiate goes through regardless of how busy the rest of the API is

---
 backend/src/Loopless.Api/Program.cs | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/backend/src/Loopless.Api/Program.cs b/backend/src/Loopless.Api/Program.cs
index 7e48358..114f53d 100644
--- a/backend/src/Loopless.Api/Program.cs
+++ b/backend/src/Loopless.Api/Program.cs
@@ -227,8 +227,13 @@
     app.MapFeaturesEndpoints();
     app.MapNotificationEndpoints();
     app.MapProfileEndpoints();
-    app.MapHub<MessagingHub>(MessagingHub.HubPath).RequireAuthorization();
-    app.MapHub<NotificationsHub>(NotificationsHub.HubPath).RequireAuthorization();
+    // Exempt SignalR hubs from the global HTTP rate limiter. Connection
+    // negotiation + reconnect attempts are connection management, not API calls,
+    // and would otherwise exhaust the per-IP budget and 429 the negotiate request
+    // (which then fails the WebSocket handshake). Hub method calls travel over the
+    // socket, so they aren't covered by the HTTP limiter anyway.
+    app.MapHub<MessagingHub>(MessagingHub.HubPath).RequireAuthorization().DisableRateLimiting();
+    app.MapHub<NotificationsHub>(NotificationsHub.HubPath).RequireAuthorization().DisableRateLimiting();
 
     _ = builder.Configuration.GetConnectionString("PostgreSQL")
         ?? throw new InvalidOperationException("PostgreSQL connection string is required. Set ConnectionStrings__PostgreSQL in configuration.");

From dff8d7a7ea61a1d22a6c4917a543094874576619 Mon Sep 17 00:00:00 2001
From: Edi Asllani <ediasllani03@gmail.com>
Date: Tue, 2 Jun 2026 15:42:57 +0200
Subject: [PATCH 10/12] Fix- Update settings, update edit profile, add password
 change setting

---
 .../Endpoints/SettingsEndpoints.cs            |  16 +
 .../ChangePassword/ChangePasswordCommand.cs   |   5 +
 .../ChangePasswordCommandHandler.cs           |  36 +++
 .../ChangePasswordCommandValidator.cs         |  20 ++
 .../Interfaces/IKeycloakAdminClient.cs        |   8 +
 .../Identity/KeycloakAdminClient.cs           |  29 ++
 .../client/app/(protected)/settings/page.tsx  | 283 ++++++++++--------
 .../profile/EnterpriseProfileCard.tsx         |   9 +
 .../profile/FreelancerProfileCard.tsx         |  27 +-
 .../components/providers/ThemeProvider.tsx    |   2 +-
 frontend/client/lib/api/auth.ts               |   7 +
 frontend/client/lib/api/client.ts             |   9 +-
 frontend/client/lib/schemas/auth.ts           |  22 ++
 13 files changed, 338 insertions(+), 135 deletions(-)
 create mode 100644 backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommand.cs
 create mode 100644 backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandHandler.cs
 create mode 100644 backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandValidator.cs

diff --git a/backend/src/Loopless.Api/Endpoints/SettingsEndpoints.cs b/backend/src/Loopless.Api/Endpoints/SettingsEndpoints.cs
index 20022b9..68cc1c8 100644
--- a/backend/src/Loopless.Api/Endpoints/SettingsEndpoints.cs
+++ b/backend/src/Loopless.Api/Endpoints/SettingsEndpoints.cs
@@ -1,3 +1,4 @@
+using Loopless.Application.Features.Settings.ChangePassword;
 using Loopless.Application.Features.Settings.UpdateNotificationSettings;
 using MediatR;
 using Microsoft.AspNetCore.Mvc;
@@ -20,5 +21,20 @@ public static void MapSettingsEndpoints(this IEndpointRouteBuilder app)
         })
         .WithName("UpdateNotificationSettings")
         .WithSummary("Toggle email notification preferences for the current user.");
+
+        group.MapPost("/password", async (
+            [FromBody] ChangePasswordCommand command,
+            IMediator mediator,
+            CancellationToken ct) =>
+        {
+            await mediator.Send(command, ct);
+            return Results.NoContent();
+        })
+        .RequireRateLimiting("auth")
+        .WithName("ChangePassword")
+        .WithSummary("Change the current user's password after verifying the existing one.")
+        .Produces(StatusCodes.Status204NoContent)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .ProducesValidationProblem();
     }
 }
diff --git a/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommand.cs b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommand.cs
new file mode 100644
index 0000000..b93d8a8
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommand.cs
@@ -0,0 +1,5 @@
+using MediatR;
+
+namespace Loopless.Application.Features.Settings.ChangePassword;
+
+public sealed record ChangePasswordCommand(string CurrentPassword, string NewPassword) : IRequest;
diff --git a/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandHandler.cs b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandHandler.cs
new file mode 100644
index 0000000..9bd30d5
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandHandler.cs
@@ -0,0 +1,36 @@
+using Loopless.Application.Common.Exceptions;
+using Loopless.Application.Interfaces;
+using MediatR;
+using Microsoft.EntityFrameworkCore;
+
+namespace Loopless.Application.Features.Settings.ChangePassword;
+
+public sealed class ChangePasswordCommandHandler(
+    IAppDbContext db,
+    ICurrentUser currentUser,
+    IKeycloakAdminClient keycloak) : IRequestHandler<ChangePasswordCommand>
+{
+    public async Task Handle(ChangePasswordCommand request, CancellationToken cancellationToken)
+    {
+        var keycloakId = currentUser.KeycloakId
+            ?? throw new UnauthorizedException("Missing subject claim.");
+
+        var user = await db.Users
+            .FirstOrDefaultAsync(u => u.KeycloakId == keycloakId, cancellationToken)
+            ?? throw new NotFoundException("User not found.");
+
+        // Verify the current password by attempting a password grant. Translate a
+        // mismatch into a 400 (BadRequest) rather than a 401 — a wrong password here
+        // must NOT trip the frontend's 401 interceptor (token refresh / logout).
+        try
+        {
+            await keycloak.PasswordGrantAsync(user.Email, request.CurrentPassword, cancellationToken);
+        }
+        catch (UnauthorizedException)
+        {
+            throw new BadRequestException("Current password is incorrect.");
+        }
+
+        await keycloak.ResetPasswordAsync(keycloakId, request.NewPassword, cancellationToken);
+    }
+}
diff --git a/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandValidator.cs b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandValidator.cs
new file mode 100644
index 0000000..9763291
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandValidator.cs
@@ -0,0 +1,20 @@
+using FluentValidation;
+
+namespace Loopless.Application.Features.Settings.ChangePassword;
+
+public sealed class ChangePasswordCommandValidator : AbstractValidator<ChangePasswordCommand>
+{
+    public ChangePasswordCommandValidator()
+    {
+        RuleFor(x => x.CurrentPassword)
+            .NotEmpty();
+
+        RuleFor(x => x.NewPassword)
+            .NotEmpty()
+            .MinimumLength(8).WithMessage("Password must be at least 8 characters.")
+            .Matches("[A-Z]").WithMessage("Password must contain an uppercase letter.")
+            .Matches("[a-z]").WithMessage("Password must contain a lowercase letter.")
+            .Matches("[0-9]").WithMessage("Password must contain a number.")
+            .NotEqual(x => x.CurrentPassword).WithMessage("New password must differ from the current one.");
+    }
+}
diff --git a/backend/src/Loopless.Application/Interfaces/IKeycloakAdminClient.cs b/backend/src/Loopless.Application/Interfaces/IKeycloakAdminClient.cs
index 54ba91c..1bf8850 100644
--- a/backend/src/Loopless.Application/Interfaces/IKeycloakAdminClient.cs
+++ b/backend/src/Loopless.Application/Interfaces/IKeycloakAdminClient.cs
@@ -50,6 +50,14 @@ Task RemoveRoleAsync(
     Task SendResetPasswordEmailAsync(
         string keycloakId,
         CancellationToken cancellationToken = default);
+
+    /// <summary>Sets a new permanent password for a user via the admin API.
+    /// Used by the authenticated "change password" flow after the current
+    /// password has been verified.</summary>
+    Task ResetPasswordAsync(
+        string keycloakId,
+        string newPassword,
+        CancellationToken cancellationToken = default);
 }
 
 public sealed record TokenResponse(
diff --git a/backend/src/Loopless.Infrastructure/Identity/KeycloakAdminClient.cs b/backend/src/Loopless.Infrastructure/Identity/KeycloakAdminClient.cs
index 42b6b2b..6f8c1e4 100644
--- a/backend/src/Loopless.Infrastructure/Identity/KeycloakAdminClient.cs
+++ b/backend/src/Loopless.Infrastructure/Identity/KeycloakAdminClient.cs
@@ -326,6 +326,35 @@ public async Task SendResetPasswordEmailAsync(
         }
     }
 
+    public async Task ResetPasswordAsync(
+        string keycloakId,
+        string newPassword,
+        CancellationToken cancellationToken = default)
+    {
+        var adminToken = await GetAdminTokenAsync(cancellationToken);
+
+        using var req = new HttpRequestMessage(
+            HttpMethod.Put,
+            BuildAdminUri($"users/{keycloakId}/reset-password"))
+        {
+            Content = JsonContent.Create(new
+            {
+                type = "password",
+                value = newPassword,
+                temporary = false,
+            }),
+        };
+        req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", adminToken);
+
+        using var res = await http.SendAsync(req, cancellationToken);
+        if (!res.IsSuccessStatusCode)
+        {
+            var body = await res.Content.ReadAsStringAsync(cancellationToken);
+            throw new KeycloakOperationException(
+                $"Failed to reset password ({(int)res.StatusCode}): {body}");
+        }
+    }
+
     private async Task AssignRealmRoleAsync(
         string keycloakUserId,
         UserRole role,
diff --git a/frontend/client/app/(protected)/settings/page.tsx b/frontend/client/app/(protected)/settings/page.tsx
index 9ddf35a..2805141 100644
--- a/frontend/client/app/(protected)/settings/page.tsx
+++ b/frontend/client/app/(protected)/settings/page.tsx
@@ -1,22 +1,16 @@
 "use client";
 
-import { useRef, useState } from "react";
+import { useEffect, useState } from "react";
 import Link from "next/link";
-import { Camera, ExternalLink, Loader2 } from "lucide-react";
-import { useMutation } from "@tanstack/react-query";
+import { Monitor, Moon, Sun } from "lucide-react";
+import { useTheme } from "next-themes";
 import { AppNavigation } from "@/components/ui/AppNavigation";
 import { apiClient } from "@/lib/api/client";
-import { useMe, useUpdateCurrentUser } from "@/hooks/useAuth";
-import { uploadAvatar } from "@/lib/api/profile";
+import { changePassword } from "@/lib/api/auth";
+import { changePasswordSchema } from "@/lib/schemas/auth";
+import { useMe } from "@/hooks/useAuth";
 import { useAuthStore } from "@/stores/authStore";
 
-function resolveAvatar(raw: string | null | undefined): string | null {
-  if (!raw) return null;
-  if (raw.startsWith("http://") || raw.startsWith("https://")) return raw;
-  const base = process.env.NEXT_PUBLIC_API_BASE_URL ?? "http://localhost:8080";
-  return `${base}/api/v1/profile/avatars/${raw.split("/").pop()}`;
-}
-
 export default function SettingsPage() {
   const storeUser = useAuthStore((s) => s.user);
   const meQuery = useMe();
@@ -32,19 +26,37 @@ export default function SettingsPage() {
         </p>
 
         <div className="mt-8 space-y-8">
-          <AccountSection
-            name={me?.name ?? ""}
-            avatarUrl={me?.avatarUrl ?? null}
-            userId={me?.id ?? null}
-          />
+          <AppearanceSection />
+          <SecuritySection />
           <NotificationsSection />
         </div>
+
+        {me?.id && (
+          <p className="mt-8 text-xs text-[var(--mute)]">
+            Looking to update your name, avatar, or bio?{" "}
+            <Link
+              href={`/profile/${me.id}`}
+              className="font-medium text-[var(--indigo)] hover:underline"
+            >
+              Edit your profile
+            </Link>
+            .
+          </p>
+        )}
       </div>
     </main>
   );
 }
 
-function Section({ title, description, children }: { title: string; description?: string; children: React.ReactNode }) {
+function Section({
+  title,
+  description,
+  children,
+}: {
+  title: string;
+  description?: string;
+  children: React.ReactNode;
+}) {
   return (
     <section className="rounded-2xl border border-[var(--line)] bg-[var(--surface)] p-6">
       <header className="mb-5">
@@ -56,15 +68,6 @@ function Section({ title, description, children }: { title: string; description?
   );
 }
 
-function Field({ label, children }: { label: string; children: React.ReactNode }) {
-  return (
-    <label className="block">
-      <span className="block text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">{label}</span>
-      <div className="mt-1">{children}</div>
-    </label>
-  );
-}
-
 function SaveStatus({ saving, saved, error }: { saving: boolean; saved: boolean; error: string | null }) {
   if (saving) return <span className="text-xs text-[var(--mute)]">Saving…</span>;
   if (saved) return <span className="text-xs text-[var(--success)]">Saved</span>;
@@ -72,132 +75,156 @@ function SaveStatus({ saving, saved, error }: { saving: boolean; saved: boolean;
   return null;
 }
 
-function AccountSection({
-  name: initialName,
-  avatarUrl: initialAvatar,
-  userId,
-}: {
-  name: string;
-  avatarUrl: string | null;
-  userId: string | null;
-}) {
-  const [name, setName] = useState(initialName);
-  const [saved, setSaved] = useState(false);
-  const [err, setErr] = useState<string | null>(null);
-  const [prevInitialName, setPrevInitialName] = useState(initialName);
-  const updateUser = useUpdateCurrentUser();
-  const fileRef = useRef<HTMLInputElement>(null);
+const THEME_OPTIONS = [
+  { value: "light", label: "Light", icon: Sun },
+  { value: "dark", label: "Dark", icon: Moon },
+  { value: "system", label: "System", icon: Monitor },
+] as const;
 
-  if (prevInitialName !== initialName) {
-    setPrevInitialName(initialName);
-    setName(initialName);
-  }
+function AppearanceSection() {
+  const { theme, setTheme } = useTheme();
+  const [mounted, setMounted] = useState(false);
+  // Avoid a hydration mismatch: the active theme is only known on the client.
+  // queueMicrotask defers the setState out of the effect body (matches ThemeToggle).
+  useEffect(() => {
+    queueMicrotask(() => setMounted(true));
+  }, []);
 
-  const avatarMutation = useMutation({ mutationFn: (file: File) => uploadAvatar(file) });
+  return (
+    <Section title="Appearance" description="Choose how Loopless looks. Dark is the default.">
+      <div
+        role="radiogroup"
+        aria-label="Theme"
+        className="inline-flex rounded-xl border border-[var(--line)] bg-[var(--bg)] p-1"
+      >
+        {THEME_OPTIONS.map(({ value, label, icon: Icon }) => {
+          const active = mounted && theme === value;
+          return (
+            <button
+              key={value}
+              type="button"
+              role="radio"
+              aria-checked={active}
+              onClick={() => setTheme(value)}
+              className={`inline-flex items-center gap-1.5 rounded-lg px-3 py-1.5 text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] ${
+                active
+                  ? "bg-[var(--indigo)] text-white"
+                  : "text-[var(--mute)] hover:text-[var(--ink)]"
+              }`}
+            >
+              <Icon className="h-4 w-4" aria-hidden="true" />
+              {label}
+            </button>
+          );
+        })}
+      </div>
+    </Section>
+  );
+}
+
+function SecuritySection() {
+  const [currentPassword, setCurrentPassword] = useState("");
+  const [newPassword, setNewPassword] = useState("");
+  const [confirmPassword, setConfirmPassword] = useState("");
+  const [saving, setSaving] = useState(false);
+  const [saved, setSaved] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const reset = () => {
+    setCurrentPassword("");
+    setNewPassword("");
+    setConfirmPassword("");
+  };
 
-  const handleSave = async (e: React.FormEvent) => {
+  const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
-    setErr(null);
+    setError(null);
     setSaved(false);
-    try {
-      await updateUser.mutateAsync({ name: name.trim() });
-      setSaved(true);
-      setTimeout(() => setSaved(false), 2000);
-    } catch (e) {
-      setErr((e as { message?: string } | undefined)?.message ?? "Failed");
+
+    const parsed = changePasswordSchema.safeParse({
+      currentPassword,
+      newPassword,
+      confirmPassword,
+    });
+    if (!parsed.success) {
+      setError(parsed.error.issues[0]?.message ?? "Invalid input");
+      return;
     }
-  };
 
-  const handleAvatar = async (file: File) => {
-    setErr(null);
+    setSaving(true);
     try {
-      await avatarMutation.mutateAsync(file);
+      await changePassword(parsed.data.currentPassword, parsed.data.newPassword);
       setSaved(true);
-      setTimeout(() => setSaved(false), 2000);
+      reset();
+      setTimeout(() => setSaved(false), 2500);
     } catch (e) {
-      setErr((e as { message?: string } | undefined)?.message ?? "Avatar upload failed");
+      setError((e as { message?: string } | undefined)?.message ?? "Failed to change password");
+    } finally {
+      setSaving(false);
     }
   };
 
-  const resolvedAvatar = resolveAvatar(initialAvatar);
-
   return (
-    <Section title="Account" description="Display name + avatar shown to other users.">
-      <form onSubmit={handleSave} className="space-y-4">
-        <div className="flex items-center gap-4">
-          <div className="relative">
-            <div className="flex h-16 w-16 items-center justify-center overflow-hidden rounded-full bg-[var(--indigo-soft)] text-sm font-semibold text-[var(--indigo)]">
-              {resolvedAvatar ? (
-                /* eslint-disable-next-line @next/next/no-img-element */
-                <img src={resolvedAvatar} alt="" className="h-full w-full object-cover" />
-              ) : (
-                name.split(" ").map((p) => p[0]).join("").toUpperCase().slice(0, 2)
-              )}
-            </div>
-            <button
-              type="button"
-              onClick={() => fileRef.current?.click()}
-              aria-label="Change avatar"
-              className="absolute -bottom-1 -right-1 rounded-full border border-[var(--line)] bg-[var(--surface)] p-1.5 text-[var(--mute)] shadow hover:text-[var(--ink)]"
-            >
-              {avatarMutation.isPending ? (
-                <Loader2 className="h-3.5 w-3.5 animate-spin" aria-hidden="true" />
-              ) : (
-                <Camera className="h-3.5 w-3.5" aria-hidden="true" />
-              )}
-            </button>
-            <input
-              ref={fileRef}
-              type="file"
-              accept="image/*"
-              className="hidden"
-              onChange={(e) => {
-                const f = e.target.files?.[0];
-                if (f) void handleAvatar(f);
-                e.target.value = "";
-              }}
-            />
-          </div>
-          <div className="flex-1">
-            <Field label="Display name">
-              <input
-                type="text"
-                value={name}
-                onChange={(e) => setName(e.target.value)}
-                maxLength={120}
-                className="w-full rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-sm"
-              />
-            </Field>
-          </div>
-        </div>
-
-        <div className="flex items-center justify-between pt-2">
-          <SaveStatus saving={updateUser.isPending} saved={saved} error={err} />
+    <Section title="Security" description="Change your account password.">
+      <form onSubmit={handleSubmit} className="space-y-4">
+        <PasswordField
+          label="Current password"
+          value={currentPassword}
+          onChange={setCurrentPassword}
+          autoComplete="current-password"
+        />
+        <PasswordField
+          label="New password"
+          value={newPassword}
+          onChange={setNewPassword}
+          autoComplete="new-password"
+        />
+        <PasswordField
+          label="Confirm new password"
+          value={confirmPassword}
+          onChange={setConfirmPassword}
+          autoComplete="new-password"
+        />
+        <div className="flex items-center justify-between pt-1">
+          <SaveStatus saving={saving} saved={saved} error={error} />
           <button
             type="submit"
-            disabled={updateUser.isPending || name.trim().length === 0}
+            disabled={saving || !currentPassword || !newPassword || !confirmPassword}
             className="rounded-full bg-[var(--indigo)] px-4 py-2 text-xs font-semibold text-white hover:opacity-90 disabled:opacity-50"
           >
-            {updateUser.isPending ? "Saving…" : "Save"}
+            {saving ? "Updating…" : "Update password"}
           </button>
         </div>
       </form>
-
-      {userId && (
-        <div className="mt-5 border-t border-[var(--line)] pt-4">
-          <Link
-            href={`/profile/${userId}`}
-            className="inline-flex items-center gap-1.5 text-xs font-medium text-[var(--indigo)] hover:underline"
-          >
-            <ExternalLink className="h-3 w-3" aria-hidden="true" />
-            View your public profile to edit bio, skills, and links
-          </Link>
-        </div>
-      )}
     </Section>
   );
 }
 
+function PasswordField({
+  label,
+  value,
+  onChange,
+  autoComplete,
+}: {
+  label: string;
+  value: string;
+  onChange: (v: string) => void;
+  autoComplete: string;
+}) {
+  return (
+    <label className="block">
+      <span className="block text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">{label}</span>
+      <input
+        type="password"
+        value={value}
+        autoComplete={autoComplete}
+        onChange={(e) => onChange(e.target.value)}
+        className="mt-1 w-full rounded-lg border border-[var(--line)] bg-[var(--bg)] px-3 py-2 text-sm text-[var(--ink)] outline-none focus:border-[var(--indigo)] focus:ring-[3px] focus:ring-[var(--indigo-soft)]"
+      />
+    </label>
+  );
+}
+
 function NotificationsSection() {
   const [enabled, setEnabled] = useState(true);
   const [saving, setSaving] = useState(false);
diff --git a/frontend/client/components/profile/EnterpriseProfileCard.tsx b/frontend/client/components/profile/EnterpriseProfileCard.tsx
index e9d7c43..2052494 100644
--- a/frontend/client/components/profile/EnterpriseProfileCard.tsx
+++ b/frontend/client/components/profile/EnterpriseProfileCard.tsx
@@ -22,6 +22,7 @@ import {
 } from "lucide-react";
 import type { PublicUser } from "@/types/auth";
 import { StartConversationButton } from "@/components/messaging/StartConversationButton";
+import { useUpdateCurrentUser } from "@/hooks/useAuth";
 import {
   updateEnterpriseProfile,
   uploadAvatar,
@@ -88,6 +89,8 @@ export function EnterpriseProfileCard({ profile, isSelf }: Props) {
     location: profile.enterpriseLocation ?? "",
   });
 
+  const updateName = useUpdateCurrentUser();
+
   const mutation = useMutation({
     mutationFn: (payload: UpdateEnterpriseProfilePayload) => updateEnterpriseProfile(payload),
     onSuccess: () => {
@@ -127,6 +130,12 @@ export function EnterpriseProfileCard({ profile, isSelf }: Props) {
   }
 
   function handleSave() {
+    // For an enterprise, the company name is their display identity everywhere
+    // (nav, messages), so keep the account display name in sync with it.
+    const trimmedCompany = form.companyName.trim();
+    if (trimmedCompany && trimmedCompany !== profile.name) {
+      updateName.mutate({ name: trimmedCompany });
+    }
     mutation.mutate({
       companyName: form.companyName || companyName,
       industry: form.industry || null,
diff --git a/frontend/client/components/profile/FreelancerProfileCard.tsx b/frontend/client/components/profile/FreelancerProfileCard.tsx
index a311f49..51e4981 100644
--- a/frontend/client/components/profile/FreelancerProfileCard.tsx
+++ b/frontend/client/components/profile/FreelancerProfileCard.tsx
@@ -25,6 +25,7 @@ import { StartConversationButton } from "@/components/messaging/StartConversatio
 import { InviteToProjectButton } from "@/components/profile/InviteToProjectButton";
 import { SkillsEditor } from "@/components/profile/SkillsEditor";
 import { useSkills } from "@/hooks/useOnboarding";
+import { useUpdateCurrentUser } from "@/hooks/useAuth";
 import {
   updateFreelancerProfile,
   uploadAvatar,
@@ -60,6 +61,7 @@ function formatMemberSince(iso: string): string {
 }
 
 type EditState = {
+  name: string;
   title: string;
   bio: string;
   hourlyRate: string;
@@ -82,6 +84,7 @@ export function FreelancerProfileCard({ profile, isSelf }: Props) {
   const [editing, setEditing] = useState(false);
   const [avatarPreview, setAvatarPreview] = useState<string | null>(null);
   const [form, setForm] = useState<EditState>({
+    name: profile.name ?? "",
     title: profile.title ?? "",
     bio: profile.bio ?? "",
     hourlyRate: profile.hourlyRate?.toString() ?? "",
@@ -92,6 +95,8 @@ export function FreelancerProfileCard({ profile, isSelf }: Props) {
     portfolioUrl: profile.portfolioUrl ?? "",
   });
 
+  const updateName = useUpdateCurrentUser();
+
   const mutation = useMutation({
     mutationFn: (payload: UpdateFreelancerProfilePayload) => updateFreelancerProfile(payload),
     onSuccess: () => {
@@ -131,6 +136,10 @@ export function FreelancerProfileCard({ profile, isSelf }: Props) {
   }
 
   function handleSave() {
+    const trimmedName = form.name.trim();
+    if (trimmedName && trimmedName !== profile.name) {
+      updateName.mutate({ name: trimmedName });
+    }
     mutation.mutate({
       title: form.title || null,
       bio: form.bio || null,
@@ -145,6 +154,7 @@ export function FreelancerProfileCard({ profile, isSelf }: Props) {
 
   function handleCancel() {
     setForm({
+      name: profile.name ?? "",
       title: profile.title ?? "",
       bio: profile.bio ?? "",
       hourlyRate: profile.hourlyRate?.toString() ?? "",
@@ -219,9 +229,20 @@ export function FreelancerProfileCard({ profile, isSelf }: Props) {
 
           {/* Identity */}
           <div className="min-w-0 pt-1">
-            <h1 className="text-[28px] font-bold leading-tight tracking-tight text-[var(--ink)]">
-              {profile.name}
-            </h1>
+            {editing ? (
+              <input
+                value={form.name}
+                maxLength={120}
+                onChange={(e) => setForm((f) => ({ ...f, name: e.target.value }))}
+                placeholder="Your name"
+                aria-label="Display name"
+                className="w-full rounded-[10px] border border-[var(--line)] bg-[var(--bg)] px-3 py-2 text-[28px] font-bold leading-tight tracking-tight text-[var(--ink)] outline-none focus:border-[var(--indigo)] focus:ring-[3px] focus:ring-[var(--indigo-soft)]"
+              />
+            ) : (
+              <h1 className="text-[28px] font-bold leading-tight tracking-tight text-[var(--ink)]">
+                {profile.name}
+              </h1>
+            )}
 
             {editing ? (
               <input
diff --git a/frontend/client/components/providers/ThemeProvider.tsx b/frontend/client/components/providers/ThemeProvider.tsx
index 1e89f83..4f50e56 100644
--- a/frontend/client/components/providers/ThemeProvider.tsx
+++ b/frontend/client/components/providers/ThemeProvider.tsx
@@ -10,7 +10,7 @@ export function ThemeProvider({ children }: { children: ReactNode }) {
     // data-theme="dark"   → drives [data-theme="dark"] CSS var block in globals.css
     <NextThemesProvider
       attribute={["class", "data-theme"]}
-      defaultTheme="system"
+      defaultTheme="dark"
       enableSystem
       disableTransitionOnChange
     >
diff --git a/frontend/client/lib/api/auth.ts b/frontend/client/lib/api/auth.ts
index 3108fb5..5583a88 100644
--- a/frontend/client/lib/api/auth.ts
+++ b/frontend/client/lib/api/auth.ts
@@ -63,6 +63,13 @@ export async function setUserRole(role: "freelancer" | "enterprise"): Promise<vo
   await apiClient.put("/api/v1/users/me/role", { role });
 }
 
+export async function changePassword(
+  currentPassword: string,
+  newPassword: string,
+): Promise<void> {
+  await apiClient.post("/api/v1/settings/password", { currentPassword, newPassword });
+}
+
 export async function refreshToken(token: string): Promise<RefreshTokenResponse> {
   const { data } = await axios.post<RefreshTokenResponse>(`${baseURL}/api/v1/auth/refresh`, {
     refreshToken: token,
diff --git a/frontend/client/lib/api/client.ts b/frontend/client/lib/api/client.ts
index f520ce8..1886d7e 100644
--- a/frontend/client/lib/api/client.ts
+++ b/frontend/client/lib/api/client.ts
@@ -49,11 +49,14 @@ function processQueue(error: unknown, token: string | null): void {
 }
 
 function toApiError(error: AxiosError): ApiError {
+  // Domain errors are serialized as { error }, validation as { message }/{ title };
+  // check all shapes so callers surface the real message instead of a generic one.
+  const data = error.response?.data as
+    | { message?: string; error?: string; title?: string }
+    | undefined;
   return {
     status: error.response?.status ?? 0,
-    message:
-      (error.response?.data as { message?: string } | undefined)?.message ??
-      error.message,
+    message: data?.message ?? data?.error ?? data?.title ?? error.message,
     details: error.response?.data,
   };
 }
diff --git a/frontend/client/lib/schemas/auth.ts b/frontend/client/lib/schemas/auth.ts
index 671fdf9..fa9574d 100644
--- a/frontend/client/lib/schemas/auth.ts
+++ b/frontend/client/lib/schemas/auth.ts
@@ -26,3 +26,25 @@ password: z
   });
 
 export type SignupFormValues = z.infer<typeof signupSchema>;
+
+export const changePasswordSchema = z
+  .object({
+    currentPassword: z.string().min(1, "Enter your current password"),
+    newPassword: z
+      .string()
+      .min(8, "Password must be at least 8 characters")
+      .regex(/[A-Z]/, "Password must contain an uppercase letter")
+      .regex(/[a-z]/, "Password must contain a lowercase letter")
+      .regex(/\d/, "Password must contain a number"),
+    confirmPassword: z.string(),
+  })
+  .refine((data) => data.newPassword === data.confirmPassword, {
+    message: "Passwords do not match",
+    path: ["confirmPassword"],
+  })
+  .refine((data) => data.newPassword !== data.currentPassword, {
+    message: "New password must differ from the current one",
+    path: ["newPassword"],
+  });
+
+export type ChangePasswordFormValues = z.infer<typeof changePasswordSchema>;

From 0088b6eabe689266b880230962832a83ee81914a Mon Sep 17 00:00:00 2001
From: Edi Asllani <ediasllani03@gmail.com>
Date: Wed, 10 Jun 2026 11:45:25 +0200
Subject: [PATCH 11/12] fix(devops): drop dangling secrets.yaml refs from
 legacy kustomize overlays

The overlays referenced a secrets.yaml that never existed, breaking
'kubectl kustomize' builds. Production deploys via the Helm chart
(devops/helm/loopless) to namespace project-01; mark the overlays as
reference-only for a future self-managed cluster.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 devops/k8s/overlays/production/kustomization.yaml | 5 ++++-
 devops/k8s/overlays/staging/kustomization.yaml    | 4 +++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/devops/k8s/overlays/production/kustomization.yaml b/devops/k8s/overlays/production/kustomization.yaml
index 12c5381..b6eb989 100644
--- a/devops/k8s/overlays/production/kustomization.yaml
+++ b/devops/k8s/overlays/production/kustomization.yaml
@@ -1,3 +1,7 @@
+# NOTE: NOT the active production deploy path. Production deploys to the
+# `project-01` namespace via the Helm chart at devops/helm/loopless
+# (see devops/k8s/project-01/README.md and .github/workflows/cd.yml).
+# This overlay is kept as a reference for a future self-managed cluster.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
@@ -7,7 +11,6 @@ resources:
   - ../../base
   - configmap.yaml
   - secret-store.yaml
-  - secrets.yaml
   - external-secret.yaml
 
 labels:
diff --git a/devops/k8s/overlays/staging/kustomization.yaml b/devops/k8s/overlays/staging/kustomization.yaml
index 7fd3955..178ccbb 100644
--- a/devops/k8s/overlays/staging/kustomization.yaml
+++ b/devops/k8s/overlays/staging/kustomization.yaml
@@ -1,3 +1,6 @@
+# NOTE: NOT an active deploy path — there is no staging cluster. Production
+# deploys to the `project-01` namespace via the Helm chart at devops/helm/loopless.
+# Kept as a reference for a future staging environment.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
@@ -7,7 +10,6 @@ resources:
   - ../../base
   - configmap.yaml
   - secret-store.yaml
-  - secrets.yaml
   - external-secret.yaml
 
 labels:

From 550def71a8e06642d972b41d2a3ab1e76119bb09 Mon Sep 17 00:00:00 2001
From: Edi Asllani <ediasllani03@gmail.com>
Date: Wed, 10 Jun 2026 12:09:54 +0200
Subject: [PATCH 12/12] ci: exclude documented placeholder connstrings from
 TruffleHog

The merge of main brought devops/k8s/project-01/{README.md,secret.example.yaml},
whose placeholder connection strings (Password=$DB / Password=__DB__) trip the
SQLServer detector as 'unverified' findings and fail the scan under
--results=verified,unknown. Scope-exclude just those two doc files via
--exclude-paths; all detectors stay active for the rest of the repo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 5 ++++-
 .trufflehog-exclude.txt  | 6 ++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 .trufflehog-exclude.txt

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c8996c7..078befd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,10 @@ jobs:
       - name: Run TruffleHog (verified secrets only)
         uses: trufflesecurity/trufflehog@main
         with:
-          extra_args: --results=verified,unknown
+          # The action mounts the workspace at /tmp inside the scanner container.
+          # .trufflehog-exclude.txt skips deploy docs whose placeholder connection
+          # strings (Password=__DB__) false-positive the SQLServer detector.
+          extra_args: --results=verified,unknown --exclude-paths=/tmp/.trufflehog-exclude.txt
 
   quality:
     name: Lint, Test, Build
diff --git a/.trufflehog-exclude.txt b/.trufflehog-exclude.txt
new file mode 100644
index 0000000..6eba4c8
--- /dev/null
+++ b/.trufflehog-exclude.txt
@@ -0,0 +1,6 @@
+# Paths excluded from TruffleHog secret scanning (regex per line).
+# These are deploy DOCUMENTATION containing placeholder connection strings
+# (Password=$DB / Password=__DB__) that pattern-match the SQLServer detector
+# but contain no real credentials. Never put real values in these files.
+devops/k8s/project-01/README\.md
+devops/k8s/project-01/secret\.example\.yaml