diff --git a/.env.example b/.env.example
index 28b3a5a8..1db7e42f 100644
--- a/.env.example
+++ b/.env.example
@@ -75,6 +75,8 @@ DB_DEBUG=false
 # -----------------------------------------------------------------------------
 # Redis
 # -----------------------------------------------------------------------------
+# Local development default; a deployment points REDIS_URL at its own Redis (rediss:// for TLS).
+# nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
 REDIS_URL=redis://localhost:6379
 
 # Redis authentication (REQUIRED for production)
@@ -94,10 +96,11 @@ REDIS_TLS_REJECT_UNAUTHORIZED=true
 # -----------------------------------------------------------------------------
 # Tracker Ports
 # -----------------------------------------------------------------------------
-TRACKER_PORT=8000
 TRACKER_HTTP_PORT=8080
-TRACKER_UDP_PORT=8081
-TRACKER_WS_PORT=8082
+# UDP (BEP 15) is off unless enabled. The production compose file serves it on
+# 6969/udp and hands the same flag to the API, which only then writes the UDP
+# tier into `.torrent` files.
+TRACKER_UDP_ENABLED=false
 
 # Debug mode for verbose tracker logging (logs raw announce params)
 TRACKER_DEBUG=false
@@ -107,8 +110,8 @@ TRACKER_DEBUG=false
 # image can be reused by anyone with their own domain (no rebuild needed).
 # ⚠️  PRODUCTION: Configure these with your actual domain
 NUXT_PUBLIC_TRACKER_HTTP_URL=https://tracker.your-domain.com/announce
-NUXT_PUBLIC_TRACKER_UDP_URL=udp://tracker.your-domain.com:8081/announce
-NUXT_PUBLIC_TRACKER_WS_URL=wss://tracker.your-domain.com/ws
+# Only used when TRACKER_UDP_ENABLED=true.
+NUXT_PUBLIC_TRACKER_UDP_URL=udp://tracker.your-domain.com:6969/announce
 
 # -----------------------------------------------------------------------------
 # Security
diff --git a/.github/workflows/api-ci.yml b/.github/workflows/api-ci.yml
index f2371167..761ecc37 100644
--- a/.github/workflows/api-ci.yml
+++ b/.github/workflows/api-ci.yml
@@ -64,17 +64,22 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          # Matches `node:24-alpine` in apps/api/Dockerfile, so CI checks the
+          # Matches `node:26-alpine` in apps/api/Dockerfile, so CI checks the
           # runtime we actually ship.
-          node-version: 24
+          node-version: 26
 
-      # corepack rather than a third-party setup action: the pinned pnpm
-      # version already lives in package.json's `packageManager` field, and the
-      # Dockerfiles activate it exactly this way.
-      - name: Enable corepack
-        run: corepack enable
+      # Still no third-party setup action, but no corepack either: Node 25
+      # stopped shipping it. The version is read from package.json's
+      # `packageManager` field, which stays the one place it is pinned — and
+      # pnpm 12 checks that pin against pnpm-lock.yaml on a frozen install.
+      # That pin is the lock zizmor's `adhoc-packages` cannot see, hence its
+      # ignore on each of these steps.
+      # `--allow-scripts`: pnpm's install script only hard-links its native
+      # binary, and npm is moving to blocking scripts it was not told about.
+      - name: Install pnpm
+        run: npm install --global --allow-scripts=pnpm "$(node -p 'require("./package.json").packageManager')" # zizmor: ignore[adhoc-packages]
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -105,7 +110,8 @@ jobs:
           POSTGRES_USER: parity
           POSTGRES_DB: postgres
         ports:
-          - 5432:5432
+          # Service containers of a throwaway runner.
+          - 5432:5432  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
         options: >-
           --health-cmd "pg_isready -U parity"
           --health-interval 5s
@@ -117,12 +123,12 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 26
 
-      - name: Enable corepack
-        run: corepack enable
+      - name: Install pnpm
+        run: npm install --global --allow-scripts=pnpm "$(node -p 'require("./package.json").packageManager')" # zizmor: ignore[adhoc-packages]
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -158,16 +164,17 @@ jobs:
           POSTGRES_PASSWORD: tracker
           POSTGRES_DB: trackarr
         ports:
-          - 5432:5432
+          # Service containers of a throwaway runner.
+          - 5432:5432  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
         options: >-
           --health-cmd "pg_isready -U tracker -d trackarr"
           --health-interval 5s
           --health-timeout 5s
           --health-retries 20
       redis:
-        image: redis:8.10.1-alpine
+        image: redis:8.10.2-alpine
         ports:
-          - 6379:6379
+          - 6379:6379  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
         options: >-
           --health-cmd "redis-cli ping"
           --health-interval 5s
@@ -177,26 +184,26 @@ jobs:
         # Pinned rather than `:latest`. The suite it serves asserts byte-exact
         # SigV4 behaviour, so a floating tag is a test that can start failing
         # for a reason that is not in this repository.
-        image: rustfs/rustfs:1.0.0-rc.3
+        image: rustfs/rustfs:1.0.3
         env:
           RUSTFS_ACCESS_KEY: trackarritest
           RUSTFS_SECRET_KEY: trackarritestsecret
           RUSTFS_VOLUMES: /data
           RUSTFS_ADDRESS: ':9000'
         ports:
-          - 9000:9000
+          - 9000:9000  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 26
 
-      - name: Enable corepack
-        run: corepack enable
+      - name: Install pnpm
+        run: npm install --global --allow-scripts=pnpm "$(node -p 'require("./package.json").packageManager')" # zizmor: ignore[adhoc-packages]
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -243,7 +250,8 @@ jobs:
         env:
           DATABASE_URL: postgres://tracker:tracker@localhost:5432/trackarr
           DB_SSL: 'false'
-          REDIS_URL: redis://localhost:6379
+          # The job's own Redis service container.
+          REDIS_URL: redis://localhost:6379  # nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
           # Explicitly empty. A service container runs `redis-server` with no
           # `--requirepass`, and the integration vitest config defaults this to
           # a fake password when it is UNSET — which would make the client send
@@ -307,12 +315,12 @@ jobs:
           persist-credentials: false
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # Single-arch and loaded into the local daemon: the check has to `docker
       # run` it, which a `--push`-only multi-arch build cannot do.
       - name: Build the API image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: apps/api/Dockerfile
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index dcde7725..a5e7ed7e 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -45,15 +45,15 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          # Node 24, comme `doc/Dockerfile` et comme les autres workflows.
+          # Node 26, comme `doc/Dockerfile` et comme les autres workflows.
           # Ce travail était resté sur 20, en fin de vie depuis avril 2026 :
           # la même documentation était donc construite sur deux runtimes,
           # et le déploiement — qui a `pages: write` — tournait sur celui
           # qui ne reçoit plus de correctif. Vérifié : `npm ci` puis
-          # `npm run build` passent en 24 (vitepress 1.6.4 demande >= 20).
-          node-version: 24
+          # `npm run build` passent en 26 (vitepress 1.6.4 demande >= 20).
+          node-version: 26
           cache: 'npm'
           cache-dependency-path: './doc/package-lock.json'
 
@@ -86,4 +86,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 5624dc76..dde3181b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -112,11 +112,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push api image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./
           file: ./apps/api/Dockerfile
@@ -192,11 +192,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push tracker image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./
           file: ./apps/tracker/Dockerfile
@@ -278,11 +278,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push relay image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./
           file: ./apps/relay/Dockerfile
@@ -358,11 +358,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push front-ssr image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./
           file: ./apps/web/Dockerfile
@@ -437,11 +437,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push front image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./
           file: ./apps/web/Dockerfile.static
@@ -520,11 +520,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push docs image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           # The doc bundle is a self-contained npm project; scope
           # the build context to ./doc so the COPY in Dockerfile
diff --git a/.github/workflows/docs-ci.yml b/.github/workflows/docs-ci.yml
index 02d215df..4d764f5b 100644
--- a/.github/workflows/docs-ci.yml
+++ b/.github/workflows/docs-ci.yml
@@ -43,15 +43,15 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          # Node 24, comme `doc/Dockerfile` et comme les autres workflows.
+          # Node 26, comme `doc/Dockerfile` et comme les autres workflows.
           # Ce travail était resté sur 20, en fin de vie depuis avril 2026 :
           # la même documentation était donc construite sur deux runtimes,
           # et le déploiement — qui a `pages: write` — tournait sur celui
           # qui ne reçoit plus de correctif. Vérifié : `npm ci` puis
-          # `npm run build` passent en 24 (vitepress 1.6.4 demande >= 20).
-          node-version: 24
+          # `npm run build` passent en 26 (vitepress 1.6.4 demande >= 20).
+          node-version: 26
           cache: 'npm'
           cache-dependency-path: './doc/package-lock.json'
 
diff --git a/.github/workflows/relay-ci.yml b/.github/workflows/relay-ci.yml
index 6d89d930..b86c8f32 100644
--- a/.github/workflows/relay-ci.yml
+++ b/.github/workflows/relay-ci.yml
@@ -59,12 +59,12 @@ jobs:
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           # The minor, not `go-version-file`. The `go` directive in go.mod is a
-          # minimum language version (`go 1.26.0`) and setup-go treats a full
-          # x.y.z as an exact pin — which on the tracker built CI on go1.26.0
-          # and failed govulncheck on 19 stdlib vulnerabilities fixed in
-          # 1.26.1. Tracking the minor matches `golang:1.26-alpine` in the
+          # minimum language version (`go 1.27.0`) and setup-go treats a full
+          # x.y.z as an exact pin — which on the tracker once built CI on
+          # go1.26.0 and failed govulncheck on 19 stdlib vulnerabilities fixed
+          # in 1.26.1. Tracking the minor matches `golang:1.27-alpine` in the
           # Dockerfile. Bump alongside the Dockerfile and the go.mod directive.
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
           cache-dependency-path: apps/relay/go.sum
 
@@ -113,7 +113,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
           cache-dependency-path: apps/relay/go.sum
 
diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index 0d993bb9..b182020c 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -81,41 +81,57 @@ jobs:
                   echo "version=$VERSION" >> "$GITHUB_OUTPUT"
                   echo "Extracted version: $VERSION"
 
+            # The version reaches the scripts below through `env`, never as
+            # `${{ }}` inside `run:`: an expression there is pasted into the
+            # script text before the shell sees it. The step above already
+            # refuses anything but digits and dots, so this is the second
+            # wall, not the first.
             - name: Check if tag exists
               id: check_tag
+              env:
+                  VERSION: ${{ steps.version.outputs.version }}
               run: |
                   # Quoted: `$GITHUB_OUTPUT` is a path, and an unquoted one
                   # word-splits on any space in the runner's temp directory.
                   # SC2086 flagged it, and the workflow that creates release
                   # tags is not the place to leave a redirection target to
                   # chance.
-                  if git rev-parse "${{ steps.version.outputs.version }}" >/dev/null 2>&1; then
+                  if git rev-parse "$VERSION" >/dev/null 2>&1; then
                     echo "exists=true" >> "$GITHUB_OUTPUT"
-                    echo "Tag ${{ steps.version.outputs.version }} already exists"
+                    echo "Tag $VERSION already exists"
                   else
                     echo "exists=false" >> "$GITHUB_OUTPUT"
                   fi
 
             - name: Create and push tag
               if: steps.check_tag.outputs.exists == 'false'
+              env:
+                  VERSION: ${{ steps.version.outputs.version }}
               run: |
                   git config user.name "github-actions[bot]"
                   git config user.email "github-actions[bot]@users.noreply.github.com"
-                  git tag -a "${{ steps.version.outputs.version }}" -m "Release ${{ steps.version.outputs.version }}"
-                  git push origin "${{ steps.version.outputs.version }}"
-                  echo "✅ Created tag: ${{ steps.version.outputs.version }}"
+                  git tag -a "$VERSION" -m "Release $VERSION"
+                  git push origin "$VERSION"
+                  echo "✅ Created tag: $VERSION"
 
+            # `gh`, already on the runner, rather than a third-party action:
+            # one dependency fewer on the one job that holds a write token.
+            # `--notes` is prepended to the generated notes, as the action's
+            # `body` was; `--verify-tag` refuses to run against a tag the step
+            # above did not push, where `gh` would otherwise create one.
             - name: Create GitHub Release
               if: steps.check_tag.outputs.exists == 'false'
-              # v1 runs on a Node runtime GitHub no longer supports.
-              uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
-              with:
-                  tag_name: ${{ steps.version.outputs.version }}
-                  name: Release ${{ steps.version.outputs.version }}
-                  body: ${{ github.event.pull_request.body }}
-                  generate_release_notes: true
               env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  VERSION: ${{ steps.version.outputs.version }}
+                  BODY: ${{ github.event.pull_request.body }}
+              run: |
+                  gh release create "$VERSION" \
+                    --repo "$GITHUB_REPOSITORY" \
+                    --verify-tag \
+                    --title "Release $VERSION" \
+                    --notes "$BODY" \
+                    --generate-notes
 
             - name: Delete release branch
               env:
@@ -127,7 +143,7 @@ jobs:
     # Build and push the images by calling docker.yml directly.
     #
     # This is NOT redundant with docker.yml's own `release: published` trigger.
-    # The Release above is created by action-gh-release using the default
+    # The Release above is created by `gh` using the default
     # GITHUB_TOKEN, and GitHub does not raise workflow-triggering events for
     # anything done with that token — the recursion guard. So the release event
     # never reaches docker.yml, and before this job existed every automated
@@ -138,7 +154,10 @@ jobs:
     publish-images:
         needs: create-tag
         if: needs.create-tag.outputs.created == 'true'
-        uses: ./.github/workflows/docker.yml
+        # zizmor prefers GitHub's `$/` same-repository syntax (July 2026), but
+        # actionlint 1.7.12 rejects it as a malformed call. Switch once
+        # actionlint parses it; until then `./` resolves to this same commit.
+        uses: ./.github/workflows/docker.yml # zizmor: ignore[self-repository]
         with:
             version: ${{ needs.create-tag.outputs.version }}
         # docker.yml pushes to ghcr and signs with cosign; a called workflow can
diff --git a/.github/workflows/tracker-ci.yml b/.github/workflows/tracker-ci.yml
index 54d2f8f0..02af0d58 100644
--- a/.github/workflows/tracker-ci.yml
+++ b/.github/workflows/tracker-ci.yml
@@ -47,14 +47,15 @@ jobs:
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           # Deliberately the minor, not `go-version-file`. The `go` directive
-          # in go.mod is a *minimum language version* (`go 1.26.0`), but
-          # setup-go treats a full x.y.z as an exact pin — so reading it built
-          # CI on go1.26.0, the initial release, which govulncheck correctly
-          # flagged for 19 reachable stdlib vulnerabilities all fixed in
-          # 1.26.1. Tracking the minor matches `golang:1.26-alpine` in the
-          # Dockerfile, so CI tests the toolchain we actually ship. Bump this
-          # alongside the Dockerfile and the go.mod directive.
-          go-version: '1.26'
+          # in go.mod is a *minimum language version* (`go 1.27.0`), but
+          # setup-go treats a full x.y.z as an exact pin — so reading it, back
+          # when the directive said `go 1.26.0`, built CI on that initial
+          # release, which govulncheck correctly flagged for 19 reachable
+          # stdlib vulnerabilities all fixed in 1.26.1. Tracking the minor
+          # matches `golang:1.27-alpine` in the Dockerfile, so CI tests the
+          # toolchain we actually ship. Bump this alongside the Dockerfile and
+          # the go.mod directive.
+          go-version: '1.27'
           check-latest: true
           cache-dependency-path: apps/tracker/go.sum
 
@@ -100,7 +101,7 @@ jobs:
           # Same reasoning as the test job: track the minor, not the go.mod
           # directive. It matters most here — pinning to go1.26.0 is what made
           # this job fail on 19 stdlib vulnerabilities fixed in 1.26.1.
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
           cache-dependency-path: apps/tracker/go.sum
 
diff --git a/.github/workflows/web-ci.yml b/.github/workflows/web-ci.yml
index f78a1a2f..e6bc494f 100644
--- a/.github/workflows/web-ci.yml
+++ b/.github/workflows/web-ci.yml
@@ -75,12 +75,12 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 26
 
-      - name: Enable corepack
-        run: corepack enable
+      - name: Install pnpm
+        run: npm install --global --allow-scripts=pnpm "$(node -p 'require("./package.json").packageManager')" # zizmor: ignore[adhoc-packages]
 
       # `nuxt prepare` runs as apps/web's postinstall, so the generated
       # `.nuxt` declarations — auto-imports, typed routes, component types —
@@ -101,17 +101,20 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          # Matches `node:24-alpine` in apps/web/Dockerfile, so CI checks the
+          # Matches `node:26-alpine` in apps/web/Dockerfile, so CI checks the
           # runtime we actually ship.
-          node-version: 24
+          node-version: 26
 
-      # corepack rather than a third-party setup action: the pinned pnpm
-      # version already lives in package.json's `packageManager` field, and the
-      # Dockerfiles activate it exactly this way.
-      - name: Enable corepack
-        run: corepack enable
+      # Still no third-party setup action, but no corepack either: Node 25
+      # stopped shipping it. The version is read from package.json's
+      # `packageManager` field, which stays the one place it is pinned — and
+      # pnpm 12 checks that pin against pnpm-lock.yaml on a frozen install.
+      # `--allow-scripts`: pnpm's install script only hard-links its native
+      # binary, and npm is moving to blocking scripts it was not told about.
+      - name: Install pnpm
+        run: npm install --global --allow-scripts=pnpm "$(node -p 'require("./package.json").packageManager')" # zizmor: ignore[adhoc-packages]
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -128,14 +131,14 @@ jobs:
           persist-credentials: false
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # Neither image is loaded or run: the question this job answers is
       # whether the SFCs still compile, and a failed `nuxt build` fails the
       # step. The gha cache keeps the repeat cost down; drop the job if that
       # trade stops being worth it.
       - name: SSR image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: apps/web/Dockerfile
@@ -144,7 +147,7 @@ jobs:
           cache-to: type=gha,mode=max,scope=web-ssr
 
       - name: Static image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: apps/web/Dockerfile.static
diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 00000000..8c9bc938
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,50 @@
+# Every line below is a test fixture or a placeholder, not a secret: fake
+# passkeys (`abcdef0123…`), the throwaway `0123…` key the CI and the
+# integration script hand the API, test-only IP hash secrets, a made-up
+# did:key, two base64 strings standing in for legacy verifiers, a test that
+# checks a generated PEM *starts with* `-----BEGIN PRIVATE KEY-----`, and an
+# import list of two PBKDF2 constants the generic rule mistook for one.
+# Checked one by one on 2026-10-25 (gitleaks over all 696 commits). A new
+# fingerprint here needs the same look first.
+
+# .github/workflows/api-ci.yml
+1b5517e2cc107e3f9eddf41efac4c4ab61e42bd0:.github/workflows/api-ci.yml:generic-api-key:251
+# apps/api/scripts/run-integration-tests.sh
+61d3b4dd07cf7d133640a0ff361eada67869298b:apps/api/scripts/run-integration-tests.sh:generic-api-key:96
+# apps/api/test/integration/credentialRewrap.itest.ts
+a8d8ee96c37690a712eb278f441ef6612815e8de:apps/api/test/integration/credentialRewrap.itest.ts:generic-api-key:33
+a8d8ee96c37690a712eb278f441ef6612815e8de:apps/api/test/integration/credentialRewrap.itest.ts:generic-api-key:55
+# apps/api/test/integration/identityRecord.itest.ts
+6a27481799149ebaabb53acb0fd6c10168b4312d:apps/api/test/integration/identityRecord.itest.ts:generic-api-key:640
+# apps/api/test/messagingToken.test.ts
+f44bc361b27539d85a0f9c1dec1106c236076317:apps/api/test/messagingToken.test.ts:generic-api-key:15
+# apps/tracker/internal/config/config_test.go
+5f2fa7a746a288b0adc90a89258eb54329f237ba:apps/tracker/internal/config/config_test.go:generic-api-key:48
+d4c480bb4f89e1299054082efe229e57e4b0fb13:apps/tracker/internal/config/config_test.go:generic-api-key:49
+d4c480bb4f89e1299054082efe229e57e4b0fb13:apps/tracker/internal/config/config_test.go:generic-api-key:58
+d4c480bb4f89e1299054082efe229e57e4b0fb13:apps/tracker/internal/config/config_test.go:generic-api-key:80
+d4c480bb4f89e1299054082efe229e57e4b0fb13:apps/tracker/internal/config/config_test.go:generic-api-key:120
+d4c480bb4f89e1299054082efe229e57e4b0fb13:apps/tracker/internal/config/config_test.go:generic-api-key:139
+d4c480bb4f89e1299054082efe229e57e4b0fb13:apps/tracker/internal/config/config_test.go:generic-api-key:151
+d4c480bb4f89e1299054082efe229e57e4b0fb13:apps/tracker/internal/config/config_test.go:generic-api-key:167
+d4c480bb4f89e1299054082efe229e57e4b0fb13:apps/tracker/internal/config/config_test.go:generic-api-key:223
+# apps/tracker/internal/db/cache_test.go
+2938fd0a8e04ca235f75791460398610803c4eca:apps/tracker/internal/db/cache_test.go:generic-api-key:25
+# apps/tracker/internal/server/logging_test.go
+c3ed12a160fec40488f201b05a5660430517ba7a:apps/tracker/internal/server/logging_test.go:generic-api-key:27
+c3ed12a160fec40488f201b05a5660430517ba7a:apps/tracker/internal/server/logging_test.go:generic-api-key:64
+c3ed12a160fec40488f201b05a5660430517ba7a:apps/tracker/internal/server/logging_test.go:generic-api-key:99
+c3ed12a160fec40488f201b05a5660430517ba7a:apps/tracker/internal/server/logging_test.go:generic-api-key:108
+c3ed12a160fec40488f201b05a5660430517ba7a:apps/tracker/internal/server/logging_test.go:generic-api-key:120
+c3ed12a160fec40488f201b05a5660430517ba7a:apps/tracker/internal/server/logging_test.go:generic-api-key:129
+# apps/tracker/internal/udp/parse_test.go
+cd3622debb27cbd47d49842b37a78060aa5211d7:apps/tracker/internal/udp/parse_test.go:generic-api-key:107
+cd3622debb27cbd47d49842b37a78060aa5211d7:apps/tracker/internal/udp/parse_test.go:generic-api-key:130
+3e6d848cacaa4d57f0a6cc306beba442802e9954:apps/tracker/internal/udp/parse_test.go:generic-api-key:538
+# apps/web/test/identityKey.test.ts
+36f897023afec1dac417f138f5537bc1a873b02d:apps/web/test/identityKey.test.ts:private-key:121
+# deploy/helm/trackarr/check-render.sh
+ab215f4eff21d6d39269f809875b6203e41735b9:deploy/helm/trackarr/check-render.sh:generic-api-key:139
+ab215f4eff21d6d39269f809875b6203e41735b9:deploy/helm/trackarr/check-render.sh:generic-api-key:140
+# tests/security/authentication.test.ts
+ab71a8aa7bb3e5eaf4170b462d02b07a60cf847b:tests/security/authentication.test.ts:generic-api-key:18
diff --git a/.semgrepignore b/.semgrepignore
new file mode 100644
index 00000000..27d149f3
--- /dev/null
+++ b/.semgrepignore
@@ -0,0 +1,32 @@
+# A .semgrepignore REPLACES Semgrep's built-in list rather than adding to it,
+# so that list comes first, as documented
+# (https://docs.semgrep.dev/ignoring-files-folders-code).
+.git
+.svn
+.hg
+_darcs
+CVS
+build/
+vendor/
+dist/
+*.min.js
+.env/
+.tox/
+node_modules/
+.npm/
+.yarn/
+.venv/
+_opam/
+_build/
+_cargo/
+test/
+tests/
+testsuite/
+*_test.go
+
+# What git does not track is not ours to scan either.
+:include .gitignore
+
+# Prose, not code. The shell in a README is an example to read: a throwaway k3s
+# needs `--privileged`, a port-forwarded test LoadBalancer answers plain HTTP.
+*.md
diff --git a/.trivyignore.yaml b/.trivyignore.yaml
new file mode 100644
index 00000000..b0ac9a82
--- /dev/null
+++ b/.trivyignore.yaml
@@ -0,0 +1,79 @@
+# Accepted findings, each with its reason. trivy.yaml points trivy here when it
+# runs from the repository root, which is also what `paths` are relative to.
+# `paths` scope an entry to the files it was checked on; `expired_at` makes it
+# lapse so it gets looked at again. Dockerfile findings are not here but at
+# their line, next to the reason (apps/web/Dockerfile.static, doc/Dockerfile).
+
+vulnerabilities:
+  # node-forge (GHSA-86w9-cpqp-85rv, a.k.a. CVE-2026-33894 / GHSA-ppp5-5v6c-4jwp):
+  # RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm
+  # elements. No fixed release exists, 1.4.0 being both the latest and the last
+  # affected. It reaches the tree only through nitropack -> listhen, the dev
+  # server's self-signed-certificate helper, which never verifies a signature;
+  # no production image ships it (checked on 2026-10-25 against the api, web
+  # and spa images).
+  - id: CVE-2026-85393
+    expired_at: 2027-01-31
+    statement: node-forge, dev server only, no fixed release (see above)
+  - id: CVE-2026-33894
+    expired_at: 2027-01-31
+    statement: node-forge, dev server only, no fixed release (see above)
+  - id: GHSA-86w9-cpqp-85rv
+    expired_at: 2027-01-31
+    statement: node-forge, dev server only, no fixed release (see above)
+
+# The Helm chart, which trivy renders with its default values. It does so only
+# once the subcharts are vendored (`helm dependency update deploy/helm/trackarr`):
+# without charts/*.tgz it skips the whole chart with a warning and reports
+# nothing, which reads like a clean result.
+misconfigurations:
+  - id: KSV-0011
+    paths:
+      - "deploy/helm/trackarr/**"
+    statement: >-
+      No CPU limit, on purpose and everywhere in the chart: a CFS quota
+      throttles a burst even on an idle node. CPU requests and memory limits
+      are set (see the comment above web.resources in values.yaml).
+  - id: KSV-0110
+    paths:
+      - "deploy/helm/trackarr/**"
+    statement: >-
+      Render artifact. The templates leave the namespace to `helm install -n`;
+      trivy renders without one and reads that as `default`.
+  - id: KSV-0125
+    paths:
+      - "deploy/helm/trackarr/**"
+    statement: >-
+      A registry allow-list is the cluster's policy to set, not the chart's.
+      The images are the project's own (ghcr.io) and Valkey's official one.
+  - id: KSV-01010
+    paths:
+      - "deploy/helm/trackarr/templates/configmap.yaml"
+    statement: >-
+      Matched on the name REDIS_KEY_PREFIX, the namespace of the app's Redis
+      keys. Credentials all live in Secrets, which check-render.sh verifies.
+  - id: KSV-01010
+    paths:
+      - "deploy/helm/trackarr/charts/valkey/templates/configmap.yaml"
+      - "deploy/helm/trackarr/charts/valkey/templates/init_config.yaml"
+    statement: >-
+      Valkey's subchart. valkey.conf holds the maxmemory and persistence
+      settings; init.sh reads the credential from the mounted Secret at start
+      and writes only its SHA-256 to the ACL file.
+  - id: KSV-0109
+    paths:
+      - "deploy/helm/trackarr/charts/valkey/templates/init_config.yaml"
+    statement: >-
+      The same init.sh: what matched is the name of a shell variable that
+      holds what the mounted Secret contains, not a value.
+  - id: KSV-0020
+    paths:
+      - "deploy/helm/trackarr/charts/valkey/templates/*.yaml"
+    statement: >-
+      Valkey's subchart runs as 1000:1000. Moving it above 10000 changes the
+      owner of an existing data volume, an upgrade nobody has tested; the
+      chart's own images run as 65532.
+  - id: KSV-0021
+    paths:
+      - "deploy/helm/trackarr/charts/valkey/templates/*.yaml"
+    statement: Same as KSV-0020, for the group.
diff --git a/README.md b/README.md
index 7524a199..78f8f203 100644
--- a/README.md
+++ b/README.md
@@ -6,10 +6,10 @@
 
 Three containers — Nuxt 4 web · Nitro API · Go tracker — backed by PostgreSQL and Redis.
 
-[![Node.js](https://img.shields.io/badge/Node.js-24+-339933?style=flat&logo=nodedotjs&logoColor=white)](https://nodejs.org/)
+[![Node.js](https://img.shields.io/badge/Node.js-26+-339933?style=flat&logo=nodedotjs&logoColor=white)](https://nodejs.org/)
 [![Nuxt](https://img.shields.io/badge/Nuxt-4-00DC82?style=flat&logo=nuxtdotjs&logoColor=white)](https://nuxt.com/)
-[![Go](https://img.shields.io/badge/Go-1.25-00ADD8?style=flat&logo=go&logoColor=white)](https://go.dev/)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5-3178C6?style=flat&logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
+[![Go](https://img.shields.io/badge/Go-1.27-00ADD8?style=flat&logo=go&logoColor=white)](https://go.dev/)
+[![TypeScript](https://img.shields.io/badge/TypeScript-6+-3178C6?style=flat&logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
 [![License](https://img.shields.io/badge/License-MIT-blue?style=flat)](LICENSE)
 
 [Features](#-features) • [Architecture](#-architecture) • [Quick Start](#-quick-start) • [Static deployment](#-static-deployment-no-ssr) • [Documentation](https://dim145.github.io/opentracker/) • [Live Demo](https://tracker.florianargaud.com/)
@@ -95,7 +95,7 @@ Three independent containers behind Caddy, plus the usual Postgres + Redis. They
 
            ┌──────────────┐    ┌──────────────┐    ┌──────────────┐
            │  apps/web    │    │  apps/api    │    │ apps/tracker │
-           │  Nuxt 4 SSR  │    │  Nitro 4     │    │  Go 1.25     │
+           │  Nuxt 4 SSR  │    │  Nitro 4     │    │  Go 1.27     │
            │  Vue 3 / TS  │    │  Drizzle ORM │    │  sqlc        │
            │  (stateless) │    │  Zod, h3     │    │  HTTP + UDP  │
            └──────────────┘    └──────┬───────┘    └──────┬───────┘
@@ -120,7 +120,7 @@ Three independent containers behind Caddy, plus the usual Postgres + Redis. They
 
 - **The tracker is its own thing.** It's the hot path — every BitTorrent client in the swarm hits `/announce` every few minutes. A static Go binary on `scratch` (~10 MB image, sub-ms p99) means a single broken Nuxt deploy can't take down announces. Two transports — BEP 3 over HTTP/8080 and BEP 15 over UDP/6969 — share one wire-agnostic processor.
 - **API and web are split.** `apps/api` (Nitro standalone) owns every `/api/*` route, upload endpoints, metadata lookups, admin tools. `apps/web` is Nuxt SSR — rendered shell + page chunks. They scale and redeploy independently.
-- **Distroless everywhere.** `apps/web` + `apps/api` run on `gcr.io/distroless/nodejs24-debian13:nonroot`; `apps/tracker` runs on `scratch`; the static frontend runs on `cgr.dev/chainguard/nginx`. No shells, no package managers, non-root by default.
+- **Distroless everywhere.** `apps/web` + `apps/api` run on `gcr.io/distroless/nodejs26-debian13:nonroot`; `apps/tracker` runs on `scratch`; the static frontend runs on `cgr.dev/chainguard/nginx`. No shells, no package managers, non-root by default.
 
 More details: [Architecture guide](doc/guide/architecture.md).
 
@@ -197,7 +197,7 @@ from **distroless Chainguard nginx**:
 | Image size  | 254 MB | **28 MB** |
 | Idle RSS    | ~120 MB | **~7 MB** |
 | Cold start  | ~2 s | **<100 ms** |
-| Base image  | `distroless/nodejs24` | **`chainguard/nginx`** |
+| Base image  | `distroless/nodejs26` | **`chainguard/nginx`** |
 | First paint | server-rendered HTML | SPA shell, hydrates client-side |
 
 ```bash
@@ -244,8 +244,8 @@ change end to end.
 | Layer            | Technology                                | Notes                                              |
 | ---------------- | ----------------------------------------- | -------------------------------------------------- |
 | Frontend         | Nuxt 4, Vue 3, Tailwind CSS, Tiptap       | SSR by default, opt-in static SPA build            |
-| API              | Nitro 4 (Node 24), Drizzle ORM, Zod       | Standalone container, distroless runtime           |
-| Tracker          | Go 1.25, sqlc                             | `scratch`-based image, sub-ms announce p99         |
+| API              | Nitro 4 (Node 26), Drizzle ORM, Zod       | Standalone container, distroless runtime           |
+| Tracker          | Go 1.27, sqlc                             | `scratch`-based image, sub-ms announce p99         |
 | Database         | PostgreSQL 18                             | `gin_trgm_ops` full-text, migrations at API boot   |
 | Connection pool  | PgBouncer                                 | Transaction-mode pooling                           |
 | Cache / queue    | Redis 8                                   | Peer hashes, sessions, rate-limit windows, pub/sub |
diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
index 7b9e9a76..2d7bdacc 100644
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.7
+# syntax=docker/dockerfile:1.28
 # Trackarr API — Nitro standalone, distroless runtime.
 #
 # The runtime image carries:
@@ -15,14 +15,21 @@
 # corepack + the api's build deps just to expose a single CLI invocation;
 # this trims it down to what's actually needed at boot.
 #
-# Base is gcr.io/distroless/nodejs24-debian13:nonroot — no /bin/sh, no apt,
+# Base is gcr.io/distroless/nodejs26-debian13:nonroot — no /bin/sh, no apt,
 # runs as uid 65532, signed by Google.
 
 # -----------------------------------------------------------------------------
 # Install dependencies for the API build (cached on package.json + lockfile)
 # -----------------------------------------------------------------------------
-FROM node:24-alpine AS deps
-RUN corepack enable && corepack prepare pnpm@11.22.0 --activate
+FROM node:26-alpine AS deps
+# npm rather than corepack: Node 25 stopped shipping corepack, so the
+# node:26 images have none. The version must match `packageManager` in the
+# root package.json — pnpm 12 records it in pnpm-lock.yaml and a frozen
+# install refuses a lockfile whose pin it does not match. `--allow-scripts`
+# names the one install script we let run: pnpm's own, which only hard-links
+# its native binary over the bins. npm 11.20 runs unlisted scripts with a
+# warning today and is moving to blocking them.
+RUN npm install --global --allow-scripts=pnpm pnpm@12.15.0
 WORKDIR /app
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY apps/api/package.json ./apps/api/
@@ -33,8 +40,8 @@ RUN pnpm install --filter "@trackarr/api..." --frozen-lockfile
 # -----------------------------------------------------------------------------
 # Build Nitro (produces apps/api/.output, fully self-contained)
 # -----------------------------------------------------------------------------
-FROM node:24-alpine AS builder
-RUN corepack enable && corepack prepare pnpm@11.22.0 --activate
+FROM node:26-alpine AS builder
+RUN npm install --global --allow-scripts=pnpm pnpm@12.15.0
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=deps /app/apps/api/node_modules ./apps/api/node_modules
@@ -54,8 +61,8 @@ RUN pnpm --filter @trackarr/api build
 # `drizzle-kit push --force` against schema.ts. Hoisted into /db-tools so it
 # stays isolated from the Nitro bundle's own (inlined) node_modules.
 # -----------------------------------------------------------------------------
-FROM node:24-alpine AS db-tools
-RUN corepack enable && corepack prepare pnpm@11.22.0 --activate
+FROM node:26-alpine AS db-tools
+RUN npm install --global --allow-scripts=pnpm pnpm@12.15.0
 WORKDIR /db-tools
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY packages/db ./packages/db
@@ -82,7 +89,7 @@ RUN mkdir -p /seed/uploads
 # Final runtime — distroless nonroot
 # Entrypoint of this base image is `/nodejs/bin/node`; CMD is just the script.
 # -----------------------------------------------------------------------------
-FROM gcr.io/distroless/nodejs24-debian13:nonroot AS runner
+FROM gcr.io/distroless/nodejs26-debian13:nonroot AS runner
 WORKDIR /app
 
 COPY --from=builder --chown=nonroot:nonroot /app/apps/api/.output ./.output
@@ -112,15 +119,25 @@ COPY --chown=nonroot:nonroot apps/api/scripts/migrationOutcome.mjs ./migrationOu
 COPY --chown=nonroot:nonroot apps/api/scripts/migrate.mjs /app/db-tools/packages/db/migrate.mjs
 COPY --chown=nonroot:nonroot apps/api/scripts/healthcheck.mjs ./healthcheck.mjs
 
-USER nonroot
+# Numeric, as in the tracker and relay images: `nonroot` is the same 65532 in
+# this distroless base, but the kubelet refuses to verify a user NAME against
+# `runAsNonRoot` ("image has non-numeric user") unless runAsUser is set.
+USER 65532:65532
 EXPOSE 4000
 # Memory tuning:
 #   --max-old-space-size=512   cap the V8 old-generation heap at 512 MB.
-#                              Without this, Node 24 derives the cap from the
+#                              Without this, Node derives the cap from the
 #                              host's RAM (often 2+ GB on dev machines), which
 #                              defers GC and lets RSS balloon under load.
 #   --max-semi-space-size=8    smaller young-generation chunks → more frequent
 #                              minor GCs, lower transient peak.
+#   --no-experimental-webstorage
+#                              Node 25 turned Web Storage on by default. On a
+#                              server that means ONE `sessionStorage` shared
+#                              by every request the process ever serves, and
+#                              a warning each time something probes
+#                              `localStorage`. Off, as it was on Node 24:
+#                              neither global exists.
 #   MALLOC_ARENA_MAX=2         glibc malloc on distroless pre-allocates one
 #                              memory arena per CPU; capping at 2 saves
 #                              ~30-60 MB of RSS on multi-core hosts.
@@ -128,7 +145,7 @@ EXPOSE 4000
 ENV NODE_ENV=production \
     NITRO_PORT=4000 \
     NITRO_HOST=0.0.0.0 \
-    NODE_OPTIONS="--max-old-space-size=512 --max-semi-space-size=8" \
+    NODE_OPTIONS="--max-old-space-size=512 --max-semi-space-size=8 --no-experimental-webstorage" \
     MALLOC_ARENA_MAX=2 \
     NITRO_ENV_PREFIX=NUXT_ \
     TRACKARR_RUNTIME=docker
diff --git a/apps/api/middleware/panic-lock.ts b/apps/api/middleware/panic-lock.ts
new file mode 100644
index 00000000..3373451e
--- /dev/null
+++ b/apps/api/middleware/panic-lock.ts
@@ -0,0 +1,29 @@
+/**
+ * Panic mode makes the API read-only.
+ *
+ * Panic encrypts the catalogue and the members' credentials in place, but it
+ * does not end the sessions already open — on purpose, so staff keep a way in.
+ * Those sessions could go on uploading, posting, resetting keys, registering
+ * members: every such row landed in clear in a database announced as encrypted,
+ * and the restore, which only knew how to decrypt, failed on each of them.
+ *
+ * The restore now keeps a row that is already clear (`decryptFieldOrKeep`), so
+ * the lockout is gone either way; this is the other half — nothing new is
+ * written in clear while the panic stands. A middleware rather than a check per
+ * route, for the reason the audit log is a hook: a writing route added tomorrow
+ * is covered before anyone remembers it should be.
+ *
+ * What still writes: the panic itself (resuming an interrupted encrypt, the
+ * restore) and logging out.
+ */
+import { allowedDuringPanic, panicActive } from '~~/utils/panicLock';
+
+export default defineEventHandler(async (event) => {
+  if (allowedDuringPanic(event.method, event.path || '')) return;
+  if (!(await panicActive())) return;
+  throw createError({
+    statusCode: 503,
+    message: 'The site is locked while panic mode is active.',
+    data: { reason: 'panic-lock' },
+  });
+});
diff --git a/apps/api/middleware/security.ts b/apps/api/middleware/security.ts
index 9b313224..a5a41a6b 100644
--- a/apps/api/middleware/security.ts
+++ b/apps/api/middleware/security.ts
@@ -267,9 +267,12 @@ export default defineEventHandler(async (event) => {
     const banned = await getUserSession(event);
     const live = banned.user ? await readLiveRoles(banned.user.id) : null;
     if (!live?.isAdmin && !live?.isModerator) {
+      // Never the stored reason: the ban route writes "Banned user: <name>.
+      // Reason: …" into it, and this answer goes to whoever shares the address
+      // — a VPN exit, a carrier NAT — not only to the banned member.
       throw createError({
         statusCode: 403,
-        message: `Access denied: ${ipBanReason}`,
+        message: 'Access denied: this address is banned.',
       });
     }
     console.warn(
diff --git a/apps/api/nitro.config.ts b/apps/api/nitro.config.ts
index 47ace6c9..6779a4f5 100644
--- a/apps/api/nitro.config.ts
+++ b/apps/api/nitro.config.ts
@@ -31,17 +31,18 @@ export default defineNitroConfig({
   // esbuild target. Nitro's default is `es2019` — far older than what
   // we actually run, and old enough to refuse BigInt literal syntax
   // (`0n` / `1024n`) at parse time even though the runtime supports
-  // them fine. Pinning to `node24` matches the production runtime
-  // (distroless `gcr.io/distroless/nodejs24-debian13:nonroot`, see
-  // apps/api/Dockerfile) and unlocks every ES2025 feature V8 13.6
-  // ships — iterator helpers, Set methods (`union` / `intersection` / …),
-  // `Promise.try`, `RegExp.escape`, JSON modules. Targeting a Node
+  // them fine. Pinning to `node26` matches the production runtime
+  // (distroless `gcr.io/distroless/nodejs26-debian13:nonroot`, see
+  // apps/api/Dockerfile) and unlocks every ES2025 feature — iterator
+  // helpers, Set methods (`union` / `intersection` / …), `Promise.try`,
+  // `RegExp.escape`, JSON modules — plus what V8 14.6 adds on top:
+  // `Map.prototype.getOrInsert`, `Iterator.concat`, `Temporal`. Targeting a Node
   // version rather than an ES year is the recommended idiom for
   // server-only bundles since esbuild keeps a per-runtime feature
   // table that accounts for V8-specific quirks.
   esbuild: {
     options: {
-      target: 'node24',
+      target: 'node26',
     },
   },
 
@@ -52,28 +53,16 @@ export default defineNitroConfig({
     '~': root,
   },
 
+  // Only what the routes read. `databaseUrl`, `redisUrl` and `sessionPassword`
+  // stood here unread — the database, Redis and session code take their
+  // environment directly — and, evaluated at BUILD time, they would have baked
+  // whatever those variables held during a build into the bundle.
   runtimeConfig: {
-    databaseUrl: (() => {
-      const baseUrl =
-        process.env.DATABASE_URL ||
-        'postgres://tracker:tracker@localhost:5432/trackarr';
-      if (
-        process.env.NODE_ENV === 'production' &&
-        !baseUrl.includes('sslmode=')
-      ) {
-        return (
-          baseUrl + (baseUrl.includes('?') ? '&' : '?') + 'sslmode=require'
-        );
-      }
-      return baseUrl;
-    })(),
-    redisUrl: process.env.REDIS_URL || 'redis://localhost:6379',
-    sessionPassword: process.env.NUXT_SESSION_SECRET || '',
     public: {
       // Tracker URLs are read at runtime from NUXT_PUBLIC_TRACKER_*_URL env vars.
       trackerHttpUrl: 'http://localhost:8080/announce',
-      trackerUdpUrl: 'udp://localhost:8081/announce',
-      trackerWsUrl: 'ws://localhost:8082',
+      // Empty unless configured: no UDP tier is advertised by default.
+      trackerUdpUrl: '',
     },
   },
 
diff --git a/apps/api/package.json b/apps/api/package.json
index a068a855..8c707881 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -15,36 +15,34 @@
   },
   "dependencies": {
     "@iconify-json/ph": "^1.2.2",
-    "@iconify/utils": "^3.1.4",
-    "@simplewebauthn/server": "^13.3.3",
+    "@iconify/utils": "^3.1.7",
+    "@prometheus-io/client": "^0.16.1",
+    "@simplewebauthn/server": "^14.0.3",
     "@trackarr/db": "workspace:*",
     "@trackarr/shared": "workspace:*",
     "bencode": "^4.0.1",
-    "create-torrent": "^6.1.3",
     "css-tree": "^3.2.1",
-    "drizzle-orm": "^0.45.2",
+    "drizzle-orm": "^0.45.4",
     "h3": "^1.15.11",
     "ioredis": "^6.0.0",
-    "marked": "^18.0.9",
-    "nitropack": "^2.13.4",
+    "marked": "^18.1.1",
+    "nitropack": "^2.13.5",
     "nodemailer": "^10.2.1",
     "otplib": "^13.4.1",
     "parse-torrent": "^11.0.24",
-    "pino": "^10.3.1",
-    "prom-client": "^15.1.3",
+    "pino": "^10.4.0",
     "qrcode": "^1.5.4",
-    "uuid": "^14.0.1",
+    "uuid": "^14.0.3",
     "web-push": "^3.6.7",
-    "zod": "^4.6.6"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/bencode": "^4.0.0",
-    "@types/create-torrent": "^6.1.1",
     "@types/css-tree": "^3.2.0",
     "@types/parse-torrent": "^11.0.1",
     "@types/qrcode": "^1.5.6",
     "@types/web-push": "^3.6.4",
-    "pino-pretty": "^13.1.3",
-    "vitest": "^4.1.12"
+    "pino-pretty": "^13.2.0",
+    "vitest": "^5.0.5"
   }
 }
diff --git a/apps/api/plugins/00.0-secret-files.ts b/apps/api/plugins/00.0-secret-files.ts
new file mode 100644
index 00000000..35f73bda
--- /dev/null
+++ b/apps/api/plugins/00.0-secret-files.ts
@@ -0,0 +1,28 @@
+/**
+ * Docker secrets, read once and exposed under their plain names.
+ *
+ * `*_FILE` is how a secret arrives from a Docker or Kubernetes secret mount,
+ * and `utils/secrets` reads that form — but only the boot validation went
+ * through it. The session, the credential and channel keys, and the login's
+ * fake-salt key all read the plain variable, so a deployment using
+ * `NUXT_SESSION_SECRET_FILE` passed the validation and then failed at its first
+ * session. Materialised here, before any other plugin runs (the file name sorts
+ * first), every reader sees the same value.
+ */
+import { readOptionalSecret } from '~~/utils/secrets';
+
+const FILE_BACKED = [
+  'NUXT_SESSION_SECRET',
+  'IP_HASH_SECRET',
+  'CREDENTIAL_ENCRYPTION_KEY',
+  'CREDENTIAL_ENCRYPTION_KEY_PREVIOUS',
+  'CHANNEL_ENCRYPTION_KEY',
+] as const;
+
+export default defineNitroPlugin(() => {
+  for (const key of FILE_BACKED) {
+    if (process.env[key] || !process.env[`${key}_FILE`]) continue;
+    const value = readOptionalSecret(key);
+    if (value) process.env[key] = value;
+  }
+});
diff --git a/apps/api/plugins/00.secrets.ts b/apps/api/plugins/00.secrets.ts
index 3d095c08..0b6f4330 100644
--- a/apps/api/plugins/00.secrets.ts
+++ b/apps/api/plugins/00.secrets.ts
@@ -15,11 +15,17 @@
  * DATABASE_URL / REDIS are validated by their own clients (and carry
  * dev defaults), so they're intentionally not listed here.
  */
-import { validateRequiredSecrets } from '~~/utils/secrets';
+import { readOptionalSecret, validateRequiredSecrets } from '~~/utils/secrets';
 
 export default defineNitroPlugin(() => {
   try {
     validateRequiredSecrets(['NUXT_SESSION_SECRET', 'IP_HASH_SECRET']);
+    // The session refuses a secret under 32 characters, but only when the
+    // first session is opened: a short one booted cleanly and then failed every
+    // sign-in. Refused here, where the operator is looking.
+    if ((readOptionalSecret('NUXT_SESSION_SECRET') ?? '').length < 32) {
+      throw new Error('NUXT_SESSION_SECRET must be at least 32 characters (`openssl rand -hex 32`).');
+    }
   } catch (err) {
     // Re-throw so the process exits non-zero — a missing security
     // secret must not boot into a half-working state.
diff --git a/apps/api/plugins/backfill-content-roots.ts b/apps/api/plugins/backfill-content-roots.ts
index 19740d36..6a8feb40 100644
--- a/apps/api/plugins/backfill-content-roots.ts
+++ b/apps/api/plugins/backfill-content-roots.ts
@@ -34,6 +34,7 @@ import { and, asc, eq, gt, isNotNull } from 'drizzle-orm';
 import { extractV2 } from '~~/utils/bittorrentV2';
 import { getSetting, setSetting } from '~~/utils/server';
 import { withCronLock } from '~~/utils/cronLock';
+import { panicActive } from '~~/utils/panicLock';
 
 const SWEEP_INTERVAL_MS = 5 * 60 * 1000;
 const FIRST_RUN_DELAY_MS = 75 * 1000;
@@ -43,6 +44,9 @@ const BATCH_SIZE = 50;
 const CURSOR_KEY = 'content_root_v2_backfill_cursor_v2';
 
 async function tick(): Promise<{ processed: number; v2: number }> {
+  // Panic encrypts `torrent_data`: walking it then would leave both columns null
+  // for every row the cursor passed, and never come back for them.
+  if (await panicActive()) return { processed: 0, v2: 0 };
   const cursor = (await getSetting(CURSOR_KEY)) ?? '';
 
   const rows = await db
diff --git a/apps/api/plugins/backfill-content-signatures.ts b/apps/api/plugins/backfill-content-signatures.ts
index 230b5260..efde4c56 100644
--- a/apps/api/plugins/backfill-content-signatures.ts
+++ b/apps/api/plugins/backfill-content-signatures.ts
@@ -23,12 +23,16 @@ import { eq, isNull } from 'drizzle-orm';
 import { parseTorrentFile } from '~~/utils/parseTorrentFile';
 import { computeContentSignature } from '~~/utils/contentSignature';
 import { withCronLock } from '~~/utils/cronLock';
+import { panicActive } from '~~/utils/panicLock';
 
 const SWEEP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
 const FIRST_RUN_DELAY_MS = 60 * 1000; // 1 minute after boot
 const BATCH_SIZE = 50;
 
 async function tick(): Promise<{ processed: number; signed: number }> {
+  // Panic encrypts `torrent_data`: every row parsed now would fail and be
+  // stamped empty below, and never be signed after the restore.
+  if (await panicActive()) return { processed: 0, signed: 0 };
   const rows = await db
     .select({
       id: schema.torrents.id,
diff --git a/apps/api/plugins/backfill-credential-rewrap.ts b/apps/api/plugins/backfill-credential-rewrap.ts
new file mode 100644
index 00000000..4c63fd32
--- /dev/null
+++ b/apps/api/plugins/backfill-credential-rewrap.ts
@@ -0,0 +1,30 @@
+/**
+ * Drives `utils/credentialRewrap`: account secrets still in plaintext, or only
+ * under the previous key, re-encrypted under the current one without waiting
+ * for their owners to log in. The module says why that matters.
+ */
+import { rewrapCredentialsTick } from '~~/utils/credentialRewrap';
+import { withCronLock } from '~~/utils/cronLock';
+
+const SWEEP_INTERVAL_MS = 60 * 1000;
+const FIRST_RUN_DELAY_MS = 60 * 1000;
+
+export default defineNitroPlugin(() => {
+  const run = async () => {
+    try {
+      await withCronLock('credential_rewrap:lock', 5 * 60, async () => {
+        const { processed, rewritten } = await rewrapCredentialsTick();
+        if (rewritten > 0) {
+          console.log(`[Credentials] re-encrypted ${rewritten} secret(s) over ${processed} account(s)`);
+        }
+      });
+    } catch (err) {
+      console.warn('[Credentials] re-encryption sweep failed:', (err as Error).message);
+    }
+  };
+
+  setTimeout(() => {
+    void run();
+    setInterval(run, SWEEP_INTERVAL_MS);
+  }, FIRST_RUN_DELAY_MS);
+});
diff --git a/apps/api/plugins/backfill-series-position.ts b/apps/api/plugins/backfill-series-position.ts
index 968c449d..fca630d3 100644
--- a/apps/api/plugins/backfill-series-position.ts
+++ b/apps/api/plugins/backfill-series-position.ts
@@ -24,6 +24,7 @@ import { sql } from 'drizzle-orm';
 import { parseReleaseName } from '@trackarr/shared/releaseParse';
 import { getSetting, setSetting } from '~~/utils/server';
 import { withCronLock } from '~~/utils/cronLock';
+import { panicActive } from '~~/utils/panicLock';
 
 // Adaptive pacing. A tick that filled its batch means there is more table to
 // walk, so the next one follows almost immediately; a short tick means we are
@@ -46,6 +47,9 @@ interface TickResult {
 }
 
 async function tick(): Promise<TickResult> {
+  // Panic encrypts the names: the cursor would walk the whole catalogue finding
+  // no series, then mark itself done for good.
+  if (await panicActive()) return { scanned: 0, written: 0, finished: false };
   const cursor = (await getSetting(CURSOR_KEY)) ?? '';
   if (cursor === DONE) return { scanned: 0, written: 0, finished: true };
 
diff --git a/apps/api/plugins/backfill-torrent-files.ts b/apps/api/plugins/backfill-torrent-files.ts
new file mode 100644
index 00000000..2c799bdc
--- /dev/null
+++ b/apps/api/plugins/backfill-torrent-files.ts
@@ -0,0 +1,34 @@
+/**
+ * Drives `utils/torrentFileCleanup`: the sweep that drops the uploader's fields
+ * and repairs the piece layers of `.torrent` files stored before the upload did
+ * either. The module explains both faults.
+ */
+import { cleanupTorrentFilesTick } from '~~/utils/torrentFileCleanup';
+import { withCronLock } from '~~/utils/cronLock';
+
+// Faster than the content-roots sweep: a row costs a byte scan, not a parse
+// (only a v2 torrent is decoded, to read its roots), and every hour a passkey
+// stays at rest is an hour it can leave in a backup. 200 rows a minute walks a
+// 100 000-torrent catalogue in under nine hours.
+const SWEEP_INTERVAL_MS = 60 * 1000;
+const FIRST_RUN_DELAY_MS = 90 * 1000;
+
+export default defineNitroPlugin(() => {
+  const run = async () => {
+    try {
+      await withCronLock('torrent_file_cleanup:lock', 5 * 60, async () => {
+        const { processed, cleaned } = await cleanupTorrentFilesTick();
+        if (processed > 0) {
+          console.log(`[TorrentFiles] cleanup tick: processed=${processed}, cleaned=${cleaned}`);
+        }
+      });
+    } catch (err) {
+      console.warn('[TorrentFiles] cleanup tick failed:', (err as Error).message);
+    }
+  };
+
+  setTimeout(() => {
+    void run();
+    setInterval(run, SWEEP_INTERVAL_MS);
+  }, FIRST_RUN_DELAY_MS);
+});
diff --git a/apps/api/plugins/ban-expiry.ts b/apps/api/plugins/ban-expiry.ts
index 6c74c108..b8277620 100644
--- a/apps/api/plugins/ban-expiry.ts
+++ b/apps/api/plugins/ban-expiry.ts
@@ -119,7 +119,8 @@ export default defineNitroPlugin(async () => {
       );
 
       console.log(
-        `[Ban Expiry] Unbanned ${expired.length} user(s):`,
+        '[Ban Expiry] Unbanned %d user(s): %s',
+        expired.length,
         expired.map((u) => u.username).join(', '),
       );
     } catch (err) {
diff --git a/apps/api/plugins/bonus-collector.ts b/apps/api/plugins/bonus-collector.ts
index 6efeef7d..b1ef67cc 100644
--- a/apps/api/plugins/bonus-collector.ts
+++ b/apps/api/plugins/bonus-collector.ts
@@ -75,6 +75,12 @@ const LOCK_KEY = 'bonus:collector:lock';
  * of stretching the time-to-credit for the tail.
  */
 const SCAN_CURSOR_KEY = 'bonus:collector:scan_cursor';
+/**
+ * The tracker's own notion of "in the swarm" (`activeListWindow` in
+ * apps/tracker/internal/peers): a peer quiet for longer is no longer handed
+ * out to other clients, and is no longer paid as a seeder either.
+ */
+const ACTIVE_PEER_WINDOW_MS = 60 * 60 * 1000;
 /** Lock TTL — generous so a 30 s SCAN budget doesn't trip the
  *  lock, but short enough that a crashed replica releases the slot
  *  before the next scheduled tick. */
@@ -154,13 +160,20 @@ export default defineNitroPlugin(async () => {
           const infoHash = key.slice('peers:'.length);
           const peers = await redis.hgetall(key);
           let set = torrentSeederUsers.get(infoHash);
+          const activeSince = Date.now() - ACTIVE_PEER_WINDOW_MS;
           for (const json of Object.values(peers)) {
             try {
               const peer = JSON.parse(json as string) as {
                 userId?: string;
                 isSeeder?: boolean;
+                updatedAt?: number;
               };
               if (!peer.isSeeder || !peer.userId) continue;
+              // Only peers still announcing. An entry lives 24 h in Redis
+              // (`TRACKER_PEER_TTL`), so one `left=0` announce a day on a
+              // torrent nobody seeds used to be paid as a full day of seeding
+              // — with the rarity and first-seeder multipliers on top.
+              if (!peer.updatedAt || peer.updatedAt < activeSince) continue;
               if (!set) {
                 set = new Set();
                 torrentSeederUsers.set(infoHash, set);
diff --git a/apps/api/plugins/bonus-event-sync.ts b/apps/api/plugins/bonus-event-sync.ts
new file mode 100644
index 00000000..3cfe814d
--- /dev/null
+++ b/apps/api/plugins/bonus-event-sync.ts
@@ -0,0 +1,38 @@
+/**
+ * Keeps the tracker's view of the running bonus event current.
+ *
+ * The tracker reads the active event from `bonus:active`, a snapshot written
+ * with a five-minute TTL. Nothing rewrote it on a schedule: only admin edits,
+ * the freeleech pool's own transitions, and a read that found it expired —
+ * `/api/bonus/active` from a browser, a Torznab search, an IRC announce. Five
+ * quiet minutes, a night on a small instance, and the tracker went back to
+ * 1×/1× in the middle of a freeleech; and a scheduled event only started at
+ * the first page view after its start time, its start notification with it.
+ *
+ * Once a minute, under a cross-replica lock. `syncActiveSnapshot` is idempotent
+ * and its start broadcast is guarded per event, so a replica that misses a tick
+ * costs nothing.
+ */
+import { syncActiveSnapshot } from '~~/utils/bonusEvents';
+import { withCronLock } from '~~/utils/cronLock';
+
+const SYNC_INTERVAL_MS = 60 * 1000;
+
+export default defineNitroPlugin(() => {
+  const run = async () => {
+    try {
+      await withCronLock('bonus_event_sync:lock', 50, async () => {
+        await syncActiveSnapshot();
+      });
+    } catch (err) {
+      console.warn('[BonusEvents] snapshot sync failed:', (err as Error).message);
+    }
+  };
+
+  // Soon after boot: a restart in the middle of an event must not leave the
+  // tracker without it until somebody browses.
+  setTimeout(() => {
+    void run();
+    setInterval(run, SYNC_INTERVAL_MS);
+  }, 5 * 1000);
+});
diff --git a/apps/api/plugins/hnr-sweep.ts b/apps/api/plugins/hnr-sweep.ts
new file mode 100644
index 00000000..a5114e7a
--- /dev/null
+++ b/apps/api/plugins/hnr-sweep.ts
@@ -0,0 +1,35 @@
+/**
+ * Hit-and-run sweep — flags the downloads whose grace period ran out before
+ * their seeding requirement was met, and notifies the member.
+ *
+ * `checkAndMarkHnrs()` used to run only when a moderator opened the H&R page
+ * with `?check=true`, although the guide described a loop: on an instance
+ * nobody moderated by hand, nobody was ever flagged. It runs here on its own
+ * now, idempotent (it only flips rows still `is_hnr = false`), under a
+ * cross-replica lock so the notifications go out once.
+ */
+import { checkAndMarkHnrs } from '~~/utils/hnr';
+import { withCronLock } from '~~/utils/cronLock';
+
+// Grace periods are counted in hours; ten minutes is late enough to cost
+// nothing and early enough that the notification reads as "now".
+const SWEEP_INTERVAL_MS = 10 * 60 * 1000;
+const FIRST_RUN_DELAY_MS = 2 * 60 * 1000;
+
+export default defineNitroPlugin(() => {
+  const run = async () => {
+    try {
+      await withCronLock('hnr_sweep:lock', 5 * 60, async () => {
+        const flagged = await checkAndMarkHnrs();
+        if (flagged > 0) console.log(`[HnR] sweep flagged ${flagged} download(s)`);
+      });
+    } catch (err) {
+      console.warn('[HnR] sweep failed:', (err as Error).message);
+    }
+  };
+
+  setTimeout(() => {
+    void run();
+    setInterval(run, SWEEP_INTERVAL_MS);
+  }, FIRST_RUN_DELAY_MS);
+});
diff --git a/apps/api/plugins/metrics.ts b/apps/api/plugins/metrics.ts
index 7de75aa5..755d182b 100644
--- a/apps/api/plugins/metrics.ts
+++ b/apps/api/plugins/metrics.ts
@@ -116,7 +116,7 @@ export default defineNitroPlugin((nitroApp) => {
   });
 
   server.on('error', (err) => {
-    console.error(`[metrics] server error on ${host}:${port}:`, err);
+    console.error('[metrics] server error on %s:%s:', host, port, err);
   });
 
   server.listen(port, host, () => {
diff --git a/apps/api/redis/client.ts b/apps/api/redis/client.ts
index 2bcaa6f0..31a3d64c 100644
--- a/apps/api/redis/client.ts
+++ b/apps/api/redis/client.ts
@@ -6,6 +6,8 @@ import { readOptionalSecret } from '../utils/secrets';
  * Supports authentication, TLS, and connection security with Docker secrets
  */
 
+// Development fallback; deployments pass REDIS_URL, rediss:// included.
+// nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
 const redisUrl = process.env.REDIS_URL || 'redis://localhost:6379';
 const isProduction = process.env.NODE_ENV === 'production';
 
@@ -52,6 +54,12 @@ function buildRedisOptions(): RedisOptions {
     // Prevent command queue overflow (DDoS protection)
     maxLoadingRetryTime: 5000,
     enableOfflineQueue: false,
+    // A socket that is open but no longer answers (a paused container, a
+    // half-dead NAT entry) otherwise holds every command — and the request
+    // behind it — until the kernel gives up on the TCP connection. The tracker
+    // pins 3 s for the same reason; nothing in the API issues a blocking
+    // command, so no legitimate reply takes this long.
+    commandTimeout: 5000,
     // Key prefix for namespace isolation
     keyPrefix: process.env.REDIS_KEY_PREFIX || 'ot:',
   };
@@ -89,17 +97,19 @@ function buildRedisOptions(): RedisOptions {
     options.tls = tlsConfig;
   }
 
-  // Connection pool limits (prevent resource exhaustion)
-  if (isProduction) {
-    options.retryStrategy = (times: number) => {
-      if (times > 10) {
-        console.error('[Redis] Max retries exceeded, giving up');
-        return null; // Stop retrying
-      }
-      // Exponential backoff with max 3 seconds
-      return Math.min(times * 200, 3000);
-    };
-  }
+  // Reconnect for as long as it takes. This used to return `null` after ten
+  // attempts — about eleven seconds — and a non-number tells ioredis to close
+  // the connection for good: nothing called `connect()` again, so any Redis
+  // outage longer than that (a container recreated for an upgrade, an OOM kill,
+  // a slow AOF load) left the API without Redis until it was restarted. Logins
+  // live in Redis, so nobody could sign in, `/api/health` stayed 503, and under
+  // Helm every pod sat NotReady with a liveness probe that never restarts it.
+  options.retryStrategy = (times: number) => {
+    if (times === 10 || times % 100 === 0) {
+      console.error(`[Redis] still unreachable after ${times} attempts, retrying every 3 s`);
+    }
+    return Math.min(times * 200, 3000);
+  };
 
   return options;
 }
@@ -112,10 +122,12 @@ redis.on('connect', () => {
 });
 
 redis.on('error', (err) => {
-  // Sanitize error messages to avoid leaking sensitive info
+  // Sanitize error messages to avoid leaking sensitive info. `rediss://` as
+  // well: a TLS URL carries the same password, and a mask that only knew the
+  // plain scheme let it through whole.
   const sanitizedMessage = err.message.replace(
-    /redis:\/\/[^@]+@/g,
-    'redis://***@'
+    /(rediss?):\/\/[^@]+@/g,
+    '$1://***@'
   );
   console.error('[Redis] Error:', sanitizedMessage);
 });
diff --git a/apps/api/routes/api/admin/debug/tracker-status.get.ts b/apps/api/routes/api/admin/debug/tracker-status.get.ts
index 02a89c97..b03d2774 100644
--- a/apps/api/routes/api/admin/debug/tracker-status.get.ts
+++ b/apps/api/routes/api/admin/debug/tracker-status.get.ts
@@ -5,6 +5,7 @@
 import { redis } from '~~/utils/server';
 import { getGlobalStats } from '~~/utils/server';
 import { requireAdminSession } from '~~/utils/adminAuth';
+import { trackerUdpEnabled } from '~~/utils/announceUrls';
 
 export default defineEventHandler(async (event) => {
   // Admin only — live-role-revalidating gate (finding L9).
@@ -25,7 +26,7 @@ export default defineEventHandler(async (event) => {
   // process state from here. Report the static protocol matrix and let the
   // operator check `docker compose ps tracker` for liveness.
   const trackerStatus = 'separate-process';
-  const trackerProtocols = { http: true, udp: false, ws: false };
+  const trackerProtocols = { http: true, udp: trackerUdpEnabled() };
 
   // Get global stats from cache
   let globalStats:
diff --git a/apps/api/routes/api/admin/panic/encrypt.post.ts b/apps/api/routes/api/admin/panic/encrypt.post.ts
index 0b1d408d..7912558b 100644
--- a/apps/api/routes/api/admin/panic/encrypt.post.ts
+++ b/apps/api/routes/api/admin/panic/encrypt.post.ts
@@ -8,6 +8,7 @@ import {
   torrentComments,
 } from '@trackarr/db/schema';
 import { requireAdminSession } from '~~/utils/adminAuth';
+import { invalidatePanicCache } from '~~/utils/panicLock';
 import { auditDetail } from '~~/utils/audit';
 import { z } from 'zod';
 import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
@@ -159,6 +160,9 @@ export default defineEventHandler(async (event) => {
         phase: 'encrypting',
       },
     });
+  // From here on the API is read-only (`middleware/panic-lock`): every replica
+  // must see it now, not when its cache lapses.
+  await invalidatePanicCache();
 
   // ── Encrypt sensitive user data ──────────────────────────────
   const allUsers = await db.select().from(users);
@@ -258,6 +262,7 @@ export default defineEventHandler(async (event) => {
       phase: 'encrypted',
     })
     .where(eq(panicState.id, 'singleton'));
+  await invalidatePanicCache();
 
   return {
     success: true,
@@ -275,11 +280,18 @@ export default defineEventHandler(async (event) => {
      * Restent EN CLAIR : `messages.body` et `room_messages.body` — soit tout le
      * texte des conversations privées et du salon public, le chiffrement de
      * bout en bout étant optionnel et par conversation —, les tickets et leurs
-     * messages, les titres de sujets de forum, la bio et le nom affiché,
-     * `totp_secret`, la configuration serveur des canaux, le journal de
-     * connexions (adresses, agents), les signalements de l'anti-triche, le
-     * journal d'audit, le miroir des torrents distants et la clé privée de
-     * fédération.
+     * messages, les titres de sujets de forum, la bio et le nom affiché, le
+     * NFO et les identifiants externes (IMDb, TMDb…) qui nomment le contenu
+     * aussi bien que le titre chiffré, les enregistrements signés du
+     * catalogue, les signalements, demandes, avertissements et IP bannies, le
+     * journal de connexions (adresses, agents), les signalements de
+     * l'anti-triche, le journal d'audit et le miroir des torrents distants.
+     *
+     * `totp_secret`, la configuration serveur des canaux et la clé privée de
+     * fédération figuraient dans cette liste ; ils sont en fait chiffrés au
+     * repos, mais par une clé tirée de l'environnement et non du mot de passe
+     * de panique : hors de portée d'un dump seul, à portée de qui tient le
+     * serveur. D'où une troisième liste.
      *
      * Étendre la couverture ferait de ces boucles quelque chose de bien plus
      * long, ce qui rend la reprise (voir `phase`) d'autant plus nécessaire.
@@ -298,9 +310,22 @@ export default defineEventHandler(async (event) => {
       'messages.body', 'room_messages.body',
       'tickets.*', 'ticket_messages.*',
       'forum_topics.title', 'users.bio', 'users.display_name',
-      'users.totp_secret', 'notification_channels.server_config',
+      'torrents.nfo', 'torrents.imdb_id', 'torrents.tmdb_id', 'torrents.tvdb_id',
+      'torrents.igdb_id', 'torrents.openlibrary_id',
+      'catalog_records.body', 'work_titles.*',
+      'banned_ips.*', 'reports.*', 'upload_requests.*', 'upload_request_comments.*',
+      'torrent_moderation_messages.*', 'user_warnings.*',
+      'notifications.payload', 'saved_searches.*', 'search_misses.*',
+      'messaging_broadcasts.*',
       'login_events.*', 'anticheat_flags.ip', 'anticheat_flags.user_agent',
-      'audit_log.*', 'remote_torrents.*', 'federation_config.private_key',
+      'audit_log.*', 'remote_torrents.*',
+    ],
+    // Encrypted at rest already, but under a key from the environment, not
+    // under the panic password: out of reach of a database dump alone, within
+    // reach of whoever holds the server. They were listed as cleartext.
+    encryptedAtRestOnly: [
+      'users.totp_secret', 'notification_channels.server_config',
+      'federation_config.private_key_enc',
     ],
   };
 });
diff --git a/apps/api/routes/api/admin/panic/index.get.ts b/apps/api/routes/api/admin/panic/index.get.ts
index a7105d1d..68ab8a48 100644
--- a/apps/api/routes/api/admin/panic/index.get.ts
+++ b/apps/api/routes/api/admin/panic/index.get.ts
@@ -14,5 +14,9 @@ export default defineEventHandler(async (event) => {
   return {
     isEncrypted: state?.isEncrypted ?? false,
     encryptedAt: state?.encryptedAt ?? null,
+    // `isEncrypted` is false for the whole encrypt pass and for an interrupted
+    // one; only the phase tells an admin that a pass needs resuming, or that a
+    // restore stopped half way.
+    phase: state?.phase ?? 'idle',
   };
 });
diff --git a/apps/api/routes/api/admin/panic/restore.post.ts b/apps/api/routes/api/admin/panic/restore.post.ts
index d1e85bbd..229fbd2f 100644
--- a/apps/api/routes/api/admin/panic/restore.post.ts
+++ b/apps/api/routes/api/admin/panic/restore.post.ts
@@ -7,9 +7,15 @@ import {
   forumPosts,
   torrentComments,
 } from '@trackarr/db/schema';
-import { deriveKey, decryptField, decrypt } from '~~/utils/panic';
+import {
+  deriveKey,
+  decryptFieldOrKeep,
+  decryptTorrentDataOrKeep,
+  decrypt,
+} from '~~/utils/panic';
 import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
 import { redis } from '~~/utils/server';
+import { invalidatePanicCache } from '~~/utils/panicLock';
 import { z } from 'zod';
 
 /**
@@ -165,19 +171,22 @@ export default defineEventHandler(async (event) => {
    * d'annonce étaient morts, sans qu'aucun compteur ne le dise.
    *
    * Tant qu'il reste un échec, le sel et la phase sont conservés : la
-   * restauration reste possible après correction, et elle est reprenable
-   * puisque les lignes déjà déchiffrées ne déchiffrent plus.
+   * restauration reste possible après correction, et elle est reprenable :
+   * une ligne déjà rendue ne se déchiffre plus, et `decryptFieldOrKeep` (ou
+   * `decryptTorrentDataOrKeep` pour le `.torrent`) la garde telle quelle au
+   * lieu de la compter en échec.
    */
   const failures: string[] = [];
   const fail = (what: string, id: string, err: unknown) => {
     failures.push(`${what}:${id}`);
-    console.error(`[panic] restore failed for ${what} ${id}:`, err);
+    console.error('[panic] restore failed for %s %s:', what, id, err);
   };
 
   await db
     .update(panicState)
     .set({ phase: 'restoring' })
     .where(eq(panicState.id, 'singleton'));
+  await invalidatePanicCache();
 
   // ── Decrypt user data ────────────────────────────────────────
   const allUsers = await db.select().from(users);
@@ -186,12 +195,12 @@ export default defineEventHandler(async (event) => {
       await db
         .update(users)
         .set({
-          authSalt: decryptField(user.authSalt, key, legacyIv)!,
-          authVerifier: decryptField(user.authVerifier, key, legacyIv)!,
-          passkey: decryptField(user.passkey, key, legacyIv)!,
-          rssKey: decryptField(user.rssKey, key, legacyIv) ?? undefined,
-          apiKey: decryptField(user.apiKey, key, legacyIv) ?? undefined,
-          lastIp: decryptField(user.lastIp, key, legacyIv) ?? undefined,
+          authSalt: decryptFieldOrKeep(user.authSalt, key, legacyIv)!,
+          authVerifier: decryptFieldOrKeep(user.authVerifier, key, legacyIv)!,
+          passkey: decryptFieldOrKeep(user.passkey, key, legacyIv)!,
+          rssKey: decryptFieldOrKeep(user.rssKey, key, legacyIv) ?? undefined,
+          apiKey: decryptFieldOrKeep(user.apiKey, key, legacyIv) ?? undefined,
+          lastIp: decryptFieldOrKeep(user.lastIp, key, legacyIv) ?? undefined,
         })
         .where(eq(users.id, user.id));
     } catch (err) {
@@ -223,34 +232,35 @@ export default defineEventHandler(async (event) => {
         } catch {
           // La taille et la catégorie sont dans ces métadonnées, et le
           // chiffrement a mis `size` à 0 : les perdre en silence était pire
-          // que de refuser de terminer.
+          // que de refuser de terminer. La ligne reste donc telle quelle :
+          // récrire sa description effacerait le seul exemplaire de ces
+          // métadonnées, et la tentative suivante n'aurait plus rien à relire.
           fail('torrent-meta', torrent.id, 'metadata');
+          continue;
         }
 
         decryptedDesc = encryptedDescPart
-          ? decryptField(encryptedDescPart, key, legacyIv)
+          ? decryptFieldOrKeep(encryptedDescPart, key, legacyIv)
           : null;
       } else {
-        decryptedDesc = decryptField(torrent.description, key, legacyIv);
+        decryptedDesc = decryptFieldOrKeep(torrent.description, key, legacyIv);
       }
 
       // .torrent payload → ascii string (matches encrypt-side wrapping)
-      // → decrypt → base64 → Buffer.
-      let decryptedTorrentData: Buffer | null = null;
+      // → decrypt → base64 → Buffer, or the clear file a previous attempt
+      // already gave back. What is neither is counted and left as stored —
+      // never overwritten with null.
+      let decryptedTorrentData = torrent.torrentData;
       if (torrent.torrentData) {
-        try {
-          const encryptedStr = torrent.torrentData.toString('ascii');
-          const decryptedBase64 = decrypt(encryptedStr, key, legacyIv);
-          decryptedTorrentData = Buffer.from(decryptedBase64, 'base64');
-        } catch {
-          fail('torrent-data', torrent.id, 'torrentData');
-        }
+        const restored = decryptTorrentDataOrKeep(torrent.torrentData, key, legacyIv);
+        if (restored) decryptedTorrentData = restored;
+        else fail('torrent-data', torrent.id, 'torrentData');
       }
 
       await db
         .update(torrents)
         .set({
-          name: decryptField(torrent.name, key, legacyIv) ?? torrent.name,
+          name: decryptFieldOrKeep(torrent.name, key, legacyIv) ?? torrent.name,
           description: decryptedDesc,
           torrentData: decryptedTorrentData,
           size: originalSize,
@@ -269,7 +279,7 @@ export default defineEventHandler(async (event) => {
       await db
         .update(forumPosts)
         .set({
-          content: decryptField(post.content, key, legacyIv) ?? post.content,
+          content: decryptFieldOrKeep(post.content, key, legacyIv) ?? post.content,
         })
         .where(eq(forumPosts.id, post.id));
     } catch (err) {
@@ -284,7 +294,7 @@ export default defineEventHandler(async (event) => {
       await db
         .update(torrentComments)
         .set({
-          content: decryptField(comment.content, key, legacyIv) ?? comment.content,
+          content: decryptFieldOrKeep(comment.content, key, legacyIv) ?? comment.content,
         })
         .where(eq(torrentComments.id, comment.id));
     } catch (err) {
@@ -303,6 +313,7 @@ export default defineEventHandler(async (event) => {
       .update(panicState)
       .set({ phase: 'restoring' })
       .where(eq(panicState.id, 'singleton'));
+    await invalidatePanicCache();
 
     throw createError({
       statusCode: 500,
@@ -325,6 +336,7 @@ export default defineEventHandler(async (event) => {
       phase: 'idle',
     })
     .where(eq(panicState.id, 'singleton'));
+  await invalidatePanicCache();
 
   return {
     success: true,
diff --git a/apps/api/routes/api/admin/stats.get.ts b/apps/api/routes/api/admin/stats.get.ts
index 3b7ef380..15e2c584 100644
--- a/apps/api/routes/api/admin/stats.get.ts
+++ b/apps/api/routes/api/admin/stats.get.ts
@@ -5,6 +5,7 @@ import { redis } from '~~/utils/server';
 import { requireAdminSession } from '~~/utils/adminAuth';
 import { rollupActivePeerCounts } from '~~/utils/peerStats';
 import { readTrackerHealth } from '~~/utils/trackerHealth';
+import { trackerUdpEnabled } from '~~/utils/announceUrls';
 
 export default defineEventHandler(async (event) => {
   // Require admin authentication
@@ -55,10 +56,9 @@ export default defineEventHandler(async (event) => {
   }
 
   // Protocol matrix mirrored from the tracker container's env. HTTP
-  // is always on; UDP toggles via `TRACKER_UDP_ENABLED` (default true,
-  // see apps/tracker/internal/config/config.go). The api process and
-  // tracker process share the same env so this read is authoritative
-  // without an internal RPC.
+  // is always on; UDP toggles via `TRACKER_UDP_ENABLED`, read exactly as the
+  // tracker reads it (`trackerUdpEnabled`). Authoritative only because the
+  // deployment hands both processes the same value.
   // L'état vient de la MÊME sonde que le badge de la page d'accueil.
   //
   // C'était `status: 'running'` en dur. Le tableau de bord affichait donc
@@ -85,8 +85,7 @@ export default defineEventHandler(async (event) => {
     },
     protocols: {
       http: true,
-      udp: process.env.TRACKER_UDP_ENABLED !== 'false',
-      ws: false,
+      udp: trackerUdpEnabled(),
     },
   };
 });
diff --git a/apps/api/routes/api/admin/users/[id]/ban.post.ts b/apps/api/routes/api/admin/users/[id]/ban.post.ts
index 414c78a3..d58fd0dc 100644
--- a/apps/api/routes/api/admin/users/[id]/ban.post.ts
+++ b/apps/api/routes/api/admin/users/[id]/ban.post.ts
@@ -11,7 +11,7 @@
  * sibling unban route can refuse a moderator trying to lift an
  * admin-issued ban.
  */
-import { and, eq } from 'drizzle-orm';
+import { and, eq, sql } from 'drizzle-orm';
 import { db } from '@trackarr/db';
 import { users, bannedIps, torrents } from '@trackarr/db/schema';
 import {
@@ -76,12 +76,20 @@ export default defineEventHandler(async (event) => {
       isBanned: true,
       bannedById: actor.id,
       bannedByRole: actor.isAdmin ? 'admin' : 'moderator',
+      // Every session the member holds ends here, not only while the ban
+      // lasts. The ban gate refuses each request during the ban; without the
+      // epoch, a cookie nobody presented in the meantime — a copy taken from a
+      // shared machine, a device left offline — worked again the moment the
+      // ban was lifted or ran out.
+      sessionEpoch: sql`${users.sessionEpoch} + 1`,
     })
     .where(eq(users.id, userId));
 
   // Drop the cached `isBanned` so the lockout takes effect on the
-  // very next request rather than waiting up to 60 s for the TTL.
+  // very next request rather than waiting up to 60 s for the TTL, and the
+  // cached epoch with it.
   await invalidateBanCache(userId);
+  await invalidateRoleCache(userId);
 
   // A banned owner is an owner who cannot act, and the decisions reserved to
   // them are the ones an instance cannot get on without. Ownership moves to the
diff --git a/apps/api/routes/api/auth/2fa/passkey-verify.post.ts b/apps/api/routes/api/auth/2fa/passkey-verify.post.ts
index f48e8c6b..798b10f2 100644
--- a/apps/api/routes/api/auth/2fa/passkey-verify.post.ts
+++ b/apps/api/routes/api/auth/2fa/passkey-verify.post.ts
@@ -23,6 +23,7 @@ import {
   markFreshAuth,
 } from '~~/utils/twoFactor';
 import { issueTrustedDevice } from '~~/utils/trustedDevices';
+import { issueKnownDevice } from '~~/utils/knownDevices';
 import { validateBody } from '~~/utils/schemas';
 import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
 import { recordLogin } from '~~/utils/account/loginLog';
@@ -153,10 +154,13 @@ export default defineEventHandler(async (event) => {
       isAdmin: true,
       isModerator: true,
       isOwner: true,
+      sessionEpoch: true,
       uploaded: true,
       downloaded: true,
       bonusPoints: true,
       trustDevicesEnabled: true,
+      // What the known-device cookie is bound to, with the epoch.
+      authVerifier: true,
     },
   });
   if (!user) throw createError({ statusCode: 401, message: 'User not found' });
@@ -179,12 +183,25 @@ export default defineEventHandler(async (event) => {
       isAdmin: user.isAdmin,
       isModerator: user.isModerator,
       isOwner: user.isOwner,
+      // The epoch `requireUserSession` compares on every request. Without it
+      // the session read as epoch 0: once a member had used "sign out
+      // everywhere", every sign-in through a passkey second factor produced a
+      // cookie revoked on its first request — the password and TOTP paths
+      // set it, this one did not.
+      sessionEpoch: user.sessionEpoch ?? 0,
       uploaded: user.uploaded,
       downloaded: user.downloaded,
       bonusPoints: user.bonusPoints,
     },
     loggedInAt: Date.now(),
   });
+  // The sign-in is complete only now, second factor met: this is where the
+  // browser becomes a known device (see `utils/knownDevices`).
+  issueKnownDevice(event, {
+    userId: user.id,
+    sessionEpoch: user.sessionEpoch,
+    authVerifier: user.authVerifier,
+  });
 
   // Real h3 session id, not the session-data object (finding H1).
   await markFreshAuth(await getSessionId(event));
diff --git a/apps/api/routes/api/auth/2fa/verify-totp.post.ts b/apps/api/routes/api/auth/2fa/verify-totp.post.ts
index 1dc6585b..edb734d9 100644
--- a/apps/api/routes/api/auth/2fa/verify-totp.post.ts
+++ b/apps/api/routes/api/auth/2fa/verify-totp.post.ts
@@ -18,6 +18,7 @@ import {
   verifyTotp,
 } from '~~/utils/twoFactor';
 import { issueTrustedDevice } from '~~/utils/trustedDevices';
+import { issueKnownDevice } from '~~/utils/knownDevices';
 import { validateBody } from '~~/utils/schemas';
 import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
 import { notify } from '~~/utils/notify';
@@ -71,6 +72,8 @@ export default defineEventHandler(async (event) => {
       totpSecret: true,
       totpEnabled: true,
       trustDevicesEnabled: true,
+      // What the known-device cookie is bound to, with the epoch.
+      authVerifier: true,
     },
   });
   if (!user) {
@@ -170,6 +173,13 @@ export default defineEventHandler(async (event) => {
     },
     loggedInAt: Date.now(),
   });
+  // The sign-in is complete only now, second factor met: this is where the
+  // browser becomes a known device (see `utils/knownDevices`).
+  issueKnownDevice(event, {
+    userId: user.id,
+    sessionEpoch: user.sessionEpoch,
+    authVerifier: user.authVerifier,
+  });
 
   // Real h3 session id, not the session-data object (finding H1).
   await markFreshAuth(await getSessionId(event));
diff --git a/apps/api/routes/api/auth/challenge.get.ts b/apps/api/routes/api/auth/challenge.get.ts
index f1677764..266f459f 100644
--- a/apps/api/routes/api/auth/challenge.get.ts
+++ b/apps/api/routes/api/auth/challenge.get.ts
@@ -9,15 +9,21 @@ import { db } from '@trackarr/db';
 import { users } from '@trackarr/db/schema';
 import { redis } from '~~/utils/server';
 import { rateLimit } from '~~/utils/rateLimit';
+import { UNKNOWN_ACCOUNT_CHALLENGE } from '~~/utils/loginChallenge';
 
 const CHALLENGE_TTL = 300; // 5 minutes
 
-/** 20 challenges per 5 min per IP, with the progressive penalty. */
+/**
+ * 20 challenges per 5 min per address (an IPv6 /64), WITHOUT the progressive
+ * penalty. That penalty puts the whole address on the blacklist, every route
+ * included: on a VPN exit or a carrier NAT, twenty-one requests from one
+ * stranger signed everybody else out of the site — the reason the sign-in
+ * itself left it (`RATE_LIMITS.signin`).
+ */
 const CHALLENGE_LIMIT = {
   windowSec: 300,
   maxRequests: 20,
   prefix: 'challenge',
-  progressive: true,
 } as const;
 
 // Stable per-process key for deriving the *fake* salt of non-existent
@@ -47,9 +53,9 @@ function fakeSaltFor(username: string): string {
 export default defineEventHandler(async (event) => {
   // The only auth route that had no limit. Enumeration is already closed by
   // the deterministic fake salt, but every call still costs a `SELECT` on
-  // `users` AND writes a Redis key with a 5-minute TTL — including the
-  // `login:fake:*` keys, which nothing ever consumes. Unbounded, that is a
-  // slow memory drain on Redis for the price of an unauthenticated GET.
+  // `users` AND writes a Redis key with a 5-minute TTL, for unknown usernames
+  // too. Unbounded, that is a slow memory drain on Redis for the price of an
+  // unauthenticated GET.
   //
   // More generous than RATE_LIMITS.auth: a challenge is not an attempt, and a
   // legitimate client fetches one per login screen, sometimes twice if the
@@ -80,10 +86,15 @@ export default defineEventHandler(async (event) => {
   if (!user || !user.authSalt) {
     // Return a DETERMINISTIC fake salt (stable per username) so an
     // attacker can't tell real from fake by requesting twice and
-    // diffing the salt (finding M1). Still do the same Redis write
-    // for timing parity.
+    // diffing the salt (finding M1).
+    //
+    // Stored under the SAME key as a real challenge. It used to go to
+    // `login:fake:*`, which the login never reads: an unknown username was
+    // answered "Invalid or expired challenge" and a known one with a wrong
+    // proof "Invalid credentials" — the roster the fake salt was hiding, read
+    // off the error message instead.
     const fakeSalt = fakeSaltFor(username);
-    await redis.set(`login:fake:${challenge}`, '1', 'EX', CHALLENGE_TTL);
+    await redis.set(`login:${challenge}`, UNKNOWN_ACCOUNT_CHALLENGE, 'EX', CHALLENGE_TTL);
     return { salt: fakeSalt, challenge };
   }
   
diff --git a/apps/api/routes/api/auth/login.post.ts b/apps/api/routes/api/auth/login.post.ts
index 0225eab0..1a19e7ea 100644
--- a/apps/api/routes/api/auth/login.post.ts
+++ b/apps/api/routes/api/auth/login.post.ts
@@ -4,37 +4,83 @@ import { db } from '@trackarr/db';
 import { users, bannedIps, webauthnCredentials } from '@trackarr/db/schema';
 import { validateBody, loginSchema } from '~~/utils/schemas';
 import { redis } from '~~/utils/server';
-import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
+import {
+  rateLimit,
+  RATE_LIMITS,
+  assertAccountNotLocked,
+  recordAccountFailure,
+  clearAccountFailures,
+} from '~~/utils/rateLimit';
+import { UNKNOWN_ACCOUNT_CHALLENGE } from '~~/utils/loginChallenge';
 import { mintChallengeToken, markFreshAuth } from '~~/utils/twoFactor';
 import { consumeTrustedDevice } from '~~/utils/trustedDevices';
+import {
+  readKnownDevice,
+  recordKnownDeviceFailure,
+  issueKnownDevice,
+} from '~~/utils/knownDevices';
 import { notify } from '~~/utils/notify';
 import { liftExpiredBan } from '~~/utils/banExpiry';
 import { decryptSecret, encryptSecretRequired, needsRewrite } from '~~/utils/credentialSecrets';
 import { recordLogin } from '~~/utils/account/loginLog';
 
+/**
+ * How long refusing credentials takes, at least.
+ *
+ * The answer to a username with no account and to a wrong proof is the same
+ * status and message, but not the same work: the second reads the account,
+ * decrypts its verifier and hashes, and was a few milliseconds slower — which
+ * enumerates members as surely as a different message, given enough samples.
+ * Both now end no sooner than this after the request arrived. Well above what
+ * either path costs; unnoticeable after a 600 000-iteration PBKDF2 in the
+ * browser.
+ */
+const REFUSAL_FLOOR_MS = 300;
+
 /**
  * POST /api/auth/login
  * Authenticate user with Zero Knowledge proof
  * User proves knowledge of password without sending it
  */
 export default defineEventHandler(async (event) => {
-  // 5 tries per 5 minutes per IP, with progressive penalties — keeps
-  // online brute-force of ZK proofs out of reach.
-  await rateLimit(event, RATE_LIMITS.auth);
+  const arrivedAt = Date.now();
+  // 10 tries per 5 minutes per address (an IPv6 /64), WITHOUT the progressive
+  // blacklist — see `RATE_LIMITS.signin` for why a sign-in failure must not
+  // shut a whole address out of the site. Guessing spread over many addresses
+  // meets the per-account counter instead.
+  await rateLimit(event, RATE_LIMITS.signin);
   const body = await validateBody(event, loginSchema);
+  // A browser that has already signed in to this account answers to its own
+  // failure counter instead of the account's: whoever fails on purpose from
+  // elsewhere can hold the account shut to new devices, not to the member's
+  // own. See `utils/knownDevices`.
+  const knownDevice = await readKnownDevice(event, body.username);
+  if (!knownDevice) await assertAccountNotLocked(body.username);
 
-  // Verify challenge is valid and get associated user ID
-  const userId = await redis.get(`login:${body.challenge}`);
+  // Consumed atomically: two concurrent requests with the same challenge used
+  // to both read it before either deleted it.
+  const userId = await redis.getdel(`login:${body.challenge}`);
   if (!userId) {
     throw createError({
       statusCode: 401,
       message: 'Invalid or expired challenge',
     });
   }
-  
-  // Delete challenge immediately to prevent reuse
-  await redis.del(`login:${body.challenge}`);
-  
+
+  // A username with no account takes the same exit as a wrong proof — same
+  // status, same message, same failure count. See `utils/loginChallenge`.
+  const rejectCredentials = async () => {
+    if (knownDevice) await recordKnownDeviceFailure(knownDevice);
+    else await recordAccountFailure(body.username);
+    const wait = REFUSAL_FLOOR_MS - (Date.now() - arrivedAt);
+    if (wait > 0) await new Promise((resolve) => setTimeout(resolve, wait));
+    return createError({
+      statusCode: 401,
+      message: 'Invalid credentials',
+    });
+  };
+  if (userId === UNKNOWN_ACCOUNT_CHALLENGE) throw await rejectCredentials();
+
   // Find user by ID from challenge
   const user = await db
     .select()
@@ -43,12 +89,7 @@ export default defineEventHandler(async (event) => {
     .limit(1)
     .then((r) => r[0]);
 
-  if (!user || user.username !== body.username) {
-    throw createError({
-      statusCode: 401,
-      message: 'Invalid credentials',
-    });
-  }
+  if (!user || user.username !== body.username) throw await rejectCredentials();
 
   // ── Verify ZKE proof FIRST ──────────────────────────────────
   // Username/account-status checks (banned, etc.) deliberately run
@@ -57,12 +98,7 @@ export default defineEventHandler(async (event) => {
   // banned accounts without ever solving the SRP challenge. With the
   // proof gate on top, those branches are unreachable to anyone
   // without the password.
-  if (!user.authVerifier) {
-    throw createError({
-      statusCode: 401,
-      message: 'Invalid credentials',
-    });
-  }
+  if (!user.authVerifier) throw await rejectCredentials();
 
   // The verifier is encrypted at rest. `decryptSecret` returns a legacy
   // plaintext value unchanged, so accounts created before the rollout keep
@@ -81,29 +117,31 @@ export default defineEventHandler(async (event) => {
     .digest('hex');
 
   if (!secureCompare(body.proof, expectedProof)) {
-    // Recorded before the throw. There is no per-account lockout on this site —
-    // throttling is entirely per IP — so an attempt spread across addresses
-    // meets nothing at all, and this row is the only trace it leaves.
+    // Recorded before the throw: the member and staff read failed attempts
+    // here, whatever the per-account counter makes of them.
     void recordLogin(event, {
       userId: user.id,
       username: user.username,
       method: 'password',
       outcome: 'failed',
     });
-    throw createError({
-      statusCode: 401,
-      message: 'Invalid credentials',
-    });
+    throw await rejectCredentials();
   }
+  // Not after a known device's success: the account's failures came from
+  // somewhere else, and wiping them would hand whoever made them a fresh ten.
+  if (!knownDevice) await clearAccountFailures(body.username);
 
   // Lazy migration: a proven-correct login is the safe moment to write the
   // verifier back under the current key — whether it was legacy plaintext or
   // only readable through CREDENTIAL_ENCRYPTION_KEY_PREVIOUS. Fire-and-forget:
   // a failure here must never cost the user their login, the next one retries.
+  // The known-device cookie issued below is bound to the column as it WILL be.
+  let storedAuthVerifier = user.authVerifier;
   if (needsRewrite(user.authVerifier)) {
+    storedAuthVerifier = encryptSecretRequired(storedVerifier);
     void db
       .update(users)
-      .set({ authVerifier: encryptSecretRequired(storedVerifier) })
+      .set({ authVerifier: storedAuthVerifier })
       .where(eq(users.id, user.id))
       .catch(() => {});
   }
@@ -230,6 +268,11 @@ export default defineEventHandler(async (event) => {
     },
     loggedInAt: Date.now(),
   });
+  issueKnownDevice(event, {
+    userId: user.id,
+    sessionEpoch: user.sessionEpoch,
+    authVerifier: storedAuthVerifier,
+  });
 
   // `trusted-device` when the second factor was skipped by a remembered
   // browser, `password` otherwise. The distinction is the point: a member
diff --git a/apps/api/routes/api/auth/passkey.get.ts b/apps/api/routes/api/auth/passkey.get.ts
index 5554de4e..6b57930a 100644
--- a/apps/api/routes/api/auth/passkey.get.ts
+++ b/apps/api/routes/api/auth/passkey.get.ts
@@ -1,3 +1,7 @@
+import { eq } from 'drizzle-orm';
+import { db } from '@trackarr/db';
+import { users } from '@trackarr/db/schema';
+
 /**
  * GET /api/auth/passkey
  * Returns the current user's passkey (private, only accessible to the user themselves)
@@ -20,8 +24,15 @@
 export default defineEventHandler(async (event) => {
   const { user } = await requireAuthSession(event);
 
-  // The passkey is stored in the session, which is only accessible to the authenticated user
+  // Read from the account, not from the session: the cookie keeps the passkey
+  // of the moment the member signed in, and after a rotation on another device
+  // that copy no longer announces.
+  const [row] = await db
+    .select({ passkey: users.passkey })
+    .from(users)
+    .where(eq(users.id, user.id))
+    .limit(1);
   return {
-    passkey: user.passkey,
+    passkey: row?.passkey ?? user.passkey,
   };
 });
diff --git a/apps/api/routes/api/auth/password.put.ts b/apps/api/routes/api/auth/password.put.ts
index f3948aae..1c8dcd73 100644
--- a/apps/api/routes/api/auth/password.put.ts
+++ b/apps/api/routes/api/auth/password.put.ts
@@ -66,15 +66,15 @@ export default defineEventHandler(async (event) => {
 
   // Verify the challenge belongs to this user (prevents a hijacker who
   // swapped a session cookie from reusing someone else's challenge).
-  const challengedUserId = await redis.get(`login:${body.challenge}`);
+  // One-shot, and atomically so: burning it in a second step left a window in
+  // which two requests could both use it, and a leaked proof be replayed.
+  const challengedUserId = await redis.getdel(`login:${body.challenge}`);
   if (!challengedUserId || challengedUserId !== user.id) {
     throw createError({
       statusCode: 401,
       message: 'Invalid or expired challenge',
     });
   }
-  // One-shot: burn the challenge so a leaked proof can't be replayed.
-  await redis.del(`login:${body.challenge}`);
 
   const row = await db.query.users.findFirst({
     where: eq(schema.users.id, user.id),
diff --git a/apps/api/routes/api/auth/register.post.ts b/apps/api/routes/api/auth/register.post.ts
index 214daee3..4dca0a73 100644
--- a/apps/api/routes/api/auth/register.post.ts
+++ b/apps/api/routes/api/auth/register.post.ts
@@ -16,6 +16,7 @@ import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
 import { markFreshAuth } from '~~/utils/twoFactor';
 import { encryptSecretRequired } from '~~/utils/credentialSecrets';
 import { recordLogin } from '~~/utils/account/loginLog';
+import { issueKnownDevice } from '~~/utils/knownDevices';
 
 /**
  * Postgres advisory lock id used to serialise the "first user gets
@@ -193,6 +194,12 @@ export default defineEventHandler(async (event) => {
   // the invite (if any) in the same transaction. Anything that can
   // fail here rolls back as a unit — no partially-created admin
   // accounts, no consumed-but-unattributed invites.
+  // Encrypted at rest: the verifier IS the login credential, not a hash of it,
+  // so a database dump would otherwise be an account takeover. Computed once,
+  // here, because the known-device cookie issued below is bound to the exact
+  // stored value and the encryption is not deterministic.
+  const storedAuthVerifier = encryptSecretRequired(body.authVerifier);
+
   const finalIsFirstUser = await db.transaction(async (tx) => {
     await tx.execute(
       sql`SELECT pg_advisory_xact_lock(${REGISTER_FIRST_USER_LOCK_ID}::bigint)`
@@ -209,9 +216,7 @@ export default defineEventHandler(async (event) => {
       id: userId,
       username: body.username,
       authSalt: body.authSalt,
-      // Encrypted at rest: the verifier IS the login credential, not a hash
-      // of it, so a database dump would otherwise be an account takeover.
-      authVerifier: encryptSecretRequired(body.authVerifier),
+      authVerifier: storedAuthVerifier,
       passkey,
       isAdmin: settledFirstUser,
       isModerator: false,
@@ -323,6 +328,9 @@ export default defineEventHandler(async (event) => {
     },
     loggedInAt: Date.now(),
   });
+  // The browser that just chose the password is the first known device: a
+  // lockout started before its first sign-in must not shut it out too.
+  issueKnownDevice(event, { userId, sessionEpoch: 0, authVerifier: storedAuthVerifier });
 
   // Open the fresh-auth window, exactly as `login.post.ts` does and at the same
   // point — after the session exists, keyed on the real h3 session id rather
diff --git a/apps/api/routes/api/auth/status.get.ts b/apps/api/routes/api/auth/status.get.ts
index 54f351f9..74ae7b50 100644
--- a/apps/api/routes/api/auth/status.get.ts
+++ b/apps/api/routes/api/auth/status.get.ts
@@ -48,14 +48,19 @@ export default defineEventHandler(async (event) => {
         isAdmin: users.isAdmin,
         isModerator: users.isModerator,
         isOwner: users.isOwner,
+        sessionEpoch: users.sessionEpoch,
+        passkey: users.passkey,
       })
       .from(users)
       .where(eq(users.id, session.user.id))
       .limit(1);
 
     if (dbUser) {
-      // Check if user is banned
-      if (dbUser.isBanned) {
+      // A banned member, or a session revoked by "sign out everywhere" (or by
+      // the ban itself): the same answer `requireUserSession` gives on every
+      // other route. Without the epoch here the page kept showing a member
+      // signed in whose every action then failed with 401.
+      if (dbUser.isBanned || (session.user.sessionEpoch ?? 0) !== dbUser.sessionEpoch) {
         await clearUserSession(event);
         publicUser = null;
       } else {
@@ -103,7 +108,8 @@ export default defineEventHandler(async (event) => {
           dbUser.displayName !== sessionDisplayName ||
           dbUser.theme !== sessionTheme ||
           dbUser.language !== sessionLanguage ||
-          dbUser.bonusPoints !== sessionBonusPoints
+          dbUser.bonusPoints !== sessionBonusPoints ||
+          dbUser.passkey !== session.user.passkey
         ) {
           await setUserSession(event, {
             ...session,
@@ -118,6 +124,11 @@ export default defineEventHandler(async (event) => {
               isAdmin: dbUser.isAdmin,
               isModerator: dbUser.isModerator,
               isOwner: dbUser.isOwner,
+              // The announce passkey the download routes write into every
+              // `.torrent`. Rotated on one device, it stayed stale in the
+              // cookie of every other one, whose downloads then announced
+              // with a dead key.
+              passkey: dbUser.passkey,
             },
           });
         }
diff --git a/apps/api/routes/api/branding.get.ts b/apps/api/routes/api/branding.get.ts
index 208706c1..bdc4a960 100644
--- a/apps/api/routes/api/branding.get.ts
+++ b/apps/api/routes/api/branding.get.ts
@@ -21,7 +21,7 @@ import {
   type ServableTheme,
 } from '~~/utils/themes';
 import { resolveTokens } from '@trackarr/shared/theme';
-import { getCatalogueSettings } from '~~/utils/settings';
+import { getCatalogueSettings, getSiteRules } from '~~/utils/settings';
 
 /**
  * GET /api/branding
@@ -107,6 +107,8 @@ export default defineEventHandler(async (event) => {
     : allThemes;
   const themeDefault = await getDefaultTheme();
   const catalogue = await getCatalogueSettings();
+  // Whether the footer links to `/rules`: a cached read like the rest.
+  const hasRules = !!(await getSiteRules()).trim();
 
   return {
     siteName,
@@ -123,6 +125,7 @@ export default defineEventHandler(async (event) => {
     // False when federation was never configured, which is the same answer as
     // configured-and-off for anything the browser does with it.
     federationEnabled,
+    hasRules,
     // Les réglages du catalogue : la page en a besoin avant tout appel signé,
     // et ils sont publics à tout membre — même enveloppe que le reste.
     catalogue,
diff --git a/apps/api/routes/api/me/favorites.get.ts b/apps/api/routes/api/me/favorites.get.ts
index 97bb80c8..3462a72c 100644
--- a/apps/api/routes/api/me/favorites.get.ts
+++ b/apps/api/routes/api/me/favorites.get.ts
@@ -18,6 +18,7 @@ import { and, asc, desc, eq, sql } from 'drizzle-orm';
 import { z } from 'zod';
 import { getStats } from '~~/utils/server';
 import { validateQuery } from '~~/utils/schemas';
+import { visibilityConditions } from '~~/utils/torrentListing';
 
 const querySchema = z.object({
   page: z.coerce.number().int().min(1).default(1),
@@ -44,9 +45,32 @@ export default defineEventHandler(async (event) => {
       ? [asc(schema.torrents.name)]
       : [desc(schema.torrentFavorites.createdAt)];
 
+  // A favorite outlives the torrent's visibility — rejected since, deactivated,
+  // or adult content the member has since hidden — and this listing used to
+  // serve it whatever it had become. Same conditions as the catalogue.
+  const vis = await visibilityConditions({
+    id: user.id,
+    isAdmin: !!user.isAdmin,
+    isModerator: !!user.isModerator,
+  });
+  const where = and(eq(schema.torrentFavorites.userId, user.id), ...vis);
+
   const rows = await db
     .select({
-      torrent: schema.torrents,
+      // The columns the rows below are built from, not the whole row: that
+      // carried the raw `.torrent` of every favorite.
+      torrent: {
+        id: schema.torrents.id,
+        infoHash: schema.torrents.infoHash,
+        name: schema.torrents.name,
+        size: schema.torrents.size,
+        createdAt: schema.torrents.createdAt,
+        imdbId: schema.torrents.imdbId,
+        tmdbId: schema.torrents.tmdbId,
+        tvdbId: schema.torrents.tvdbId,
+        igdbId: schema.torrents.igdbId,
+        openlibraryId: schema.torrents.openlibraryId,
+      },
       category: schema.categories,
       favoritedAt: schema.torrentFavorites.createdAt,
     })
@@ -59,7 +83,7 @@ export default defineEventHandler(async (event) => {
       schema.categories,
       eq(schema.torrents.categoryId, schema.categories.id),
     )
-    .where(eq(schema.torrentFavorites.userId, user.id))
+    .where(where)
     .orderBy(...orderClause)
     .limit(query.limit)
     .offset(offset);
@@ -67,7 +91,8 @@ export default defineEventHandler(async (event) => {
   const [{ value: total } = { value: 0 }] = await db
     .select({ value: sql<number>`count(*)::int` })
     .from(schema.torrentFavorites)
-    .where(eq(schema.torrentFavorites.userId, user.id));
+    .innerJoin(schema.torrents, eq(schema.torrentFavorites.torrentId, schema.torrents.id))
+    .where(where);
 
   // Enrich with Redis swarm stats. Tolerant of partial failure —
   // a missing key falls back to zeroes rather than torpedoing the
diff --git a/apps/api/routes/api/me/sessions/revoke-all.post.ts b/apps/api/routes/api/me/sessions/revoke-all.post.ts
index eafe96df..9920e34d 100644
--- a/apps/api/routes/api/me/sessions/revoke-all.post.ts
+++ b/apps/api/routes/api/me/sessions/revoke-all.post.ts
@@ -29,6 +29,7 @@ import { db, schema } from '@trackarr/db';
 import { eq, sql } from 'drizzle-orm';
 import { requireAuthSession, requireFreshAuth } from '~~/utils/adminAuth';
 import { invalidateRoleCache } from '~~/utils/liveRoles';
+import { revokeAllForUser } from '~~/utils/trustedDevices';
 import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
 import { auditDetail } from '~~/utils/audit';
 
@@ -52,6 +53,11 @@ export default defineEventHandler(async (event) => {
   // Le cache de rôles porte l'époque : sans cette purge, l'instance
   // continuerait d'accepter les sessions périmées jusqu'à 60 s.
   await invalidateRoleCache(session.user.id);
+  // And the trusted devices: a device let through 2FA once stays trusted for
+  // its own cookie's lifetime, so a compromised one kept skipping the second
+  // factor at its next password sign-in. A password change already revokes
+  // them; this is the same gesture, made for the same reason.
+  await revokeAllForUser(session.user.id);
 
   // On ne vide pas le cookie ici : la prochaine requête le fera, avec le motif
   // `session-revoked` que le front sait présenter. Le vider maintenant
diff --git a/apps/api/routes/api/rss/latest.get.ts b/apps/api/routes/api/rss/latest.get.ts
index 03f5d800..9b70b42c 100644
--- a/apps/api/routes/api/rss/latest.get.ts
+++ b/apps/api/routes/api/rss/latest.get.ts
@@ -109,6 +109,8 @@ function buildRSSFeed(feed: RSSFeed): string {
   // are independent. ES2021 `replaceAll` makes the literal-string
   // intent explicit (no global-regex / per-char-class confusion).
   const escapeXml = (str: string) =>
+    // Complete for XML: & first, then < > " '.
+    // nosemgrep: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization
     str
       .replaceAll('&', '&amp;')
       .replaceAll('<', '&lt;')
diff --git a/apps/api/routes/api/rules.get.ts b/apps/api/routes/api/rules.get.ts
new file mode 100644
index 00000000..362fc368
--- /dev/null
+++ b/apps/api/routes/api/rules.get.ts
@@ -0,0 +1,16 @@
+/**
+ * GET /api/rules — the site rules, as staff wrote them in Admin → Branding.
+ *
+ * The admin form has long described them as "displayed to users", and nothing
+ * served them: they lived in the editor and nowhere else. Public, like
+ * `/api/privacy`: somebody holding an invitation reads the rules before
+ * deciding to register, and nothing in them is about any member. Rich text
+ * from the editor, stored as HTML; the page sanitises it.
+ */
+import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
+import { getSiteRules } from '~~/utils/settings';
+
+export default defineEventHandler(async (event) => {
+  await rateLimit(event, RATE_LIMITS.public);
+  return { rules: await getSiteRules() };
+});
diff --git a/apps/api/routes/api/runtime-config.get.ts b/apps/api/routes/api/runtime-config.get.ts
index 22d52438..2f56133e 100644
--- a/apps/api/routes/api/runtime-config.get.ts
+++ b/apps/api/routes/api/runtime-config.get.ts
@@ -3,7 +3,7 @@
  *
  * Public endpoint that surfaces the small set of *runtime* config values
  * the browser bundle needs to know — primarily the public tracker URLs
- * (HTTP / UDP / WebSocket).
+ * (HTTP / UDP).
  *
  * Why an endpoint instead of build-time substitution? When the web app
  * is served as a fully static bundle (the new Dockerfile.static path,
@@ -30,7 +30,6 @@ export default defineEventHandler((event) => {
   return {
     trackerHttpUrl: (cfg.public.trackerHttpUrl as string) ?? '',
     trackerUdpUrl: (cfg.public.trackerUdpUrl as string) ?? '',
-    trackerWsUrl: (cfg.public.trackerWsUrl as string) ?? '',
     // `appVersion` was read off `cfg.public`, where it was never declared —
     // Nitro only maps env vars onto declared runtime-config keys, so this
     // always served an empty string and the web fell back to whatever version
diff --git a/apps/api/routes/api/stats/public.get.ts b/apps/api/routes/api/stats/public.get.ts
index 8e904109..fb09de8d 100644
--- a/apps/api/routes/api/stats/public.get.ts
+++ b/apps/api/routes/api/stats/public.get.ts
@@ -2,6 +2,7 @@ import { db, schema } from '@trackarr/db';
 import { sql } from 'drizzle-orm';
 import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
 import { rollupActivePeerCounts } from '~~/utils/peerStats';
+import { trackerUdpEnabled } from '~~/utils/announceUrls';
 
 /**
  * GET /api/stats/public
@@ -41,15 +42,15 @@ interface PublicStats {
     peers: number;
   };
   /**
-   * Static protocol matrix mirrored from /api/admin/stats. The Go tracker
-   * only implements HTTP — UDP and WebSocket are not built in. We expose
-   * the same shape on the public endpoint so the homepage can render the
+   * Protocol matrix mirrored from /api/admin/stats. The Go tracker serves
+   * HTTP, and UDP when `TRACKER_UDP_ENABLED` is on. (A `ws` entry, always
+   * false, listed a WebSocket transport that never existed.) We expose the
+   * same shape on the public endpoint so the homepage can render the
    * "Protocol health" tile without needing admin credentials.
    */
   protocols: {
     http: boolean;
     udp: boolean;
-    ws: boolean;
   };
 }
 
@@ -107,8 +108,7 @@ async function computeStats(): Promise<PublicStats> {
     // history — the cost/value ratio doesn't justify it).
     protocols: {
       http: true,
-      udp: process.env.TRACKER_UDP_ENABLED !== 'false',
-      ws: false,
+      udp: trackerUdpEnabled(),
     },
   };
 }
diff --git a/apps/api/routes/api/torrents/[hash]/comments.post.ts b/apps/api/routes/api/torrents/[hash]/comments.post.ts
index 48f8bd21..f51250d4 100644
--- a/apps/api/routes/api/torrents/[hash]/comments.post.ts
+++ b/apps/api/routes/api/torrents/[hash]/comments.post.ts
@@ -3,6 +3,7 @@ import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
 import { db, schema } from '@trackarr/db';
 import { torrents, torrentComments } from '@trackarr/db/schema';
 import { canComment } from '~~/utils/commentPolicy';
+import { assertVisibleTorrent } from '~~/utils/torrentListing';
 import { requireAuthSession } from '~~/utils/adminAuth';
 import {
   validateParam,
@@ -22,6 +23,12 @@ export default defineEventHandler(async (event) => {
   // Validate request body
   const body = await validateBody(event, torrentCommentSchema);
 
+  // Reading the comments goes through the listing's visibility; posting one
+  // did not. Any member could comment on a pending, inactive or adult-hidden
+  // torrent — notifying its uploader — and the 200 against the 404 confirmed
+  // that the torrent existed.
+  await assertVisibleTorrent(hash.toLowerCase(), session.user);
+
   // Find torrent by hash to get its UUID
   const torrent = await db.query.torrents.findFirst({
     where: eq(torrents.infoHash, hash.toLowerCase()),
diff --git a/apps/api/routes/api/torrents/[hash]/download.get.ts b/apps/api/routes/api/torrents/[hash]/download.get.ts
index 585acd80..e0c5b852 100644
--- a/apps/api/routes/api/torrents/[hash]/download.get.ts
+++ b/apps/api/routes/api/torrents/[hash]/download.get.ts
@@ -1,6 +1,7 @@
 import { db, schema } from '@trackarr/db';
 import { eq } from 'drizzle-orm';
-import bencode from 'bencode';
+import { personalizeTorrent } from '~~/utils/torrentBytes';
+import { personalAnnounceUrls, trackerUdpEnabled } from '~~/utils/announceUrls';
 import { recordDownloadClick } from '~~/utils/hnr';
 
 export default defineEventHandler(async (event) => {
@@ -84,83 +85,36 @@ export default defineEventHandler(async (event) => {
     console.warn('[download] failed to record download click', err);
   }
 
-  // Inject passkey into torrent data
-  let decoded: any;
+  // The announce passkey as it stands now. The session cookie holds the one
+  // the member had at sign-in: rotated since on another device, that copy is
+  // dead, and every `.torrent` downloaded here would announce with it.
+  const [owner] = await db
+    .select({ passkey: schema.users.passkey })
+    .from(schema.users)
+    .where(eq(schema.users.id, user.id))
+    .limit(1);
+  if (!owner?.passkey) {
+    throw createError({ statusCode: 401, message: 'Unauthorized' });
+  }
+
+  // The member's announce URLs, written into the stored bytes without
+  // decoding them: `utils/torrentBytes` says why a decode → encode round trip
+  // corrupted every v2 torrent's piece layers.
+  const { announce, tiers } = personalAnnounceUrls(owner.passkey, {
+    httpUrl: config.public.trackerHttpUrl as string,
+    udpUrl: (config.public.trackerUdpUrl as string) || '',
+    udpEnabled: trackerUdpEnabled(),
+  });
+  let personalizedData: Buffer;
   try {
-    decoded = bencode.decode(torrent.torrentData);
-  } catch (err) {
+    personalizedData = personalizeTorrent(Buffer.from(torrent.torrentData), announce, tiers);
+  } catch {
     throw createError({
       statusCode: 500,
       message: 'Failed to decode torrent file',
     });
   }
 
-  // Personalize announce URL(s).
-  //
-  // HTTP (always present): `…/announce?passkey=…` — the canonical form
-  // every BT client understands.
-  //
-  // UDP (BEP 15, only if NUXT_PUBLIC_TRACKER_UDP_URL is set): we encode
-  // the passkey as a trailing path segment — `udp://host:6969/announce/PASSKEY`
-  // — because BEP 15 has no native passkey field and the UDP tracker
-  // pulls it out of the BEP 41 URL_DATA option that libtorrent /
-  // qBittorrent / Transmission send for the path. Embedding the
-  // passkey straight into the URL means the user never has to copy-
-  // paste it into qBittorrent's tracker list manually.
-  const httpUrl = new URL(config.public.trackerHttpUrl as string);
-  httpUrl.searchParams.set('passkey', user.passkey);
-  const personalizedHttpUrl = httpUrl.toString();
-
-  // Only emit the UDP entry when the tracker is *actually* serving
-  // UDP. Two conditions must both hold:
-  //   1. `NUXT_PUBLIC_TRACKER_UDP_URL` is configured (otherwise we
-  //      have no idea what host:port to advertise).
-  //   2. `TRACKER_UDP_ENABLED` isn't explicitly set to `false` —
-  //      same env the tracker process reads in `internal/config`.
-  //      Both processes share the same env in our compose setup,
-  //      so this is authoritative without an internal RPC.
-  //
-  // Without this guard, an operator who disabled UDP would still
-  // ship `.torrent` files pointing clients at a dead udp:// endpoint;
-  // BT clients that prefer UDP would then back off the working HTTP
-  // tracker for a while every announce, breaking ratio in subtle ways.
-  let personalizedUdpUrl: string | null = null;
-  const udpEnabled = process.env.TRACKER_UDP_ENABLED !== 'false';
-  const rawUdpUrl = (config.public.trackerUdpUrl as string) || '';
-  if (udpEnabled && rawUdpUrl) {
-    try {
-      const udpUrl = new URL(rawUdpUrl);
-      // Strip any trailing slash on the configured path so the
-      // passkey segment doesn't double up.
-      const basePath = udpUrl.pathname.replace(/\/+$/, '') || '/announce';
-      udpUrl.pathname = `${basePath}/${user.passkey}`;
-      personalizedUdpUrl = udpUrl.toString();
-    } catch {
-      // A misconfigured tracker URL shouldn't tank the .torrent
-      // download. Log and fall back to HTTP-only.
-      console.warn('[download] invalid trackerUdpUrl, skipping UDP announce-list entry:', rawUdpUrl);
-    }
-  }
-
-  // BEP 12 announce-list — each tier is a list of equivalent trackers
-  // tried in order. We put HTTP and UDP in their own tiers so a client
-  // hammers both independently rather than treating them as fallbacks
-  // of each other; that mirrors how every tracker we've cribbed off of
-  // (opentrackr, AnimeBytes, etc.) advertises a multi-protocol setup.
-  decoded.announce = Buffer.from(personalizedHttpUrl);
-  const tiers: Buffer[][] = [[Buffer.from(personalizedHttpUrl)]];
-  if (personalizedUdpUrl) {
-    tiers.push([Buffer.from(personalizedUdpUrl)]);
-  }
-  decoded['announce-list'] = tiers;
-
-  // Set private flag to 1
-  if (decoded.info) {
-    decoded.info.private = 1;
-  }
-
-  const personalizedData = bencode.encode(decoded);
-
   // Sanitize filename
   const filename = torrent.name.replace(/[^a-zA-Z0-9._-]/g, '_') + '.torrent';
 
diff --git a/apps/api/routes/api/torrents/[hash]/favorite.post.ts b/apps/api/routes/api/torrents/[hash]/favorite.post.ts
index b8b8af42..23e615cc 100644
--- a/apps/api/routes/api/torrents/[hash]/favorite.post.ts
+++ b/apps/api/routes/api/torrents/[hash]/favorite.post.ts
@@ -10,9 +10,9 @@
  * private, and surfacing "X starred your upload" would tilt the
  * feature into a popularity contest the tracker doesn't need.
  */
-import { eq } from 'drizzle-orm';
 import { db } from '@trackarr/db';
-import { torrents, torrentFavorites } from '@trackarr/db/schema';
+import { torrentFavorites } from '@trackarr/db/schema';
+import { assertVisibleTorrent } from '~~/utils/torrentListing';
 import { requireAuthSession } from '~~/utils/adminAuth';
 import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
 import { validateParam, infoHashSchema } from '~~/utils/schemas';
@@ -22,14 +22,10 @@ export default defineEventHandler(async (event) => {
   await rateLimit(event, RATE_LIMITS.mutation);
   const hash = validateParam(event, 'hash', infoHashSchema);
 
-  const torrent = await db.query.torrents.findFirst({
-    where: eq(torrents.infoHash, hash.toLowerCase()),
-    columns: { id: true },
-  });
-
-  if (!torrent) {
-    throw createError({ statusCode: 404, message: 'Torrent not found' });
-  }
+  // The listing's visibility, not mere existence: knowing an info hash was
+  // enough to favorite a pending, inactive or adult-hidden torrent — and then
+  // read its name, size and ids back from the favorites page.
+  const torrent = await assertVisibleTorrent(hash.toLowerCase(), session.user);
 
   await db
     .insert(torrentFavorites)
diff --git a/apps/api/routes/api/torrents/check.post.ts b/apps/api/routes/api/torrents/check.post.ts
index 3cea2f91..c429edca 100644
--- a/apps/api/routes/api/torrents/check.post.ts
+++ b/apps/api/routes/api/torrents/check.post.ts
@@ -15,6 +15,7 @@
  */
 import { db } from '@trackarr/db';
 import { parseTorrentFile } from '~~/utils/parseTorrentFile';
+import { normalizeUploadedTorrent } from '~~/utils/torrentBytes';
 import { rateLimit, RATE_LIMITS } from '~~/utils/rateLimit';
 
 export default defineEventHandler(async (event) => {
@@ -48,9 +49,13 @@ export default defineEventHandler(async (event) => {
     });
   }
 
+  // Hashed after the upload's own normalisation, not on the raw file: a
+  // torrent uploaded without the private flag is stored with it, under a
+  // different infohash, so hashing the raw bytes answered "not on the tracker"
+  // for a release that already was.
   let parsed: Awaited<ReturnType<typeof parseTorrentFile>>;
   try {
-    parsed = await parseTorrentFile(file.data);
+    parsed = await parseTorrentFile(normalizeUploadedTorrent(file.data));
   } catch {
     throw createError({ statusCode: 400, message: 'Invalid torrent file' });
   }
diff --git a/apps/api/routes/api/torrents/index.post.ts b/apps/api/routes/api/torrents/index.post.ts
index 9c2449ce..165c0ea8 100644
--- a/apps/api/routes/api/torrents/index.post.ts
+++ b/apps/api/routes/api/torrents/index.post.ts
@@ -2,7 +2,7 @@ import { db, schema } from '@trackarr/db';
 import { eq } from 'drizzle-orm';
 import { randomUUID } from 'crypto';
 import { parseTorrentFile } from '~~/utils/parseTorrentFile';
-import bencode from 'bencode';
+import { normalizeUploadedTorrent } from '~~/utils/torrentBytes';
 import { parseReleaseName } from '@trackarr/shared/releaseParse';
 import { computeContentSignature } from '~~/utils/contentSignature';
 import { extractV2 } from '~~/utils/bittorrentV2';
@@ -185,9 +185,9 @@ export default defineEventHandler(async (event) => {
     });
   }
 
-  // Normalise the torrent to a PRIVATE one at upload time: decode,
-  // force info.private = 1, re-encode, and treat THOSE bytes as
-  // canonical. We then compute the info_hash and store the normalised
+  // Normalise the torrent to a PRIVATE one at upload time: force
+  // info.private = 1, drop the uploader's own fields, and treat THOSE bytes
+  // as canonical. We then compute the info_hash and store the normalised
   // blob — so the hash in the DB equals the hash a client derives from
   // the .torrent we serve (the download route also sets private = 1).
   // The previous code stored the raw bytes but the download route
@@ -197,34 +197,10 @@ export default defineEventHandler(async (event) => {
   // info_hash drift). Normalising once here keeps all three in sync.
   let normalizedData: Buffer;
   try {
-    const decoded = bencode.decode(file.data) as Record<string, unknown>;
-    const info = decoded?.info as Record<string, unknown> | undefined;
-    if (!info || typeof info !== 'object') {
-      throw new Error('missing info dict');
-    }
-    info.private = 1;
-    // Les champs HORS `info`, qui portent les secrets de l'uploadeur.
-    //
-    // Un `.torrent` de tracker privé porte la passkey de son propriétaire dans
-    // `announce` (et dans chaque niveau d'`announce-list`). Les stocker verbatim
-    // laissait cette passkey au repos dans `torrent_data` : la route de sortie
-    // les réécrit de toute façon (`[hash]/download.get.ts`), donc la conserver
-    // n'apportait rien et suffisait à ce qu'un autre membre la lise — le cas
-    // courant en cross-seed étant que le fichier vienne d'un AUTRE tracker
-    // privé, dont la passkey n'a rien à faire ici.
-    //
-    // `url-list` (web seeds) sort aussi : un hôte tiers y ferait sortir le
-    // client de chaque téléchargeur vers lui. `comment` et `created by` sont du
-    // texte libre venu d'un fichier étranger, sans usage chez nous.
-    //
-    // Aucun de ces champs n'est dans `info`, donc l'infohash ne change pas et
-    // les lignes déjà stockées restent valides.
-    delete decoded.announce;
-    delete decoded['announce-list'];
-    delete decoded['url-list'];
-    delete decoded.comment;
-    delete decoded['created by'];
-    normalizedData = Buffer.from(bencode.encode(decoded));
+    // Byte-level, never decode → encode: `bencode` re-spells in hex any key that
+    // is not valid UTF-8, which re-keyed the `piece layers` of every v2 or
+    // hybrid torrent. `utils/torrentBytes` says why each dropped field goes.
+    normalizedData = normalizeUploadedTorrent(file.data);
   } catch (_err) {
     throw createError({ statusCode: 400, message: 'Invalid torrent file' });
   }
diff --git a/apps/api/routes/api/torznab/api/index.get.ts b/apps/api/routes/api/torznab/api/index.get.ts
index 04fb28ae..bc99a175 100644
--- a/apps/api/routes/api/torznab/api/index.get.ts
+++ b/apps/api/routes/api/torznab/api/index.get.ts
@@ -425,6 +425,9 @@ async function performSearch(
   // Fetch torrents
   const torrents = await db.query.torrents.findMany({
     where: whereClause,
+    // The item builder below never reads the raw .torrent; loading it put a
+    // whole file per result in memory on every *arr search.
+    columns: { torrentData: false },
     with: {
       category: true,
     },
diff --git a/apps/api/routes/api/torznab/download.get.ts b/apps/api/routes/api/torznab/download.get.ts
index 78f15b1b..e18c8651 100644
--- a/apps/api/routes/api/torznab/download.get.ts
+++ b/apps/api/routes/api/torznab/download.get.ts
@@ -7,7 +7,8 @@
 
 import { db, schema } from '@trackarr/db';
 import { eq } from 'drizzle-orm';
-import bencode from 'bencode';
+import { personalizeTorrent } from '~~/utils/torrentBytes';
+import { personalAnnounceUrls, trackerUdpEnabled } from '~~/utils/announceUrls';
 import { authenticateTorznab } from './utils/auth';
 import { TORZNAB_ERRORS, buildErrorXml } from './utils/xml';
 import { rateLimit, getClientIP } from '~~/utils/rateLimit';
@@ -128,11 +129,18 @@ export default defineEventHandler(async (event) => {
     });
   }
 
-  // Inject passkey into torrent data
-  let decoded: any;
+  // The member's announce URLs — the same tiers as a download from the site,
+  // through the same byte-level writer (see `utils/torrentBytes` for why not
+  // decode → encode).
+  const { announce, tiers } = personalAnnounceUrls(user.passkey, {
+    httpUrl: config.public.trackerHttpUrl as string,
+    udpUrl: (config.public.trackerUdpUrl as string) || '',
+    udpEnabled: trackerUdpEnabled(),
+  });
+  let personalizedData: Buffer;
   try {
-    decoded = bencode.decode(torrent.torrentData);
-  } catch (err) {
+    personalizedData = personalizeTorrent(Buffer.from(torrent.torrentData), announce, tiers);
+  } catch {
     setHeader(event, 'Content-Type', 'application/xml; charset=utf-8');
     throw createError({
       statusCode: 500,
@@ -141,25 +149,6 @@ export default defineEventHandler(async (event) => {
     });
   }
 
-  // Personalize announce URL
-  const trackerUrl = new URL(config.public.trackerHttpUrl as string);
-  trackerUrl.searchParams.set('passkey', user.passkey);
-  const personalizedUrl = trackerUrl.toString();
-
-  decoded.announce = Buffer.from(personalizedUrl);
-
-  // Also update announce-list if it exists
-  if (decoded['announce-list']) {
-    decoded['announce-list'] = [[Buffer.from(personalizedUrl)]];
-  }
-
-  // Set private flag to 1
-  if (decoded.info) {
-    decoded.info.private = 1;
-  }
-
-  const personalizedData = bencode.encode(decoded);
-
   // Sanitize filename
   const filename = torrent.name.replace(/[^a-zA-Z0-9._-]/g, '_') + '.torrent';
 
diff --git a/apps/api/routes/api/users/[id]/uploads.get.ts b/apps/api/routes/api/users/[id]/uploads.get.ts
index 54bf0438..46d189bc 100644
--- a/apps/api/routes/api/users/[id]/uploads.get.ts
+++ b/apps/api/routes/api/users/[id]/uploads.get.ts
@@ -88,6 +88,11 @@ export default defineEventHandler(async (event) => {
   // Get user's uploads
   const torrents = await db.query.torrents.findMany({
     where,
+    // Never the raw .torrent: every row below is spread into the response,
+    // and a file stored before the upload dropped its `announce` still carried
+    // its uploader's passkey — any member could read it off a profile. The
+    // detail and listing routes exclude it for the same reason (finding M4).
+    columns: { torrentData: false },
     with: {
       category: true,
     },
diff --git a/apps/api/routes/api/welcome.get.ts b/apps/api/routes/api/welcome.get.ts
new file mode 100644
index 00000000..7e928493
--- /dev/null
+++ b/apps/api/routes/api/welcome.get.ts
@@ -0,0 +1,14 @@
+/**
+ * GET /api/welcome — the staff's welcome note, for signed-in members.
+ *
+ * Admin → Branding has edited this note for a long time, and the branding
+ * guide promised it to members; nothing served it, so nothing showed it. The
+ * home page now renders it as a card a member can dismiss. Behind a session
+ * because it is written for members, not for whoever reaches the API.
+ */
+import { getWelcomeMessage } from '~~/utils/settings';
+
+export default defineEventHandler(async (event) => {
+  await requireUserSession(event);
+  return { message: await getWelcomeMessage() };
+});
diff --git a/apps/api/scripts/run-integration-tests.sh b/apps/api/scripts/run-integration-tests.sh
index 0380433f..beb6b715 100755
--- a/apps/api/scripts/run-integration-tests.sh
+++ b/apps/api/scripts/run-integration-tests.sh
@@ -10,7 +10,7 @@
 #      migration. Measurably not equivalent either: a push of this schema onto
 #      a database one version behind stops on an interactive rename prompt and
 #      exits 0, applying nothing.
-#   3. installs deps + runs the integration suite inside node:24-alpine
+#   3. installs deps + runs the integration suite inside node:26-alpine
 #   4. tears the containers + network down on exit (success or failure)
 #
 # RustFS is here for objectStorage.itest.ts, which exercises the S3 driver
@@ -29,11 +29,13 @@ PG=trackarr-itest-pg
 RD=trackarr-itest-redis
 S3=trackarr-itest-rustfs
 PG_IMAGE=postgres:18.6-alpine
-RD_IMAGE=redis:8.10.1-alpine
+RD_IMAGE=redis:8.10.2-alpine
 S3_IMAGE=rustfs/rustfs:latest
-NODE_IMAGE=node:24-alpine
+NODE_IMAGE=node:26-alpine
 DB_URL="postgres://tracker:tracker@${PG}:5432/trackarr"
 RD_PASS=itest-redis-password
+# The test's own Redis container on a private network.
+# nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
 RD_URL="redis://${RD}:6379"
 S3_URL="http://${S3}:9000"
 S3_KEY=trackarritest
@@ -136,7 +138,7 @@ docker run --rm --network "$NET" \
   -e S3_TEST_BUCKET="$S3_BUCKET" \
   "$NODE_IMAGE" sh -c "
     set -e
-    corepack enable
+    npm install --global --silent --allow-scripts=pnpm \"\$(node -p \"require('./package.json').packageManager\")\"
     pnpm config set store-dir /pnpm-store >/dev/null
     pnpm install --filter '@trackarr/api...' --filter '@trackarr/db...'
     echo '=== migrations ==='
diff --git a/apps/api/scripts/run-unit-tests.sh b/apps/api/scripts/run-unit-tests.sh
index 84c9bd41..d99f4d3d 100755
--- a/apps/api/scripts/run-unit-tests.sh
+++ b/apps/api/scripts/run-unit-tests.sh
@@ -18,9 +18,9 @@ docker run --rm \
   -v trackarr-itest-nm-api:/app/apps/api/node_modules \
   -v trackarr-itest-nm-db:/app/packages/db/node_modules \
   -v trackarr-itest-nm-shared:/app/packages/shared/node_modules \
-  node:24-alpine sh -c "
+  node:26-alpine sh -c "
     set -e
-    corepack enable
+    npm install --global --silent --allow-scripts=pnpm \"\$(node -p \"require('./package.json').packageManager\")\"
     pnpm config set store-dir /pnpm-store >/dev/null
     pnpm install --filter '@trackarr/api...' --filter '@trackarr/db...' --prefer-offline
     pnpm --filter @trackarr/api exec vitest run $*
diff --git a/apps/api/test/didProof.test.ts b/apps/api/test/didProof.test.ts
index fe282e23..7de8694c 100644
--- a/apps/api/test/didProof.test.ts
+++ b/apps/api/test/didProof.test.ts
@@ -137,7 +137,10 @@ describe('a browser signature the server accepts', () => {
 
     // The member's half, in the browser's terms.
     const config = proofConfigFor(memberDid, endorsedAt);
-    const digest = async (bytes: Uint8Array) =>
+    // `Uint8Array<ArrayBuffer>`, not the default `ArrayBufferLike`: since
+    // @types/node 26, WebCrypto's `BufferSource` refuses a view that could sit
+    // on a SharedArrayBuffer — the same rule the browser's lib.dom applies.
+    const digest = async (bytes: Uint8Array<ArrayBuffer>) =>
       new Uint8Array(await subtle.digest('SHA-256', bytes));
     const input = composeSigningInput(
       await digest(canonicalUtf8(config)),
@@ -175,7 +178,7 @@ describe('a browser signature the server accepts', () => {
       createHash('sha256').update(canonicalBytes(config)).digest(),
       createHash('sha256').update(canonicalBytes(doc)).digest(),
     );
-    const browserDigest = async (bytes: Uint8Array) =>
+    const browserDigest = async (bytes: Uint8Array<ArrayBuffer>) =>
       new Uint8Array(await subtle.digest('SHA-256', bytes));
     const browserInput = composeSigningInput(
       await browserDigest(canonicalUtf8(config)),
diff --git a/apps/api/test/integration/credentialRewrap.itest.ts b/apps/api/test/integration/credentialRewrap.itest.ts
new file mode 100644
index 00000000..4c778f50
--- /dev/null
+++ b/apps/api/test/integration/credentialRewrap.itest.ts
@@ -0,0 +1,65 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { eq } from 'drizzle-orm';
+import { db, schema } from '@trackarr/db';
+import { rewrapCredentialsTick, rewrapCursorKey } from '../../utils/credentialRewrap';
+import {
+  decryptSecret,
+  encryptSecretRequired,
+  looksEncrypted,
+} from '../../utils/credentialSecrets';
+import { setSetting } from '../../utils/settings';
+import { invalidatePanicCache } from '../../utils/panicLock';
+import { makeUser } from './helpers';
+
+// Account secrets left in plaintext — or readable only through the previous
+// key — used to wait for their owner's next login to be re-encrypted. A dormant
+// account's verifier, the credential itself, sat in clear in every dump.
+
+async function secretsOf(id: string) {
+  const [row] = await db
+    .select({ authVerifier: schema.users.authVerifier, totpSecret: schema.users.totpSecret })
+    .from(schema.users)
+    .where(eq(schema.users.id, id));
+  return row!;
+}
+
+describe('rewrapCredentialsTick', () => {
+  beforeEach(async () => {
+    await setSetting(rewrapCursorKey(), '');
+  });
+
+  it('encrypts plaintext verifiers and TOTP seeds, and leaves encrypted ones be', async () => {
+    const legacy = await makeUser({
+      authVerifier: 'cGxhaW50ZXh0LXZlcmlmaWVyLWZyb20tYmVmb3Jl',
+      totpSecret: 'JBSWY3DPEHPK3PXP',
+    });
+    const encrypted = encryptSecretRequired('YWxyZWFkeS1lbmNyeXB0ZWQ=');
+    const current = await makeUser({ authVerifier: encrypted });
+
+    const r = await rewrapCredentialsTick();
+    expect(r.rewritten).toBe(2);
+
+    const after = await secretsOf(legacy);
+    expect(looksEncrypted(after.authVerifier)).toBe(true);
+    expect(decryptSecret(after.authVerifier)).toBe('cGxhaW50ZXh0LXZlcmlmaWVyLWZyb20tYmVmb3Jl');
+    expect(looksEncrypted(after.totpSecret)).toBe(true);
+    expect(decryptSecret(after.totpSecret)).toBe('JBSWY3DPEHPK3PXP');
+
+    expect((await secretsOf(current)).authVerifier).toBe(encrypted);
+
+    // The walk is done: nothing left to do.
+    expect((await rewrapCredentialsTick()).processed).toBe(0);
+  });
+
+  it('stands still during a panic — its ciphertext has the same shape', async () => {
+    const legacy = await makeUser({ authVerifier: 'cGxhaW4tZHVyaW5nLXBhbmlj' });
+    await db
+      .insert(schema.panicState)
+      .values({ id: 'singleton', isEncrypted: true, phase: 'encrypted' })
+      .onConflictDoUpdate({ target: schema.panicState.id, set: { isEncrypted: true, phase: 'encrypted' } });
+    await invalidatePanicCache();
+
+    expect(await rewrapCredentialsTick()).toEqual({ processed: 0, rewritten: 0 });
+    expect((await secretsOf(legacy)).authVerifier).toBe('cGxhaW4tZHVyaW5nLXBhbmlj');
+  });
+});
diff --git a/apps/api/test/integration/federationPanic.itest.ts b/apps/api/test/integration/federationPanic.itest.ts
index 2f21f322..a4bc2c04 100644
--- a/apps/api/test/integration/federationPanic.itest.ts
+++ b/apps/api/test/integration/federationPanic.itest.ts
@@ -3,6 +3,7 @@ import { eq } from 'drizzle-orm';
 import { db, schema } from '@trackarr/db';
 import { federationSuspended } from '../../utils/federation/config';
 import { redis } from '../../utils/server';
+import { invalidatePanicCache } from '../../utils/panicLock';
 
 // Panic mode must stop federation. It encrypts the catalogue in place, and the
 // whole point is to stop exfiltration during an incident — yet nothing in the
@@ -11,19 +12,18 @@ import { redis } from '../../utils/server';
 // torrent; the S2S endpoints kept serving. `federationSuspended()` is the one
 // gate that now sits in front of the loops and the serving surface.
 
-async function setPanic(on: boolean): Promise<void> {
+async function setPanic(
+  on: boolean,
+  phase: 'idle' | 'encrypting' | 'encrypted' | 'restoring' = on ? 'encrypted' : 'idle',
+): Promise<void> {
   await db
     .insert(schema.panicState)
-    .values({ id: 'singleton', isEncrypted: on })
-    .onConflictDoUpdate({ target: schema.panicState.id, set: { isEncrypted: on } });
+    .values({ id: 'singleton', isEncrypted: on, phase })
+    .onConflictDoUpdate({ target: schema.panicState.id, set: { isEncrypted: on, phase } });
   // The gate caches through Redis; clear it so the test reads the new state.
   // Best-effort: if Redis is briefly unavailable the gate itself falls back to
   // the database, which is the property under test.
-  try {
-    await redis.del('federation:panic:suspended');
-  } catch {
-    /* the gate reads through to the DB anyway */
-  }
+  await invalidatePanicCache();
 }
 
 describe('federation while the instance is in panic', () => {
@@ -61,7 +61,17 @@ describe('federation while the instance is in panic', () => {
     // A stale or missing cache must never read as "not in panic" — panic is
     // exactly when a cache miss is most likely and most dangerous.
     await setPanic(true);
-    await redis.del('federation:panic:suspended');
+    await invalidatePanicCache();
+    expect(await federationSuspended()).toBe(true);
+  });
+
+  it('is suspended from the first encrypted row, not only once the flag is set', async () => {
+    // `is_encrypted` stays false for the whole encrypt pass — and an interrupted
+    // pass can stay there — while the mint loop would publish what it already
+    // encrypted. Same for a restore that stopped half way.
+    await setPanic(false, 'encrypting');
+    expect(await federationSuspended()).toBe(true);
+    await setPanic(true, 'restoring');
     expect(await federationSuspended()).toBe(true);
   });
 });
diff --git a/apps/api/test/integration/hnrSweep.itest.ts b/apps/api/test/integration/hnrSweep.itest.ts
new file mode 100644
index 00000000..c6f3a112
--- /dev/null
+++ b/apps/api/test/integration/hnrSweep.itest.ts
@@ -0,0 +1,77 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { randomUUID } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { db, schema } from '@trackarr/db';
+import { checkAndMarkHnrs } from '../../utils/hnr';
+import { setSetting } from '../../utils/settings';
+import { makeUser } from './helpers';
+
+// The sweep now runs on its own (`plugins/hnr-sweep`), so what it flags is what
+// members get notified about without a moderator in the loop. A row is born at
+// the Download click; only one where bytes actually moved can be a hit-and-run.
+
+const DAY = 24 * 3600 * 1000;
+
+async function makeTorrent(): Promise<string> {
+  const id = randomUUID();
+  await db.insert(schema.torrents).values({
+    id,
+    infoHash: `${randomUUID().replace(/-/g, '')}00000000`,
+    name: 'Release',
+    size: 1000,
+    moderationStatus: 'accepted',
+  });
+  return id;
+}
+
+async function track(over: Partial<typeof schema.hnrTracking.$inferInsert>): Promise<string> {
+  const id = randomUUID();
+  await db.insert(schema.hnrTracking).values({
+    id,
+    userId: await makeUser(),
+    torrentId: await makeTorrent(),
+    downloadedAt: new Date(Date.now() - 5 * DAY),
+    ...over,
+  });
+  return id;
+}
+
+async function isHnr(id: string): Promise<boolean> {
+  const [row] = await db
+    .select({ isHnr: schema.hnrTracking.isHnr })
+    .from(schema.hnrTracking)
+    .where(eq(schema.hnrTracking.id, id));
+  return row!.isHnr;
+}
+
+describe('checkAndMarkHnrs', () => {
+  beforeEach(async () => {
+    await setSetting('hnr_enabled', 'true');
+    await setSetting('hnr_grace_period', String(3 * 24 * 3600));
+  });
+
+  it('flags a download past its grace period, and only that', async () => {
+    const leeched = await track({ downloaded: 700 });
+    const clickedOnly = await track({ downloaded: 0 });
+    const inGrace = await track({ downloaded: 700, downloadedAt: new Date(Date.now() - DAY) });
+    const seeded = await track({ downloaded: 700, completedAt: new Date() });
+    const exempt = await track({ downloaded: 700, isExempt: true });
+
+    expect(await checkAndMarkHnrs()).toBe(1);
+    expect(await isHnr(leeched)).toBe(true);
+    expect(await isHnr(clickedOnly)).toBe(false);
+    expect(await isHnr(inGrace)).toBe(false);
+    expect(await isHnr(seeded)).toBe(false);
+    expect(await isHnr(exempt)).toBe(false);
+
+    // Idempotent: a second pass flags nothing new.
+    expect(await checkAndMarkHnrs()).toBe(0);
+  });
+
+  it('does nothing while hit-and-run is disabled', async () => {
+    await setSetting('hnr_enabled', 'false');
+    const leeched = await track({ downloaded: 700 });
+    expect(await checkAndMarkHnrs()).toBe(0);
+    expect(await isHnr(leeched)).toBe(false);
+  });
+});
diff --git a/apps/api/test/integration/knownDevices.itest.ts b/apps/api/test/integration/knownDevices.itest.ts
new file mode 100644
index 00000000..f02d1f79
--- /dev/null
+++ b/apps/api/test/integration/knownDevices.itest.ts
@@ -0,0 +1,93 @@
+import { describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { db, schema } from '@trackarr/db';
+import { redis } from '../../utils/server';
+import {
+  encodeKnownDevice,
+  knownDeviceFor,
+  recordKnownDeviceFailure,
+} from '../../utils/knownDevices';
+import { makeUser } from './helpers';
+
+// A known-device cookie exempts a browser from the per-account sign-in lockout.
+// What makes it safe to hand out is checked here against the real account row
+// and Redis: it names one account, dies with "sign out everywhere" and with a
+// password change, and a device that keeps failing loses it for good.
+
+const VERIFIER = 'v1:cipher-a';
+const now = () => Math.floor(Date.now() / 1000);
+const newDevice = () => randomBytes(16).toString('base64url');
+
+async function member(): Promise<{ id: string; username: string }> {
+  const id = await makeUser({ sessionEpoch: 0, authVerifier: VERIFIER });
+  const row = await db.query.users.findFirst({
+    where: eq(schema.users.id, id),
+    columns: { username: true },
+  });
+  return { id, username: row!.username };
+}
+
+const cookieFor = (userId: string, device: string) =>
+  encodeKnownDevice({ userId, sessionEpoch: 0, authVerifier: VERIFIER }, device, now());
+
+describe('known devices', () => {
+  it('recognises a cookie for the account it was issued to, under that username only', async () => {
+    const a = await member();
+    const b = await member();
+    const device = newDevice();
+    const value = cookieFor(a.id, device);
+
+    expect(await knownDeviceFor(value, a.username)).toBe(device);
+    expect(await knownDeviceFor(value, b.username)).toBeNull();
+    expect(await knownDeviceFor(value, 'no-such-member-anywhere')).toBeNull();
+    expect(await knownDeviceFor(undefined, a.username)).toBeNull();
+  });
+
+  it('forgets the browser when the account signs out everywhere or changes password', async () => {
+    const a = await member();
+    const device = newDevice();
+    const value = cookieFor(a.id, device);
+    expect(await knownDeviceFor(value, a.username)).toBe(device);
+
+    // What "sign out everywhere" and a ban do.
+    await db.update(schema.users).set({ sessionEpoch: 1 }).where(eq(schema.users.id, a.id));
+    expect(await knownDeviceFor(value, a.username)).toBeNull();
+
+    // What a password change does to the stored verifier.
+    await db
+      .update(schema.users)
+      .set({ sessionEpoch: 0, authVerifier: 'v1:cipher-b' })
+      .where(eq(schema.users.id, a.id));
+    expect(await knownDeviceFor(value, a.username)).toBeNull();
+  });
+
+  it('revokes a device after ten failures in the window, and only that device', async () => {
+    const a = await member();
+    const noisy = newDevice();
+    const quiet = newDevice();
+
+    for (let i = 0; i < 9; i++) await recordKnownDeviceFailure(noisy);
+    expect(await knownDeviceFor(cookieFor(a.id, noisy), a.username)).toBe(noisy);
+    await recordKnownDeviceFailure(noisy);
+    expect(await knownDeviceFor(cookieFor(a.id, noisy), a.username)).toBeNull();
+    // Re-signed or not, the id stays revoked: the cookie's age is not what failed.
+    expect(await knownDeviceFor(cookieFor(a.id, noisy), a.username)).toBeNull();
+    expect(await knownDeviceFor(cookieFor(a.id, quiet), a.username)).toBe(quiet);
+
+    await redis.del(`known-device:revoked:${noisy}`, `ratelimit:signin-fail-device:${noisy}`);
+  });
+
+  it('does not count failures older than the window', async () => {
+    const a = await member();
+    const device = newDevice();
+    const old = Date.now() - 16 * 60 * 1000;
+    for (let i = 0; i < 9; i++) {
+      await redis.zadd(`ratelimit:signin-fail-device:${device}`, old + i, `old-${i}`);
+    }
+    await recordKnownDeviceFailure(device); // the tenth entry, nine of them stale
+    expect(await knownDeviceFor(cookieFor(a.id, device), a.username)).toBe(device);
+
+    await redis.del(`ratelimit:signin-fail-device:${device}`);
+  });
+});
diff --git a/apps/api/test/integration/setup.ts b/apps/api/test/integration/setup.ts
index dd8ed06d..43542ce6 100644
--- a/apps/api/test/integration/setup.ts
+++ b/apps/api/test/integration/setup.ts
@@ -82,9 +82,21 @@ beforeEach(async () => {
           federation_config, federation_peers,
           catalog_records,
           themes, uploaded_fonts,
+          panic_state,
+          revoked_identities,
           users
         RESTART IDENTITY CASCADE`,
   );
+  // `panic_state` is named because a test that leaves the instance in panic
+  // turns every later one read-only — the write lock, the federation gate and
+  // the catalogue sweeps all stop on it — and only in the files that run after
+  // it. The gate caches in Redis for a few seconds, hence the second line.
+  //
+  // `revoked_identities` holds DIDs, not foreign keys, so no cascade reaches
+  // it, and the succession tests reuse fixed DIDs: a run left its revocations
+  // behind and the next run of `identityRecord.itest.ts` found an alias too
+  // many. Green on a fresh database, red on every re-run.
+  await redis.del('panic:active').catch(() => {});
 });
 
 afterAll(async () => {
diff --git a/apps/api/test/integration/signinLockout.itest.ts b/apps/api/test/integration/signinLockout.itest.ts
new file mode 100644
index 00000000..72762845
--- /dev/null
+++ b/apps/api/test/integration/signinLockout.itest.ts
@@ -0,0 +1,56 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { redis } from '../../utils/server';
+import {
+  assertAccountNotLocked,
+  recordAccountFailure,
+  clearAccountFailures,
+} from '../../utils/rateLimit';
+
+// Failed sign-ins counted per username, so a guesser spread over many addresses
+// still meets a limit. Every username counts, existing or not: a lockout must
+// never be how somebody learns that an account exists.
+
+const locked = async (u: string) =>
+  assertAccountNotLocked(u).then(
+    () => false,
+    (err: { statusCode?: number }) => {
+      if (err.statusCode !== 429) throw err;
+      return true;
+    },
+  );
+
+describe('per-account sign-in lockout', () => {
+  beforeEach(async () => {
+    for (const u of ['alice', 'nobody-at-all', 'bob']) await clearAccountFailures(u);
+  });
+
+  it('locks a username after ten failures in the window', async () => {
+    for (let i = 0; i < 9; i++) await recordAccountFailure('alice');
+    expect(await locked('alice')).toBe(false);
+    await recordAccountFailure('alice');
+    expect(await locked('alice')).toBe(true);
+    // Case does not open a second counter.
+    expect(await locked('ALICE')).toBe(true);
+    // Another account is untouched.
+    expect(await locked('bob')).toBe(false);
+  });
+
+  it('counts a username that has no account the same way', async () => {
+    for (let i = 0; i < 10; i++) await recordAccountFailure('nobody-at-all');
+    expect(await locked('nobody-at-all')).toBe(true);
+  });
+
+  it('forgets failures older than the window, and on a successful sign-in', async () => {
+    for (let i = 0; i < 10; i++) await recordAccountFailure('alice');
+    expect(await locked('alice')).toBe(true);
+    await clearAccountFailures('alice');
+    expect(await locked('alice')).toBe(false);
+
+    // Ten failures stamped sixteen minutes ago no longer count.
+    const old = Date.now() - 16 * 60 * 1000;
+    for (let i = 0; i < 10; i++) {
+      await redis.zadd('ratelimit:signin-fail:alice', old + i, `old-${i}`);
+    }
+    expect(await locked('alice')).toBe(false);
+  });
+});
diff --git a/apps/api/test/integration/torrentFileCleanup.itest.ts b/apps/api/test/integration/torrentFileCleanup.itest.ts
new file mode 100644
index 00000000..ee6fdd71
--- /dev/null
+++ b/apps/api/test/integration/torrentFileCleanup.itest.ts
@@ -0,0 +1,136 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { randomUUID } from 'node:crypto';
+import bencode from 'bencode';
+import { eq } from 'drizzle-orm';
+import { db, schema } from '@trackarr/db';
+import { cleanupTorrentFilesTick, CLEANUP_CURSOR_KEY } from '../../utils/torrentFileCleanup';
+import { setSetting } from '../../utils/settings';
+import { invalidatePanicCache } from '../../utils/panicLock';
+import { infoDictRange } from '../../utils/bittorrentV2';
+
+// The sweep that cleans the `.torrent` files stored before the upload dropped
+// the uploader's fields and stopped re-keying piece layers. What has to hold:
+// the passkey leaves the row, the piece layers get their raw roots back, and the
+// info dict — the infohash — does not move by a single byte.
+
+const raw = (s: string) => Buffer.from(s, 'latin1');
+const bstr = (b: Buffer | string) => {
+  const buf = typeof b === 'string' ? Buffer.from(b) : b;
+  return Buffer.concat([raw(`${buf.length}:`), buf]);
+};
+const dictOf = (pairs: Array<[Buffer | string, Buffer]>) =>
+  Buffer.concat([raw('d'), ...pairs.flatMap(([k, v]) => [bstr(k), v]), raw('e')]);
+const enc = (v: unknown) => Buffer.from(bencode.encode(v as never));
+const infoOf = (file: Buffer) => {
+  const r = infoDictRange(file)!;
+  return file.subarray(r.start, r.end);
+};
+
+const ROOT = Buffer.alloc(32, 0xc3);
+const LAYER = Buffer.alloc(64, 0x11);
+const PASSKEY = 'a'.repeat(40);
+
+async function storeTorrent(torrentData: Buffer): Promise<string> {
+  const id = randomUUID();
+  await db.insert(schema.torrents).values({
+    id,
+    infoHash: `${randomUUID().replace(/-/g, '')}00000000`,
+    name: 'Release',
+    size: 1000,
+    torrentData,
+    moderationStatus: 'accepted',
+  });
+  return id;
+}
+
+async function storedBytes(id: string): Promise<Buffer> {
+  const [row] = await db
+    .select({ torrentData: schema.torrents.torrentData })
+    .from(schema.torrents)
+    .where(eq(schema.torrents.id, id));
+  return Buffer.from(row!.torrentData!);
+}
+
+describe('cleanupTorrentFilesTick', () => {
+  // The setup TRUNCATEs `settings`, but `getSetting` keeps an in-process cache
+  // for a minute: without this the second test resumes from the first's cursor.
+  beforeEach(async () => {
+    await setSetting(CLEANUP_CURSOR_KEY, '');
+  });
+
+  it('drops the uploader passkey and repairs piece layers without moving info', async () => {
+    const v1Info = enc({ length: 5, name: Buffer.from('a'), 'piece length': 16384, pieces: Buffer.alloc(20), private: 1 });
+    const legacy = dictOf([
+      ['announce', bstr(`https://tracker.example/announce?passkey=${PASSKEY}`)],
+      ['announce-list', enc([[Buffer.from(`https://tracker.example/announce?passkey=${PASSKEY}`)]])],
+      ['info', v1Info],
+    ]);
+
+    const hybridInfo = enc({
+      'file tree': { 'movie.mkv': { '': { length: 40000, 'pieces root': ROOT } } },
+      length: 40000,
+      'meta version': 2,
+      name: Buffer.from('movie.mkv'),
+      'piece length': 16384,
+      pieces: Buffer.alloc(60, 0x22),
+      private: 1,
+    });
+    // What the old upload stored: piece layers keyed by the hex of the root.
+    const reKeyed = dictOf([
+      ['info', hybridInfo],
+      ['piece layers', dictOf([[Buffer.from(ROOT.toString('hex')), bstr(LAYER)]])],
+    ]);
+
+    const clean = dictOf([['info', v1Info]]);
+
+    const legacyId = await storeTorrent(legacy);
+    const reKeyedId = await storeTorrent(reKeyed);
+    const cleanId = await storeTorrent(clean);
+
+    const first = await cleanupTorrentFilesTick();
+    expect(first).toEqual({ processed: 3, cleaned: 2 });
+
+    const legacyAfter = await storedBytes(legacyId);
+    expect(legacyAfter.toString('latin1')).not.toContain(PASSKEY);
+    expect(infoOf(legacyAfter).equals(v1Info)).toBe(true);
+
+    const reKeyedAfter = await storedBytes(reKeyedId);
+    expect(reKeyedAfter.includes(Buffer.concat([raw('32:'), ROOT, bstr(LAYER)]))).toBe(true);
+    expect(infoOf(reKeyedAfter).equals(hybridInfo)).toBe(true);
+
+    expect((await storedBytes(cleanId)).equals(clean)).toBe(true);
+
+    // The cursor walked past all three: a second tick has nothing to do.
+    expect(await cleanupTorrentFilesTick()).toEqual({ processed: 0, cleaned: 0 });
+  });
+
+  it('moves past a file it cannot walk without writing it', async () => {
+    const junkId = await storeTorrent(raw('not bencode at all'));
+    expect(await cleanupTorrentFilesTick()).toEqual({ processed: 1, cleaned: 0 });
+    expect((await storedBytes(junkId)).toString('latin1')).toBe('not bencode at all');
+  });
+
+  it('stands still during a panic, so the encrypted rows are not walked past', async () => {
+    const legacy = dictOf([
+      ['announce', bstr(`https://tracker.example/announce?passkey=${PASSKEY}`)],
+      ['info', enc({ name: Buffer.from('a'), private: 1 })],
+    ]);
+    const id = await storeTorrent(legacy);
+    const setPhase = async (phase: 'idle' | 'encrypting') => {
+      await db
+        .insert(schema.panicState)
+        .values({ id: 'singleton', isEncrypted: false, phase })
+        .onConflictDoUpdate({ target: schema.panicState.id, set: { isEncrypted: false, phase } });
+      await invalidatePanicCache();
+    };
+    try {
+      await setPhase('encrypting');
+      expect(await cleanupTorrentFilesTick()).toEqual({ processed: 0, cleaned: 0 });
+      expect((await storedBytes(id)).equals(legacy)).toBe(true);
+    } finally {
+      await setPhase('idle');
+    }
+    // Once the panic is over, the row is still ahead of the cursor.
+    expect(await cleanupTorrentFilesTick()).toEqual({ processed: 1, cleaned: 1 });
+  });
+});
diff --git a/apps/api/test/knownDevices.test.ts b/apps/api/test/knownDevices.test.ts
new file mode 100644
index 00000000..db7d4aae
--- /dev/null
+++ b/apps/api/test/knownDevices.test.ts
@@ -0,0 +1,87 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import {
+  encodeKnownDevice,
+  verifyKnownDevice,
+  KNOWN_DEVICE_TTL_S,
+} from '../utils/knownDevices';
+
+// The known-device cookie exempts a browser from the per-account sign-in
+// lockout, so everything it is bound to must void it when it changes: the
+// account, the session epoch ("sign out everywhere", a ban), the stored
+// verifier (a password change). And nothing about it may be forged or stretched.
+
+const subject = {
+  userId: 'a8e2c0de-0000-4000-8000-000000000001',
+  sessionEpoch: 3,
+  authVerifier: 'v1:cipher',
+};
+const DEVICE = 'AAAAAAAAAAAAAAAAAAAAAA'; // 22 base64url characters, as issued
+const NOW = 1_800_000_000;
+
+describe('known-device cookie', () => {
+  const originalSecret = process.env.NUXT_SESSION_SECRET;
+  afterEach(() => {
+    process.env.NUXT_SESSION_SECRET = originalSecret;
+  });
+
+  it('round-trips to its device id', () => {
+    const value = encodeKnownDevice(subject, DEVICE, NOW);
+    expect(value).toMatch(/^v1\.[A-Za-z0-9_-]{22}\.\d+\.[A-Za-z0-9_-]{43}$/);
+    expect(verifyKnownDevice(value, subject, NOW)).toBe(DEVICE);
+  });
+
+  it('is void for another account, epoch or credential', () => {
+    const value = encodeKnownDevice(subject, DEVICE, NOW);
+    const other = 'a8e2c0de-0000-4000-8000-000000000002';
+    expect(verifyKnownDevice(value, { ...subject, userId: other }, NOW)).toBeNull();
+    expect(verifyKnownDevice(value, { ...subject, sessionEpoch: 4 }, NOW)).toBeNull();
+    expect(verifyKnownDevice(value, { ...subject, authVerifier: 'v1:other' }, NOW)).toBeNull();
+  });
+
+  it('reads a missing epoch as 0, the way sessions do', () => {
+    const value = encodeKnownDevice({ ...subject, sessionEpoch: null }, DEVICE, NOW);
+    expect(verifyKnownDevice(value, { ...subject, sessionEpoch: 0 }, NOW)).toBe(DEVICE);
+  });
+
+  it('refuses any part edited', () => {
+    const value = encodeKnownDevice(subject, DEVICE, NOW);
+    const [v, device, issued, mac] = value.split('.') as [string, string, string, string];
+    const flip = (s: string) => (s[0] === 'A' ? 'B' : 'A') + s.slice(1);
+    expect(verifyKnownDevice([v, flip(device), issued, mac].join('.'), subject, NOW)).toBeNull();
+    expect(verifyKnownDevice([v, device, String(Number(issued) + 1), mac].join('.'), subject, NOW)).toBeNull();
+    expect(verifyKnownDevice([v, device, issued, flip(mac)].join('.'), subject, NOW)).toBeNull();
+    expect(verifyKnownDevice(['v2', device, issued, mac].join('.'), subject, NOW)).toBeNull();
+  });
+
+  it('expires, and takes no issue time from the future beyond clock skew', () => {
+    const at = (issuedAt: number) => encodeKnownDevice(subject, DEVICE, issuedAt);
+    expect(verifyKnownDevice(at(NOW - KNOWN_DEVICE_TTL_S), subject, NOW)).toBe(DEVICE);
+    expect(verifyKnownDevice(at(NOW - KNOWN_DEVICE_TTL_S - 1), subject, NOW)).toBeNull();
+    expect(verifyKnownDevice(at(NOW + 299), subject, NOW)).toBe(DEVICE);
+    expect(verifyKnownDevice(at(NOW + 301), subject, NOW)).toBeNull();
+  });
+
+  it('rejects anything that is not the issued shape', () => {
+    const mac = 'A'.repeat(43);
+    for (const bad of [
+      undefined,
+      null,
+      '',
+      'v1',
+      'v1..1.x',
+      `v1.${DEVICE}.1`,
+      `v1.${DEVICE}.1.x.y`,
+      `v1.${DEVICE.slice(1)}.1.${mac}`, // device id one character short
+      `v1.${DEVICE}.-1.${mac}`,
+      `v1.${DEVICE}.1.${mac.slice(1)}=`, // padding is not base64url
+    ]) {
+      expect(verifyKnownDevice(bad, subject, NOW)).toBeNull();
+    }
+  });
+
+  it('dies with the session secret', () => {
+    const value = encodeKnownDevice(subject, DEVICE, NOW);
+    process.env.NUXT_SESSION_SECRET = 'another-session-secret-0123456789abcdef';
+    expect(verifyKnownDevice(value, subject, NOW)).toBeNull();
+  });
+});
diff --git a/apps/api/test/panic.test.ts b/apps/api/test/panic.test.ts
index 8dd72973..8c63e0f4 100644
--- a/apps/api/test/panic.test.ts
+++ b/apps/api/test/panic.test.ts
@@ -7,7 +7,10 @@ import {
   generateSalt,
   encryptField,
   decryptField,
+  decryptFieldOrKeep,
+  decryptTorrentDataOrKeep,
 } from '../utils/panic';
+import { allowedDuringPanic } from '../utils/panicLock';
 
 // Panic-mode encryption. This module is the project's only use of AES-GCM, and
 // it serves two paths: sealing the database, and the notification channel
@@ -175,3 +178,84 @@ describe('encryptField / decryptField', () => {
     }
   });
 });
+
+describe('decryptFieldOrKeep', () => {
+  // What the restore runs on every column. The password is verified before the
+  // key is derived, so a value that does not decrypt is clear text: a row
+  // written while the database was encrypted, or one an interrupted restore had
+  // already given back. Refusing those made a single write during the panic —
+  // or a single crash mid-restore — enough to lose the instance.
+  it('decrypts what this key encrypted', async () => {
+    const k = await key();
+    expect(decryptFieldOrKeep(encryptField('secret', k), k)).toBe('secret');
+  });
+
+  it('keeps a value that is already clear, colons and all', async () => {
+    const k = await key();
+    for (const v of ['3f1a9c', 'plain text', 'a:b:c', '2001:db8::1', '']) {
+      expect(decryptFieldOrKeep(v, k)).toBe(v);
+    }
+  });
+
+  it('makes a second restore pass a no-op on what the first restored', async () => {
+    const k = await key();
+    const once = decryptFieldOrKeep(encryptField('passkey-value', k), k);
+    expect(decryptFieldOrKeep(once, k)).toBe('passkey-value');
+  });
+
+  it('passes null and undefined through', async () => {
+    const k = await key();
+    expect(decryptFieldOrKeep(null, k)).toBeNull();
+    expect(decryptFieldOrKeep(undefined, k)).toBeNull();
+  });
+});
+
+describe('decryptTorrentDataOrKeep', () => {
+  // The same rule for `torrent_data`, which the encrypt pass wraps as base64 and
+  // then stores the `iv:ct:tag` as ASCII bytes. A second restore attempt meets the
+  // clear file the first one gave back; the route used to write null over it.
+  const file = Buffer.from('d8:announce3:url4:infod6:lengthi1e4:name1:xee', 'latin1');
+  const wrap = (raw: Buffer, k: Buffer) =>
+    Buffer.from(encrypt(raw.toString('base64'), k), 'ascii');
+
+  it('unwraps what the encrypt pass stored', async () => {
+    const k = await key();
+    expect(decryptTorrentDataOrKeep(wrap(file, k), k)).toEqual(file);
+  });
+
+  it('keeps the clear file a previous attempt gave back', async () => {
+    const k = await key();
+    const once = decryptTorrentDataOrKeep(wrap(file, k), k)!;
+    expect(decryptTorrentDataOrKeep(once, k)).toEqual(file);
+  });
+
+  it('answers null for bytes that are neither, so the restore counts them', async () => {
+    const k = await key();
+    expect(decryptTorrentDataOrKeep(Buffer.from('not a torrent'), k)).toBeNull();
+    expect(decryptTorrentDataOrKeep(Buffer.from('d4:name1:xe'), k)).toBeNull();
+    expect(decryptTorrentDataOrKeep(wrap(file, await key()), k)).toBeNull();
+  });
+});
+
+describe('allowedDuringPanic', () => {
+  it('lets every read through', () => {
+    expect(allowedDuringPanic('GET', '/api/torrents')).toBe(true);
+    expect(allowedDuringPanic('HEAD', '/api/admin/panic')).toBe(true);
+  });
+
+  it('lets the panic itself and logging out write', () => {
+    expect(allowedDuringPanic('POST', '/api/admin/panic/restore')).toBe(true);
+    expect(allowedDuringPanic('POST', '/api/admin/panic/encrypt/')).toBe(true);
+    expect(allowedDuringPanic('POST', '/api/auth/logout?next=/')).toBe(true);
+  });
+
+  it('refuses every other write, however it is spelled', () => {
+    expect(allowedDuringPanic('POST', '/api/torrents')).toBe(false);
+    expect(allowedDuringPanic('put', '/api/auth/password')).toBe(false);
+    expect(allowedDuringPanic('DELETE', '/API/torrents/abc')).toBe(false);
+    expect(allowedDuringPanic('POST', '/%61pi/torrents')).toBe(false);
+    expect(allowedDuringPanic('POST', '/uploads/x')).toBe(false);
+    expect(allowedDuringPanic('POST', '/api/admin/panic/restore%')).toBe(false);
+  });
+});
+
diff --git a/apps/api/test/rateLimitSubject.test.ts b/apps/api/test/rateLimitSubject.test.ts
new file mode 100644
index 00000000..1f4912bb
--- /dev/null
+++ b/apps/api/test/rateLimitSubject.test.ts
@@ -0,0 +1,37 @@
+import { describe, it, expect } from 'vitest';
+import { rateLimitSubject } from '../utils/rateLimit';
+
+// What an address-based limit — and the blacklist built on it — counts. An IPv6
+// host routinely holds a whole /64 and can use a fresh address per request, so
+// keying on the full address limited nobody who rotated inside their prefix.
+
+describe('rateLimitSubject', () => {
+  it('keeps an IPv4 address whole, IPv4-mapped included', () => {
+    expect(rateLimitSubject('203.0.113.7')).toBe('203.0.113.7');
+    expect(rateLimitSubject('::ffff:203.0.113.7')).toBe('203.0.113.7');
+  });
+
+  it('folds every address of an IPv6 /64 onto one subject', () => {
+    const a = rateLimitSubject('2001:db8:aa:bb:1:2:3:4');
+    const b = rateLimitSubject('2001:0db8:00aa:00bb:ffff:ffff:ffff:ffff');
+    const c = rateLimitSubject('2001:db8:aa:bb::1');
+    expect(a).toBe('2001:db8:aa:bb::/64');
+    expect(b).toBe(a);
+    expect(c).toBe(a);
+  });
+
+  it('keeps two /64s apart', () => {
+    expect(rateLimitSubject('2001:db8:aa:bb::1')).not.toBe(rateLimitSubject('2001:db8:aa:bc::1'));
+  });
+
+  it('reads compressed, zoned and IPv4-tailed spellings', () => {
+    expect(rateLimitSubject('::1')).toBe('0:0:0:0::/64');
+    expect(rateLimitSubject('fe80::1%eth0')).toBe('fe80:0:0:0::/64');
+    expect(rateLimitSubject('64:ff9b::192.0.2.1')).toBe('64:ff9b:0:0::/64');
+  });
+
+  it('passes anything else through untouched', () => {
+    expect(rateLimitSubject('unknown')).toBe('unknown');
+    expect(rateLimitSubject('')).toBe('');
+  });
+});
diff --git a/apps/api/test/torrentBytes.test.ts b/apps/api/test/torrentBytes.test.ts
new file mode 100644
index 00000000..e177994f
--- /dev/null
+++ b/apps/api/test/torrentBytes.test.ts
@@ -0,0 +1,286 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import bencode from 'bencode';
+import { dictEntries, skipValue } from '../utils/bencodeScan';
+import {
+  cleanStoredTorrent,
+  normalizeUploadedTorrent,
+  personalizeTorrent,
+} from '../utils/torrentBytes';
+import { infoDictRange } from '../utils/bittorrentV2';
+import { personalAnnounceUrls, trackerUdpEnabled } from '../utils/announceUrls';
+
+// The files are built by hand, byte by byte where it matters: the faults these
+// tests pin down live in keys a JS object cannot hold (raw 32-byte roots), so
+// `bencode.encode` can only build the parts whose keys are plain text.
+
+const raw = (s: string) => Buffer.from(s, 'latin1');
+const bstr = (b: Buffer | string) => {
+  const buf = typeof b === 'string' ? Buffer.from(b) : b;
+  return Buffer.concat([raw(`${buf.length}:`), buf]);
+};
+/** A bencoded dict with the entries in the order given, keys as raw bytes. */
+function dictOf(pairs: Array<[Buffer | string, Buffer]>): Buffer {
+  return Buffer.concat([raw('d'), ...pairs.flatMap(([k, v]) => [bstr(k), v]), raw('e')]);
+}
+const enc = (v: unknown) => Buffer.from(bencode.encode(v as never));
+
+/** The info dict's bytes, located the way the infohash is computed. */
+function infoBytes(file: Buffer): Buffer {
+  const r = infoDictRange(file)!;
+  return file.subarray(r.start, r.end);
+}
+
+const ROOT = Buffer.alloc(32, 0xc3); // 0xc3 alone is invalid UTF-8: a realistic root
+const LAYER = Buffer.alloc(64, 0x11); // two 32-byte hashes
+
+/** A hybrid info dict (v1 `pieces` + v2 `file tree`) whose single file has ROOT. */
+function hybridInfo(extra: Record<string, unknown> = {}): Buffer {
+  return enc({
+    'file tree': { 'movie.mkv': { '': { length: 40000, 'pieces root': ROOT } } },
+    length: 40000,
+    'meta version': 2,
+    name: Buffer.from('movie.mkv'),
+    'piece length': 16384,
+    pieces: Buffer.alloc(60, 0x22),
+    ...extra,
+  });
+}
+
+/** A whole hybrid `.torrent`, piece layers keyed by `layerKey`. */
+function hybridFile(layerKey: Buffer, info = hybridInfo()): Buffer {
+  return dictOf([
+    ['announce', bstr('http://other.tracker/announce?passkey=deadbeef')],
+    ['info', info],
+    ['piece layers', dictOf([[layerKey, bstr(LAYER)]])],
+  ]);
+}
+
+describe('bencodeScan', () => {
+  it('lists dict entries with their raw keys and ranges', () => {
+    const file = dictOf([['a', raw('i1e')], [ROOT, bstr('x')]]);
+    const d = dictEntries(file)!;
+    expect(d.end).toBe(file.length);
+    expect(d.entries.map((e) => e.key)).toEqual([Buffer.from('a'), ROOT]);
+    expect(file.subarray(d.entries[0]!.valueStart, d.entries[0]!.end).toString()).toBe('i1e');
+  });
+
+  it('rejects what is not a well-formed dict', () => {
+    expect(dictEntries(Buffer.alloc(0))).toBeNull();
+    expect(dictEntries(raw('l1:ae'))).toBeNull(); // list root
+    expect(dictEntries(raw('di1ei2ee'))).toBeNull(); // integer key
+    expect(dictEntries(raw('d1:a'))).toBeNull(); // value missing
+    expect(dictEntries(raw('d1:ai1e'))).toBeNull(); // unterminated
+    expect(skipValue(raw('5:ab'), 0)).toBe(-1); // length past EOF
+    expect(skipValue(raw('-1:a'), 0)).toBe(-1);
+    expect(skipValue(raw('ixyze'), 0)).toBe(-1); // not a number
+    expect(skipValue(raw('ie'), 0)).toBe(-1);
+    expect(skipValue(raw('i1-2e'), 0)).toBe(-1);
+  });
+
+  it('reads integers, tolerating the leading zeros an old file may carry', () => {
+    expect(skipValue(raw('i42e'), 0)).toBe(4);
+    expect(skipValue(raw('i-7e'), 0)).toBe(4);
+    expect(skipValue(raw('i007e'), 0)).toBe(5);
+  });
+
+  it('terminates on deeply nested junk', () => {
+    const started = Date.now();
+    expect(dictEntries(raw('d1:a' + 'l'.repeat(5000)))).toBeNull();
+    expect(Date.now() - started).toBeLessThan(1000);
+  });
+});
+
+describe('the bencode round trip these helpers replace', () => {
+  it('re-keys piece layers in hex — the fault being fixed', () => {
+    // Pins the library behaviour the module comment describes, so a future
+    // bencode that keeps raw keys shows up here rather than silently.
+    // Key AND value: `32:<root>` alone also occurs inside `info`, as the file's
+    // `pieces root` — a value, which the decoder keeps raw.
+    const file = hybridFile(ROOT);
+    const roundTrip = enc(bencode.decode(file));
+    expect(file.includes(Buffer.concat([raw('32:'), ROOT, bstr(LAYER)]))).toBe(true);
+    expect(roundTrip.includes(Buffer.concat([raw('32:'), ROOT, bstr(LAYER)]))).toBe(false);
+    expect(roundTrip.includes(Buffer.concat([raw(`64:${ROOT.toString('hex')}`), bstr(LAYER)]))).toBe(true);
+  });
+});
+
+describe('normalizeUploadedTorrent', () => {
+  it('drops the uploader fields, keeps the rest, forces private', () => {
+    const info = enc({ length: 5, name: Buffer.from('a'), 'piece length': 16384, pieces: Buffer.alloc(20) });
+    const file = dictOf([
+      ['announce', bstr('http://t/announce?passkey=secret')],
+      ['announce-list', enc([[Buffer.from('http://t/announce?passkey=secret')]])],
+      ['comment', bstr('hi')],
+      ['created by', bstr('mktorrent')],
+      ['creation date', raw('i1700000000e')],
+      ['info', info],
+      ['url-list', enc([Buffer.from('http://webseed')])],
+    ]);
+    const out = normalizeUploadedTorrent(file);
+    expect(out.toString('latin1')).not.toContain('secret');
+    expect(Object.keys(bencode.decode(out) as object)).toEqual(['creation date', 'info']);
+    // `private` lands where a sorted dict holds it: after `pieces`.
+    expect(infoBytes(out).equals(enc({ length: 5, name: Buffer.from('a'), 'piece length': 16384, pieces: Buffer.alloc(20), private: 1 }))).toBe(true);
+  });
+
+  it('leaves a private info dict byte for byte, and fixes private=0', () => {
+    const p1 = enc({ name: Buffer.from('a'), private: 1 });
+    expect(infoBytes(normalizeUploadedTorrent(dictOf([['info', p1]]))).equals(p1)).toBe(true);
+    const p0 = enc({ name: Buffer.from('a'), private: 0 });
+    expect(infoBytes(normalizeUploadedTorrent(dictOf([['info', p0]]))).equals(p1)).toBe(true);
+  });
+
+  it('keeps the piece layers of a v2 torrent intact', () => {
+    const file = hybridFile(ROOT, hybridInfo({ private: 1 }));
+    const out = normalizeUploadedTorrent(file);
+    expect(out.includes(Buffer.concat([raw('32:'), ROOT, bstr(LAYER)]))).toBe(true);
+    expect(infoBytes(out).equals(infoBytes(file))).toBe(true);
+  });
+
+  it('keeps a file tree path that is not valid UTF-8', () => {
+    // Inside `info`: a re-encode would re-spell it, and move both infohashes.
+    const badPath = Buffer.from([0x66, 0xff, 0x6f]);
+    const tree = dictOf([[badPath, dictOf([['', enc({ length: 1, 'pieces root': ROOT })]])]]);
+    const info = dictOf([['file tree', tree], ['meta version', raw('i2e')], ['name', bstr('x')], ['private', raw('i1e')]]);
+    const out = normalizeUploadedTorrent(dictOf([['info', info]]));
+    expect(infoBytes(out).equals(info)).toBe(true);
+  });
+
+  it('sorts the keys a careless encoder left out of order, at every depth', () => {
+    // The decode → encode it replaces did this as a side effect; without it the
+    // same release hashed apart from the row stored before, and dodged the
+    // duplicate check.
+    const sortedInfo = enc({ length: 5, name: Buffer.from('a'), 'piece length': 16384, pieces: Buffer.alloc(20), private: 1 });
+    const unsortedInfo = dictOf([
+      ['private', raw('i1e')],
+      ['pieces', bstr(Buffer.alloc(20))],
+      ['name', bstr('a')],
+      ['piece length', raw('i16384e')],
+      ['length', raw('i5e')],
+    ]);
+    const out = normalizeUploadedTorrent(dictOf([['info', unsortedInfo], ['creation date', raw('i1e')]]));
+    expect(infoBytes(out).equals(sortedInfo)).toBe(true);
+    expect(out.equals(enc(bencode.decode(out)))).toBe(true); // canonical as a whole
+  });
+
+  it('sorts binary piece layer keys by their raw bytes, and keeps them raw', () => {
+    const low = Buffer.alloc(32, 0x81);
+    const high = Buffer.alloc(32, 0xf1);
+    const file = dictOf([
+      ['info', hybridInfo({ private: 1 })],
+      ['piece layers', dictOf([[high, bstr(LAYER)], [low, bstr(LAYER)]])],
+    ]);
+    const out = normalizeUploadedTorrent(file);
+    const layers = dictEntries(out, dictEntries(out)!.entries.find((e) => e.key.toString() === 'piece layers')!.valueStart)!;
+    expect(layers.entries.map((e) => e.key)).toEqual([low, high]);
+  });
+
+  it('keeps the last value of a repeated key, as the decoder did', () => {
+    const info = dictOf([['name', bstr('first')], ['name', bstr('second')], ['private', raw('i1e')]]);
+    const out = normalizeUploadedTorrent(dictOf([['info', info]]));
+    expect(infoBytes(out).equals(enc({ name: Buffer.from('second'), private: 1 }))).toBe(true);
+  });
+
+  it('throws on anything it cannot walk', () => {
+    expect(() => normalizeUploadedTorrent(raw('not bencode'))).toThrow();
+    expect(() => normalizeUploadedTorrent(dictOf([['name', bstr('no info')]]))).toThrow();
+    expect(() => normalizeUploadedTorrent(dictOf([['info', bstr('not a dict')]]))).toThrow();
+    expect(() => normalizeUploadedTorrent(raw('d4:infod4:name1:a'))).toThrow();
+  });
+});
+
+describe('personalizeTorrent', () => {
+  it('writes the member announce and tiers without touching info or piece layers', () => {
+    const file = hybridFile(ROOT, hybridInfo({ private: 1 }));
+    const out = personalizeTorrent(file, 'http://us/announce?passkey=mine', [
+      ['http://us/announce?passkey=mine'],
+      ['udp://us:6969/announce/mine'],
+    ]);
+    const d = bencode.decode(out) as Record<string, unknown>;
+    expect(Buffer.from(d.announce as Uint8Array).toString()).toBe('http://us/announce?passkey=mine');
+    expect((d['announce-list'] as Uint8Array[][]).map((t) => t.map((u) => Buffer.from(u).toString()))).toEqual([
+      ['http://us/announce?passkey=mine'],
+      ['udp://us:6969/announce/mine'],
+    ]);
+    expect(out.toString('latin1')).not.toContain('deadbeef');
+    expect(infoBytes(out).equals(infoBytes(file))).toBe(true);
+    expect(out.includes(Buffer.concat([raw('32:'), ROOT, bstr(LAYER)]))).toBe(true);
+  });
+
+  it('strips the uploader fields of a row stored before the upload did', () => {
+    const file = dictOf([
+      ['comment', bstr('x')],
+      ['info', enc({ name: Buffer.from('a'), private: 1 })],
+      ['url-list', enc([Buffer.from('http://webseed')])],
+    ]);
+    const out = personalizeTorrent(file, 'http://us/a', [['http://us/a']]);
+    expect(Object.keys(bencode.decode(out) as object)).toEqual(['announce', 'announce-list', 'info']);
+  });
+});
+
+describe('cleanStoredTorrent', () => {
+  it('turns hex-spelled piece layer keys back into the roots they name', () => {
+    const stored = hybridFile(Buffer.from(ROOT.toString('hex')), hybridInfo({ private: 1 }));
+    const out = cleanStoredTorrent(stored)!;
+    expect(out).not.toBeNull();
+    expect(out.includes(Buffer.concat([raw('32:'), ROOT, bstr(LAYER)]))).toBe(true);
+    expect(out.toString('latin1')).not.toContain('passkey');
+    expect(infoBytes(out).equals(infoBytes(stored))).toBe(true);
+  });
+
+  it('leaves a 64-character key that is no root of this torrent', () => {
+    const stranger = Buffer.from(Buffer.alloc(32, 0x7e).toString('hex'));
+    const stored = dictOf([
+      ['info', hybridInfo({ private: 1 })],
+      ['piece layers', dictOf([[stranger, bstr(LAYER)]])],
+    ]);
+    expect(cleanStoredTorrent(stored)).toBeNull();
+  });
+
+  it('returns null for a row that needs nothing, or cannot be walked', () => {
+    expect(cleanStoredTorrent(dictOf([['info', enc({ name: Buffer.from('a'), private: 1 })]]))).toBeNull();
+    expect(cleanStoredTorrent(raw('garbage'))).toBeNull();
+  });
+
+  it('never touches info, not even a missing private flag', () => {
+    const info = enc({ name: Buffer.from('a') });
+    const out = cleanStoredTorrent(dictOf([['announce', bstr('http://x')], ['info', info]]))!;
+    expect(infoBytes(out).equals(info)).toBe(true);
+  });
+});
+
+describe('personalAnnounceUrls', () => {
+  const cfg = { httpUrl: 'https://t.example/announce', udpUrl: 'udp://t.example:6969/announce/', udpEnabled: true };
+
+  it('puts HTTP and UDP in their own tiers', () => {
+    const r = personalAnnounceUrls('pk', cfg);
+    expect(r.announce).toBe('https://t.example/announce?passkey=pk');
+    expect(r.tiers).toEqual([['https://t.example/announce?passkey=pk'], ['udp://t.example:6969/announce/pk']]);
+  });
+
+  it('leaves UDP out when the tracker does not serve it, or no URL is set', () => {
+    expect(personalAnnounceUrls('pk', { ...cfg, udpEnabled: false }).tiers).toHaveLength(1);
+    expect(personalAnnounceUrls('pk', { ...cfg, udpUrl: '' }).tiers).toHaveLength(1);
+  });
+});
+
+describe('trackerUdpEnabled', () => {
+  const saved = process.env.TRACKER_UDP_ENABLED;
+  afterEach(() => {
+    if (saved === undefined) delete process.env.TRACKER_UDP_ENABLED;
+    else process.env.TRACKER_UDP_ENABLED = saved;
+  });
+
+  it('reads the variable exactly as the tracker does', () => {
+    delete process.env.TRACKER_UDP_ENABLED;
+    expect(trackerUdpEnabled()).toBe(true);
+    process.env.TRACKER_UDP_ENABLED = '';
+    expect(trackerUdpEnabled()).toBe(true);
+    process.env.TRACKER_UDP_ENABLED = 'true';
+    expect(trackerUdpEnabled()).toBe(true);
+    process.env.TRACKER_UDP_ENABLED = 'false';
+    expect(trackerUdpEnabled()).toBe(false);
+    process.env.TRACKER_UDP_ENABLED = '1';
+    expect(trackerUdpEnabled()).toBe(false);
+  });
+});
diff --git a/apps/api/utils/account/loginLog.ts b/apps/api/utils/account/loginLog.ts
index b169bdf5..b03d6c0b 100644
--- a/apps/api/utils/account/loginLog.ts
+++ b/apps/api/utils/account/loginLog.ts
@@ -7,10 +7,10 @@
  *
  * ## Why failures are recorded
  *
- * The failed attempt is the more useful half. There is no per-account lockout
- * on this site — throttling is entirely per IP, so an attempt spread across
- * addresses meets nothing at all — and this table is what makes such an attempt
- * visible afterwards even though nothing stopped it at the time.
+ * The failed attempt is the more useful half. A guesser spread across many
+ * addresses meets only the per-account counter (`assertAccountNotLocked`),
+ * which slows them without saying who they are; this table is what makes such
+ * an attempt visible afterwards.
  *
  * ## The User-Agent is truncated
  *
diff --git a/apps/api/utils/announceUrls.ts b/apps/api/utils/announceUrls.ts
new file mode 100644
index 00000000..c940b44c
--- /dev/null
+++ b/apps/api/utils/announceUrls.ts
@@ -0,0 +1,71 @@
+/**
+ * The announce URLs a member's `.torrent` carries — one builder for both
+ * download routes, so a file grabbed through Torznab and one clicked on the
+ * site advertise the same trackers. Torznab used to write `announce` alone, so a
+ * torrent fetched by an *arr app never got the UDP tier even where it was served.
+ */
+
+/**
+ * Whether the tracker serves BEP 15, read exactly as the tracker reads it
+ * (`getEnvDefault("TRACKER_UDP_ENABLED", "true") == "true"` in
+ * `apps/tracker/internal/config`): unset or empty means on, and anything but
+ * the literal `true` means off. The API, the public stats and the `.torrent`
+ * files only agree with the listener if the deployment hands this process the
+ * same variable — the packaged Compose file and Helm chart now do.
+ */
+export function trackerUdpEnabled(): boolean {
+  const v = process.env.TRACKER_UDP_ENABLED;
+  return (v ? v : 'true') === 'true';
+}
+
+export interface AnnounceConfig {
+  /** `NUXT_PUBLIC_TRACKER_HTTP_URL`. */
+  httpUrl: string;
+  /** `NUXT_PUBLIC_TRACKER_UDP_URL`, possibly empty. */
+  udpUrl: string;
+  /** `trackerUdpEnabled()`. */
+  udpEnabled: boolean;
+}
+
+/**
+ * `announce` and the BEP 12 `announce-list` for one member.
+ *
+ * HTTP (always present): `…/announce?passkey=…` — the canonical form every BT
+ * client understands.
+ *
+ * UDP (BEP 15), only when the tracker serves it AND a URL is configured: the
+ * passkey goes in as a trailing path segment — `udp://host:6969/announce/PASSKEY`
+ * — because BEP 15 has no passkey field and the UDP tracker pulls it out of the
+ * BEP 41 URL_DATA option that libtorrent, qBittorrent and Transmission send for
+ * the path. Advertising a UDP endpoint nobody serves is worse than leaving it
+ * out: a client that prefers UDP backs off the working HTTP tracker every
+ * announce, which breaks ratio in subtle ways.
+ *
+ * HTTP and UDP sit in their own tiers so a client announces to both rather than
+ * treating one as the other's fallback — how every multi-protocol tracker we
+ * cribbed from (opentrackr, AnimeBytes…) advertises itself.
+ */
+export function personalAnnounceUrls(
+  passkey: string,
+  cfg: AnnounceConfig,
+): { announce: string; tiers: string[][] } {
+  const httpUrl = new URL(cfg.httpUrl);
+  httpUrl.searchParams.set('passkey', passkey);
+  const announce = httpUrl.toString();
+  const tiers: string[][] = [[announce]];
+
+  if (cfg.udpEnabled && cfg.udpUrl) {
+    try {
+      const udpUrl = new URL(cfg.udpUrl);
+      // A trailing slash on the configured path would double the separator.
+      const basePath = udpUrl.pathname.replace(/\/+$/, '') || '/announce';
+      udpUrl.pathname = `${basePath}/${passkey}`;
+      tiers.push([udpUrl.toString()]);
+    } catch {
+      // A misconfigured UDP URL must not cost the member their download.
+      console.warn('[download] invalid trackerUdpUrl, skipping UDP announce-list entry:', cfg.udpUrl);
+    }
+  }
+
+  return { announce, tiers };
+}
diff --git a/apps/api/utils/bencodeScan.ts b/apps/api/utils/bencodeScan.ts
new file mode 100644
index 00000000..2e0d8e81
--- /dev/null
+++ b/apps/api/utils/bencodeScan.ts
@@ -0,0 +1,111 @@
+/**
+ * A bencode scanner that walks structure without interpreting it: it does not
+ * need to understand a single value, only where each one ends.
+ *
+ * Two kinds of caller need exactly that. An infohash — v1 or v2 — is the hash of
+ * the ORIGINAL bytes of the info dict, so `infoDictRange` locates them rather
+ * than re-encoding a decoded value. And every rewrite of a `.torrent`
+ * (`torrentBytes`) splices byte ranges instead of decoding and re-encoding,
+ * because `bencode@4` re-spells in hex any dictionary key that is not valid
+ * UTF-8, and the keys of a BEP 52 `piece layers` dict never are.
+ *
+ * Everything is bounded by the buffer length on every path, so a hostile file
+ * cannot make it loop.
+ */
+
+/**
+ * Nothing legitimate nests past a handful of levels. The walk cannot loop —
+ * every step is forward — but it recurses once per level, and a file nesting
+ * fifteen thousand containers used to blow the stack on the upload path, where
+ * the `RangeError` reached the member as a 500 instead of "this file cannot be
+ * read".
+ */
+export const MAX_DEPTH = 64;
+
+const D = 0x64; // d
+const L = 0x6c; // l
+const I = 0x69; // i
+const E = 0x65; // e
+const COLON = 0x3a;
+
+/**
+ * Index one past the bencoded value that starts at `i`, or -1 when it is
+ * malformed, truncated or nested too deep.
+ */
+export function skipValue(bytes: Buffer, i: number, depth = 0): number {
+  if (i >= bytes.length || depth > MAX_DEPTH) return -1;
+  const c = bytes[i]!;
+
+  // Integer: `i<digits>e`, optionally negative. Leading zeros and `-0` are
+  // tolerated — BEP 3 forbids them, but a file stored years ago may carry one,
+  // and refusing it here would make that torrent undownloadable — while
+  // anything that is not a digit is malformed.
+  if (c === I) {
+    const e = bytes.indexOf(E, i + 1);
+    if (e === -1) return -1;
+    return /^-?[0-9]+$/.test(bytes.toString('latin1', i + 1, e)) ? e + 1 : -1;
+  }
+
+  // Dict or list: walk until the matching `e`.
+  if (c === D || c === L) {
+    let j = i + 1;
+    while (j < bytes.length && bytes[j] !== E) {
+      const next = skipValue(bytes, j, depth + 1);
+      if (next <= j) return -1; // no progress, or too deep: malformed
+      j = next;
+    }
+    return j < bytes.length ? j + 1 : -1;
+  }
+
+  // Byte string: `<length>:<bytes>`. Digits only — a leading `-` or a missing
+  // colon is malformed, not a negative length.
+  if (c >= 0x30 && c <= 0x39) {
+    const colon = bytes.indexOf(COLON, i);
+    if (colon === -1) return -1;
+    const digits = bytes.toString('latin1', i, colon);
+    if (!/^[0-9]+$/.test(digits)) return -1;
+    // A 20-digit length parses to something past any real buffer; the bound
+    // below rejects it either way.
+    const end = colon + 1 + Number.parseInt(digits, 10);
+    return end <= bytes.length ? end : -1;
+  }
+
+  return -1;
+}
+
+export interface DictEntry {
+  /** The key's raw bytes — never decoded, so never re-spelled. */
+  key: Buffer;
+  /** Where the entry starts: the key's length prefix. */
+  start: number;
+  /** Where its value starts, one past the key. */
+  valueStart: number;
+  /** One past its value. */
+  end: number;
+}
+
+/**
+ * The entries of the dict that starts at `start`, in file order, and the index
+ * one past its closing `e`. Null for anything that is not a well-formed dict.
+ */
+export function dictEntries(
+  bytes: Buffer,
+  start = 0,
+): { entries: DictEntry[]; end: number } | null {
+  if (start >= bytes.length || bytes[start] !== D) return null;
+  const entries: DictEntry[] = [];
+  let i = start + 1;
+  while (i < bytes.length && bytes[i] !== E) {
+    // Every key in a bencoded dict is a byte string.
+    if (bytes[i]! < 0x30 || bytes[i]! > 0x39) return null;
+    const keyEnd = skipValue(bytes, i);
+    if (keyEnd <= i) return null;
+    const colon = bytes.indexOf(COLON, i);
+    if (colon === -1 || colon >= keyEnd) return null;
+    const end = skipValue(bytes, keyEnd);
+    if (end <= keyEnd) return null;
+    entries.push({ key: bytes.subarray(colon + 1, keyEnd), start: i, valueStart: keyEnd, end });
+    i = end;
+  }
+  return i < bytes.length ? { entries, end: i + 1 } : null;
+}
diff --git a/apps/api/utils/bittorrentV2.ts b/apps/api/utils/bittorrentV2.ts
index a0602c0c..191223b6 100644
--- a/apps/api/utils/bittorrentV2.ts
+++ b/apps/api/utils/bittorrentV2.ts
@@ -37,6 +37,7 @@
  */
 import bencode from 'bencode';
 import { createHash } from 'node:crypto';
+import { skipValue } from '~~/utils/bencodeScan';
 
 export interface V2Content {
   /** SHA-256 of the bencoded `info` dict, hex. Torrent-specific (hybrid announce). */
@@ -135,10 +136,10 @@ function collectRoots(
  * a member with an unusual client whose hybrid torrent announces into a swarm
  * that does not exist, on a site where every other hybrid torrent works.
  *
- * So the bytes are located instead. This is a bencode scanner that walks
- * structure without interpreting it — it does not need to understand a single
- * value, only where each one ends — and returns the half-open range of the
- * top-level `info` value.
+ * So the bytes are located instead, with the scanner in `bencodeScan`, which
+ * walks structure without interpreting it — it does not need to understand a
+ * single value, only where each one ends — and this returns the half-open range
+ * of the top-level `info` value.
  *
  * Returns null for anything it cannot walk: a truncated file, a non-dict root,
  * no `info` key. Bounded by the buffer length on every path, so a hostile file
@@ -147,68 +148,19 @@ function collectRoots(
 export function infoDictRange(
   bytes: Buffer
 ): { start: number; end: number } | null {
-  /**
-   * `skip` returns the index one past the value that starts at `i`, or -1.
-   *
-   * `depth` is the bound the comment above did not have. The walk cannot loop —
-   * every step is forward — but it recurses once per nesting level, so a file
-   * with fifteen thousand nested containers before the `info` key blew the
-   * stack, and `extractV2` is called without a try/catch on the upload path: a
-   * `RangeError` reached the member as a 500 instead of "this file cannot be
-   * read". Nothing legitimate nests past a handful of levels.
-   */
-  const MAX_DEPTH = 64;
-  const skip = (i: number, depth = 0): number => {
-    if (i >= bytes.length || depth > MAX_DEPTH) return -1;
-    const c = bytes[i]!;
-
-    // Integer: `i<digits>e`.
-    if (c === 0x69 /* i */) {
-      const e = bytes.indexOf(0x65 /* e */, i + 1);
-      return e === -1 ? -1 : e + 1;
-    }
-
-    // Dict or list: recurse until the matching `e`.
-    if (c === 0x64 /* d */ || c === 0x6c /* l */) {
-      let j = i + 1;
-      while (j < bytes.length && bytes[j] !== 0x65 /* e */) {
-        const next = skip(j, depth + 1);
-        if (next <= j) return -1; // no progress, or too deep: malformed
-        j = next;
-      }
-      return j < bytes.length ? j + 1 : -1;
-    }
-
-    // Byte string: `<length>:<bytes>`. Digits only — a leading `-` or a
-    // missing colon is malformed, not a negative length.
-    if (c >= 0x30 && c <= 0x39) {
-      const colon = bytes.indexOf(0x3a /* : */, i);
-      if (colon === -1) return -1;
-      const digits = bytes.toString('latin1', i, colon);
-      if (!/^[0-9]+$/.test(digits)) return -1;
-      const len = Number.parseInt(digits, 10);
-      // `Number.parseInt` on a 20-digit length yields something past any real
-      // buffer; the bound below rejects it either way.
-      const end = colon + 1 + len;
-      return end <= bytes.length ? end : -1;
-    }
-
-    return -1;
-  };
-
   if (bytes.length < 2 || bytes[0] !== 0x64 /* d */) return null;
 
   let i = 1;
   while (i < bytes.length && bytes[i] !== 0x65 /* e */) {
     // Every key in a bencoded dict is a byte string.
     const keyStart = i;
-    const keyEnd = skip(keyStart);
+    const keyEnd = skipValue(bytes, keyStart);
     if (keyEnd <= keyStart) return null;
     const colon = bytes.indexOf(0x3a /* : */, keyStart);
     if (colon === -1 || colon >= keyEnd) return null;
     const key = bytes.toString('latin1', colon + 1, keyEnd);
 
-    const valEnd = skip(keyEnd);
+    const valEnd = skipValue(bytes, keyEnd);
     if (valEnd <= keyEnd) return null;
 
     if (key === 'info') return { start: keyEnd, end: valEnd };
diff --git a/apps/api/utils/bonusEvents.ts b/apps/api/utils/bonusEvents.ts
index f6aebe5b..e9ef24a6 100644
--- a/apps/api/utils/bonusEvents.ts
+++ b/apps/api/utils/bonusEvents.ts
@@ -56,11 +56,11 @@ export interface ActiveBonusEventSnapshot {
 }
 
 const ACTIVE_KEY = 'bonus:active';
-// Long TTL — the snapshot is the canonical source for the tracker
-// between mutations, but we re-stamp on every admin write and on every
-// /api/bonus/active read, so a stale value can only persist if both
-// fail. 5 minutes balances "self-heal quickly" against "don't thrash
-// Redis on a quiet site".
+// The snapshot is the canonical source for the tracker between mutations.
+// `plugins/bonus-event-sync` re-stamps it every minute; admin writes and a
+// read that finds it expired do too. The TTL only bounds how long a snapshot
+// outlives an API that stopped re-stamping it — reads alone never kept it
+// alive, which is how an event used to lapse on a quiet night.
 const ACTIVE_TTL_S = 5 * 60;
 
 /**
diff --git a/apps/api/utils/channels/smtp.ts b/apps/api/utils/channels/smtp.ts
index 4435d0a8..62635c27 100644
--- a/apps/api/utils/channels/smtp.ts
+++ b/apps/api/utils/channels/smtp.ts
@@ -56,6 +56,8 @@ async function getTransporter(server: SmtpServer) {
 // interpolated into `href="…"` below, and an unescaped quote would end
 // the attribute early and let the rest be read as markup.
 function escapeHtml(s: string): string {
+  // Complete for HTML text and double-quoted attributes.
+  // nosemgrep: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization
   return s
     .replaceAll('&', '&amp;')
     .replaceAll('<', '&lt;')
diff --git a/apps/api/utils/channels/telegram.ts b/apps/api/utils/channels/telegram.ts
index cac5b24a..3b1c1ddd 100644
--- a/apps/api/utils/channels/telegram.ts
+++ b/apps/api/utils/channels/telegram.ts
@@ -27,11 +27,17 @@ interface TelegramUser {
   chatId: string;
 }
 
+// `"` too: the result also lands in `href="…"` below, where an unescaped quote
+// ends the attribute early. `&quot;` is one of the four named entities
+// Telegram's HTML mode accepts (with `&lt;`, `&gt;`, `&amp;`); the apostrophe
+// needs none, the only attribute below being double-quoted.
 function escapeHtml(s: string): string {
+  // nosemgrep: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization
   return s
     .replaceAll('&', '&amp;')
     .replaceAll('<', '&lt;')
-    .replaceAll('>', '&gt;');
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;');
 }
 
 function renderHtml(payload: NotificationPayload): string {
diff --git a/apps/api/utils/credentialRewrap.ts b/apps/api/utils/credentialRewrap.ts
new file mode 100644
index 00000000..8d3469bc
--- /dev/null
+++ b/apps/api/utils/credentialRewrap.ts
@@ -0,0 +1,84 @@
+/**
+ * Re-encrypts the account secrets that are not under the current key yet:
+ * login verifiers and TOTP seeds still in plaintext from before encryption at
+ * rest, and values readable only through `CREDENTIAL_ENCRYPTION_KEY_PREVIOUS`.
+ *
+ * Those used to move only when their owner next logged in. A dormant account
+ * therefore kept its verifier in clear — and the verifier is the credential:
+ * a database dump alone was enough to sign in as that member, the very thing
+ * encryption at rest was added to stop (SECURITY-REVIEW.md, H1). A key rotation
+ * waited on the same logins before the previous key could be dropped.
+ *
+ * The cursor is keyed on the current key's check value, so a rotation starts a
+ * fresh walk on its own. Each write is conditional on the value it read, so a
+ * password change or a TOTP enrolment landing in between is never overwritten.
+ * Suspended during panic: panic ciphertext has the same `iv:ct:tag` shape, and
+ * re-encrypting it under another key would leave the restore nothing to
+ * decrypt.
+ */
+import { db, schema } from '@trackarr/db';
+import { and, asc, eq, gt } from 'drizzle-orm';
+import {
+  decryptSecret,
+  encryptSecret,
+  encryptSecretRequired,
+  keyCheckValue,
+  needsRewrite,
+} from '~~/utils/credentialSecrets';
+import { getSetting, setSetting } from '~~/utils/server';
+import { panicActive } from '~~/utils/panicLock';
+
+const BATCH_SIZE = 500;
+
+export function rewrapCursorKey(): string {
+  return `credential_rewrap_cursor:${keyCheckValue()}`;
+}
+
+/** One batch of the sweep. Exported for the integration suite. */
+export async function rewrapCredentialsTick(): Promise<{ processed: number; rewritten: number }> {
+  if (await panicActive()) return { processed: 0, rewritten: 0 };
+  const cursorKey = rewrapCursorKey();
+  const cursor = (await getSetting(cursorKey)) ?? '';
+
+  const rows = await db
+    .select({
+      id: schema.users.id,
+      authVerifier: schema.users.authVerifier,
+      totpSecret: schema.users.totpSecret,
+    })
+    .from(schema.users)
+    .where(gt(schema.users.id, cursor))
+    .orderBy(asc(schema.users.id))
+    .limit(BATCH_SIZE);
+
+  if (!rows.length) return { processed: 0, rewritten: 0 };
+
+  let rewritten = 0;
+  for (const row of rows) {
+    if (row.authVerifier && needsRewrite(row.authVerifier)) {
+      const plain = decryptSecret(row.authVerifier);
+      // Null: under no key this instance holds. Left alone — the login fails
+      // closed on it already, and rewriting it would destroy the evidence.
+      if (plain) {
+        await db
+          .update(schema.users)
+          .set({ authVerifier: encryptSecretRequired(plain) })
+          .where(and(eq(schema.users.id, row.id), eq(schema.users.authVerifier, row.authVerifier)));
+        rewritten += 1;
+      }
+    }
+    if (row.totpSecret && needsRewrite(row.totpSecret)) {
+      const plain = decryptSecret(row.totpSecret);
+      if (plain) {
+        await db
+          .update(schema.users)
+          .set({ totpSecret: encryptSecret(plain) })
+          .where(and(eq(schema.users.id, row.id), eq(schema.users.totpSecret, row.totpSecret)));
+        rewritten += 1;
+      }
+    }
+  }
+
+  await setSetting(cursorKey, rows[rows.length - 1]!.id);
+  return { processed: rows.length, rewritten };
+}
diff --git a/apps/api/utils/federation/config.ts b/apps/api/utils/federation/config.ts
index 01dc51fc..dbaa61ae 100644
--- a/apps/api/utils/federation/config.ts
+++ b/apps/api/utils/federation/config.ts
@@ -16,8 +16,8 @@ import {
   type FederationConfig,
 } from '@trackarr/db/schema';
 import { encryptJson, decryptJson } from '../channelSecrets';
-import { redis } from '../server';
 import { generateInstanceKeypair } from './keys';
+import { panicActive } from '../panicLock';
 
 const SINGLETON = 'singleton';
 
@@ -158,32 +158,11 @@ export function syncIntervalMs(): number {
  * every partner then ingested over good data), while the S2S endpoints kept
  * serving the catalogue.
  *
- * This is the one flag that gates all of it. Read through a short Redis cache
- * because it is now consulted on the hot serving path; a stale value costs at
- * most `PANIC_CACHE_TTL_S` seconds of the very thing panic is racing to stop,
- * which is why the window is small. On any Redis error it falls back to the
- * database rather than failing open — panic must not be defeated by a cache
- * miss.
+ * This is the one flag that gates all of it — and it is panic itself, phases
+ * included, as `utils/panicLock` defines it: `is_encrypted` alone stayed false
+ * for the whole `encrypting` phase, during which the mint loop published records
+ * of torrents already encrypted.
  */
-const PANIC_CACHE_KEY = 'federation:panic:suspended';
-const PANIC_CACHE_TTL_S = 5;
-
 export async function federationSuspended(): Promise<boolean> {
-  try {
-    const cached = await redis.get(PANIC_CACHE_KEY);
-    if (cached !== null) return cached === '1';
-  } catch {
-    /* fall through to the database */
-  }
-  const [row] = await db
-    .select({ isEncrypted: schema.panicState.isEncrypted })
-    .from(schema.panicState)
-    .limit(1);
-  const suspended = !!row?.isEncrypted;
-  try {
-    await redis.setex(PANIC_CACHE_KEY, PANIC_CACHE_TTL_S, suspended ? '1' : '0');
-  } catch {
-    /* best effort */
-  }
-  return suspended;
+  return panicActive();
 }
diff --git a/apps/api/utils/hnr.ts b/apps/api/utils/hnr.ts
index d6f49d9c..d25ed922 100644
--- a/apps/api/utils/hnr.ts
+++ b/apps/api/utils/hnr.ts
@@ -1,5 +1,5 @@
 import { db, schema } from '@trackarr/db';
-import { eq, and, lt, sql } from 'drizzle-orm';
+import { eq, and, gt, lt, sql } from 'drizzle-orm';
 import { randomUUID } from 'crypto';
 import {
   isHnrEnabled,
@@ -119,6 +119,11 @@ export async function checkAndMarkHnrs(): Promise<number> {
   // - Not yet completed
   // - Not exempt
   // - Not already marked as HnR
+  // - Something was actually downloaded. The row is born when the member
+  //   clicks Download (`recordDownloadClick`), before any byte moves; a member
+  //   who clicked and never started the torrent took nothing from the swarm,
+  //   and this sweep now runs on its own (`plugins/hnr-sweep`), not only when
+  //   a moderator asks.
   const result = await db
     .update(schema.hnrTracking)
     .set({ isHnr: true })
@@ -127,7 +132,8 @@ export async function checkAndMarkHnrs(): Promise<number> {
         eq(schema.hnrTracking.isHnr, false),
         eq(schema.hnrTracking.isExempt, false),
         sql`${schema.hnrTracking.completedAt} IS NULL`,
-        lt(schema.hnrTracking.downloadedAt, cutoffDate)
+        lt(schema.hnrTracking.downloadedAt, cutoffDate),
+        gt(schema.hnrTracking.downloaded, 0)
       )
     )
     .returning();
diff --git a/apps/api/utils/irc/format.ts b/apps/api/utils/irc/format.ts
index 3fe09e26..13f1856c 100644
--- a/apps/api/utils/irc/format.ts
+++ b/apps/api/utils/irc/format.ts
@@ -331,6 +331,8 @@ export function announcePattern(template: string): AnnouncePattern {
  * shipped pattern instead of a lookalike.
  */
 export function toJsRegExp(pattern: string): RegExp {
+  // Built by announcePattern from escaped literals and named groups, never typed in as a regex.
+  // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
   return new RegExp(pattern.replace(/\(\?P</g, '(?<'));
 }
 
diff --git a/apps/api/utils/knownDevices.ts b/apps/api/utils/knownDevices.ts
new file mode 100644
index 00000000..d33f9ca3
--- /dev/null
+++ b/apps/api/utils/knownDevices.ts
@@ -0,0 +1,203 @@
+/**
+ * Known-device cookies: the per-account sign-in lockout, minus the member's own
+ * browsers.
+ *
+ * Ten failed sign-ins in fifteen minutes hold a username out of password
+ * sign-in from every address (`assertAccountNotLocked`). That is what stops a
+ * guess spread over many addresses, and it let anyone who knows a username —
+ * on a tracker, everyone — keep its owner out with one failure every ninety
+ * seconds, the right password included.
+ *
+ * A browser that completes a sign-in gets this cookie. It vouches for nothing
+ * but "this browser has proven this account's password before", so it skips
+ * nothing: not the password, not the second factor, not the per-address limit.
+ * What it changes is which counter a sign-in answers to — the device's own
+ * instead of the account's. A stranger failing on purpose can still hold the
+ * account shut to new devices; no longer to the member's usual ones. Guessing
+ * meets the same wall as before, since a guesser never holds a valid cookie.
+ *
+ * Not to be confused with `trustedDevices.ts`, which is opt-in, stored in the
+ * database, and DOES skip the second factor.
+ *
+ * Stateless: the value is an HMAC over the account id, `users.session_epoch`,
+ * a fingerprint of the stored verifier, a random device id and the issue time.
+ * So "sign out everywhere" and a ban (the epoch) revoke every such cookie at
+ * once, and so does a password change (the verifier). Server side, only Redis
+ * keeps anything: a failure counter per device id, and the ids revoked after
+ * ten failures — a stolen cookie is worth ten guesses, once.
+ */
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import type { H3Event } from 'h3';
+import { eq } from 'drizzle-orm';
+import { db } from '@trackarr/db';
+import { users } from '@trackarr/db/schema';
+import { redis } from './server';
+
+export const KNOWN_DEVICE_COOKIE = 'trackarr_kd';
+
+/** Long enough to outlive the seven-day session many times over. */
+export const KNOWN_DEVICE_TTL_S = 180 * 24 * 60 * 60;
+
+/** How far in the future an issue time may sit: clock skew between replicas. */
+const FUTURE_SKEW_S = 5 * 60;
+
+// Same window and threshold as the account's own counter.
+const DEVICE_FAILURE_WINDOW_S = 15 * 60;
+const DEVICE_MAX_FAILURES = 10;
+
+const failureKey = (deviceId: string) => `ratelimit:signin-fail-device:${deviceId}`;
+const revokedKey = (deviceId: string) => `known-device:revoked:${deviceId}`;
+
+/** What a cookie is bound to. Any of these changing voids it. */
+export interface KnownDeviceSubject {
+  userId: string;
+  sessionEpoch: number | null | undefined;
+  /** The stored column as is, ciphertext included: it changes when the password does. */
+  authVerifier: string | null | undefined;
+}
+
+const VALUE = /^v1\.([A-Za-z0-9_-]{22})\.(\d{1,12})\.([A-Za-z0-9_-]{43})$/;
+
+let cachedKey: { secret: string; key: Buffer } | null = null;
+
+/** A key of its own, derived from the session secret rather than reusing it as is. */
+function signingKey(): Buffer {
+  const secret = process.env.NUXT_SESSION_SECRET;
+  if (!secret || secret.length < 32) {
+    throw new Error('NUXT_SESSION_SECRET must be set and at least 32 characters long');
+  }
+  if (cachedKey?.secret !== secret) {
+    cachedKey = {
+      secret,
+      key: createHmac('sha256', secret).update('trackarr known-device cookie v1').digest(),
+    };
+  }
+  return cachedKey.key;
+}
+
+function mac(subject: KnownDeviceSubject, deviceId: string, issuedAt: number): string {
+  const credential = createHash('sha256')
+    .update(subject.authVerifier ?? '')
+    .digest('base64url');
+  return createHmac('sha256', signingKey())
+    .update(
+      `known-device|${subject.userId}|${subject.sessionEpoch ?? 0}|${credential}|${deviceId}|${issuedAt}`,
+    )
+    .digest('base64url');
+}
+
+/** The cookie value for `subject`. Exported for the tests. */
+export function encodeKnownDevice(
+  subject: KnownDeviceSubject,
+  deviceId: string,
+  issuedAt: number,
+): string {
+  return `v1.${deviceId}.${issuedAt}.${mac(subject, deviceId, issuedAt)}`;
+}
+
+/**
+ * The device id `value` carries, if it was issued for `subject` and has not
+ * outlived its life. Format, signature and age only: revocation is Redis's
+ * business, see `knownDeviceFor`.
+ */
+export function verifyKnownDevice(
+  value: string | null | undefined,
+  subject: KnownDeviceSubject,
+  now: number = Math.floor(Date.now() / 1000),
+): string | null {
+  const m = value ? VALUE.exec(value) : null;
+  if (!m) return null;
+  const [, deviceId = '', issued = '', given = ''] = m;
+  const issuedAt = Number(issued);
+  if (issuedAt > now + FUTURE_SKEW_S || now - issuedAt > KNOWN_DEVICE_TTL_S) return null;
+  const expected = Buffer.from(mac(subject, deviceId, issuedAt));
+  const actual = Buffer.from(given);
+  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) return null;
+  return deviceId;
+}
+
+/**
+ * The device id of a valid, unrevoked known-device cookie for `username`, or
+ * null. Reads the account only when there is a cookie to check, so a sign-in
+ * without one costs nothing more than before.
+ *
+ * Fails closed on a Redis error: a device whose revocation cannot be checked is
+ * treated as unknown, which is what every browser was before this existed.
+ */
+export async function knownDeviceFor(
+  value: string | null | undefined,
+  username: string,
+): Promise<string | null> {
+  if (!value || !VALUE.test(value)) return null;
+  const user = await db
+    .select({ id: users.id, sessionEpoch: users.sessionEpoch, authVerifier: users.authVerifier })
+    .from(users)
+    .where(eq(users.username, username))
+    .limit(1)
+    .then((r) => r[0]);
+  if (!user) return null;
+  const deviceId = verifyKnownDevice(value, {
+    userId: user.id,
+    sessionEpoch: user.sessionEpoch,
+    authVerifier: user.authVerifier,
+  });
+  if (!deviceId) return null;
+  try {
+    if (await redis.exists(revokedKey(deviceId))) return null;
+  } catch {
+    return null;
+  }
+  return deviceId;
+}
+
+/** `knownDeviceFor` on the cookie this request carries. */
+export function readKnownDevice(event: H3Event, username: string): Promise<string | null> {
+  return knownDeviceFor(getCookie(event, KNOWN_DEVICE_COOKIE), username);
+}
+
+/**
+ * One failed sign-in from a known device. The tenth inside the window revokes
+ * its id for good: from then on the browser is unknown, and answers to the
+ * account's counter like any other.
+ */
+export async function recordKnownDeviceFailure(deviceId: string): Promise<void> {
+  const key = failureKey(deviceId);
+  const now = Date.now();
+  try {
+    const results = await redis
+      .multi()
+      .zadd(key, now, `${now}:${randomBytes(6).toString('hex')}`)
+      .zremrangebyscore(key, 0, now - DEVICE_FAILURE_WINDOW_S * 1000)
+      .expire(key, DEVICE_FAILURE_WINDOW_S)
+      .zcard(key)
+      .exec();
+    // [error, reply] per command; the fourth is the count after the trim.
+    if (Number(results?.[3]?.[1] ?? 0) >= DEVICE_MAX_FAILURES) {
+      await redis.set(revokedKey(deviceId), '1', 'EX', KNOWN_DEVICE_TTL_S);
+    }
+  } catch {
+    /* best effort, like the account's counter */
+  }
+}
+
+/**
+ * Hand this browser a fresh known-device cookie once a sign-in is complete —
+ * session open, second factor met. A new device id each time, so an id revoked
+ * on this browser is never carried forward.
+ */
+export function issueKnownDevice(event: H3Event, subject: KnownDeviceSubject): void {
+  const deviceId = randomBytes(16).toString('base64url');
+  setCookie(
+    event,
+    KNOWN_DEVICE_COOKIE,
+    encodeKnownDevice(subject, deviceId, Math.floor(Date.now() / 1000)),
+    {
+      httpOnly: true,
+      sameSite: 'lax',
+      // As the session cookie: a plain-HTTP development stack would never get it back.
+      secure: process.env.NODE_ENV === 'production',
+      path: '/',
+      maxAge: KNOWN_DEVICE_TTL_S,
+    },
+  );
+}
diff --git a/apps/api/utils/loginChallenge.ts b/apps/api/utils/loginChallenge.ts
new file mode 100644
index 00000000..7b0f3bad
--- /dev/null
+++ b/apps/api/utils/loginChallenge.ts
@@ -0,0 +1,10 @@
+/**
+ * What `login:<challenge>` holds for a username that has no account.
+ *
+ * A real challenge holds the account id — a UUID, so this can never collide with
+ * one. The challenge route stores it under the same key as a real challenge, and
+ * the login turns it into the same "Invalid credentials" as a wrong proof:
+ * the two branches have to be indistinguishable from outside, or the error
+ * message enumerates the members the fake salt is there to hide.
+ */
+export const UNKNOWN_ACCOUNT_CHALLENGE = '!unknown';
diff --git a/apps/api/utils/mediaIds.ts b/apps/api/utils/mediaIds.ts
index e6d57831..6c60e7c3 100644
--- a/apps/api/utils/mediaIds.ts
+++ b/apps/api/utils/mediaIds.ts
@@ -33,22 +33,6 @@ export function normalizeImdbId(input: unknown): string | null {
   return null;
 }
 
-function normalizeNumericId(
-  input: unknown,
-  hostPattern: RegExp,
-  minDigits: number,
-  maxDigits: number
-): string | null {
-  if (typeof input !== 'string') return null;
-  const trimmed = input.trim();
-  if (!trimmed) return null;
-  const fromUrl = trimmed.match(hostPattern);
-  if (fromUrl) return fromUrl[1]!;
-  const re = new RegExp(`^\\d{${minDigits},${maxDigits}}$`);
-  if (re.test(trimmed)) return trimmed;
-  return null;
-}
-
 export function normalizeTmdbId(input: unknown): string | null {
   // TMDb has TWO independent id namespaces — `/movie/{n}` and `/tv/{n}`
   // — and the same integer can resolve in both. Without a type hint
diff --git a/apps/api/utils/metadata/igdb.ts b/apps/api/utils/metadata/igdb.ts
index 5d0c6a1c..c63ef208 100644
--- a/apps/api/utils/metadata/igdb.ts
+++ b/apps/api/utils/metadata/igdb.ts
@@ -208,7 +208,7 @@ async function igdbPost<T = any>(path: string, query: string): Promise<T | null>
     return (await res.json()) as T;
   } catch (err) {
     if (err instanceof UpstreamUnavailableError) throw err;
-    console.warn(`[metadata:igdb] fetch failed for ${path}:`, err);
+    console.warn('[metadata:igdb] fetch failed for %s:', path, err);
     throw new UpstreamUnavailableError('igdb', null);
   }
 }
diff --git a/apps/api/utils/metadata/openlibrary.ts b/apps/api/utils/metadata/openlibrary.ts
index fdf2a422..2f8317be 100644
--- a/apps/api/utils/metadata/openlibrary.ts
+++ b/apps/api/utils/metadata/openlibrary.ts
@@ -73,7 +73,7 @@ async function olGet<T = any>(
     return (await res.json()) as T;
   } catch (err) {
     if (err instanceof UpstreamUnavailableError) throw err;
-    console.warn(`[metadata:openlibrary] fetch failed for ${path}:`, err);
+    console.warn('[metadata:openlibrary] fetch failed for %s:', path, err);
     throw new UpstreamUnavailableError('openlibrary', null);
   }
 }
@@ -98,7 +98,7 @@ async function gbGet<T = any>(
     return (await res.json()) as T;
   } catch (err) {
     if (err instanceof UpstreamUnavailableError) throw err;
-    console.warn(`[metadata:googlebooks] fetch failed for ${path}:`, err);
+    console.warn('[metadata:googlebooks] fetch failed for %s:', path, err);
     throw new UpstreamUnavailableError('googlebooks', null);
   }
 }
diff --git a/apps/api/utils/metadata/tmdb.ts b/apps/api/utils/metadata/tmdb.ts
index e92f6235..d7d0277d 100644
--- a/apps/api/utils/metadata/tmdb.ts
+++ b/apps/api/utils/metadata/tmdb.ts
@@ -103,7 +103,7 @@ async function tmdbGet<T = any>(
       signal: AbortSignal.timeout(8000),
     });
   } catch (err) {
-    console.warn(`[metadata:tmdb] fetch failed for ${path}:`, err);
+    console.warn('[metadata:tmdb] fetch failed for %s:', path, err);
     throw new UpstreamUnavailableError('tmdb', null);
   }
   if (res.status === 404) return null;
@@ -114,7 +114,7 @@ async function tmdbGet<T = any>(
   try {
     return (await res.json()) as T;
   } catch (err) {
-    console.warn(`[metadata:tmdb] unreadable body on ${path}:`, err);
+    console.warn('[metadata:tmdb] unreadable body on %s:', path, err);
     throw new UpstreamUnavailableError('tmdb', res.status);
   }
 }
diff --git a/apps/api/utils/metrics.ts b/apps/api/utils/metrics.ts
index fb8b6d1e..fc7b0fc5 100644
--- a/apps/api/utils/metrics.ts
+++ b/apps/api/utils/metrics.ts
@@ -13,29 +13,32 @@
  *     keyspace.
  */
 /*
- * `prom-client` est marqué déprécié (« replaced by @prometheus-io/client »).
- * On y reste, délibérément, et voici les chiffres qui portent ce choix — pris
- * le 2026-09-02 :
+ * `@prometheus-io/client`, et non plus `prom-client` : c'est le même code,
+ * devenu sous-projet de Prometheus en août 2026 (même auteur, Simon Nyberg) et
+ * renommé au passage. `prom-client` est marqué « replaced by
+ * @prometheus-io/client » et ne recevra plus rien.
  *
- *   - `prom-client@15.1.3` n'a AUCUNE alerte de sécurité (audit npm en masse
- *     sur les 1101 paquets du verrou : 0). Déprécié n'est pas vulnérable.
- *   - `@prometheus-io/client` en est à `0.16.1`, avec quatre versions publiées
- *     en tout, la première non-alpha le 2026-08-24. Le dépôt s'impose
- *     `minimumReleaseAge: 1440` justement pour ne pas dépendre du frais ; un
- *     0.x de six jours est très en dessous de cette barre.
- *   - Il ajoute une dépendance d'exécution, `@opentelemetry/api`.
+ * La bascule avait été repoussée le 2026-09-02 : la 0.16.1 avait six jours,
+ * très en dessous de la barre que pose `minimumReleaseAge`. Faite le
+ * 2026-10-24, sur la même 0.16.1, et voici ce que la 0.16 change pour nous :
  *
- * La surface à migrer est pourtant minuscule — ce fichier est le seul
- * appelant, et il n'utilise que les quatre symboles ci-dessous. Le jour où le
- * successeur atteint une majeure stable, la bascule tient en un import.
- * D'ici là, changer de bibliothèque de métriques ne corrigerait rien.
+ *   - le nom du paquet — ce fichier est le seul appelant, d'où un seul import ;
+ *   - Node 22 minimum — nous tournons en 26 ;
+ *   - `MetricType` devient une union de chaînes, `AggregatorRegistry` s'appelle
+ *     `ClusterRegistry` et les messages IPC du mode cluster sont renommés :
+ *     rien de cela n'est utilisé ici ;
+ *   - deux métriques par défaut de plus, `trackarr_nodejs_eventloop_utilization_*`.
+ *
+ * À surveiller à la version suivante : une jauge ne démarrera plus à zéro.
+ * Toutes celles-ci sont posées à chaque collecte, sauf quand leur requête
+ * échoue — elles seraient alors absentes d'un premier scrape au lieu de valoir 0.
  */
 import {
   Registry,
   Gauge,
   collectDefaultMetrics,
   type MetricObjectWithValues,
-} from 'prom-client';
+} from '@prometheus-io/client';
 import { db, schema } from '@trackarr/db';
 import { recordStore } from './federation/storeCounts';
 import { sql, eq, isNull, and, or, gt, ne, lte } from 'drizzle-orm';
@@ -54,10 +57,10 @@ export const registry = new Registry();
 collectDefaultMetrics({ register: registry, prefix: 'trackarr_' });
 
 // `Gauge` config takes `registers: Registry[]`; `register` (singular) is
-// silently ignored, which would route every gauge to prom-client's default
+// silently ignored, which would route every gauge to the library's default
 // global registry instead of our custom one. Spent an embarrassing amount
 // of time staring at /metrics wondering where my counts went.
-// Typed rather than `as const`: prom-client's configs declare
+// Typed rather than `as const`: the library's configs declare
 // `registers: Registry[]`, and a readonly tuple is not assignable to a
 // mutable array — that single `as const` produced 55 of the API's type
 // errors, one per metric spread.
diff --git a/apps/api/utils/panic.ts b/apps/api/utils/panic.ts
index 1ef628b3..af427d9e 100644
--- a/apps/api/utils/panic.ts
+++ b/apps/api/utils/panic.ts
@@ -22,6 +22,7 @@ import {
   type ScryptOptions,
 } from 'crypto';
 import { promisify } from 'util';
+import { dictEntries } from '~~/utils/bencodeScan';
 
 /**
  * `promisify` ne retient qu'une des surcharges de `scrypt`, celle sans options.
@@ -192,3 +193,55 @@ export function decryptField(
   if (value == null) return null;
   return decrypt(value, key, legacyIv);
 }
+
+/**
+ * Déchiffrer une valeur qui ne l'est peut-être plus — le pendant de
+ * `encryptFieldOnce`, avec la même règle : on juge à l'authentification, pas à
+ * la forme.
+ *
+ * La restauration vérifie le mot de passe AVANT de dériver la clé ; une valeur
+ * qui ne se déchiffre pas sous cette clé n'est donc pas « une mauvaise clé »,
+ * c'est du clair : une ligne écrite pendant que la base était chiffrée, ou une
+ * ligne qu'une restauration interrompue avait déjà rendue. `decryptField`
+ * levait sur les deux, et chaque nouvelle tentative échouait sur toutes les
+ * lignes que la précédente avait déjà déchiffrées : une seule écriture pendant
+ * la panique suffisait à rendre la base irrécupérable sans SQL à la main.
+ */
+export function decryptFieldOrKeep(
+  value: string | null | undefined,
+  key: Buffer,
+  legacyIv?: Buffer
+): string | null {
+  if (value == null) return null;
+  try {
+    return decrypt(value, key, legacyIv);
+  } catch {
+    return value;
+  }
+}
+
+/**
+ * La même règle pour le `.torrent` d'une ligne, que le chiffrement enveloppe en
+ * base64 puis en `iv:ct:tag` stocké comme octets ASCII.
+ *
+ * Une ligne qu'une restauration interrompue a déjà rendue porte de nouveau le
+ * fichier bencodé, qui ne se déchiffre pas. La route écrivait alors `null` à sa
+ * place et comptait un échec : chaque nouvelle tentative effaçait le fichier de
+ * toutes les lignes que la précédente avait rendues.
+ *
+ * Rend les octets stockés tels quels quand ils forment déjà un dictionnaire
+ * bencodé muni d'`info`. `null` quand ils ne sont ni un chiffré sous cette clé ni
+ * un `.torrent` : la route le compte en échec, sans rien écrire à la place.
+ */
+export function decryptTorrentDataOrKeep(
+  stored: Buffer,
+  key: Buffer,
+  legacyIv?: Buffer
+): Buffer | null {
+  try {
+    return Buffer.from(decrypt(stored.toString('ascii'), key, legacyIv), 'base64');
+  } catch {
+    const top = dictEntries(stored);
+    return top?.entries.some((e) => e.key.toString('latin1') === 'info') ? stored : null;
+  }
+}
diff --git a/apps/api/utils/panicLock.ts b/apps/api/utils/panicLock.ts
new file mode 100644
index 00000000..9128e158
--- /dev/null
+++ b/apps/api/utils/panicLock.ts
@@ -0,0 +1,82 @@
+/**
+ * Whether panic mode is under way: from the moment the encrypt pass writes its
+ * salt until a restore completes — every phase but `idle`, and `is_encrypted`
+ * for databases encrypted before phases existed.
+ *
+ * `is_encrypted` alone is not that. It stays false for the whole `encrypting`
+ * phase, and an interrupted pass can sit there indefinitely, so everything that
+ * read only the flag — the federation gate first — ran on through a database
+ * already half encrypted.
+ *
+ * Several things stop on this answer: federation (`federationSuspended`), every
+ * write that is not part of the panic itself (`middleware/panic-lock`), and the
+ * catalogue sweeps, which would otherwise walk past encrypted rows and never come
+ * back for them.
+ *
+ * Read through a short Redis cache because the write lock consults it on every
+ * mutating request; the panic routes clear it as they change the state, so the
+ * window only covers other replicas. On any Redis error it reads the database
+ * rather than failing open: panic must not be defeated by a cache miss.
+ */
+import { db, schema } from '@trackarr/db';
+import { redis } from '~~/utils/server';
+
+const CACHE_KEY = 'panic:active';
+const CACHE_TTL_S = 5;
+
+export async function panicActive(): Promise<boolean> {
+  try {
+    const cached = await redis.get(CACHE_KEY);
+    if (cached !== null) return cached === '1';
+  } catch {
+    /* fall through to the database */
+  }
+  const [row] = await db
+    .select({ isEncrypted: schema.panicState.isEncrypted, phase: schema.panicState.phase })
+    .from(schema.panicState)
+    .limit(1);
+  const active = !!row && (row.isEncrypted || row.phase !== 'idle');
+  try {
+    await redis.setex(CACHE_KEY, CACHE_TTL_S, active ? '1' : '0');
+  } catch {
+    /* best effort */
+  }
+  return active;
+}
+
+/** Called by the panic routes as they change the state. */
+export async function invalidatePanicCache(): Promise<void> {
+  try {
+    await redis.del(CACHE_KEY);
+  } catch {
+    /* the TTL bounds it */
+  }
+}
+
+const WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+/** The writes that are part of the panic itself, and leaving. */
+const ALLOWED_DURING_PANIC = new Set([
+  '/api/admin/panic/encrypt',
+  '/api/admin/panic/restore',
+  '/api/auth/logout',
+]);
+
+/**
+ * Whether a request may run while panic mode stands (`middleware/panic-lock`).
+ * Every read may; a write only if it resumes the encrypt pass, restores, or logs
+ * out. Fail-closed on the spelling: the path is decoded and lower-cased before
+ * the exact comparison, and a write that does not name an allowed route —
+ * whatever prefix it claims — is refused. Every writing route lives under
+ * `/api/`, so nothing legitimate is lost by not trusting the prefix.
+ */
+export function allowedDuringPanic(method: string, rawPath: string): boolean {
+  if (!WRITE_METHODS.has(method.toUpperCase())) return true;
+  let path = rawPath.split('?')[0] ?? '';
+  try {
+    path = decodeURIComponent(path);
+  } catch {
+    return false;
+  }
+  return ALLOWED_DURING_PANIC.has(path.toLowerCase().replace(/\/+$/, ''));
+}
diff --git a/apps/api/utils/rateLimit.ts b/apps/api/utils/rateLimit.ts
index cb9660f5..877f5351 100644
--- a/apps/api/utils/rateLimit.ts
+++ b/apps/api/utils/rateLimit.ts
@@ -7,6 +7,7 @@
 import { randomUUID } from 'node:crypto';
 import { redis } from '~~/utils/server';
 import { isIP } from 'node:net';
+import { createError } from 'h3';
 
 // ============================================================================
 // Types & Configuration
@@ -231,6 +232,54 @@ function normalizeIP(ip: string): string {
   return ip;
 }
 
+/** The eight 16-bit groups of an IPv6 address, or null if it is not one. */
+function ipv6Groups(ip: string): number[] | null {
+  const bare = ip.split('%')[0]!; // zone index
+  const halves = bare.split('::');
+  if (halves.length > 2) return null;
+  const parse = (part: string): number[] | null => {
+    if (!part) return [];
+    const out: number[] = [];
+    const pieces = part.split(':');
+    for (let i = 0; i < pieces.length; i++) {
+      const piece = pieces[i]!;
+      // An embedded IPv4 tail (`64:ff9b::192.0.2.1`) is two groups.
+      if (i === pieces.length - 1 && piece.includes('.')) {
+        if (isIP(piece) !== 4) return null;
+        const [a, b, c, d] = piece.split('.').map(Number) as [number, number, number, number];
+        out.push((a << 8) | b, (c << 8) | d);
+        continue;
+      }
+      if (!/^[0-9a-f]{1,4}$/i.test(piece)) return null;
+      out.push(parseInt(piece, 16));
+    }
+    return out;
+  };
+  const head = parse(halves[0]!);
+  const tail = halves.length === 2 ? parse(halves[1]!) : [];
+  if (!head || !tail) return null;
+  if (halves.length === 1) return head.length === 8 ? head : null;
+  const missing = 8 - head.length - tail.length;
+  return missing < 1 ? null : [...head, ...new Array<number>(missing).fill(0), ...tail];
+}
+
+/**
+ * What an address-based limit counts: the address for IPv4, its /64 for IPv6.
+ *
+ * One IPv6 host is routinely handed a whole /64 and can pick a fresh address
+ * for every request, so a limit keyed on the full address — and the blacklist
+ * built on top of it — stopped nobody who rotated inside their own prefix. A
+ * /64 is the smallest block a subscriber is assigned, so it is the narrowest
+ * unit that still means "one customer".
+ */
+export function rateLimitSubject(raw: string): string {
+  const ip = normalizeIP(raw);
+  if (isIP(ip) !== 6) return ip;
+  const groups = ipv6Groups(ip);
+  if (!groups) return ip;
+  return `${groups.slice(0, 4).map((g) => g.toString(16)).join(':')}::/64`;
+}
+
 // ============================================================================
 // Blacklist Management
 // ============================================================================
@@ -265,7 +314,7 @@ const MAX_BLACKLIST_DURATION = 86400; // 24 hours max
  * Check if an IP is blacklisted
  */
 export async function isBlacklisted(ip: string): Promise<boolean> {
-  const normalizedIP = normalizeIP(ip);
+  const normalizedIP = rateLimitSubject(ip);
 
   try {
     if ((await redis.exists(blacklistKey(normalizedIP))) === 1) return true;
@@ -299,7 +348,7 @@ export async function blacklistIP(
   reason: string,
   previousViolations: number = 0
 ): Promise<void> {
-  const normalizedIP = normalizeIP(ip);
+  const normalizedIP = rateLimitSubject(ip);
   const violations = previousViolations + 1;
 
   // Progressive penalty: doubles each time, up to max
@@ -335,7 +384,7 @@ export async function blacklistIP(
  * Get violation count for an IP
  */
 async function getViolationCount(ip: string): Promise<number> {
-  const normalizedIP = normalizeIP(ip);
+  const normalizedIP = rateLimitSubject(ip);
 
   try {
     const data =
@@ -480,10 +529,18 @@ export async function rateLimit(
   } = options;
 
   const ip = getClientIP(event);
-  const normalizedIP = normalizeIP(ip);
+  const normalizedIP = rateLimitSubject(ip);
+
+  // Our own server-rendering layer speaking for nobody (`isInternalOrigin`):
+  // `middleware/security.ts` keeps it off the blacklist, and this function has
+  // to agree with it — it repeated the check, and the blacklisting below, with
+  // no such exemption, so a burst of anonymous page renders could put the web
+  // container's own address on the list. The bucket itself still counts it:
+  // a network neighbour stays subject to the per-route limits.
+  const internal = isInternalOrigin(event);
 
   // Check blacklist first
-  if (await isBlacklisted(normalizedIP)) {
+  if (!internal && (await isBlacklisted(normalizedIP))) {
     throw createError({
       statusCode: 403,
       message: 'Access temporarily blocked',
@@ -541,7 +598,7 @@ export async function rateLimit(
     // Jamais pour un compte : la sanction doit viser le sujet compté. Mettre
     // une adresse en liste noire parce qu'un compte a dépassé son seau est
     // précisément ce qui permettait d'expulser ses voisins.
-    if (progressive && !actorId) {
+    if (progressive && !actorId && !internal) {
       const violations = await getViolationCount(normalizedIP);
       if (violations >= 3) {
         await blacklistIP(
@@ -581,7 +638,7 @@ const DDOS_THRESHOLD = 100; // 100 requests in 10 seconds = attack
  */
 export async function detectDDoS(event: any): Promise<void> {
   const ip = getClientIP(event);
-  const normalizedIP = normalizeIP(ip);
+  const normalizedIP = rateLimitSubject(ip);
 
   if (await isBlacklisted(normalizedIP)) {
     throw createError({
@@ -671,6 +728,15 @@ export const RATE_LIMITS = {
   // Auth endpoints - strict to prevent brute force
   auth: { windowSec: 300, maxRequests: 5, prefix: 'auth', progressive: true },
 
+  // Password sign-in. Its own bucket, and NOT progressive: on `auth`, the sixth
+  // failed login within five minutes put the whole address on the blacklist —
+  // every request refused with a 403, signed-in members included — so on a VPN
+  // exit, a campus or a carrier NAT one stranger mistyping a password locked
+  // everyone else out of the site. Guessing is held back by this limit per
+  // address and by the per-account counter below, neither of which punishes
+  // the neighbours.
+  signin: { windowSec: 300, maxRequests: 10, prefix: 'signin' },
+
   // Search - moderate
   search: { windowSec: 60, maxRequests: 30, prefix: 'search' },
 
@@ -686,6 +752,74 @@ export const RATE_LIMITS = {
   stream: { windowSec: 60, maxRequests: 12, prefix: 'sse', progressive: false },
 };
 
+// ============================================================================
+// Per-account sign-in failures
+// ============================================================================
+
+/**
+ * Limits per address do not stop a guesser spread over many addresses, so
+ * failures are also counted per username — every username, existing or not, so
+ * a lockout never tells whether an account exists. The cost — anyone can hold
+ * an account out of password sign-in for the window — falls only on browsers
+ * that have never signed in to it: a known device answers to its own count
+ * instead (`knownDevices.ts`). A member's sessions are untouched either way.
+ */
+const ACCOUNT_FAILURE_WINDOW_S = 15 * 60;
+const ACCOUNT_MAX_FAILURES = 10;
+
+const accountFailureKey = (username: string) =>
+  `ratelimit:signin-fail:${username.trim().toLowerCase()}`;
+
+/** Throws 429 once this username has too many recent failed sign-ins. */
+export async function assertAccountNotLocked(username: string): Promise<void> {
+  const key = accountFailureKey(username);
+  let failures = 0;
+  try {
+    await redis.zremrangebyscore(key, 0, Date.now() - ACCOUNT_FAILURE_WINDOW_S * 1000);
+    failures = await redis.zcard(key);
+  } catch {
+    // Redis down: the per-address limit still applies.
+    return;
+  }
+  if (failures >= ACCOUNT_MAX_FAILURES) {
+    throw createError({
+      statusCode: 429,
+      // Told apart from the per-address limit because the way out differs: a
+      // browser that has signed in to this account before is not held here.
+      // Says nothing about whether the account exists — every username counts.
+      data: { reason: 'account-locked' },
+      message: 'Too many failed attempts for this account. Try again later.',
+    });
+  }
+}
+
+/** One failed sign-in for this username, whether or not it exists. */
+export async function recordAccountFailure(username: string): Promise<void> {
+  const key = accountFailureKey(username);
+  const now = Date.now();
+  try {
+    await redis
+      .multi()
+      .zadd(key, now, `${now}:${randomUUID()}`)
+      // Only the newest entries can matter; a flood spread over thousands of
+      // addresses must not grow one key without bound.
+      .zremrangebyrank(key, 0, -(ACCOUNT_MAX_FAILURES * 4) - 1)
+      .expire(key, ACCOUNT_FAILURE_WINDOW_S)
+      .exec();
+  } catch {
+    /* best effort */
+  }
+}
+
+/** A successful sign-in starts the count again. */
+export async function clearAccountFailures(username: string): Promise<void> {
+  try {
+    await redis.del(accountFailureKey(username));
+  } catch {
+    /* best effort: the window lapses anyway */
+  }
+}
+
 // ============================================================================
 // Middleware Helper
 // ============================================================================
diff --git a/apps/api/utils/releaseTags.ts b/apps/api/utils/releaseTags.ts
index 1d4322bf..6d93f00a 100644
--- a/apps/api/utils/releaseTags.ts
+++ b/apps/api/utils/releaseTags.ts
@@ -59,6 +59,8 @@ const EMPTY: ReleaseFacets = { extras: [] };
  * inside an NFO sentence.
  */
 function token(pattern: string): RegExp {
+  // The patterns are this file's constant rule tables.
+  // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
   return new RegExp(`(?:^|[^a-z0-9])(?:${pattern})(?=[^a-z0-9]|$)`, 'i');
 }
 
diff --git a/apps/api/utils/savedSearchFanout.ts b/apps/api/utils/savedSearchFanout.ts
index 0d07018a..ef2114d4 100644
--- a/apps/api/utils/savedSearchFanout.ts
+++ b/apps/api/utils/savedSearchFanout.ts
@@ -147,6 +147,8 @@ async function runFanout(torrent: SavedSearchCandidate): Promise<void> {
     }
     if (f.season != null && f.season !== (torrent.season ?? null)) return false;
     if (f.episode != null && f.episode !== (torrent.episode ?? null)) return false;
+    // An integer year from the database, not a pattern.
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
     if (f.year != null && !new RegExp(`(^|[^0-9])${f.year}([^0-9]|$)`).test(torrent.name)) return false;
     if (f.uploaderId && f.uploaderId !== torrent.uploaderId) return false;
     // A filter with no free text, no category, no tag and no id would match
diff --git a/apps/api/utils/secrets.ts b/apps/api/utils/secrets.ts
index ef1fc799..ed240ac0 100644
--- a/apps/api/utils/secrets.ts
+++ b/apps/api/utils/secrets.ts
@@ -22,7 +22,8 @@ export function readSecret(envKey: string, defaultValue?: string): string {
       }
     } catch (error) {
       console.error(
-        `[Secrets] Error reading secret file ${secretFilePath}:`,
+        '[Secrets] Error reading secret file %s:',
+        secretFilePath,
         error
       );
     }
@@ -74,7 +75,7 @@ export function validateRequiredSecrets(requiredKeys: string[]): void {
   if (missing.length > 0) {
     throw new Error(
       `Missing required secrets: ${missing.join(', ')}\n` +
-        'Generate secrets with: ./scripts/generate-secrets.sh'
+        'Generate each one with `openssl rand -hex 32` — see doc/guide/getting-started.md'
     );
   }
 
diff --git a/apps/api/utils/settings.ts b/apps/api/utils/settings.ts
index 7644f776..81ca7559 100644
--- a/apps/api/utils/settings.ts
+++ b/apps/api/utils/settings.ts
@@ -546,9 +546,19 @@ export async function getHeroSubtitle(): Promise<string> {
   );
 }
 
+/**
+ * The admin's label for the home page's live pill — empty when they set none,
+ * so the page keeps its own translated "Live".
+ *
+ * This used to default to an English sentence that nothing displayed; the
+ * admin form then saved that default back on any branding change. Treated as
+ * unset, so wiring the label up does not swap a translated pill for an English
+ * sentence nobody chose.
+ */
+const LEGACY_STATUS_BADGE_DEFAULT = 'Tracker Online & Operational';
 export async function getStatusBadgeText(): Promise<string> {
-  const value = await getSetting(SETTINGS_KEYS.STATUS_BADGE_TEXT);
-  return value || 'Tracker Online & Operational';
+  const value = (await getSetting(SETTINGS_KEYS.STATUS_BADGE_TEXT)) ?? '';
+  return value === LEGACY_STATUS_BADGE_DEFAULT ? '' : value;
 }
 
 export async function getFeature1Title(): Promise<string> {
@@ -573,7 +583,7 @@ export async function getFeature2Desc(): Promise<string> {
   const value = await getSetting(SETTINGS_KEYS.FEATURE_2_DESC);
   return (
     value ||
-    'Supports HTTP, UDP, and WebSocket protocols for maximum compatibility with all BitTorrent clients.'
+    'Supports HTTP and UDP announces for maximum compatibility with all BitTorrent clients.'
   );
 }
 
diff --git a/apps/api/utils/storage/fsDriver.ts b/apps/api/utils/storage/fsDriver.ts
index e88df5b3..3f3b2434 100644
--- a/apps/api/utils/storage/fsDriver.ts
+++ b/apps/api/utils/storage/fsDriver.ts
@@ -57,6 +57,8 @@ export class FilesystemStorage implements ObjectStorage {
     const baseReal = mustExist
       ? await realpath(this.baseDir)
       : resolve(this.baseDir);
+    // Checked on the next line: anything resolving outside the base is refused.
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
     const candidate = resolve(baseReal, key);
     if (candidate !== baseReal && !candidate.startsWith(baseReal + sep)) {
       throw new Error(`Refusing to address "${key}" outside ${baseReal}`);
diff --git a/apps/api/utils/torrentBytes.ts b/apps/api/utils/torrentBytes.ts
new file mode 100644
index 00000000..fda0d0c5
--- /dev/null
+++ b/apps/api/utils/torrentBytes.ts
@@ -0,0 +1,271 @@
+/**
+ * Byte-level edits to a `.torrent`, for every place that rewrites one: the
+ * upload (drops the uploader's own fields, forces `private`), the two download
+ * routes (write the member's announce URLs) and the backfill that cleans the
+ * rows stored before the upload did either.
+ *
+ * ## Why not decode, mutate, encode
+ *
+ * `bencode@4` decodes every dictionary KEY to a string, and a key that is not
+ * valid UTF-8 comes back spelled in hex (`decode.dictionary` in
+ * bencode/lib/decode.js). Encoding then writes the hex — 64 ASCII bytes where
+ * there were 32 raw ones. The keys of a BEP 52 `piece layers` dict are raw
+ * 32-byte Merkle roots, so every v2 or hybrid `.torrent` that went through the
+ * upload, and again through each download, came out with its piece layers
+ * re-keyed: a v2 client looks a layer up by its file's `pieces root` and finds
+ * nothing. A `file tree` path that is not valid UTF-8 suffers the same, inside
+ * `info`, where it also moves the infohash.
+ *
+ * So nothing here decodes a value it does not edit. The scanner (`bencodeScan`)
+ * only finds where each value ends, and an edit splices byte ranges: everything
+ * it does not touch is copied verbatim.
+ */
+import { MAX_DEPTH, dictEntries, skipValue, type DictEntry } from '~~/utils/bencodeScan';
+import { extractV2 } from '~~/utils/bittorrentV2';
+
+/** A bencoded byte string. */
+function str(value: Buffer | string): Buffer {
+  const b = typeof value === 'string' ? Buffer.from(value) : value;
+  return Buffer.concat([Buffer.from(`${b.length}:`, 'latin1'), b]);
+}
+
+/** A bencoded list of lists of strings — the shape of `announce-list`. */
+function tierList(tiers: string[][]): Buffer {
+  const parts: Buffer[] = [Buffer.from('l')];
+  for (const tier of tiers) {
+    parts.push(Buffer.from('l'), ...tier.map((url) => str(url)), Buffer.from('e'));
+  }
+  parts.push(Buffer.from('e'));
+  return Buffer.concat(parts);
+}
+
+/**
+ * Rewrites the dict at `start`. A key named in `edits` takes the new value, or
+ * disappears for `null`; a named key the dict lacks is inserted where a sorted
+ * dict would hold it (bencode requires sorted keys, compared as raw bytes).
+ * Every other entry is copied byte for byte, key included.
+ */
+function rewriteDict(
+  bytes: Buffer,
+  start: number,
+  edits: Map<string, Buffer | null>,
+): Buffer | null {
+  const dict = dictEntries(bytes, start);
+  if (!dict) return null;
+
+  // Edit keys are ASCII, so `latin1` compares them with the raw key bytes
+  // exactly — a non-ASCII key maps to characters no edit key contains.
+  const name = (e: DictEntry) => e.key.toString('latin1');
+  const present = new Set(dict.entries.map(name));
+  const missing = [...edits]
+    .filter(([k, v]) => v !== null && !present.has(k))
+    .map(([k, v]) => ({ key: Buffer.from(k, 'latin1'), value: v! }))
+    .sort((a, b) => Buffer.compare(a.key, b.key));
+
+  const parts: Buffer[] = [Buffer.from('d')];
+  const insertBefore = (key: Buffer | null) => {
+    while (missing.length && (key === null || Buffer.compare(missing[0]!.key, key) < 0)) {
+      const m = missing.shift()!;
+      parts.push(str(m.key), m.value);
+    }
+  };
+  for (const e of dict.entries) {
+    insertBefore(e.key);
+    const k = name(e);
+    if (!edits.has(k)) {
+      parts.push(bytes.subarray(e.start, e.end));
+      continue;
+    }
+    const value = edits.get(k)!;
+    if (value !== null) parts.push(bytes.subarray(e.start, e.valueStart), value);
+  }
+  insertBefore(null);
+  parts.push(Buffer.from('e'));
+  return Buffer.concat(parts);
+}
+
+/**
+ * The value at `start` with the entries of every dictionary in sorted key
+ * order, at every depth; strings and integers are copied verbatim, and a value
+ * that is already canonical comes back as the very same bytes.
+ *
+ * The upload got this for free from decode → encode, which sorted every
+ * dictionary (and re-spelled every binary key). A file from a careless encoder,
+ * keys out of order, was therefore stored canonical, under the canonical
+ * infohash; kept as it came, the same release uploaded again hashed apart from
+ * the row stored before, and the duplicate check missed it. Sorting by raw key
+ * bytes is the order bencode defines, and a key that occurs twice keeps its
+ * last value, as the decoder did.
+ */
+function canonical(
+  bytes: Buffer,
+  start: number,
+  depth = 0,
+): { out: Buffer; end: number; changed: boolean } | null {
+  if (depth > MAX_DEPTH) return null;
+  if (bytes[start] === 0x64) {
+    const dict = dictEntries(bytes, start);
+    if (!dict) return null;
+    let changed = false;
+    let previous: Buffer | null = null;
+    // `latin1` maps bytes to characters one to one: distinct raw keys stay distinct.
+    const byKey = new Map<string, { key: Buffer; value: Buffer }>();
+    for (const e of dict.entries) {
+      const v = canonical(bytes, e.valueStart, depth + 1);
+      if (!v) return null;
+      // A value rebuilt below, or a key out of order or repeated: rebuild this one.
+      if (v.changed || (previous && Buffer.compare(previous, e.key) >= 0)) changed = true;
+      previous = e.key;
+      byKey.set(e.key.toString('latin1'), { key: e.key, value: v.out });
+    }
+    if (!changed) return { out: bytes.subarray(start, dict.end), end: dict.end, changed };
+    const entries = [...byKey.values()].sort((a, b) => Buffer.compare(a.key, b.key));
+    return {
+      out: Buffer.concat([Buffer.from('d'), ...entries.flatMap((e) => [str(e.key), e.value]), Buffer.from('e')]),
+      end: dict.end,
+      changed,
+    };
+  }
+  if (bytes[start] === 0x6c) {
+    let changed = false;
+    const parts: Buffer[] = [];
+    let i = start + 1;
+    while (i < bytes.length && bytes[i] !== 0x65) {
+      const v = canonical(bytes, i, depth + 1);
+      if (!v) return null;
+      changed ||= v.changed;
+      parts.push(v.out);
+      i = v.end;
+    }
+    if (i >= bytes.length) return null;
+    const out = changed
+      ? Buffer.concat([Buffer.from('l'), ...parts, Buffer.from('e')])
+      : bytes.subarray(start, i + 1);
+    return { out, end: i + 1, changed };
+  }
+  const end = skipValue(bytes, start);
+  return end > start ? { out: bytes.subarray(start, end), end, changed: false } : null;
+}
+
+/**
+ * The top-level fields that carry the uploader's own announce URLs, or text from
+ * a foreign file that has no use here.
+ *
+ * A private tracker's `.torrent` holds its owner's passkey in `announce` and in
+ * every tier of `announce-list`, and in a cross-seed the file usually comes from
+ * ANOTHER private tracker, whose passkey has no business being stored here.
+ * `url-list` (web seeds) would point every downloader's client at a third-party
+ * host. `comment` and `created by` are free text with no use here. None of them
+ * is inside `info`, so dropping them never moves the infohash.
+ */
+export const UPLOADER_FIELDS = ['announce', 'announce-list', 'url-list', 'comment', 'created by'] as const;
+
+const PRIVATE = Buffer.from('i1e');
+
+/** The `info` value with `private` forced to 1; null when there is no info dict. */
+function privateInfo(bytes: Buffer, top: { entries: DictEntry[] }): Buffer | null {
+  const info = top.entries.find((e) => e.key.toString('latin1') === 'info');
+  if (!info) return null;
+  return rewriteDict(bytes, info.valueStart, new Map([['private', PRIVATE]]));
+}
+
+/**
+ * The upload's normalisation: `info.private` forced to 1 and the uploader's
+ * fields dropped. The result is what the site stores, serves and hashes.
+ *
+ * Throws on anything it cannot walk; the caller answers 400.
+ */
+export function normalizeUploadedTorrent(upload: Buffer): Buffer {
+  const raw = canonical(upload, 0)?.out;
+  const top = raw && dictEntries(raw);
+  if (!raw || !top) throw new Error('not a bencoded dictionary');
+  const info = privateInfo(raw, top);
+  if (!info) throw new Error('missing info dict');
+  const edits = new Map<string, Buffer | null>(UPLOADER_FIELDS.map((k) => [k, null]));
+  edits.set('info', info);
+  const out = rewriteDict(raw, 0, edits);
+  if (!out) throw new Error('not a bencoded dictionary');
+  return out;
+}
+
+/**
+ * A member's copy: their announce URL and tier list, `private` forced to 1,
+ * and none of the uploader's fields, so a row stored before the upload dropped
+ * them still serves without them. `info` and `piece layers` leave as stored.
+ *
+ * Throws on a stored file it cannot walk.
+ */
+export function personalizeTorrent(raw: Buffer, announce: string, tiers: string[][]): Buffer {
+  const top = dictEntries(raw);
+  if (!top) throw new Error('not a bencoded dictionary');
+  const info = privateInfo(raw, top);
+  if (!info) throw new Error('missing info dict');
+  const edits = new Map<string, Buffer | null>(UPLOADER_FIELDS.map((k) => [k, null]));
+  edits.set('announce', str(announce));
+  edits.set('announce-list', tierList(tiers));
+  edits.set('info', info);
+  const out = rewriteDict(raw, 0, edits);
+  if (!out) throw new Error('not a bencoded dictionary');
+  return out;
+}
+
+/**
+ * The piece layers of a v2 or hybrid torrent with their keys put back to raw
+ * 32-byte roots, after the upload re-spelled them in hex (see the module
+ * comment). Null when there is nothing to repair, or anything to doubt.
+ *
+ * A key is only converted back when its hex spelling names the `pieces root` of
+ * a file in this torrent's own `file tree`: a real 32-byte root is never 64
+ * bytes long, and a 64-character key that is not one of our roots is left as
+ * found. Hex preserves byte order, so the repaired dict comes out sorted; it is
+ * sorted again anyway, and a repaired key that collides with a key already
+ * there aborts the repair.
+ */
+function repairedPieceLayers(raw: Buffer, top: { entries: DictEntry[] }): Buffer | null {
+  const layers = top.entries.find((e) => e.key.toString('latin1') === 'piece layers');
+  if (!layers) return null;
+  const dict = dictEntries(raw, layers.valueStart);
+  if (!dict) return null;
+  const roots = new Set(extractV2(raw)?.fileRoots.map((f) => f.root) ?? []);
+  if (!roots.size) return null;
+
+  let changed = false;
+  const entries = dict.entries.map((e) => {
+    const k = e.key.toString('latin1');
+    if (k.length === 64 && /^[0-9a-f]+$/.test(k) && roots.has(k)) {
+      changed = true;
+      return { key: Buffer.from(k, 'hex'), value: raw.subarray(e.valueStart, e.end) };
+    }
+    return { key: e.key, value: raw.subarray(e.valueStart, e.end) };
+  });
+  if (!changed) return null;
+
+  entries.sort((a, b) => Buffer.compare(a.key, b.key));
+  for (let i = 1; i < entries.length; i++) {
+    if (Buffer.compare(entries[i - 1]!.key, entries[i]!.key) === 0) return null;
+  }
+  return Buffer.concat([
+    Buffer.from('d'),
+    ...entries.flatMap((e) => [str(e.key), e.value]),
+    Buffer.from('e'),
+  ]);
+}
+
+/**
+ * What the backfill applies to a stored row: the uploader's fields dropped and
+ * the piece layers re-keyed. `info` is copied verbatim — not even `private` is
+ * touched — so the infohash cannot move. Null when the row needs nothing, or
+ * cannot be walked.
+ */
+export function cleanStoredTorrent(raw: Buffer): Buffer | null {
+  const top = dictEntries(raw);
+  if (!top) return null;
+  const names = new Set(top.entries.map((e) => e.key.toString('latin1')));
+  const edits = new Map<string, Buffer | null>(
+    UPLOADER_FIELDS.filter((k) => names.has(k)).map((k) => [k, null]),
+  );
+  const layers = repairedPieceLayers(raw, top);
+  if (layers) edits.set('piece layers', layers);
+  if (!edits.size) return null;
+  return rewriteDict(raw, 0, edits);
+}
diff --git a/apps/api/utils/torrentFileCleanup.ts b/apps/api/utils/torrentFileCleanup.ts
new file mode 100644
index 00000000..4c5e6abd
--- /dev/null
+++ b/apps/api/utils/torrentFileCleanup.ts
@@ -0,0 +1,84 @@
+/**
+ * Cleans the `.torrent` files stored before the upload learnt to.
+ *
+ * Two things the upload now does were never applied to the rows already there:
+ *
+ * - **The uploader's own fields.** Until 2026-09-02 the upload kept `announce`
+ *   and `announce-list`, so a file made with the uploader's personal announce
+ *   URL — the normal case — kept their passkey at rest in `torrent_data`. The
+ *   route listing a member's uploads then served those bytes to anyone who
+ *   opened the profile. The route no longer does, but the passkeys are still in
+ *   the column, one SELECT from the next leak.
+ * - **Re-keyed piece layers.** The upload decoded and re-encoded the file, and
+ *   `bencode` re-spells in hex any key that is not valid UTF-8 — every key of a
+ *   BEP 52 `piece layers` dict. `utils/torrentBytes` explains the fault and how
+ *   the hex is turned back into the 32-byte roots.
+ *
+ * `cleanStoredTorrent` never touches `info`, and this checks it: the info dict
+ * of what is written must be byte-identical to the one read, so neither
+ * infohash can move under a swarm. A row that fails the check is logged and
+ * left alone.
+ *
+ * Same shape as `backfill-content-roots`: a cursor over `torrents.id` walks the
+ * catalogue once, in capped batches, under a cross-replica lock, then idles at
+ * the end. New uploads are already clean.
+ */
+import { db, schema } from '@trackarr/db';
+import { and, asc, eq, gt, isNotNull } from 'drizzle-orm';
+import { cleanStoredTorrent } from '~~/utils/torrentBytes';
+import { infoDictRange } from '~~/utils/bittorrentV2';
+import { getSetting, setSetting } from '~~/utils/server';
+import { panicActive } from '~~/utils/panicLock';
+
+const BATCH_SIZE = 200;
+// Bump (and say why above) whenever `cleanStoredTorrent` learns something new,
+// so the sweep walks the catalogue once more.
+export const CLEANUP_CURSOR_KEY = 'torrent_file_cleanup_cursor_v1';
+
+function sameInfo(before: Buffer, after: Buffer): boolean {
+  const a = infoDictRange(before);
+  const b = infoDictRange(after);
+  return !!a && !!b && before.subarray(a.start, a.end).equals(after.subarray(b.start, b.end));
+}
+
+/** One batch of the sweep. Exported for the integration suite. */
+export async function cleanupTorrentFilesTick(): Promise<{ processed: number; cleaned: number }> {
+  // Panic encrypts `torrent_data`, and an encrypted row cannot be walked: a
+  // sweep during the panic would move its cursor past every one of them, and
+  // nothing would come back for them after the restore.
+  if (await panicActive()) return { processed: 0, cleaned: 0 };
+  const cursor = (await getSetting(CLEANUP_CURSOR_KEY)) ?? '';
+
+  const rows = await db
+    .select({ id: schema.torrents.id, torrentData: schema.torrents.torrentData })
+    .from(schema.torrents)
+    .where(and(gt(schema.torrents.id, cursor), isNotNull(schema.torrents.torrentData)))
+    .orderBy(asc(schema.torrents.id))
+    .limit(BATCH_SIZE);
+
+  if (!rows.length) return { processed: 0, cleaned: 0 };
+
+  let cleaned = 0;
+  for (const row of rows) {
+    if (!row.torrentData || row.torrentData.length === 0) continue;
+    const before = Buffer.from(row.torrentData);
+    // Deterministic: a file that cannot be walked now never will be, so the
+    // cursor moves past it. The UPDATE is the only part that can fail
+    // transiently, and it is outside any catch: a failure aborts the tick
+    // WITHOUT advancing the cursor, and the batch is retried next tick.
+    const after = cleanStoredTorrent(before);
+    if (!after) continue;
+    if (!sameInfo(before, after)) {
+      console.warn('[TorrentFiles] info dict would change, row left alone:', row.id);
+      continue;
+    }
+    await db
+      .update(schema.torrents)
+      .set({ torrentData: after })
+      .where(eq(schema.torrents.id, row.id));
+    cleaned += 1;
+  }
+
+  await setSetting(CLEANUP_CURSOR_KEY, rows[rows.length - 1]!.id);
+  return { processed: rows.length, cleaned };
+}
diff --git a/apps/api/utils/trackerHealth.ts b/apps/api/utils/trackerHealth.ts
index 6d517e09..3faaf506 100644
--- a/apps/api/utils/trackerHealth.ts
+++ b/apps/api/utils/trackerHealth.ts
@@ -19,7 +19,11 @@
  * pouvaient déjà se contredire pendant leurs dix secondes respectives.
  */
 
-/** Ce que le tracker répond sur `/health` : 200 seulement si Postgres ET Redis répondent. */
+/**
+ * Ce que le tracker répond sur `/health` : 200 tant que Postgres répond — sans
+ * Redis il répond encore aux annonces, en mode dégradé, et le corps le dit
+ * (`"status":"degraded"`) ; 503 seulement quand Postgres manque.
+ */
 export interface TrackerHealth {
   online: boolean;
   /** Millisecondes unix de la dernière sonde ; l'interface affiche « vérifié il y a Xs ». */
diff --git a/apps/api/utils/uploadRules.ts b/apps/api/utils/uploadRules.ts
index 467d558e..37fb5564 100644
--- a/apps/api/utils/uploadRules.ts
+++ b/apps/api/utils/uploadRules.ts
@@ -310,6 +310,8 @@ export function evaluateUpload(
   // have been rejected on size/NFO/etc.
   if (snapshot.titleBlocklist) {
     try {
+      // Staff-written on purpose; a slow pattern only costs the admin who wrote it (fail open, above).
+      // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
       const re = new RegExp(snapshot.titleBlocklist, 'i');
       if (re.test(input.title)) {
         return {
@@ -337,6 +339,8 @@ export function evaluateUpload(
     const pattern = snapshot.effectiveCategoryPatterns[input.categoryId];
     if (pattern) {
       try {
+        // Staff-written on purpose; a slow pattern only costs the admin who wrote it (fail open, above).
+        // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
         const re = new RegExp(pattern, 'i');
         if (!re.test(input.title)) {
           return {
@@ -376,6 +380,8 @@ export function anchorPattern(raw: string): string {
 export function validateAndAnchor(raw: string): string | null {
   const candidate = anchorPattern(raw);
   try {
+    // Staff-written on purpose: this is the validation that compiles it.
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
     new RegExp(candidate, 'i');
     return candidate;
   } catch {
diff --git a/apps/relay/Dockerfile b/apps/relay/Dockerfile
index 60e0b92f..7f038966 100644
--- a/apps/relay/Dockerfile
+++ b/apps/relay/Dockerfile
@@ -8,7 +8,7 @@
 # No /etc/passwd: USER takes a numeric uid:gid, which the kernel applies
 # without a name lookup.
 
-FROM golang:1.26-alpine AS builder
+FROM golang:1.27-alpine AS builder
 WORKDIR /src
 
 COPY apps/relay/go.mod apps/relay/go.sum ./
diff --git a/apps/relay/cmd/relay/main.go b/apps/relay/cmd/relay/main.go
index f4b32575..366e3ced 100644
--- a/apps/relay/cmd/relay/main.go
+++ b/apps/relay/cmd/relay/main.go
@@ -56,7 +56,7 @@ func runHealthcheck() int {
 	// boucle locale, donc seul le port compte.
 	port := addr[strings.LastIndex(addr, ":")+1:]
 	client := &http.Client{Timeout: 4 * time.Second}
-	resp, err := client.Get("http://127.0.0.1:" + port + "/healthz")
+	resp, err := client.Get("http://127.0.0.1:" + port + "/healthz") // #nosec G704 -- boucle locale ; seul le port vient de l'environnement
 	if err != nil {
 		return 1
 	}
@@ -141,6 +141,8 @@ func main() {
 	mux.HandleFunc("/metrics", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "text/plain; version=0.0.4")
 		cfg := live.Get()
+		// Texte Prometheus fait de compteurs entiers : rien de la requête.
+		// nosemgrep: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
 		_, _ = w.Write([]byte(
 			"# HELP relay_connections Open SSE connections on this node.\n" +
 				"# TYPE relay_connections gauge\n" +
@@ -168,7 +170,7 @@ func main() {
 
 	srv := &http.Server{
 		Addr:              static.Addr,
-		Handler:           mux,
+		Handler:           noSniff(mux),
 		ReadHeaderTimeout: 10 * time.Second,
 		// No WriteTimeout: these responses are meant to stay open. The
 		// heartbeat is what detects a reader that went away.
@@ -196,6 +198,16 @@ func main() {
 	_ = srv.Shutdown(shutdown)
 }
 
+// noSniff : aucune réponse du relais n'est à deviner. Le flux SSE est
+// `text/event-stream`, `/healthz` et `/metrics` du texte brut ; le Caddyfile
+// livré pose l'en-tête, un ingress devant le chart ne le pose pas.
+func noSniff(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		next.ServeHTTP(w, r)
+	})
+}
+
 func itoa(v int64) string {
 	if v == 0 {
 		return "0"
diff --git a/apps/relay/cmd/relay/nosniff_test.go b/apps/relay/cmd/relay/nosniff_test.go
new file mode 100644
index 00000000..1951985c
--- /dev/null
+++ b/apps/relay/cmd/relay/nosniff_test.go
@@ -0,0 +1,23 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// Le relais pose nosniff lui-même, sans compter sur ce qui le précède.
+func TestNoSniff_SetOnEveryResponse(t *testing.T) {
+	h := noSniff(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		w.WriteHeader(http.StatusOK)
+	}))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/messaging/events", nil))
+	if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+		t.Fatalf("X-Content-Type-Options = %q, want nosniff", got)
+	}
+	if got := rec.Header().Get("Content-Type"); got != "text/event-stream" {
+		t.Fatalf("le Content-Type du handler a été perdu : %q", got)
+	}
+}
diff --git a/apps/relay/go.mod b/apps/relay/go.mod
index f932ff78..e31107f7 100644
--- a/apps/relay/go.mod
+++ b/apps/relay/go.mod
@@ -1,11 +1,11 @@
 module github.com/florianjs/trackarr/apps/relay
 
-go 1.26.0
+go 1.27.0
 
-require github.com/redis/go-redis/v9 v9.22.0
+require github.com/redis/go-redis/v9 v9.23.0
 
 require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	go.uber.org/atomic v1.12.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
diff --git a/apps/relay/go.sum b/apps/relay/go.sum
index 4f35daa9..edc2c001 100644
--- a/apps/relay/go.sum
+++ b/apps/relay/go.sum
@@ -4,19 +4,17 @@ github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
-github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=
-github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=
-github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/redis/go-redis/v9 v9.23.0 h1:/TTVdJa8BRNsybwwGGnmiYktHNlUXtbOQxlWpHBPL3s=
+github.com/redis/go-redis/v9 v9.23.0/go.mod h1:EWP2UUk+XDaI1s5nQB5mablZN6vccXlmBQTyfnF87D0=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+go.uber.org/atomic v1.12.0 h1:BvcXdFKuviU4fTL/f+SxdQ5qJX/Jix8pAkgdUcb3XOE=
+go.uber.org/atomic v1.12.0/go.mod h1:I6c4cg+6HCxRjfjSsYtApoFILnpc0CGUdGkXVqbYVNk=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
diff --git a/apps/relay/internal/sse/handler.go b/apps/relay/internal/sse/handler.go
index 7ff95920..1f584f6a 100644
--- a/apps/relay/internal/sse/handler.go
+++ b/apps/relay/internal/sse/handler.go
@@ -139,6 +139,9 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			if err != nil {
 				continue
 			}
+			// Un tableau JSON dans un flux text/event-stream (nosniff posé par
+			// le serveur) : du JSON, pas du balisage.
+			// nosemgrep: go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter
 			if _, err := fmt.Fprintf(w, "data: %s\n\n", encoded); err != nil {
 				return
 			}
diff --git a/apps/tracker/Dockerfile b/apps/tracker/Dockerfile
index cf294115..aa302b45 100644
--- a/apps/tracker/Dockerfile
+++ b/apps/tracker/Dockerfile
@@ -11,7 +11,7 @@
 # We also skip /etc/passwd: USER takes a numeric uid:gid, so the kernel
 # applies it without ever needing to look up a username.
 
-FROM golang:1.26-alpine AS builder
+FROM golang:1.27-alpine AS builder
 WORKDIR /src
 
 # Cache deps independently of source changes.
diff --git a/apps/tracker/cmd/tracker/main.go b/apps/tracker/cmd/tracker/main.go
index 06b249d8..59ce2922 100644
--- a/apps/tracker/cmd/tracker/main.go
+++ b/apps/tracker/cmd/tracker/main.go
@@ -187,7 +187,7 @@ func runHealthcheck() int {
 	url := "http://127.0.0.1:" + port + "/health"
 
 	client := &http.Client{Timeout: 4 * time.Second}
-	resp, err := client.Get(url)
+	resp, err := client.Get(url) // #nosec G704 -- always 127.0.0.1; only the port comes from the environment
 	if err != nil {
 		return 1
 	}
diff --git a/apps/tracker/go.mod b/apps/tracker/go.mod
index 823b2f7b..0fd10fe3 100644
--- a/apps/tracker/go.mod
+++ b/apps/tracker/go.mod
@@ -1,21 +1,21 @@
 module github.com/florianjs/trackarr/apps/tracker
 
-go 1.26.0
+go 1.27.0
 
 require (
-	github.com/alicebob/miniredis/v2 v2.38.0
-	github.com/jackc/pgx/v5 v5.10.0
-	github.com/redis/go-redis/v9 v9.22.0
+	github.com/alicebob/miniredis/v2 v2.40.0
+	github.com/jackc/pgx/v5 v5.11.0
+	github.com/redis/go-redis/v9 v9.23.0
 )
 
 require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/yuin/gopher-lua v1.1.1 // indirect
-	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	github.com/jackc/puddle/v2 v2.2.3 // indirect
+	github.com/yuin/gopher-lua v1.1.2 // indirect
+	go.uber.org/atomic v1.12.0 // indirect
+	golang.org/x/sync v0.24.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 )
diff --git a/apps/tracker/go.sum b/apps/tracker/go.sum
index 3e94c635..be24b4e2 100644
--- a/apps/tracker/go.sum
+++ b/apps/tracker/go.sum
@@ -1,5 +1,5 @@
-github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e2uP9jiw=
-github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
+github.com/alicebob/miniredis/v2 v2.40.0 h1:6IgTQbvm2JiMYZ8yur/acNJzVjtSOWCelxXbk/LUBXc=
+github.com/alicebob/miniredis/v2 v2.40.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
 github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
@@ -7,40 +7,37 @@ github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
-github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
-github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
-github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
-github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/jackc/pgx/v5 v5.11.0 h1:IzBBtyK9AHqf98cctWFifYSci2hgQR/cd56wB4p+ogg=
+github.com/jackc/pgx/v5 v5.11.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/puddle/v2 v2.2.3 h1:f8HoREISb3l5eO9coPgK7U3hKLhWGokOFVcThl5jrao=
+github.com/jackc/puddle/v2 v2.2.3/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=
-github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=
+github.com/redis/go-redis/v9 v9.23.0 h1:/TTVdJa8BRNsybwwGGnmiYktHNlUXtbOQxlWpHBPL3s=
+github.com/redis/go-redis/v9 v9.23.0/go.mod h1:EWP2UUk+XDaI1s5nQB5mablZN6vccXlmBQTyfnF87D0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
-github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=
+github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+go.uber.org/atomic v1.12.0 h1:BvcXdFKuviU4fTL/f+SxdQ5qJX/Jix8pAkgdUcb3XOE=
+go.uber.org/atomic v1.12.0/go.mod h1:I6c4cg+6HCxRjfjSsYtApoFILnpc0CGUdGkXVqbYVNk=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/apps/tracker/internal/anticheat/detect.go b/apps/tracker/internal/anticheat/detect.go
index f837b76d..eac078a6 100644
--- a/apps/tracker/internal/anticheat/detect.go
+++ b/apps/tracker/internal/anticheat/detect.go
@@ -16,6 +16,8 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"log/slog"
+	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -34,12 +36,22 @@ type Config struct {
 	MaxUploadBytesPerSecond int64
 }
 
-// DefaultConfig returns the operator-friendly defaults. The handler
-// can override individual fields without copy-pasting the rest.
+// DefaultConfig returns the operator-friendly defaults, with
+// `ANTICHEAT_MAX_BYTES_PER_SECOND` (bytes/s) overriding the velocity
+// threshold. The guide documented that variable long before anything read it;
+// it is read once, at start-up.
 func DefaultConfig() Config {
-	return Config{MaxUploadBytesPerSecond: 80 * 1024 * 1024}
+	return defaultConfig
 }
 
+var defaultConfig = func() Config {
+	cfg := Config{MaxUploadBytesPerSecond: 80 * 1024 * 1024}
+	if v, err := strconv.ParseInt(os.Getenv("ANTICHEAT_MAX_BYTES_PER_SECOND"), 10, 64); err == nil && v > 0 {
+		cfg.MaxUploadBytesPerSecond = v
+	}
+	return cfg
+}()
+
 // Flag is one detection event. The handler builds a slice per
 // announce; `Store` persists the whole slice in a single batch.
 type Flag struct {
diff --git a/apps/tracker/internal/peers/breaker.go b/apps/tracker/internal/peers/breaker.go
new file mode 100644
index 00000000..acc58c80
--- /dev/null
+++ b/apps/tracker/internal/peers/breaker.go
@@ -0,0 +1,186 @@
+package peers
+
+import (
+	"context"
+	"errors"
+	"net"
+	"sync/atomic"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+)
+
+// ErrRedisUnavailable is what every command returns, without reaching Redis,
+// while the breaker is open.
+var ErrRedisUnavailable = errors.New("redis unavailable: circuit open")
+
+const (
+	// breakerCooldown is how long the breaker stays open before one command is
+	// let through to probe.
+	breakerCooldown = time.Second
+	// breakerThreshold is how many timeouts in a row, with no reply from the
+	// server in between, open it.
+	breakerThreshold = 3
+)
+
+// breaker fails Redis commands at once while Redis cannot be reached.
+//
+// Finding out that Redis is down is what made an outage slow, more than the
+// outage itself. Against a host that does not resolve or refuses connections,
+// go-redis dials five times a hundred milliseconds apart and retries the
+// command three times on top: two seconds per command. Against one that
+// accepts connections and never answers, each command waits out its read
+// timeout. An announce issues half a dozen commands, so the degraded mode
+// (answer without a swarm rather than refuse) took one to five seconds per
+// announce, and one that spent its whole deadline on Redis failed anyway on the
+// Postgres query that came after.
+//
+// What opens it: a connection refused or a host that does not resolve, at
+// once — go-redis has already made some twenty attempts before it reports one —
+// or `breakerThreshold` timeouts in a row. Any reply from the server resets the count, whatever it says:
+// redis.Nil, WRONGTYPE and a wrong password all prove Redis is up. So a latency
+// spike, where timeouts come between successes, does not turn into a second of
+// degraded announces, while a Redis that accepts connections and never answers
+// still opens it. A caller that gave up (context.Canceled), or whose deadline
+// had passed before the command even started, says nothing about Redis and is
+// not counted.
+//
+// Open, a command fails without touching the connection pool. After
+// `breakerCooldown`, one command at a time goes through as a probe; a reply
+// closes the breaker, a failure keeps it open for another cooldown.
+type breaker struct {
+	cooldown  time.Duration
+	threshold int32
+	timeouts  atomic.Int32
+	openUntil atomic.Int64 // unix nanoseconds; 0 when closed
+	probing   atomic.Bool
+}
+
+func newBreaker() *breaker {
+	return &breaker{cooldown: breakerCooldown, threshold: breakerThreshold}
+}
+
+// admit reports whether a command may go to Redis, and whether it is the probe.
+func (b *breaker) admit(now time.Time) (ok, probe bool) {
+	until := b.openUntil.Load()
+	if until == 0 {
+		return true, false
+	}
+	if now.UnixNano() < until {
+		return false, false
+	}
+	if b.probing.CompareAndSwap(false, true) {
+		return true, true
+	}
+	return false, false
+}
+
+func (b *breaker) record(err error, probe bool) {
+	switch classify(err) {
+	case replied:
+		b.timeouts.Store(0)
+		if b.openUntil.Load() != 0 {
+			b.openUntil.Store(0)
+		}
+	case unreachable:
+		b.open()
+	case timedOut:
+		if b.timeouts.Add(1) >= b.threshold || probe {
+			b.open()
+		}
+	}
+}
+
+func (b *breaker) open() {
+	b.openUntil.Store(time.Now().Add(b.cooldown).UnixNano())
+}
+
+// admittedKey marks the context of a command the breaker let through.
+type admittedKey struct{}
+
+// do runs one command, or one pipeline, through the breaker.
+//
+// A command go-redis issues while serving one already admitted belongs to it:
+// the handshake of a connection it opens — HELLO, AUTH, CLIENT SETINFO — runs
+// through the same hooks, with the same context. Refusing it kept the probe,
+// the one command allowed through an open breaker, from ever connecting: the
+// breaker never closed again. Counting it would count one failure twice.
+func (b *breaker) do(ctx context.Context, run func(context.Context) error, refuse func()) error {
+	if ctx.Value(admittedKey{}) != nil {
+		return run(ctx)
+	}
+	ok, probe := b.admit(time.Now())
+	if !ok {
+		refuse()
+		return ErrRedisUnavailable
+	}
+	if probe {
+		defer b.probing.Store(false)
+	}
+	inner := context.WithValue(ctx, admittedKey{}, struct{}{})
+	if ctx.Err() != nil {
+		return run(inner)
+	}
+	err := run(inner)
+	b.record(err, probe)
+	return err
+}
+
+type outcome int
+
+const (
+	inconclusive outcome = iota
+	replied
+	unreachable
+	timedOut
+)
+
+func classify(err error) outcome {
+	if err == nil {
+		return replied
+	}
+	var rerr redis.Error // a reply from the server, redis.Nil included
+	if errors.As(err, &rerr) {
+		return replied
+	}
+	if errors.Is(err, context.Canceled) || errors.Is(err, ErrRedisUnavailable) {
+		return inconclusive
+	}
+	// A deadline that fell while the command was under way, whoever set it. A
+	// connection attempt that timed out lands here too: it may only mean the
+	// caller had little time left. go-redis also reports the caller's deadline
+	// as such when it falls in a pause between two attempts, even when the
+	// attempt before it was refused.
+	var op *net.OpError
+	isOp := errors.As(err, &op)
+	if errors.Is(err, context.DeadlineExceeded) || (isOp && op.Timeout()) {
+		return timedOut
+	}
+	// Refused, unresolvable, unroutable: Redis is not there.
+	if isOp && op.Op == "dial" {
+		return unreachable
+	}
+	return inconclusive
+}
+
+func (b *breaker) DialHook(next redis.DialHook) redis.DialHook { return next }
+
+func (b *breaker) ProcessHook(next redis.ProcessHook) redis.ProcessHook {
+	return func(ctx context.Context, cmd redis.Cmder) error {
+		return b.do(ctx,
+			func(ctx context.Context) error { return next(ctx, cmd) },
+			func() { cmd.SetErr(ErrRedisUnavailable) })
+	}
+}
+
+func (b *breaker) ProcessPipelineHook(next redis.ProcessPipelineHook) redis.ProcessPipelineHook {
+	return func(ctx context.Context, cmds []redis.Cmder) error {
+		return b.do(ctx,
+			func(ctx context.Context) error { return next(ctx, cmds) },
+			func() {
+				for _, cmd := range cmds {
+					cmd.SetErr(ErrRedisUnavailable)
+				}
+			})
+	}
+}
diff --git a/apps/tracker/internal/peers/breaker_test.go b/apps/tracker/internal/peers/breaker_test.go
new file mode 100644
index 00000000..421906c6
--- /dev/null
+++ b/apps/tracker/internal/peers/breaker_test.go
@@ -0,0 +1,205 @@
+package peers
+
+import (
+	"context"
+	"errors"
+	"net"
+	"os"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/redis/go-redis/v9"
+)
+
+var (
+	errRefused = &net.OpError{Op: "dial", Net: "tcp",
+		Err: os.NewSyscallError("connect", syscall.ECONNREFUSED)}
+	errReadTimeout = &net.OpError{Op: "read", Net: "tcp", Err: os.ErrDeadlineExceeded}
+)
+
+func TestClassify(t *testing.T) {
+	mr := miniredis.RunT(t)
+	c := redis.NewClient(&redis.Options{Addr: mr.Addr()})
+	defer c.Close()
+	ctx := context.Background()
+	if err := c.HSet(ctx, "h", "f", "v").Err(); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, tc := range []struct {
+		name string
+		err  error
+		want outcome
+	}{
+		{"success", nil, replied},
+		{"redis.Nil", c.Get(ctx, "missing").Err(), replied},
+		{"WRONGTYPE", c.Get(ctx, "h").Err(), replied},
+		{"connection refused", errRefused, unreachable},
+		{"no such host", &net.OpError{Op: "dial", Net: "tcp",
+			Err: &net.DNSError{Err: "no such host", Name: "redis", IsNotFound: true}}, unreachable},
+		{"dial timeout", &net.OpError{Op: "dial", Net: "tcp", Err: os.ErrDeadlineExceeded}, timedOut},
+		{"read timeout", errReadTimeout, timedOut},
+		{"caller deadline", context.DeadlineExceeded, timedOut},
+		{"caller gave up", context.Canceled, inconclusive},
+		{"connection reset", &net.OpError{Op: "read", Net: "tcp",
+			Err: os.NewSyscallError("read", syscall.ECONNRESET)}, inconclusive},
+		{"breaker open", ErrRedisUnavailable, inconclusive},
+	} {
+		if got := classify(tc.err); got != tc.want {
+			t.Errorf("%s (%v): got %d, want %d", tc.name, tc.err, got, tc.want)
+		}
+	}
+}
+
+// call runs one fake command through the breaker and reports whether it
+// reached "Redis".
+func call(b *breaker, ctx context.Context, result error) (reached bool, err error) {
+	err = b.do(ctx, func(context.Context) error { reached = true; return result }, func() {})
+	return reached, err
+}
+
+func TestBreaker_TimeoutsOpenItOnlyInARow(t *testing.T) {
+	b := &breaker{cooldown: time.Hour, threshold: 3}
+	ctx := context.Background()
+	call(b, ctx, errReadTimeout)
+	call(b, ctx, errReadTimeout)
+	call(b, ctx, nil) // a reply in between: a latency spike, not an outage
+	call(b, ctx, errReadTimeout)
+	call(b, ctx, errReadTimeout)
+	if reached, _ := call(b, ctx, errReadTimeout); !reached {
+		t.Fatal("two timeouts after a reply opened the breaker")
+	}
+	if reached, err := call(b, ctx, nil); reached || !errors.Is(err, ErrRedisUnavailable) {
+		t.Fatalf("three timeouts in a row: reached=%v err=%v, want refused", reached, err)
+	}
+}
+
+func TestBreaker_RefusedOpensItAtOnceAndAProbeClosesIt(t *testing.T) {
+	const cooldown = 30 * time.Millisecond
+	b := &breaker{cooldown: cooldown, threshold: 3}
+	ctx := context.Background()
+
+	call(b, ctx, errRefused)
+	if reached, err := call(b, ctx, nil); reached || !errors.Is(err, ErrRedisUnavailable) {
+		t.Fatalf("after a refused connection: reached=%v err=%v, want refused", reached, err)
+	}
+
+	// After the cooldown, one probe at a time.
+	time.Sleep(cooldown + 10*time.Millisecond)
+	release := make(chan error)
+	probeDone := make(chan error)
+	go func() {
+		probeDone <- b.do(ctx, func(context.Context) error { return <-release }, func() {})
+	}()
+	deadline := time.Now().Add(time.Second)
+	for !b.probing.Load() {
+		if time.Now().After(deadline) {
+			t.Fatal("the probe never started")
+		}
+		time.Sleep(time.Millisecond)
+	}
+	if reached, _ := call(b, ctx, nil); reached {
+		t.Fatal("a second command went through while the probe was in flight")
+	}
+	release <- errRefused
+	<-probeDone
+	if reached, _ := call(b, ctx, nil); reached {
+		t.Fatal("a failed probe did not keep the breaker open")
+	}
+
+	time.Sleep(cooldown + 10*time.Millisecond)
+	if reached, err := call(b, ctx, redis.Nil); !reached || !errors.Is(err, redis.Nil) {
+		t.Fatalf("probe: reached=%v err=%v", reached, err)
+	}
+	for i := 0; i < 3; i++ {
+		if reached, _ := call(b, ctx, nil); !reached {
+			t.Fatalf("command %d refused after a probe got a reply", i)
+		}
+	}
+}
+
+// go-redis opens the probe's connection with a handshake that runs through the
+// same hooks: refused, it kept every probe from connecting, and the breaker,
+// once open, never closed again.
+func TestBreaker_LetsThroughWhatAnAdmittedCommandIssues(t *testing.T) {
+	const cooldown = 10 * time.Millisecond
+	b := &breaker{cooldown: cooldown, threshold: 3}
+	ctx := context.Background()
+	call(b, ctx, errRefused)
+	time.Sleep(cooldown + 5*time.Millisecond)
+
+	nested := false
+	err := b.do(ctx, func(inner context.Context) error {
+		// the probe, opening its connection
+		return b.do(inner, func(context.Context) error { nested = true; return nil }, func() {})
+	}, func() {})
+	if err != nil || !nested {
+		t.Fatalf("the probe's handshake: nested=%v err=%v", nested, err)
+	}
+	if reached, _ := call(b, ctx, nil); !reached {
+		t.Fatal("the breaker did not close after the probe connected")
+	}
+}
+
+func TestBreaker_IgnoresTheCallersOwnContext(t *testing.T) {
+	b := &breaker{cooldown: time.Hour, threshold: 3}
+	expired, cancel := context.WithDeadline(context.Background(), time.Now().Add(-time.Second))
+	defer cancel()
+	for i := 0; i < 10; i++ {
+		// A deadline already gone before the command started: Postgres ate the
+		// announce's budget, Redis did nothing wrong.
+		call(b, expired, context.DeadlineExceeded)
+		call(b, context.Background(), context.Canceled)
+	}
+	if reached, _ := call(b, context.Background(), nil); !reached {
+		t.Fatal("the callers' own contexts opened the breaker")
+	}
+}
+
+// The client the tracker builds: once Redis is gone, the first command finds
+// out the slow way and every one after it fails at once, pipelines included;
+// once it is back, the first probe after the cooldown closes the breaker.
+func TestNewClientFromURL_FailsFastWhileRedisIsGone(t *testing.T) {
+	mr := miniredis.RunT(t)
+	c, err := NewClientFromURL("redis://"+mr.Addr(), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer c.Close()
+	ctx := context.Background()
+	if err := c.Set(ctx, "k", "v", 0).Err(); err != nil {
+		t.Fatal(err)
+	}
+
+	mr.Close()
+	if err := c.Get(ctx, "k").Err(); err == nil {
+		t.Fatal("GET succeeded against a closed server")
+	}
+	start := time.Now()
+	for i := 0; i < 50; i++ {
+		if err := c.Get(ctx, "k").Err(); !errors.Is(err, ErrRedisUnavailable) {
+			t.Fatalf("GET %d: %v, want ErrRedisUnavailable", i, err)
+		}
+	}
+	_, err = c.Pipelined(ctx, func(p redis.Pipeliner) error {
+		p.Get(ctx, "k")
+		p.Incr(ctx, "n")
+		return nil
+	})
+	if !errors.Is(err, ErrRedisUnavailable) {
+		t.Fatalf("pipeline: %v, want ErrRedisUnavailable", err)
+	}
+	if d := time.Since(start); d > 200*time.Millisecond {
+		t.Fatalf("fifty-one refused commands took %v", d)
+	}
+
+	if err := mr.Restart(); err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(breakerCooldown + 100*time.Millisecond)
+	if v, err := c.Get(ctx, "k").Result(); err != nil || v != "v" {
+		t.Fatalf("after the restart: %q, %v", v, err)
+	}
+}
diff --git a/apps/tracker/internal/peers/peers.go b/apps/tracker/internal/peers/peers.go
index 4d937d90..20522476 100644
--- a/apps/tracker/internal/peers/peers.go
+++ b/apps/tracker/internal/peers/peers.go
@@ -68,6 +68,12 @@ type PeerData struct {
 	Left       int64  `json:"left"`
 	IsSeeder   bool   `json:"isSeeder"`
 	UpdatedAt  int64  `json:"updatedAt"` // unix millis
+
+	// Field is the hash field the entry lives under — its peer_id, or
+	// `peer_id:user_id` when another member already holds that peer_id (see
+	// `Slot`). Filled by `Slot` and `List`, read by `Set` and by whoever removes
+	// a listed entry; never stored.
+	Field string `json:"-"`
 }
 
 // countsCacheTTL bounds how stale `Counts` is allowed to go. Each
@@ -232,11 +238,18 @@ const staleWriteWindowMs = 5000
 // cjson is used to READ the two counters for comparison and nothing else — the
 // value written is the payload Go marshalled, byte for byte. Re-encoding in
 // Lua would round int64 byte counts through a double.
+//
+// It also refuses, with 2, to write over an entry another member owns — the
+// atomic half of `Slot`, for two members claiming one free peer_id at once.
 var setPeerScript = redis.NewScript(`
 local cur = redis.call('HGET', KEYS[1], ARGV[1])
 if cur then
   local ok, d = pcall(cjson.decode, cur)
   if ok and type(d) == 'table' then
+    if ARGV[8] ~= '' and type(d.userId) == 'string' and d.userId ~= ''
+       and d.userId ~= ARGV[8] then
+      return 2
+    end
     local age = tonumber(ARGV[5]) - (tonumber(d.updatedAt) or 0)
     if age >= 0 and age <= tonumber(ARGV[6]) then
       if (tonumber(d.uploaded) or 0) > tonumber(ARGV[3])
@@ -258,6 +271,10 @@ return 1
 // a TTL (which previously caused slow memory leaks on swarms that went idle
 // right after their first peer). The same script is what drops a stale
 // concurrent write.
+//
+// The entry goes under `p.Field`, or the bare peer_id when that is empty. If
+// another member took that peer_id in the meantime, it goes under this
+// member's own field instead, as `Slot` would have chosen.
 func (s *Store) Set(ctx context.Context, infoHashHex string, p *PeerData) error {
 	now := time.Now().UnixMilli()
 	p.UpdatedAt = now
@@ -265,15 +282,32 @@ func (s *Store) Set(ctx context.Context, infoHashHex string, p *PeerData) error
 	if err != nil {
 		return err
 	}
+	field := p.Field
+	if field == "" {
+		field = p.PeerID
+	}
 	key := s.peerKey(infoHashHex)
-	written, err := setPeerScript.Run(ctx, s.client,
-		[]string{key},
-		p.PeerID, data, p.Uploaded, p.Downloaded,
-		now, staleWriteWindowMs, int(s.peerTTL.Seconds()),
-	).Int()
+	run := func(field string) (int, error) {
+		return setPeerScript.Run(ctx, s.client,
+			[]string{key},
+			field, data, p.Uploaded, p.Downloaded,
+			now, staleWriteWindowMs, int(s.peerTTL.Seconds()), p.UserID,
+		).Int()
+	}
+	written, err := run(field)
+	if err == nil && written == 2 && field == p.PeerID && p.UserID != "" {
+		field = memberField(p.PeerID, p.UserID)
+		written, err = run(field)
+	}
 	if err != nil {
 		return err
 	}
+	p.Field = field
+	if written == 2 {
+		slog.Debug("peers: entry held by another member, not written",
+			"info_hash", infoHashHex, "field", field)
+		return nil
+	}
 	if written == 0 {
 		// Not an error: a concurrent announce already stored a fresher
 		// snapshot for this peer, so ours is the one to drop.
@@ -310,9 +344,63 @@ func (s *Store) Get(ctx context.Context, infoHashHex, peerIDHex string) (*PeerDa
 	return p, nil
 }
 
-// Remove deletes a single peer from the swarm.
-func (s *Store) Remove(ctx context.Context, infoHashHex, peerIDHex string) error {
-	err := s.client.HDel(ctx, s.peerKey(infoHashHex), peerIDHex).Err()
+// memberField is where a member's entry goes when another member holds its
+// peer_id. A peer_id is forty hex characters, so the colon cannot clash with a
+// bare one.
+func memberField(peerIDHex, userID string) string { return peerIDHex + ":" + userID }
+
+// Slot finds this member's entry for this peer_id, and the field it lives (or
+// will live) under.
+//
+// Entries are keyed by (info_hash, peer_id), and a peer_id is no secret: every
+// client in the swarm reads it in the BitTorrent handshake. Overwriting
+// another member's entry is how a stranger could delete their baseline (a
+// `stopped`) or replace it with their own counters and address. Refusing the
+// newcomer outright was no better: a stranger who announced a peer_id first —
+// after its owner paused the torrent, say — kept the owner out of the swarm
+// and out of credit for as long as they kept announcing, and two clients that
+// genuinely share a peer_id could never both be served.
+//
+// So a member whose peer_id is held by someone else gets a field of its own,
+// `peer_id:user_id`, and keeps it while it lives — it does not move back to the
+// bare field when that frees up, which would cost it its baseline. Both fields
+// come back in one HMGET. An entry with no owner predates `userId` and belongs
+// to whoever announces it.
+func (s *Store) Slot(ctx context.Context, infoHashHex, peerIDHex, userID string) (*PeerData, string, error) {
+	own := memberField(peerIDHex, userID)
+	vals, err := s.client.HMGet(ctx, s.peerKey(infoHashHex), own, peerIDHex).Result()
+	if err != nil {
+		return nil, peerIDHex, err
+	}
+	if p := s.fresh(ctx, infoHashHex, own, vals[0]); p != nil {
+		return p, own, nil
+	}
+	p := s.fresh(ctx, infoHashHex, peerIDHex, vals[1])
+	if p != nil && p.UserID != "" && p.UserID != userID {
+		return nil, own, nil
+	}
+	return p, peerIDHex, nil
+}
+
+// fresh decodes one HMGET value: nil when absent, and the entry is dropped
+// when unreadable or older than the peer TTL, as `Get` does.
+func (s *Store) fresh(ctx context.Context, infoHashHex, field string, v any) *PeerData {
+	raw, ok := v.(string)
+	if !ok {
+		return nil
+	}
+	p := &PeerData{}
+	if json.Unmarshal([]byte(raw), p) != nil || time.Since(time.UnixMilli(p.UpdatedAt)) > s.peerTTL {
+		_ = s.client.HDel(ctx, s.peerKey(infoHashHex), field).Err()
+		return nil
+	}
+	p.Field = field
+	return p
+}
+
+// Remove deletes a single entry from the swarm, by its field.
+func (s *Store) Remove(ctx context.Context, infoHashHex, field string) error {
+	err := s.client.HDel(ctx, s.peerKey(infoHashHex), field).Err()
 	s.invalidateCounts(infoHashHex)
 	return err
 }
@@ -334,7 +422,7 @@ func (s *Store) List(ctx context.Context, infoHashHex string) ([]*PeerData, erro
 	stale := make([]string, 0)
 	activeCutoffMs := activeListWindow.Milliseconds()
 	for pid, raw := range all {
-		p := &PeerData{}
+		p := &PeerData{Field: pid}
 		if err := json.Unmarshal([]byte(raw), p); err != nil {
 			stale = append(stale, pid)
 			continue
@@ -584,6 +672,56 @@ func (s *Store) creditBudgetKey(u string) string {
 	return s.prefix + "credit_budget:" + u
 }
 
+/*
+ * seedTimeScript — jusqu'où le temps de seed d'un compte est déjà crédité, par
+ * torrent.
+ *
+ * Le temps de seed se crédite en temps réel : un seedeur qui réannonce toutes
+ * les `interval` doit voir son compteur avancer d'autant. Le correctif de
+ * 3e6d848 — cent peer_id versaient chacun le même intervalle dans la même ligne
+ * `hnr_tracking` — plafonnait `elapsed` à `minAnnounceInterval` (900 s) sous
+ * une fenêtre de déduplication de même durée. Mais les clients réannoncent
+ * toutes les 1 800 s : chaque annonce n'en créditait que 900, la moitié du temps
+ * réel, et toute exigence H&R s'en trouvait doublée.
+ *
+ * On garde à la place l'instant jusqu'où le compte a été crédité sur ce
+ * torrent. Une annonce crédite de `max(marque, ligne de base du peer)` à
+ * maintenant, plafonné, puis avance la marque à maintenant. Les intervalles
+ * crédités sont donc disjoints quel que soit le nombre de peer_id — leur somme
+ * ne dépasse jamais le temps réel — et un peer seul qui suit l'intervalle est
+ * crédité de tout son temps. Atomique, donc aussi juste entre réplicas.
+ *
+ * KEYS[1] la marque · ARGV[1] maintenant (ms) · ARGV[2] ligne de base du peer
+ * (ms) · ARGV[3] plafond (ms) · ARGV[4] durée de vie de la marque (s)
+ */
+var seedTimeScript = redis.NewScript(`
+local last  = tonumber(redis.call('GET', KEYS[1]) or '0')
+local now   = tonumber(ARGV[1])
+local from  = math.max(last, tonumber(ARGV[2]))
+if now <= from then return 0 end
+local credit = math.min(now - from, tonumber(ARGV[3]))
+redis.call('SET', KEYS[1], now, 'EX', tonumber(ARGV[4]))
+return math.floor(credit / 1000)
+`)
+
+// ClaimSeedTime réserve, en secondes, le temps de seed que cette annonce peut
+// créditer au compte sur ce torrent : de la ligne de base du peer (`since`), ou
+// de la marque si elle est plus récente, jusqu'à `now`, plafonné à `maxCredit`.
+// Un intervalle déjà crédité par un autre peer_id du même compte ne l'est pas
+// deux fois.
+//
+// La marque vit aussi longtemps qu'une entrée de peer : passé ce délai, la
+// ligne de base du peer redevient le seul point de départ, et elle a expiré
+// avec lui.
+func (s *Store) ClaimSeedTime(
+	ctx context.Context, torrentID, userID string, now, since time.Time, maxCredit time.Duration,
+) (int64, error) {
+	return seedTimeScript.Run(ctx, s.client,
+		[]string{s.prefix + "seedtime:" + torrentID + ":" + userID},
+		now.UnixMilli(), since.UnixMilli(), maxCredit.Milliseconds(), int64(s.peerTTL/time.Second),
+	).Int64()
+}
+
 func (s *Store) peerKey(h string) string  { return s.prefix + "peers:" + h }
 func (s *Store) statsKey(h string) string { return s.prefix + "stats:" + h }
 
@@ -609,5 +747,8 @@ func NewClientFromURL(redisURL, password string) (*redis.Client, error) {
 	if opts.WriteTimeout == 0 {
 		opts.WriteTimeout = 3 * time.Second
 	}
-	return redis.NewClient(opts), nil
+	// Fail fast while Redis is out of reach — see breaker.go.
+	client := redis.NewClient(opts)
+	client.AddHook(newBreaker())
+	return client, nil
 }
diff --git a/apps/tracker/internal/peers/peers_test.go b/apps/tracker/internal/peers/peers_test.go
index 50417944..b8657062 100644
--- a/apps/tracker/internal/peers/peers_test.go
+++ b/apps/tracker/internal/peers/peers_test.go
@@ -769,3 +769,110 @@ func TestTakeCreditBudget_LetsAnHonestSeederThrough(t *testing.T) {
 		}
 	}
 }
+
+// ----------------------------------------------------------------------------
+// ClaimSeedTime — le temps de seed se crédite en temps réel, une seule fois
+// ----------------------------------------------------------------------------
+
+const seedCap = 3600 * time.Second
+
+// Un seedeur qui réannonce toutes les 1 800 s doit voir 1 800 s à chaque
+// annonce — pas 900, ce que créditait le plafond à `minAnnounceInterval`.
+func TestClaimSeedTime_CreditsAnHonestSeederInFull(t *testing.T) {
+	t.Parallel()
+	s, mr := newTestStore(t, 24*time.Hour)
+	defer mr.Close()
+	ctx := context.Background()
+
+	t0 := time.Unix(1_700_000_000, 0)
+	for i := 1; i <= 4; i++ {
+		now := t0.Add(time.Duration(i) * 1800 * time.Second)
+		prev := now.Add(-1800 * time.Second) // la ligne de base du peer
+		got, err := s.ClaimSeedTime(ctx, "torrent", "user", now, prev, seedCap)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got != 1800 {
+			t.Fatalf("annonce %d : %d s crédités, 1800 attendus", i, got)
+		}
+	}
+}
+
+// Cent peer_id du même compte sur le même torrent, à la même seconde : un seul
+// intervalle de temps réel au total.
+func TestClaimSeedTime_ManyPeerIDsNeverBeatRealTime(t *testing.T) {
+	t.Parallel()
+	s, mr := newTestStore(t, 24*time.Hour)
+	defer mr.Close()
+	ctx := context.Background()
+
+	now := time.Unix(1_700_000_000, 0)
+	var total int64
+	for i := 0; i < 100; i++ {
+		got, err := s.ClaimSeedTime(ctx, "torrent", "user", now, now.Add(-1800*time.Second), seedCap)
+		if err != nil {
+			t.Fatal(err)
+		}
+		total += got
+	}
+	if total != 1800 {
+		t.Fatalf("%d s crédités pour 1800 s de temps réel", total)
+	}
+
+	// Deux peer_id décalés : les intervalles crédités se suivent sans se
+	// recouvrir, et leur somme est le temps écoulé.
+	later := now.Add(900 * time.Second)
+	got, err := s.ClaimSeedTime(ctx, "torrent", "user", later, now.Add(-900*time.Second), seedCap)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != 900 {
+		t.Fatalf("le second peer_id devait recevoir les 900 s écoulées depuis la marque, a reçu %d", got)
+	}
+}
+
+// Une ligne de base vieille de vingt heures ne réclame pas vingt heures.
+func TestClaimSeedTime_CapsAnOldBaseline(t *testing.T) {
+	t.Parallel()
+	s, mr := newTestStore(t, 24*time.Hour)
+	defer mr.Close()
+
+	now := time.Unix(1_700_000_000, 0)
+	got, err := s.ClaimSeedTime(context.Background(), "torrent", "user", now, now.Add(-20*time.Hour), seedCap)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != 3600 {
+		t.Fatalf("%d s crédités, le plafond est 3600", got)
+	}
+}
+
+// Rien n'est crédité à l'envers (horloges décalées entre réplicas), et la
+// marque n'est pas reculée.
+func TestClaimSeedTime_NothingForAnIntervalAlreadyCredited(t *testing.T) {
+	t.Parallel()
+	s, mr := newTestStore(t, 24*time.Hour)
+	defer mr.Close()
+	ctx := context.Background()
+
+	now := time.Unix(1_700_000_000, 0)
+	if _, err := s.ClaimSeedTime(ctx, "torrent", "user", now, now.Add(-60*time.Second), seedCap); err != nil {
+		t.Fatal(err)
+	}
+	got, err := s.ClaimSeedTime(ctx, "torrent", "user", now.Add(-30*time.Second), now.Add(-90*time.Second), seedCap)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != 0 {
+		t.Fatalf("%d s crédités pour un intervalle déjà payé", got)
+	}
+
+	// Un autre torrent, ou un autre compte, a sa propre marque.
+	other, _ := s.ClaimSeedTime(ctx, "torrent-2", "user", now, now.Add(-60*time.Second), seedCap)
+	if other != 60 {
+		t.Fatalf("la marque d'un torrent a débordé sur un autre : %d", other)
+	}
+	if ttl := mr.TTL("ot:seedtime:torrent:user"); ttl != 24*time.Hour {
+		t.Fatalf("la marque doit vivre comme une entrée de peer, TTL %v", ttl)
+	}
+}
diff --git a/apps/tracker/internal/peers/slot_test.go b/apps/tracker/internal/peers/slot_test.go
new file mode 100644
index 00000000..0c1af56a
--- /dev/null
+++ b/apps/tracker/internal/peers/slot_test.go
@@ -0,0 +1,103 @@
+package peers
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+func memberPeer(peerID, userID string, port uint16) *PeerData {
+	return &PeerData{PeerID: peerID, UserID: userID, IP: "203.0.113.9", Port: port}
+}
+
+// A peer_id is public. A stranger announcing under one a member holds must get
+// an entry of their own — never the member's baseline, never a refusal that
+// would let them keep the member out.
+func TestSlot_AnotherMembersPeerIDGetsItsOwnField(t *testing.T) {
+	s, _ := newTestStore(t, time.Hour)
+	ctx := context.Background()
+	if err := s.Set(ctx, "h", memberPeer("p1", "alice", 1)); err != nil {
+		t.Fatal(err)
+	}
+
+	prev, field, err := s.Slot(ctx, "h", "p1", "mallory")
+	if err != nil || prev != nil || field != "p1:mallory" {
+		t.Fatalf("stranger: prev=%v field=%q err=%v, want nil, p1:mallory", prev, field, err)
+	}
+	stranger := memberPeer("p1", "mallory", 2)
+	stranger.Field = field
+	if err := s.Set(ctx, "h", stranger); err != nil {
+		t.Fatal(err)
+	}
+
+	prev, field, _ = s.Slot(ctx, "h", "p1", "alice")
+	if prev == nil || prev.UserID != "alice" || prev.Port != 1 || field != "p1" {
+		t.Fatalf("owner after the stranger wrote: %+v field=%q", prev, field)
+	}
+
+	// The stranger's `stopped` removes their own entry and nothing else.
+	if err := s.Remove(ctx, "h", "p1:mallory"); err != nil {
+		t.Fatal(err)
+	}
+	if got, _ := s.Get(ctx, "h", "p1"); got == nil || got.UserID != "alice" {
+		t.Fatalf("owner's entry after the stranger's stop: %+v", got)
+	}
+}
+
+// Once on a field of its own, a member stays there while it lives: moving back
+// to the bare peer_id when that frees up would cost it its baseline.
+func TestSlot_StaysOnTheMembersFieldWhenTheBareOneFreesUp(t *testing.T) {
+	s, _ := newTestStore(t, time.Hour)
+	ctx := context.Background()
+	_ = s.Set(ctx, "h", memberPeer("p1", "alice", 1))
+	own := memberPeer("p1", "bob", 2)
+	own.Field = "p1:bob"
+	_ = s.Set(ctx, "h", own)
+	_ = s.Remove(ctx, "h", "p1") // alice leaves
+
+	prev, field, _ := s.Slot(ctx, "h", "p1", "bob")
+	if prev == nil || prev.Port != 2 || field != "p1:bob" {
+		t.Fatalf("bob after alice left: %+v field=%q, want his own entry", prev, field)
+	}
+}
+
+// Two members claiming one free peer_id at the same moment both see it free;
+// the script settles it, and the second write lands on its own field.
+func TestSet_NeverOverwritesAnotherMembersEntry(t *testing.T) {
+	s, _ := newTestStore(t, time.Hour)
+	ctx := context.Background()
+	_ = s.Set(ctx, "h", memberPeer("p1", "alice", 1))
+
+	late := memberPeer("p1", "bob", 2)
+	late.Field = "p1" // what a racing Slot would have answered
+	if err := s.Set(ctx, "h", late); err != nil {
+		t.Fatal(err)
+	}
+	if late.Field != "p1:bob" {
+		t.Fatalf("written under %q, want p1:bob", late.Field)
+	}
+	if got, _ := s.Get(ctx, "h", "p1"); got == nil || got.UserID != "alice" || got.Port != 1 {
+		t.Fatalf("alice's entry: %+v", got)
+	}
+	list, _ := s.List(ctx, "h")
+	fields := map[string]string{}
+	for _, p := range list {
+		fields[p.Field] = p.UserID
+	}
+	if len(fields) != 2 || fields["p1"] != "alice" || fields["p1:bob"] != "bob" {
+		t.Fatalf("listed fields: %v", fields)
+	}
+}
+
+// An entry written before `userId` existed has no owner, and is taken over by
+// whoever announces it, as before.
+func TestSlot_AdoptsAnEntryWithNoOwner(t *testing.T) {
+	s, mr := newTestStore(t, time.Hour)
+	ctx := context.Background()
+	injectPeer(t, mr, "h", PeerData{PeerID: "p1", Port: 1, UpdatedAt: time.Now().UnixMilli()})
+
+	prev, field, _ := s.Slot(ctx, "h", "p1", "alice")
+	if prev == nil || field != "p1" {
+		t.Fatalf("legacy entry: %+v field=%q", prev, field)
+	}
+}
diff --git a/apps/tracker/internal/server/dedup.go b/apps/tracker/internal/server/dedup.go
index 3c2e1c2d..1e017794 100644
--- a/apps/tracker/internal/server/dedup.go
+++ b/apps/tracker/internal/server/dedup.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"log/slog"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/redis/go-redis/v9"
@@ -54,9 +55,9 @@ const dedupRedisTimeout = 150 * time.Millisecond
 // bonus and hit-and-run.
 //
 // The same guard covers all three call sites — the per-event announce key,
-// the `:credit` key that gates the byte delta (finding M5) and the
-// `:seedtime` key that gates seed-time accrual (finding M7) — so all three
-// become correct across instances at once.
+// the `:credit` key that gates the byte delta (finding M5) and the anti-cheat
+// flags — so all three are correct across instances at once. (Seed time,
+// finding M7, used to be one of them; `peers.ClaimSeedTime` books it now.)
 //
 // Note what is NOT fixed here: the rate ceiling on the delta is derived from
 // `prev.UpdatedAt`, which lives in Redis and is therefore already shared, so
@@ -71,6 +72,11 @@ type dedup struct {
 	// single-instance deployment loses nothing by it.
 	rdb    *redis.Client
 	prefix string
+
+	// redisErrors counts the checks that fell back to the local map. Sampled
+	// in the log like the tracker's other outage counters: through a Redis
+	// outage every announce lands here, and one line each would bury the log.
+	redisErrors atomic.Uint64
 }
 
 func newDedup(rdb *redis.Client, keyPrefix string) *dedup {
@@ -98,9 +104,10 @@ func (d *dedup) CheckAndMark(ctx context.Context, key string) bool {
 //
 // The 2-second default is right for what it was written for: one announce
 // arriving on IPv4, IPv6 and localhost within milliseconds. It is wrong for
-// anything that books a QUANTITY per period — seed time, most of all. There,
-// the window has to be the period itself, or N concurrent peer_ids each claim
-// the same stretch of wall-clock time and the total is N times the truth.
+// what must be recorded at most once per period — the anti-cheat flags, keyed
+// per member and per kind over the minimum announce interval. (Seed time, the
+// first such quantity, moved to `peers.ClaimSeedTime`: a window can refuse a
+// second claim, it cannot credit a stretch of time exactly once.)
 func (d *dedup) CheckAndMarkFor(ctx context.Context, key string, window time.Duration) bool {
 	if !d.checkLocalFor(key, window) {
 		return false
@@ -131,49 +138,15 @@ func (d *dedup) checkRedisFor(ctx context.Context, key string, window time.Durat
 
 	ok, err := d.rdb.SetNX(ctx, d.prefix+"dedup:"+key, 1, window).Result()
 	if err != nil {
-		slog.Warn("dedup: redis unreachable, falling back to the local window",
-			"err", err)
+		if n := d.redisErrors.Add(1); n%1_000 == 1 {
+			slog.Warn("dedup: redis unreachable, falling back to the local window",
+				"count", n, "err", err)
+		}
 		return true
 	}
 	return ok
 }
 
-// Release lève un marqueur posé par `CheckAndMarkFor`.
-//
-// `CheckAndMark*` pose la marque AVANT que l'effet de bord qu'elle protège ait
-// eu lieu — c'est ce qui la rend atomique entre instances, et c'est aussi ce qui
-// laisse la marque en place quand cet effet échoue. Pour le crédit de temps de
-// seed, la fenêtre est de 900 s : une écriture Postgres ratée n'était pas
-// seulement perdue, elle interdisait toute reprise pendant un quart d'heure.
-//
-// Lever la marque rend la place à l'annonce suivante. Ce n'est PAS une
-// annulation exacte — entre l'échec et la levée, une annonce concurrente a pu
-// passer son tour — mais le coût d'un intervalle manqué n'a rien à voir avec
-// celui d'un quart d'heure aveugle.
-//
-// Les deux couches sont levées. Ne lever que Redis laisserait la carte locale
-// refuser jusqu'à la fin de la fenêtre sur l'instance qui a échoué, c'est-à-dire
-// exactement celle vers laquelle le client va se réannoncer.
-//
-// Aucune erreur n'est remontée : si Redis ne répond pas, `checkRedisFor` échoue
-// déjà OUVERT (il rend `true` sans poser de marque), donc il n'y a rien à lever
-// dans ce cas de figure.
-func (d *dedup) Release(ctx context.Context, key string) {
-	d.mu.Lock()
-	delete(d.seen, key)
-	d.mu.Unlock()
-
-	if d.rdb == nil {
-		return
-	}
-	ctx, cancel := context.WithTimeout(ctx, dedupRedisTimeout)
-	defer cancel()
-	if err := d.rdb.Del(ctx, d.prefix+"dedup:"+key).Err(); err != nil {
-		slog.Warn("dedup: could not release a marker, the next credit will wait out its window",
-			"err", err)
-	}
-}
-
 // Stop signals the cleanup goroutine to exit.
 func (d *dedup) Stop() { close(d.stop) }
 
diff --git a/apps/tracker/internal/server/dedup_release_test.go b/apps/tracker/internal/server/dedup_release_test.go
deleted file mode 100644
index 27796f7f..00000000
--- a/apps/tracker/internal/server/dedup_release_test.go
+++ /dev/null
@@ -1,52 +0,0 @@
-package server
-
-import (
-	"context"
-	"testing"
-	"time"
-)
-
-// Une marque rendue laisse repasser tout de suite.
-//
-// `CheckAndMarkFor` pose la marque AVANT l'effet de bord qu'elle protège, et
-// rien ne la retirait quand cet effet n'avait pas lieu. Pour le crédit de temps
-// de seed la fenêtre est de 900 s : une écriture Postgres ratée n'était pas
-// seulement perdue, elle interdisait toute reprise pendant un quart d'heure —
-// le hit-and-run cessait de mesurer, en silence.
-func TestReleaseLetsTheNextAttemptThrough(t *testing.T) {
-	d := newDedup(nil, "ot:")
-	defer d.Stop()
-
-	ctx := context.Background()
-	const key = "hash:user:seedtime"
-	const window = 900 * time.Second
-
-	if !d.CheckAndMarkFor(ctx, key, window) {
-		t.Fatal("la première tentative doit passer")
-	}
-	if d.CheckAndMarkFor(ctx, key, window) {
-		t.Fatal("la deuxième doit être refusée : c'est le rôle de la marque")
-	}
-
-	// L'écriture a échoué : on rend la place.
-	d.Release(ctx, key)
-
-	if !d.CheckAndMarkFor(ctx, key, window) {
-		t.Fatal("après Release, la reprise doit passer — sinon la perte dure toute la fenêtre")
-	}
-	if d.CheckAndMarkFor(ctx, key, window) {
-		t.Fatal("Release ne doit pas désarmer la marque pour de bon")
-	}
-}
-
-// Rendre une marque qui n'existe pas ne casse rien, et n'en crée pas une.
-func TestReleaseOfAnUnknownKeyIsHarmless(t *testing.T) {
-	d := newDedup(nil, "ot:")
-	defer d.Stop()
-
-	ctx := context.Background()
-	d.Release(ctx, "jamais-posee")
-	if !d.CheckAndMarkFor(ctx, "jamais-posee", time.Minute) {
-		t.Fatal("Release ne doit pas laisser d'état derrière lui")
-	}
-}
diff --git a/apps/tracker/internal/server/handler.go b/apps/tracker/internal/server/handler.go
index 6c81f397..4661c1ac 100644
--- a/apps/tracker/internal/server/handler.go
+++ b/apps/tracker/internal/server/handler.go
@@ -7,6 +7,7 @@ import (
 	"net"
 	"net/http"
 	"runtime"
+	"sort"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -86,6 +87,13 @@ type Server struct {
 	// le journal comme les compteurs UDP : ce qui compte est la PENTE, pas la
 	// valeur.
 	seedTimeDropped atomic.Uint64
+	// swarmUnavailable compte les annonces servies sans essaim parce que Redis
+	// ne répondait pas (voir `degradedOutcome`). Un compteur plutôt qu'une
+	// ligne par annonce : une panne de Redis ne doit pas se doubler d'une
+	// avalanche de journaux.
+	swarmUnavailable atomic.Uint64
+	// lookups answers from memory the announces that cannot succeed.
+	lookups *lookupGuard
 }
 
 // New builds a Server. It does not start listening — callers wire it into
@@ -110,6 +118,7 @@ func New(appCtx context.Context, db *dbpkg.DB, rclient *redis.Client, store *pee
 		peers:           store,
 		bonus:           bonus.New(rclient, redisKeyPrefix),
 		dedup:           newDedup(rclient, redisKeyPrefix),
+		lookups:         newLookupGuard(),
 		stats:           stats.New(rclient, db.Q, redisKeyPrefix, statsFlushInterval, statsFlushChunk),
 		ipHashSecret:    ipHashSecret,
 		debug:           debug,
@@ -125,7 +134,19 @@ func (s *Server) Routes() http.Handler {
 	mux.HandleFunc("/announce", s.handleAnnounce)
 	mux.HandleFunc("/scrape", s.handleScrape)
 	mux.HandleFunc("/health", s.handleHealth)
-	return mux
+	return noSniff(mux)
+}
+
+// noSniff stops a browser from guessing a type for these bodies. They are
+// declared text/plain or JSON, and a bencoded failure reason or peer list read
+// as HTML is what a sniffing browser could make of them. The shipped Caddyfile
+// adds the header on the tracker host; an ingress in front of the chart does
+// not, so the tracker sets it itself.
+func noSniff(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		next.ServeHTTP(w, r)
+	})
 }
 
 // Stop tears the server down: stops the dedup eviction loop, then
@@ -160,6 +181,15 @@ func (s *Server) Stop() {
 // give up on it.
 const bgDrainTimeout = 8 * time.Second
 
+// maxSeedTimeCredit bounds what one announce may credit as seed time: two
+// announce intervals, so a client that missed one announce is not
+// short-changed, while a baseline left hours ago cannot claim the whole gap.
+const maxSeedTimeCredit = 2 * announceInterval * time.Second
+
+// announceDeadline bounds one announce end to end, under the HTTP server's
+// 10 s write timeout.
+const announceDeadline = 5 * time.Second
+
 // ----------------------------------------------------------------------------
 // /announce
 // ----------------------------------------------------------------------------
@@ -229,7 +259,9 @@ func (s *Server) handleAnnounce(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	body := buildAnnounceResponse(out.Seeders, out.Leechers, out.Peers, req.Compact, req.PeerID, req.NumWant)
+	body := buildAnnounceResponse(out.Seeders, out.Leechers, out.Interval, out.MinInterval, out.Peers, req.Compact, req.PeerID, req.NumWant)
+	// Bencode, served as text/plain with nosniff (noSniff): not markup.
+	// nosemgrep: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
 	_, _ = w.Write(body)
 }
 
@@ -284,10 +316,31 @@ type AnnounceOutcome struct {
 func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, clientIP, userAgent string) AnnounceOutcome {
 	infoHashHex := hexBytes(req.InfoHash[:])
 
+	// A deadline for everything below, connection-pool waits included. Over
+	// HTTP the request context has none, and over UDP the processor gets the
+	// process's: a query plan gone wrong held a pooled connection with nothing
+	// able to cancel it, and twenty such announces froze every other one in
+	// `Acquire`. Background writes take `s.appCtx`, not this.
+	ctx, cancel := context.WithTimeout(ctx, announceDeadline)
+	defer cancel()
+
+	// 0. Announces that cannot succeed, answered without a lookup: an address
+	// that has used up its failures for the minute, or a passkey of a shape
+	// the site never mints. See lookupGuard.
+	now := time.Now()
+	if s.lookups.blocked(clientIP, now) {
+		return AnnounceOutcome{Failure: "Too many invalid requests, retry later"}
+	}
+	if !plausiblePasskey(req.Passkey) {
+		s.lookups.fail(clientIP, now)
+		return AnnounceOutcome{Failure: "Invalid passkey"}
+	}
+
 	// 1. Resolve & validate the user
 	user, err := s.db.UserByPasskey(ctx, req.Passkey)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
+			s.lookups.fail(clientIP, now)
 			return AnnounceOutcome{Failure: "Invalid passkey"}
 		}
 		slog.Error("internal error", "where", "find user", "err", err)
@@ -333,8 +386,11 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 		return AnnounceOutcome{Failure: "Access denied"}
 	}
 
-	// 2. Ratio check (only when leeching: left > 0)
-	if req.Left > 0 {
+	// 2. Ratio check (only when leeching: left > 0) — and not while a
+	// site-wide event counts no download at all. Under a freeleech nothing a
+	// member downloads moves their ratio, so refusing them for it held the
+	// members the event was meant for out of it.
+	if req.Left > 0 && s.bonus.Get(ctx).Download != 0 {
 		minRatio, err := s.db.GetMinRatio(ctx)
 		if err == nil && minRatio > 0 && user.Downloaded > 0 {
 			ratio := float64(user.Uploaded) / float64(user.Downloaded)
@@ -358,6 +414,8 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 	resolved, err := s.db.ResolveAnnouncedTorrent(ctx, infoHashHex)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
+			// Not counted by the lookup guard: the passkey was valid, so this is
+			// a member's client still announcing a torrent the site removed.
 			return AnnounceOutcome{Failure: "Torrent not found or inactive"}
 		}
 		slog.Error("internal error", "where", "find torrent", "err", err)
@@ -373,9 +431,15 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 		infoHashHex = resolved.SwarmKey
 	}
 
-	// 4. Dedup window — skip if same {hash,peer,event} fired within 2 seconds
+	// 4. Dedup window — skip if same {hash,peer,event} fired within 2 seconds.
+	//
+	// The member is part of every key below. A peer_id is public — any client
+	// in the swarm reads it in the handshake — so a key made of it alone let a
+	// stranger announcing under someone else's peer_id every second hold that
+	// member's window shut, and their announces with it.
 	peerHex := hexBytes(req.PeerID[:])
-	dedupKey := infoHashHex + ":" + peerHex + ":" + req.Event.String()
+	peerKey := peerHex + ":" + user.ID
+	dedupKey := infoHashHex + ":" + peerKey + ":" + req.Event.String()
 	if !s.dedup.CheckAndMark(ctx, dedupKey) {
 		seeders, leechers, _ := s.peers.Counts(ctx, infoHashHex)
 		return AnnounceOutcome{
@@ -411,7 +475,12 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 	// forfeits at most one announce-interval of credit — identical to
 	// the long-standing TTL-expiry behaviour, and the only direction
 	// that cannot be replayed.
-	prev, _ := s.peers.Get(ctx, infoHashHex, peerHex)
+	//
+	// The entry is this member's own: another member announcing under the same
+	// peer_id gets a field of its own, and neither can reach the other's
+	// baseline (see peers.Slot).
+	prev, slot, _ := s.peers.Slot(ctx, infoHashHex, peerHex, user.ID)
+
 	var deltaUp, deltaDown int64
 	if prev != nil {
 		if d := req.Uploaded - prev.Uploaded; d > 0 {
@@ -475,17 +544,23 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 		// partial unique index it upserts against; every other kind was
 		// a plain INSERT.
 		//
-		// Keyed per KIND, and on the same 2 s window as the credit: two
-		// announces milliseconds apart are one event and should be one
-		// flag, while the same detector firing again ten minutes later is
-		// new evidence and must still be recorded.
+		// Keyed per KIND and per MEMBER, over the minimum announce interval.
+		// It was per peer over 2 s: two announces milliseconds apart made
+		// one flag, but a client announcing every few seconds — or rotating
+		// its peer_id — added a row each time, and a single cheater could
+		// bury the moderation queue. No honest client announces faster than
+		// `minAnnounceInterval`, so evidence arriving at a normal cadence is
+		// still recorded every time.
 		//
 		// The filter lives here rather than in the anticheat package so
 		// that package stays free of Redis and remains a pure detector.
 		if len(acFlags) > 0 {
 			fresh := acFlags[:0]
 			for _, f := range acFlags {
-				if s.dedup.CheckAndMark(ctx, infoHashHex+":"+peerHex+":acflag:"+f.Kind) {
+				if s.dedup.CheckAndMarkFor(
+					ctx, infoHashHex+":"+user.ID+":acflag:"+f.Kind,
+					time.Duration(minAnnounceInterval)*time.Second,
+				) {
 					fresh = append(fresh, f)
 				}
 			}
@@ -620,7 +695,7 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 	 * L'écrêtage garde sa place d'origine — avant les multiplicateurs de bonus,
 	 * qui s'appliquent ensuite au delta déjà borné.
 	 */
-	creditKey := infoHashHex + ":" + peerHex + ":credit"
+	creditKey := infoHashHex + ":" + peerKey + ":credit"
 	bookCredit := (deltaUp > 0 || deltaDown > 0) &&
 		s.dedup.CheckAndMark(ctx, creditKey)
 
@@ -757,7 +832,7 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 	// response — the client just left, so they don't need a fresh
 	// swarm snapshot, but they do still want the current counts.
 	if req.Event == announce.EventStopped {
-		_ = s.peers.Remove(ctx, infoHashHex, peerHex)
+		_ = s.peers.Remove(ctx, infoHashHex, slot)
 		seeders, leechers, _ := s.peers.Counts(ctx, infoHashHex)
 		return AnnounceOutcome{
 			Seeders:     seeders,
@@ -768,7 +843,11 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 		}
 	}
 
-	// 8. Upsert the peer
+	// 8. Upsert the peer — after making room for it if this member already
+	// holds as many live entries on this torrent as one member may.
+	if prev == nil {
+		s.capMemberPeers(ctx, infoHashHex, user.ID)
+	}
 	ipHash := cryptohash.HashIP(clientIP, s.ipHashSecret)
 	pdata := &peers.PeerData{
 		PeerID:     peerHex,
@@ -780,10 +859,13 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 		Downloaded: req.Downloaded,
 		Left:       req.Left,
 		IsSeeder:   req.IsSeeder(),
+		Field:      slot,
 	}
 	if err := s.peers.Set(ctx, infoHashHex, pdata); err != nil {
-		slog.Error("internal error", "where", "store peer", "err", err)
-		return AnnounceOutcome{Failure: "Internal tracker error"}
+		// Redis is down: the swarm can be neither stored nor read, but the rest
+		// of the announce still runs — the credit already fell back to a direct
+		// write — and step 11 answers in degraded mode.
+		s.noteSwarmUnavailable("store peer", err)
 	}
 
 	// 9. event=completed: bump the counter and create the HnR entry.
@@ -800,11 +882,7 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 		go s.recordHnrCompletion(user.ID, torrentID, infoHashHex)
 	}
 
-	// 10. Seeders contribute to seed-time tracking. Gate on an
-	// event-independent dedup key (mirroring the byte-credit creditKey) so
-	// concurrent announces with distinct events (started/completed/update,
-	// all left=0) can't each book the same `elapsed` — an N× over-credit
-	// the per-event dedup at step 4 doesn't stop (finding M7).
+	// 10. Seeders contribute to seed-time tracking.
 	//
 	// A BEP 21 partial seed is excluded by `IsSeeder()` and that is the
 	// intended reading: hit-and-run asks a member to seed what they took, and
@@ -813,43 +891,51 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 	// still in the swarm — they simply do not bank seed time towards a
 	// requirement they cannot meet.
 	if req.IsSeeder() && prev != nil {
-		elapsed := (time.Now().UnixMilli() - prev.UpdatedAt) / 1000
 		/*
-		 * La clé porte sur (torrent, UTILISATEUR), et la fenêtre est
-		 * l'intervalle d'annonce.
+		 * Le temps crédité est réservé par (torrent, UTILISATEUR), pas par peer.
 		 *
 		 * `AddSeedTime` additionne dans UNE ligne `hnr_tracking` par
-		 * (user, torrent) — la clé contenait `peerHex`, donc cent peer_id
-		 * concurrents sur le même torrent versaient chacun le même intervalle
-		 * de temps réel dans la même ligne : cent secondes de seed par seconde
-		 * écoulée. Les 24 h exigées se soldaient en un quart d'heure, et le
-		 * hit-and-run cessait de mesurer quoi que ce soit.
+		 * (user, torrent) : cent peer_id concurrents sur le même torrent
+		 * versaient chacun le même intervalle de temps réel dans la même ligne,
+		 * et les 24 h exigées se soldaient en un quart d'heure. Le premier
+		 * correctif bornait chaque crédit à `minAnnounceInterval` sous une
+		 * fenêtre de même durée — ce qui ne créditait que la moitié du temps
+		 * d'un seedeur qui réannonce toutes les `announceInterval`.
+		 *
+		 * `ClaimSeedTime` garde la marque jusqu'où le compte est crédité :
+		 * chaque annonce prend l'intervalle qui la sépare de la marque (ou de
+		 * sa propre ligne de base, si elle est plus récente), puis l'avance.
+		 * Disjoints quel que soit le nombre de peer_id ou de réplicas, donc
+		 * jamais plus que le temps réel ; entiers pour un seedeur honnête.
+		 * Concurrent announces with distinct events (finding M7) are covered
+		 * the same way: the second one finds the mark already at now.
 		 *
-		 * La fenêtre de deux secondes était l'autre moitié du défaut : elle est
-		 * faite pour dédupliquer UNE annonce arrivée sur trois interfaces, pas
-		 * pour borner une quantité par période. À `minAnnounceInterval`, on
-		 * crédite au plus un intervalle par intervalle — et le plafond sur
-		 * `elapsed` empêche une ligne de base ancienne d'en réclamer plus.
+		 * Le plafond borne ce qu'une ligne de base ancienne peut réclamer : un
+		 * client resté muet plus de deux intervalles n'a sans doute pas seedé
+		 * tout ce temps. Une erreur Redis ne crédite rien.
 		 */
-		seedKey := infoHashHex + ":" + user.ID + ":seedtime"
-		if elapsed > int64(minAnnounceInterval) {
-			elapsed = int64(minAnnounceInterval)
-		}
-		if elapsed > 0 && s.dedup.CheckAndMarkFor(
-			ctx, seedKey, time.Duration(minAnnounceInterval)*time.Second,
-		) {
+		now := time.Now()
+		if secs, err := s.peers.ClaimSeedTime(
+			ctx, torrentID, user.ID, now, time.UnixMilli(prev.UpdatedAt), maxSeedTimeCredit,
+		); err == nil && secs > 0 {
 			s.bgTasks.Add(1)
-			// `seedKey` suit jusqu'à l'écriture : la marque vient d'être posée,
-			// et c'est à celui qui échoue de la rendre. Voir `recordSeedTime`.
-			go s.recordSeedTime(user.ID, torrentID, infoHashHex, seedKey, int32(elapsed))
+			go s.recordSeedTime(user.ID, torrentID, infoHashHex, int32(secs)) // #nosec G115 -- capped at maxSeedTimeCredit (two intervals) by ClaimSeedTime
+		} else if err != nil {
+			slog.Warn("claim seed time", "info_hash", infoHashHex, "err", err)
 		}
 	}
 
 	// 11. Build the announce response with the current swarm state
+	return s.swarmOutcome(ctx, infoHashHex, req.IsSeeder())
+}
+
+// swarmOutcome is the reply to an announce that is not a stop: the current
+// swarm, as much of it as this client should be told about.
+func (s *Server) swarmOutcome(ctx context.Context, infoHashHex string, announcerIsSeeder bool) AnnounceOutcome {
 	peerList, err := s.peers.List(ctx, infoHashHex)
 	if err != nil {
-		slog.Error("internal error", "where", "list peers", "err", err)
-		return AnnounceOutcome{Failure: "Internal tracker error"}
+		s.noteSwarmUnavailable("list peers", err)
+		return degradedOutcome()
 	}
 	// 11b. Federation cross-announce (Phase 4): mix in peers cached from
 	// partner instances for this torrent. Off unless TRACKER_FEDERATION_SWARM.
@@ -867,15 +953,79 @@ func (s *Server) ProcessAnnounce(ctx context.Context, req *announce.Request, cli
 			leechers++
 		}
 	}
+	// A seeder has nothing to fetch from another seeder, so it is only told
+	// about leechers — what every tracker does, and it closes the cheap half
+	// of the `left=0` bypass: the ratio gate (step 2) only looks at members
+	// still downloading, so one under the minimum ratio who announces as a
+	// seeder used to be handed every seeder of the swarm to download from. The
+	// counts above still describe the whole swarm.
 	return AnnounceOutcome{
 		Seeders:     seeders,
 		Leechers:    leechers,
-		Peers:       peerList,
+		Peers:       peersForAnnouncer(peerList, announcerIsSeeder),
 		Interval:    announceInterval,
 		MinInterval: minAnnounceInterval,
 	}
 }
 
+// maxPeersPerMember is how many live entries one member may hold on one
+// torrent: a seedbox, a home client, a laptop, with room for a restart or two.
+const maxPeersPerMember = 5
+
+// capMemberPeers evicts this member's oldest live entries on the torrent until
+// a new one fits under `maxPeersPerMember`.
+//
+// Nothing bounded them. One passkey announcing random peer_ids grew the
+// swarm's hash without end — each write pushed its 24 h TTL further — and every
+// announce on that torrent then read the whole bloated hash, while other
+// clients were handed peers that did not exist. Evicting rather than refusing,
+// because the usual way to cross the line is innocent: qBittorrent picks a new
+// peer_id every session, and a client restarted a few times in an hour leaves
+// its previous entries live behind it. The oldest are the ones it left.
+//
+// Best effort: called only for a peer_id the swarm has not seen, so the swarm
+// read it costs is paid once per client session, and an error skips the cap.
+func (s *Server) capMemberPeers(ctx context.Context, infoHashHex, userID string) {
+	list, err := s.peers.List(ctx, infoHashHex)
+	if err != nil {
+		return
+	}
+	mine := make([]*peers.PeerData, 0, maxPeersPerMember)
+	for _, p := range list {
+		if p.UserID == userID {
+			mine = append(mine, p)
+		}
+	}
+	if len(mine) < maxPeersPerMember {
+		return
+	}
+	sort.Slice(mine, func(i, j int) bool { return mine[i].UpdatedAt < mine[j].UpdatedAt })
+	for _, p := range mine[:len(mine)-maxPeersPerMember+1] {
+		_ = s.peers.Remove(ctx, infoHashHex, p.Field)
+	}
+}
+
+// degradedInterval is how soon a client answered without a swarm comes back:
+// short, so announces resume within minutes of Redis returning.
+const degradedInterval = 300
+
+// degradedOutcome answers an announce while Redis is down. Refusing it — what
+// the tracker did — turned a Redis outage into a tracker outage: every client
+// showed the torrent's tracker as failing and backed off on its own schedule,
+// although Postgres could still authenticate them and the credit had already
+// fallen back to a direct write. An empty peer list and a short interval keep
+// the clients' existing connections going and bring them back soon.
+func degradedOutcome() AnnounceOutcome {
+	return AnnounceOutcome{Interval: degradedInterval, MinInterval: 60}
+}
+
+func (s *Server) noteSwarmUnavailable(where string, err error) {
+	if n := s.swarmUnavailable.Add(1); n%1_000 == 1 {
+		slog.Error("swarm store unavailable, announces answered in degraded mode",
+			"where", where, "count", n, "err", err)
+	}
+}
+
 // mergePeers appends remote (partner-instance) peers to the local set,
 // de-duplicating by ip:port so a peer present in both swarms isn't listed
 // twice. Local peers keep priority (kept first); remote ones fill in.
@@ -989,40 +1139,20 @@ func (s *Server) recordHnrCompletion(userID, torrentID, infoHashHex string) {
 
 // Mêmes raisons que `recordHnrCompletion` : par les identifiants.
 //
-// `seedKey` est la marque de déduplication posée par l'appelant, et cette
-// fonction la REND si elle n'écrit pas.
-//
-// La marque est posée avant l'écriture — c'est ce qui la rend atomique entre
-// instances — mais rien ne la retirait quand l'écriture n'avait pas lieu. Or
-// cette fonction peut renoncer en silence de trois façons : le sémaphore à huit
-// places saturé pendant 5 s, une erreur Postgres (hoquet, `statement_timeout`,
-// pool épuisé), ou une panique rattrapée. Dans les trois cas la marque restait
-// posée pour 900 secondes, et toute annonce suivante du même couple
-// (membre, torrent) passait son tour — y compris celle qui aurait rattrapé.
-//
-// Un hoquet Postgres de trois secondes pendant une rafale perdait donc
-// l'intervalle de TOUS les seedeurs concernés et interdisait la reprise pendant
-// un quart d'heure : le hit-and-run cessait de mesurer, sans que rien ne le
-// dise. Le plafond sur `elapsed` (un intervalle d'annonce) rend d'ailleurs la
-// perte irrattrapable une fois la fenêtre passée — une annonce ultérieure ne
-// peut pas créditer deux intervalles pour en compenser un.
-//
-// Rendre la marque ramène le coût d'un échec de quinze minutes à un intervalle.
-// Ce n'est pas la réparation complète — la base ne détient toujours pas la
-// vérité, un `last_seed_credit_at` la rendrait auto-réparante — mais c'est celle
-// qui ne demande ni migration ni changement du chemin chaud.
-func (s *Server) recordSeedTime(userID, torrentID, infoHashHex, seedKey string, secondsToAdd int32) {
+// L'intervalle est déjà réservé quand cette fonction tourne : `ClaimSeedTime`
+// a avancé la marque du compte. Si l'écriture n'a pas lieu — sémaphore saturé
+// pendant 5 s, erreur Postgres, panique rattrapée —, cet intervalle-là est
+// perdu, et l'annonce suivante crédite le sien normalement, depuis la marque.
+// Elle n'est pas reculée pour autant : entre-temps, un autre peer_id du même
+// compte a pu l'avancer à son tour, et la reculer lui ferait créditer deux fois
+// le même temps. Les pertes sont comptées dans `seedTimeDropped`.
+func (s *Server) recordSeedTime(userID, torrentID, infoHashHex string, secondsToAdd int32) {
 	defer s.bgTasks.Done()
 
 	credited := false
 	// Enregistré AVANT le `recover` ci-dessous, donc exécuté APRÈS lui : les
-	// defer se déroulent en ordre inverse. Une panique est donc rattrapée, puis
-	// la marque est rendue — sans quoi le seul chemin qui ne rend rien serait
-	// celui qui en a le plus besoin.
-	//
-	// `context.Background()` et non `s.appCtx` : rendre une marque est une
-	// compensation qui doit aboutir même pendant l'arrêt, où `appCtx` est déjà
-	// annulé. `Release` porte sa propre échéance courte.
+	// defer se déroulent en ordre inverse, et une panique est comptée comme les
+	// autres pertes.
 	defer func() {
 		if credited {
 			return
@@ -1033,7 +1163,6 @@ func (s *Server) recordSeedTime(userID, torrentID, infoHashHex, seedKey string,
 				"info_hash", infoHashHex,
 				"seconds", secondsToAdd)
 		}
-		s.dedup.Release(context.Background(), seedKey)
 	}()
 
 	// See `recordHnrCompletion` for the rationale — without this
@@ -1168,7 +1297,22 @@ func (s *Server) handleScrape(w http.ResponseWriter, r *http.Request) {
 		writeFailure(w, "Passkey required")
 		return
 	}
+	// The announce's lookup guard, here too: a scrape costs the same passkey
+	// query, and a scanner turned away from /announce would come here instead.
+	clientIP, now := s.clientIP(r), time.Now()
+	if s.lookups.blocked(clientIP, now) {
+		writeFailure(w, "Too many invalid requests, retry later")
+		return
+	}
+	if !plausiblePasskey(passkey) {
+		s.lookups.fail(clientIP, now)
+		writeFailure(w, "Invalid passkey")
+		return
+	}
 	if _, err := s.db.UserByPasskey(r.Context(), passkey); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			s.lookups.fail(clientIP, now)
+		}
 		// Le même message dans les deux cas : une passkey absente et une
 		// passkey invalide ne se distinguent pas depuis l'extérieur.
 		writeFailure(w, "Invalid passkey")
@@ -1207,6 +1351,8 @@ func (s *Server) handleScrape(w http.ResponseWriter, r *http.Request) {
 			Completed:   completed,
 		})
 	}
+	// Bencode, served as text/plain with nosniff (noSniff): not markup.
+	// nosemgrep: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
 	_, _ = w.Write(scrapeResponse(stats))
 }
 
@@ -1225,10 +1371,20 @@ func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 	// le `Content-Type` posé après était purement et simplement ignoré sur le
 	// chemin dégradé.
 	w.Header().Set("Content-Type", "application/json")
-	if !dbOK || !redisOK {
+	// Only Postgres makes the tracker unable to answer: without Redis it still
+	// authenticates and credits, and announces get the degraded reply. A 503
+	// here pulled every replica out of the Service on a Redis outage — no
+	// announce answered at all, which is what degraded mode exists to avoid.
+	status := "healthy"
+	if !dbOK {
+		status = "unhealthy"
 		w.WriteHeader(http.StatusServiceUnavailable)
+	} else if !redisOK {
+		status = "degraded"
 	}
-	body := `{"status":"healthy","db":` + boolStr(dbOK) + `,"redis":` + boolStr(redisOK) + `}`
+	body := `{"status":"` + status + `","db":` + boolStr(dbOK) + `,"redis":` + boolStr(redisOK) + `}`
+	// Fixed JSON built from two booleans: nothing from the request.
+	// nosemgrep: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
 	_, _ = w.Write([]byte(body))
 }
 
@@ -1326,5 +1482,7 @@ func (s *Server) clientIP(r *http.Request) string {
 
 func writeFailure(w http.ResponseWriter, reason string) {
 	w.WriteHeader(http.StatusOK) // BT trackers MUST return 200 with bencode failure
-	_, _ = w.Write(bencode.FailureResponse(reason))
+	// Bencode, served as text/plain with nosniff (noSniff): not markup.
+	// nosemgrep: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
+	_, _ = w.Write(bencode.FailureResponse(reason)) // #nosec G705 -- bencode in text/plain with nosniff
 }
diff --git a/apps/tracker/internal/server/lookupguard.go b/apps/tracker/internal/server/lookupguard.go
new file mode 100644
index 00000000..d72aa6d3
--- /dev/null
+++ b/apps/tracker/internal/server/lookupguard.go
@@ -0,0 +1,113 @@
+package server
+
+import (
+	"net"
+	"sync"
+	"time"
+)
+
+// lookupGuard refuses, without touching Postgres or Redis, a client that keeps
+// presenting passkeys that match no account — on /announce, over HTTP and UDP,
+// and on the HTTP /scrape, which costs the same query.
+//
+// Each such announce used to cost a Redis GET and a Postgres query (misses are
+// deliberately not cached, so a member created a second ago can announce). A
+// scanner cycling through random passkeys was therefore a database load
+// generator. After `maxLookupFailures` failures in a minute, the address is
+// answered from memory for the rest of that minute. Counted per replica, which
+// is enough: the point is the database, and each replica guards its own share
+// of it.
+//
+// An unknown info hash under a VALID passkey is not counted. That is a member's
+// client still announcing a torrent the site removed; after a purge, a single
+// restart sends hundreds of them at once, and counting them locked the member —
+// and everyone sharing the address, a seedbox host's other customers say — out
+// of the torrents that do exist.
+//
+// IPv6 is counted per /64, the smallest block a subscriber is handed: a host
+// that can pick a fresh address for every request would otherwise never meet
+// the limit.
+type lookupGuard struct {
+	mu      sync.Mutex
+	windows map[string]*lookupWindow
+}
+
+type lookupWindow struct {
+	start    time.Time
+	failures int
+}
+
+const (
+	maxLookupFailures = 120
+	lookupWindowSpan  = time.Minute
+	// A flood of distinct addresses must not grow the map without bound: past
+	// this size the stale windows are swept, and if every window is live the
+	// map is reset — the guard forgets, the database is still protected by the
+	// shape check and the per-announce cost.
+	maxLookupWindows = 100_000
+)
+
+func newLookupGuard() *lookupGuard {
+	return &lookupGuard{windows: make(map[string]*lookupWindow)}
+}
+
+// subject is the address for IPv4, its /64 for IPv6.
+func lookupSubject(ip string) string {
+	parsed := net.ParseIP(ip)
+	if parsed == nil || parsed.To4() != nil {
+		return ip
+	}
+	return parsed.Mask(net.CIDRMask(64, 128)).String() + "/64"
+}
+
+// blocked reports whether this address has used up its failures for the
+// current window.
+func (g *lookupGuard) blocked(ip string, now time.Time) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	w, ok := g.windows[lookupSubject(ip)]
+	return ok && now.Sub(w.start) < lookupWindowSpan && w.failures >= maxLookupFailures
+}
+
+// fail records one announce that could not succeed.
+func (g *lookupGuard) fail(ip string, now time.Time) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	key := lookupSubject(ip)
+	w, ok := g.windows[key]
+	if !ok || now.Sub(w.start) >= lookupWindowSpan {
+		if !ok && len(g.windows) >= maxLookupWindows {
+			g.sweep(now)
+		}
+		g.windows[key] = &lookupWindow{start: now, failures: 1}
+		return
+	}
+	w.failures++
+}
+
+func (g *lookupGuard) sweep(now time.Time) {
+	for k, w := range g.windows {
+		if now.Sub(w.start) >= lookupWindowSpan {
+			delete(g.windows, k)
+		}
+	}
+	if len(g.windows) >= maxLookupWindows {
+		g.windows = make(map[string]*lookupWindow)
+	}
+}
+
+// plausiblePasskey is the shape check that runs before any lookup: lowercase or
+// uppercase hex, 32 to 64 characters. The site mints 40; the range keeps any
+// older key format working.
+func plausiblePasskey(p string) bool {
+	if len(p) < 32 || len(p) > 64 {
+		return false
+	}
+	for i := 0; i < len(p); i++ {
+		c := p[i]
+		if !(c >= '0' && c <= '9' || c >= 'a' && c <= 'f' || c >= 'A' && c <= 'F') {
+			return false
+		}
+	}
+	return true
+}
diff --git a/apps/tracker/internal/server/lookupguard_test.go b/apps/tracker/internal/server/lookupguard_test.go
new file mode 100644
index 00000000..263a4d17
--- /dev/null
+++ b/apps/tracker/internal/server/lookupguard_test.go
@@ -0,0 +1,59 @@
+package server
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// A client that keeps announcing with a passkey nobody holds, or for a hash no
+// torrent has, is answered from memory once it has used up its failures — the
+// database is not its load generator.
+func TestLookupGuard_BlocksAfterTheLimitForTheRestOfTheWindow(t *testing.T) {
+	g := newLookupGuard()
+	now := time.Unix(1_700_000_000, 0)
+	for i := 0; i < maxLookupFailures-1; i++ {
+		g.fail("203.0.113.7", now)
+	}
+	if g.blocked("203.0.113.7", now) {
+		t.Fatal("bloqué avant d'avoir atteint la limite")
+	}
+	g.fail("203.0.113.7", now)
+	if !g.blocked("203.0.113.7", now.Add(30*time.Second)) {
+		t.Fatal("devait être bloqué pour le reste de la minute")
+	}
+	if g.blocked("203.0.113.8", now) {
+		t.Fatal("une autre adresse ne doit pas payer pour la première")
+	}
+	if g.blocked("203.0.113.7", now.Add(61*time.Second)) {
+		t.Fatal("la fenêtre suivante repart de zéro")
+	}
+}
+
+// Every address of one IPv6 /64 counts as one client.
+func TestLookupGuard_FoldsAnIPv6Slash64(t *testing.T) {
+	g := newLookupGuard()
+	now := time.Unix(1_700_000_000, 0)
+	for i := 0; i < maxLookupFailures; i++ {
+		g.fail("2001:db8:aa:bb::"+strings.Repeat("1", 1+i%4), now)
+	}
+	if !g.blocked("2001:db8:aa:bb:ffff::1", now) {
+		t.Fatal("tourner dans son /64 ne doit pas échapper au compte")
+	}
+	if g.blocked("2001:db8:aa:bc::1", now) {
+		t.Fatal("un autre /64 n'est pas concerné")
+	}
+}
+
+func TestPlausiblePasskey(t *testing.T) {
+	for _, ok := range []string{strings.Repeat("a", 40), strings.Repeat("F", 32), strings.Repeat("0", 64)} {
+		if !plausiblePasskey(ok) {
+			t.Fatalf("%q devait passer", ok)
+		}
+	}
+	for _, bad := range []string{"", "short", strings.Repeat("a", 31), strings.Repeat("a", 65), strings.Repeat("g", 40), strings.Repeat("a", 39) + "'"} {
+		if plausiblePasskey(bad) {
+			t.Fatalf("%q devait être refusé", bad)
+		}
+	}
+}
diff --git a/apps/tracker/internal/server/nosniff_test.go b/apps/tracker/internal/server/nosniff_test.go
new file mode 100644
index 00000000..626a7066
--- /dev/null
+++ b/apps/tracker/internal/server/nosniff_test.go
@@ -0,0 +1,40 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// Every response of the tracker's own mux carries nosniff, the bencoded
+// failures included, whatever sits (or does not) in front of it.
+func TestNoSniff_SetOnEveryResponse(t *testing.T) {
+	h := noSniff(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("d14:failure reason15:Invalid passkeye"))
+	}))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/announce", nil))
+	if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+		t.Fatalf("X-Content-Type-Options = %q, want nosniff", got)
+	}
+	if got := rec.Header().Get("Content-Type"); got != "text/plain; charset=utf-8" {
+		t.Fatalf("the handler's own Content-Type was lost: %q", got)
+	}
+}
+
+// And Routes() is what puts it there. A scrape without a passkey is refused
+// before the database or Redis is touched, and with a plain Write: a 404 would
+// prove nothing, http.Error setting nosniff on its own.
+func TestRoutes_WrapsTheMuxInNoSniff(t *testing.T) {
+	rec := httptest.NewRecorder()
+	(&Server{}).Routes().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/scrape", nil))
+	if body := rec.Body.String(); !strings.Contains(body, "failure reason") {
+		t.Fatalf("body = %q, want a bencoded failure", body)
+	}
+	if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+		t.Fatalf("X-Content-Type-Options = %q, want nosniff", got)
+	}
+}
diff --git a/apps/tracker/internal/server/response.go b/apps/tracker/internal/server/response.go
index 1bfb82aa..5500c407 100644
--- a/apps/tracker/internal/server/response.go
+++ b/apps/tracker/internal/server/response.go
@@ -29,7 +29,17 @@ const (
 // the peer list — the `To4()` filter in `splitCompactPeers` excludes them
 // and the requesting client ends up with an empty `peers` string, which is
 // indistinguishable from a dead swarm.
-func buildAnnounceResponse(seeders, leechers int, peers []*peers.PeerData, _ bool, excludePeerID [20]byte, numWant int) []byte {
+//
+// `interval` and `minInterval` come from the announce's outcome: the degraded
+// reply asks clients back sooner than a normal one. Zero falls back to the
+// normal values rather than telling clients to re-announce at once.
+func buildAnnounceResponse(seeders, leechers, interval, minInterval int, peers []*peers.PeerData, _ bool, excludePeerID [20]byte, numWant int) []byte {
+	if interval <= 0 {
+		interval = announceInterval
+	}
+	if minInterval <= 0 {
+		minInterval = minAnnounceInterval
+	}
 	v4, v6 := splitCompactPeers(peers, excludePeerID, numWant)
 
 	enc := bencode.NewEncoder(256 + len(v4) + len(v6))
@@ -43,10 +53,10 @@ func buildAnnounceResponse(seeders, leechers int, peers []*peers.PeerData, _ boo
 	enc.Int(int64(leechers))
 
 	enc.String("interval")
-	enc.Int(announceInterval)
+	enc.Int(int64(interval))
 
 	enc.String("min interval")
-	enc.Int(minAnnounceInterval)
+	enc.Int(int64(minInterval))
 
 	enc.String("peers")
 	enc.ByteString(v4)
@@ -64,6 +74,22 @@ func buildAnnounceResponse(seeders, leechers int, peers []*peers.PeerData, _ boo
 	return enc.Bytes()
 }
 
+// peersForAnnouncer is the part of the swarm worth telling this client
+// about: everyone to a leecher, only leechers to a seeder. See step 11 of the
+// announce handler for why that also matters beyond bandwidth.
+func peersForAnnouncer(list []*peers.PeerData, announcerIsSeeder bool) []*peers.PeerData {
+	if !announcerIsSeeder {
+		return list
+	}
+	out := make([]*peers.PeerData, 0, len(list))
+	for _, p := range list {
+		if !p.IsSeeder {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
 // splitCompactPeers walks the swarm once and returns two compact peer
 // strings ready for bencoding:
 //
diff --git a/apps/tracker/internal/server/response_test.go b/apps/tracker/internal/server/response_test.go
index 68030054..e830ef7f 100644
--- a/apps/tracker/internal/server/response_test.go
+++ b/apps/tracker/internal/server/response_test.go
@@ -159,7 +159,7 @@ func TestBuildAnnounceResponse_OmitsPeers6WhenEmpty(t *testing.T) {
 		{PeerID: "aa", IP: "203.0.113.5", Port: 6881},
 	}
 	var exclude [20]byte
-	body := buildAnnounceResponse(1, 0, peerList, true, exclude, 50)
+	body := buildAnnounceResponse(1, 0, announceInterval, minAnnounceInterval, peerList, true, exclude, 50)
 	// `6:peers6` is the bencoded key marker — distinct from the
 	// substring `peers6` that can show up as `5:peers` followed by
 	// a 6-byte compact peer entry whose first byte happens to be 6.
@@ -176,14 +176,14 @@ func TestBuildAnnounceResponse_IncludesPeers6WhenIPv6(t *testing.T) {
 		{PeerID: "aa", IP: "2001:db8::1", Port: 6881},
 	}
 	var exclude [20]byte
-	body := buildAnnounceResponse(1, 0, peerList, true, exclude, 50)
+	body := buildAnnounceResponse(1, 0, announceInterval, minAnnounceInterval, peerList, true, exclude, 50)
 	if !bytes.Contains(body, []byte("6:peers6")) {
 		t.Fatalf("response missing peers6 key for IPv6 swarm: %q", body)
 	}
 }
 
 func TestBuildAnnounceResponse_ContainsRequiredKeys(t *testing.T) {
-	body := buildAnnounceResponse(42, 17, nil, true, [20]byte{}, 50)
+	body := buildAnnounceResponse(42, 17, announceInterval, minAnnounceInterval, nil, true, [20]byte{}, 50)
 	for _, key := range []string{"8:complete", "10:incomplete", "8:interval", "12:min interval", "5:peers"} {
 		if !bytes.Contains(body, []byte(key)) {
 			t.Errorf("body missing key %q: %q", key, body)
@@ -195,6 +195,24 @@ func TestBuildAnnounceResponse_ContainsRequiredKeys(t *testing.T) {
 	}
 }
 
+// The degraded reply (Redis down) asks clients back in five minutes. The HTTP
+// response wrote the constants whatever the outcome said, so only UDP clients
+// ever saw it — HTTP clients were sent away for half an hour with no peers.
+func TestBuildAnnounceResponse_CarriesTheOutcomeInterval(t *testing.T) {
+	body := buildAnnounceResponse(0, 0, 300, 60, nil, true, [20]byte{}, 50)
+	for _, want := range []string{"8:intervali300e", "12:min intervali60e"} {
+		if !bytes.Contains(body, []byte(want)) {
+			t.Errorf("body missing %q: %q", want, body)
+		}
+	}
+	body = buildAnnounceResponse(0, 0, 0, 0, nil, true, [20]byte{}, 50)
+	for _, want := range []string{"8:intervali1800e", "12:min intervali900e"} {
+		if !bytes.Contains(body, []byte(want)) {
+			t.Errorf("zero intervals should fall back to the normal ones, missing %q: %q", want, body)
+		}
+	}
+}
+
 func TestHexBytes_RoundTrip(t *testing.T) {
 	// Known 20-byte info hash → 40 lowercase hex chars.
 	raw := []byte{0x00, 0xff, 0xab, 0xcd, 0xef, 0x01, 0x23, 0x45,
@@ -273,3 +291,22 @@ func TestScrapeResponse_MultipleHashes(t *testing.T) {
 		t.Fatalf("missing entries from multi-hash scrape: %q", body)
 	}
 }
+
+// A seeder is told about leechers only. Besides the bandwidth, this is what
+// keeps a member under the minimum ratio — whom the ratio gate lets through
+// when they claim `left=0` — from being handed every seeder to download from.
+func TestPeersForAnnouncer_SeederGetsLeechersOnly(t *testing.T) {
+	swarm := []*peers.PeerData{
+		{PeerID: "s1", IsSeeder: true},
+		{PeerID: "l1", IsSeeder: false},
+		{PeerID: "s2", IsSeeder: true},
+		{PeerID: "l2", IsSeeder: false},
+	}
+	got := peersForAnnouncer(swarm, true)
+	if len(got) != 2 || got[0].PeerID != "l1" || got[1].PeerID != "l2" {
+		t.Fatalf("un seeder devait recevoir l1 et l2, a reçu %v", got)
+	}
+	if all := peersForAnnouncer(swarm, false); len(all) != 4 {
+		t.Fatalf("un leecher devait recevoir tout l'essaim, a reçu %d peers", len(all))
+	}
+}
diff --git a/apps/tracker/internal/stats/stats.go b/apps/tracker/internal/stats/stats.go
index c46f4cf2..1e75e1b5 100644
--- a/apps/tracker/internal/stats/stats.go
+++ b/apps/tracker/internal/stats/stats.go
@@ -358,6 +358,8 @@ func (a *Accumulator) Flush(ctx context.Context) (int, error) {
 // Le tri sert à ce que deux versements concurrents, s'ils se recouvraient,
 // prennent leurs verrous de ligne dans le même ordre.
 func (a *Accumulator) pendingIDs(ctx context.Context) ([]string, error) {
+	// Filled by the HSCAN loop below before anything ranges over it.
+	// nosemgrep: trailofbits.go.iterate-over-empty-map.iterate-over-empty-map
 	seen := make(map[string]struct{})
 	for _, key := range []string{a.upKey, a.downKey} {
 		var cursor uint64
diff --git a/apps/tracker/internal/udp/connid.go b/apps/tracker/internal/udp/connid.go
index 2c6986c9..779e3931 100644
--- a/apps/tracker/internal/udp/connid.go
+++ b/apps/tracker/internal/udp/connid.go
@@ -90,7 +90,7 @@ func (i *ConnIDIssuer) derive(ip net.IP, minute int64) uint64 {
 	// in-memory layouts (4-byte vs 4-in-16) hashes the same way.
 	mac.Write(ipBytes(ip))
 	var minBuf [8]byte
-	binary.BigEndian.PutUint64(minBuf[:], uint64(minute))
+	binary.BigEndian.PutUint64(minBuf[:], uint64(minute)) // #nosec G115 -- bytes fed to the HMAC; the sign does not matter
 	mac.Write(minBuf[:])
 	sum := mac.Sum(nil)
 	id := binary.BigEndian.Uint64(sum[0:8]) ^ binary.BigEndian.Uint64(sum[8:16])
diff --git a/apps/tracker/internal/udp/encode.go b/apps/tracker/internal/udp/encode.go
index 907d6656..50ef1a22 100644
--- a/apps/tracker/internal/udp/encode.go
+++ b/apps/tracker/internal/udp/encode.go
@@ -46,9 +46,11 @@ func EncodeAnnounceResponse(
 	out = out[:announceRespHdr]
 	binary.BigEndian.PutUint32(out[0:4], ActionAnnounce)
 	binary.BigEndian.PutUint32(out[4:8], transactionID)
-	binary.BigEndian.PutUint32(out[8:12], uint32(interval))
-	binary.BigEndian.PutUint32(out[12:16], uint32(leechers))
-	binary.BigEndian.PutUint32(out[16:20], uint32(seeders))
+	// The interval is configuration and the two counts are peers in one swarm:
+	// none is negative, none comes near 2^32.
+	binary.BigEndian.PutUint32(out[8:12], uint32(interval))  // #nosec G115 -- see above
+	binary.BigEndian.PutUint32(out[12:16], uint32(leechers)) // #nosec G115 -- see above
+	binary.BigEndian.PutUint32(out[16:20], uint32(seeders))  // #nosec G115 -- see above
 
 	written := 0
 	for _, p := range peerList {
@@ -104,9 +106,11 @@ func EncodeScrapeResponse(out []byte, transactionID uint32, stats []ScrapeStat)
 	binary.BigEndian.PutUint32(out[4:8], transactionID)
 	for i, s := range stats {
 		off := scrapeRespHdr + scrapeEntrySize*i
-		binary.BigEndian.PutUint32(out[off+0:off+4], uint32(s.Seeders))
-		binary.BigEndian.PutUint32(out[off+4:off+8], uint32(s.Completed))
-		binary.BigEndian.PutUint32(out[off+8:off+12], uint32(s.Leechers))
+		// Counts of one torrent's peers and snatches: never negative, nowhere
+		// near 2^32, and BEP 15 fixes the field at 32 bits anyway.
+		binary.BigEndian.PutUint32(out[off+0:off+4], uint32(s.Seeders))   // #nosec G115 -- see above
+		binary.BigEndian.PutUint32(out[off+4:off+8], uint32(s.Completed)) // #nosec G115 -- see above
+		binary.BigEndian.PutUint32(out[off+8:off+12], uint32(s.Leechers)) // #nosec G115 -- see above
 	}
 	return out
 }
diff --git a/apps/tracker/internal/udp/parse.go b/apps/tracker/internal/udp/parse.go
index 73b04a60..0f570266 100644
--- a/apps/tracker/internal/udp/parse.go
+++ b/apps/tracker/internal/udp/parse.go
@@ -147,13 +147,13 @@ func ParseAnnounce(data []byte) (*AnnounceRequestUDP, error) {
 	r := &AnnounceRequestUDP{
 		ConnectionID:  binary.BigEndian.Uint64(data[0:8]),
 		TransactionID: binary.BigEndian.Uint32(data[12:16]),
-		Downloaded:    int64(binary.BigEndian.Uint64(data[56:64])),
+		Downloaded:    int64(binary.BigEndian.Uint64(data[56:64])), // #nosec G115 -- a wrapped negative is floored by nonNeg in ToAnnounceRequest
 		Left:          clampLeft(binary.BigEndian.Uint64(data[64:72])),
-		Uploaded:      int64(binary.BigEndian.Uint64(data[72:80])),
+		Uploaded:      int64(binary.BigEndian.Uint64(data[72:80])), // #nosec G115 -- a wrapped negative is floored by nonNeg in ToAnnounceRequest
 		Event:         binary.BigEndian.Uint32(data[80:84]),
 		IPv4:          binary.BigEndian.Uint32(data[84:88]),
 		Key:           binary.BigEndian.Uint32(data[88:92]),
-		NumWant:       int32(binary.BigEndian.Uint32(data[92:96])),
+		NumWant:       int32(binary.BigEndian.Uint32(data[92:96])), // #nosec G115 -- BEP 15 num_want IS a signed int32 (0xFFFFFFFF = -1, "default"); clamped to [0,100] later
 		Port:          binary.BigEndian.Uint16(data[96:98]),
 	}
 	// action sanity — caller already routes by action, but if the
diff --git a/apps/web/Dockerfile b/apps/web/Dockerfile
index f3ddda44..0395b3e5 100644
--- a/apps/web/Dockerfile
+++ b/apps/web/Dockerfile
@@ -1,18 +1,25 @@
-# syntax=docker/dockerfile:1.7
+# syntax=docker/dockerfile:1.28
 # Trackarr web — Nuxt SSR, distroless runtime.
 #
 # The Nitro server bundle in `.output/server/` is fully self-contained
 # (Nuxt inlines its node_modules at build time), so the runtime image
 # carries only that bundle and a small Node-based healthcheck.
 #
-# Base is gcr.io/distroless/nodejs24-debian13:nonroot — no /bin/sh, no apt,
+# Base is gcr.io/distroless/nodejs26-debian13:nonroot — no /bin/sh, no apt,
 # no package manager, runs as uid 65532, signed by Google.
 
 # -----------------------------------------------------------------------------
 # Install dependencies (cached on package.json + lockfile)
 # -----------------------------------------------------------------------------
-FROM node:24-alpine AS deps
-RUN corepack enable && corepack prepare pnpm@11.22.0 --activate
+FROM node:26-alpine AS deps
+# npm rather than corepack: Node 25 stopped shipping corepack, so the
+# node:26 images have none. The version must match `packageManager` in the
+# root package.json — pnpm 12 records it in pnpm-lock.yaml and a frozen
+# install refuses a lockfile whose pin it does not match. `--allow-scripts`
+# names the one install script we let run: pnpm's own, which only hard-links
+# its native binary over the bins. npm 11.20 runs unlisted scripts with a
+# warning today and is moving to blocking them.
+RUN npm install --global --allow-scripts=pnpm pnpm@12.15.0
 WORKDIR /app
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY apps/web/package.json ./apps/web/
@@ -22,8 +29,8 @@ RUN pnpm install --filter "@trackarr/web..." --frozen-lockfile
 # -----------------------------------------------------------------------------
 # Build the Nuxt app (produces apps/web/.output)
 # -----------------------------------------------------------------------------
-FROM node:24-alpine AS builder
-RUN corepack enable && corepack prepare pnpm@11.22.0 --activate
+FROM node:26-alpine AS builder
+RUN npm install --global --allow-scripts=pnpm pnpm@12.15.0
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=deps /app/apps/web/node_modules ./apps/web/node_modules
@@ -43,31 +50,45 @@ COPY tsconfig.base.json ./
 # mode from "the build breaks" into "the first build of the day is the only one
 # that needs Google".
 #
+# The target is the WEB package's node_modules, not the workspace root's: the
+# module resolves its cache against Nuxt's `rootDir` (apps/web) — @nuxt/fonts
+# 1.x says so, and 0.14 got the same path from the working directory pnpm
+# runs the script in. Until 2026-10 this mounted `/app/node_modules/.cache/nuxt`,
+# which nothing writes to, so the cache this comment promises never existed:
+# measured, the faces land in apps/web/node_modules/.cache/nuxt/fonts (3 MB).
+#
 # It does not help a cold CI runner. If a release pipeline cannot tolerate a
 # retry, switch the families to `provider: 'local'` — see apps/web/nuxt.config.ts.
-RUN --mount=type=cache,target=/app/node_modules/.cache/nuxt,sharing=locked \
+RUN --mount=type=cache,target=/app/apps/web/node_modules/.cache/nuxt/fonts,sharing=locked \
     pnpm --filter @trackarr/web build
 
 # -----------------------------------------------------------------------------
 # Final runtime — distroless nonroot
 # Entrypoint of this base image is `/nodejs/bin/node`; CMD is just the script.
 # -----------------------------------------------------------------------------
-FROM gcr.io/distroless/nodejs24-debian13:nonroot AS runner
+FROM gcr.io/distroless/nodejs26-debian13:nonroot AS runner
 WORKDIR /app
 
 COPY --from=builder --chown=nonroot:nonroot /app/apps/web/.output ./.output
 COPY --chown=nonroot:nonroot apps/web/scripts/healthcheck.mjs ./healthcheck.mjs
 
-USER nonroot
+# Numeric for the same reason as apps/api/Dockerfile: `runAsNonRoot` cannot
+# check a name.
+USER 65532:65532
 EXPOSE 3000
 # Memory tuning (see apps/api/Dockerfile for rationale).
 # Web SSR retains compiled Vue templates / component state; without an
-# explicit V8 heap cap, sustained traffic on Node 24 grows RSS into the
-# hundreds of MB before V8 bothers to GC. 384 MB is plenty for SSR.
+# explicit V8 heap cap, sustained traffic grows RSS into the hundreds of
+# MB before V8 bothers to GC. 384 MB is plenty for SSR.
+#
+# `--no-experimental-webstorage` matters more here than in the API: this
+# process renders pages for every visitor, and Node 25+ would hand that
+# render a `sessionStorage` shared by all of them. Same flag, same reason
+# — see apps/api/Dockerfile.
 ENV NODE_ENV=production \
     NUXT_HOST=0.0.0.0 \
     NUXT_PORT=3000 \
-    NODE_OPTIONS="--max-old-space-size=384 --max-semi-space-size=8" \
+    NODE_OPTIONS="--max-old-space-size=384 --max-semi-space-size=8 --no-experimental-webstorage" \
     MALLOC_ARENA_MAX=2 \
     TRACKARR_RUNTIME=docker
 STOPSIGNAL SIGTERM
diff --git a/apps/web/Dockerfile.static b/apps/web/Dockerfile.static
index 45ec1d90..4f481aa3 100644
--- a/apps/web/Dockerfile.static
+++ b/apps/web/Dockerfile.static
@@ -1,4 +1,6 @@
-# syntax=docker/dockerfile:1.7
+# syntax=docker/dockerfile:1.28
+# hadolint global ignore=DL3007
+# (the one `:latest` in this file is Chainguard's: see the runner stage)
 # Trackarr web — static SPA build, distroless nginx runtime.
 #
 # This image is the no-SSR alternative to apps/web/Dockerfile. Memory
@@ -19,8 +21,15 @@
 # -----------------------------------------------------------------------------
 # Install workspace dependencies (cached on package.json + lockfile)
 # -----------------------------------------------------------------------------
-FROM node:24-alpine AS deps
-RUN corepack enable && corepack prepare pnpm@11.22.0 --activate
+FROM node:26-alpine AS deps
+# npm rather than corepack: Node 25 stopped shipping corepack, so the
+# node:26 images have none. The version must match `packageManager` in the
+# root package.json — pnpm 12 records it in pnpm-lock.yaml and a frozen
+# install refuses a lockfile whose pin it does not match. `--allow-scripts`
+# names the one install script we let run: pnpm's own, which only hard-links
+# its native binary over the bins. npm 11.20 runs unlisted scripts with a
+# warning today and is moving to blocking them.
+RUN npm install --global --allow-scripts=pnpm pnpm@12.15.0
 WORKDIR /app
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY apps/web/package.json ./apps/web/
@@ -32,8 +41,8 @@ RUN pnpm install --filter "@trackarr/web..." --frozen-lockfile
 # turn `ssr: false`, and `nuxi generate` writes the prerendered static
 # tree to apps/web/.output/public/.
 # -----------------------------------------------------------------------------
-FROM node:24-alpine AS builder
-RUN corepack enable && corepack prepare pnpm@11.22.0 --activate
+FROM node:26-alpine AS builder
+RUN npm install --global --allow-scripts=pnpm pnpm@12.15.0
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=deps /app/apps/web/node_modules ./apps/web/node_modules
@@ -56,9 +65,16 @@ ENV NUXT_STATIC_BUILD=true \
 # mode from "the build breaks" into "the first build of the day is the only one
 # that needs Google".
 #
+# The target is the WEB package's node_modules, not the workspace root's: the
+# module resolves its cache against Nuxt's `rootDir` (apps/web) — @nuxt/fonts
+# 1.x says so, and 0.14 got the same path from the working directory pnpm
+# runs the script in. Until 2026-10 this mounted `/app/node_modules/.cache/nuxt`,
+# which nothing writes to, so the cache this comment promises never existed:
+# measured, the faces land in apps/web/node_modules/.cache/nuxt/fonts (3 MB).
+#
 # It does not help a cold CI runner. If a release pipeline cannot tolerate a
 # retry, switch the families to `provider: 'local'` — see apps/web/nuxt.config.ts.
-RUN --mount=type=cache,target=/app/node_modules/.cache/nuxt,sharing=locked \
+RUN --mount=type=cache,target=/app/apps/web/node_modules/.cache/nuxt/fonts,sharing=locked \
     pnpm --filter @trackarr/web exec nuxi generate
 
 # -----------------------------------------------------------------------------
@@ -67,6 +83,9 @@ RUN --mount=type=cache,target=/app/node_modules/.cache/nuxt,sharing=locked \
 #   - Reads its config from /etc/nginx/nginx.conf
 #   - Serves /usr/share/nginx/html
 # -----------------------------------------------------------------------------
+# `:latest` is the only tag Chainguard's free tier publishes (the image already
+# runs as 65532).
+# trivy:ignore:AVD-DS-0001
 FROM cgr.dev/chainguard/nginx:latest AS runner
 
 # nginx config (SPA fallback, gzip, asset caching, /healthz)
@@ -101,6 +120,10 @@ STOPSIGNAL SIGQUIT
 # La sonde revient donc à l'orchestrateur, qui sait le faire depuis l'extérieur :
 # `readinessProbe: httpGet: { path: /healthz }` côté Kubernetes, ou un
 # `healthcheck:` dans le compose si l'on veut la garder ici.
+#
+# `HEALTHCHECK NONE` le dit aux analyseurs (trivy DS-0026) sans rien changer :
+# l'image de base n'en déclare aucun.
+HEALTHCHECK NONE
 
 # The Chainguard image's default ENTRYPOINT runs `nginx -g 'daemon off;'`
 # from the right user — no overrides needed.
diff --git a/apps/web/app/assets/css/main.css b/apps/web/app/assets/css/main.css
index 860f88a6..df4cd57e 100644
--- a/apps/web/app/assets/css/main.css
+++ b/apps/web/app/assets/css/main.css
@@ -1,20 +1,187 @@
-@tailwind base;
-@tailwind components;
-@tailwind utilities;
+/* Tailwind 4. `source()` keeps the class scan where tailwind.config.ts's
+   `content` had it — app/ — rather than the whole package. */
+@import 'tailwindcss' source('../..');
+
+/* `darkMode: ['selector', '[data-theme="dark"]']`, as Tailwind 4 spells it. */
+@custom-variant dark (&:where([data-theme="dark"], [data-theme="dark"] *));
+
+/* Tailwind 4 makes `hover:` apply only where the primary pointer can hover,
+   so a tap no longer triggers it. Kept as Tailwind 3 had it: some controls here
+   are revealed on hover, and a touch screen would otherwise never show them. */
+@custom-variant hover (&:hover);
+
+/* =============================================================================
+ * Theme — what tailwind.config.ts used to say, for Tailwind 4
+ *
+ * `inline`, and that is load-bearing. This file's own tokens share Tailwind's
+ * theme namespace: `--font-sans`, `--radius-md`, `--ease-standard` and the rest
+ * are both the design tokens below and Tailwind theme variables. Without
+ * `inline`, `rounded-sm` would compile to `var(--radius-sm)` — the TOKEN, 4 px —
+ * where Tailwind 3 compiled the config's `var(--radius-xs)`, 2 px. With it,
+ * each utility carries the value written here.
+ *
+ * The variables Tailwind also emits from this block live in `@layer theme`,
+ * and the tokens below are unlayered, so where a name collides — including the
+ * self-references (`--font-sans: var(--font-sans)`) — the token wins the
+ * cascade and the theme's copy never applies. Operator themes
+ * (`/api/theme.css`) are unlayered too.
+ *
+ * The keys are Tailwind 3's (`sm`, the bare `rounded`/`shadow`), not renamed
+ * to Tailwind 4's scale, so every class in the templates keeps its meaning.
+ * ============================================================================= */
+@theme inline {
+  /* Surfaces */
+  --color-bg-primary: rgb(var(--bg-base));
+  --color-bg-secondary: rgb(var(--bg-surface));
+  --color-bg-tertiary: rgb(var(--bg-elevated));
+  --color-bg-hover: rgb(var(--bg-hover));
+  --color-bg-inset: rgb(var(--bg-inset));
+
+  /* Foreground (text *and* opacity-aware fills) */
+  --color-text-primary: rgb(var(--fg-default));
+  --color-text-secondary: rgb(var(--fg-muted));
+  --color-text-muted: rgb(var(--fg-subtle));
+  --color-text-faint: rgb(var(--fg-faint));
+  --color-text-strong: rgb(var(--fg-strong));
+
+  /* `fg.*` is the same set under bg/border-friendly names, so
+     `bg-fg-default/10` and `border-fg-default/20` read without ambiguity. */
+  --color-fg-default: rgb(var(--fg-default));
+  --color-fg-strong: rgb(var(--fg-strong));
+  --color-fg-muted: rgb(var(--fg-muted));
+  --color-fg-subtle: rgb(var(--fg-subtle));
+  --color-fg-faint: rgb(var(--fg-faint));
+
+  /* `border-border` is the decorative hairline; `border-border-field` is the
+     3:1 edge WCAG 1.4.11 asks of a control (see `.input`). */
+  --color-border: rgb(var(--line-default));
+  --color-border-hover: rgb(var(--line-strong));
+  --color-border-field: rgb(var(--line-field));
+
+  --color-line: rgb(var(--line-default));
+  --color-line-strong: rgb(var(--line-strong));
+
+  --color-accent: rgb(var(--accent));
+  --color-accent-hover: rgb(var(--accent-hover));
+  --color-accent-fg: rgb(var(--accent-fg));
+  --color-accent-muted: rgb(var(--fg-subtle));
+
+  --color-success: rgb(var(--online));
+  --color-online: rgb(var(--online));
+  --color-warning: rgb(var(--warning));
+  --color-error: rgb(var(--danger));
+  --color-danger: rgb(var(--danger));
+  --color-info: rgb(var(--info));
+
+  /* The stacks live in the tokens below; the utilities only point at them.
+     No `display` entry: `.font-display` is written by hand further down. */
+  --font-sans: var(--font-sans);
+  --font-mono: var(--font-mono);
+
+  --text-2xs: 0.65rem;
+  --text-2xs--line-height: 0.85rem;
+
+  /* Tailwind 3's steps, mapped onto `--radius`'s derived scale exactly as the
+     config had them: 2 / 4 / 6 / 8 / 12 px, nothing shifts by a pixel. */
+  --radius-none: 0;
+  --radius-sm: var(--radius-xs);
+  --radius: var(--radius-sm);
+  --radius-md: var(--radius-md);
+  --radius-lg: var(--radius-lg);
+  --radius-xl: var(--radius-xl);
+  --radius-2xl: calc(var(--radius) * 2.6667);
+  --radius-3xl: calc(var(--radius) * 4);
+  --radius-full: var(--radius-pill);
+
+  /* Durations carry `--motion-scale`, so `motion-scale: 0` stops the
+     utility-driven transitions as well as the hand-written ones. */
+  --default-transition-duration: var(--dur-2);
+  --transition-duration-75: calc(75ms * var(--motion-scale));
+  --transition-duration-100: calc(100ms * var(--motion-scale));
+  --transition-duration-150: var(--dur-2);
+  --transition-duration-200: var(--dur-4);
+  --transition-duration-300: var(--dur-slow);
+  --transition-duration-500: calc(500ms * var(--motion-scale));
+  --transition-duration-700: calc(700ms * var(--motion-scale));
+  --transition-duration-1000: calc(1000ms * var(--motion-scale));
+  --default-transition-timing-function: var(--ease-standard);
+  --ease-standard: var(--ease-standard);
+  --ease-emphasis: var(--ease-emphasis);
+
+  /* Shadows a theme can tint and flatten, through the same two levers. */
+  --shadow-sm: 0 1px 2px 0 rgb(var(--shadow-color) / calc(0.05 * var(--shadow-strength)));
+  --shadow: 0 1px 3px 0 rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength))),
+    0 1px 2px -1px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength)));
+  --shadow-md: 0 4px 6px -1px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength))),
+    0 2px 4px -2px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength)));
+  --shadow-lg: 0 10px 15px -3px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength))),
+    0 4px 6px -4px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength)));
+  --shadow-xl: 0 20px 25px -5px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength))),
+    0 8px 10px -6px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength)));
+  --shadow-2xl: 0 25px 50px -12px rgb(var(--shadow-color) / calc(0.25 * var(--shadow-strength)));
+  --shadow-inner: inset 0 2px 4px 0 rgb(var(--shadow-color) / calc(0.05 * var(--shadow-strength)));
+  --shadow-none: none;
+}
+
+/* Tailwind 4 redrew its default palette in oklch, more saturated than Tailwind
+   3's hex values: sky-400 loses 56 of red, amber-400 36 of blue. The templates
+   use eight of those shades (menu icons, the favourite and rating stars, the
+   bonus-pool marker, the register notice, the Torznab chips and gauges) and the
+   placeholder rule below a ninth; they keep Tailwind 3's values. Delete this
+   block to adopt Tailwind 4's palette. gray-200, the bare border's colour, is
+   identical in both. */
+@theme {
+  --color-amber-400: #fbbf24;
+  --color-amber-500: #f59e0b;
+  --color-yellow-500: #eab308;
+  --color-sky-400: #38bdf8;
+  --color-sky-500: #0ea5e9;
+  --color-emerald-500: #10b981;
+  --color-purple-500: #a855f7;
+  --color-pink-500: #ec4899;
+  --color-gray-400: #9ca3af;
+}
+
+/* Three Tailwind 3 defaults that Tailwind 4 changed, restored: elements that
+   relied on them would otherwise change look without a class changing.
+     - a bare `border` was gray-200, not `currentColor`;
+     - a placeholder was gray-400, not the text colour at half opacity
+       (`.input` sets its own, further down, and wins over this);
+     - a button showed the pointer cursor. */
+@layer base {
+  *,
+  ::after,
+  ::before,
+  ::backdrop,
+  ::file-selector-button {
+    border-color: var(--color-gray-200, currentcolor);
+  }
+
+  input::placeholder,
+  textarea::placeholder {
+    color: var(--color-gray-400);
+  }
+
+  button:not(:disabled),
+  [role='button']:not(:disabled) {
+    cursor: pointer;
+  }
+}
 
 /* =============================================================================
  * Design tokens
  *
  * Two themes (`data-theme="dark"` default, `data-theme="light"`) driven from
- * CSS variables. The Tailwind config maps `bg-bg-primary`, `text-text-muted`,
- * `border-border` etc. to these vars so the existing markup picks both
- * themes up without churn.
+ * CSS variables. The `@theme inline` block above maps `bg-bg-primary`,
+ * `text-text-muted`, `border-border` etc. to these vars so the existing markup
+ * picks both themes up without churn.
  *
  * Colour vars are stored as **space-separated RGB triplets** ("250 250 250")
- * rather than hex literals, so Tailwind's `<alpha-value>` placeholder can
- * compose them: `rgb(var(--bg-base) / 0.5)` is valid; the previous
- * `rgba(var(--bg-base), 0.5)` form silently dropped to the user-agent default
- * and gave us white inputs in dark mode.
+ * rather than hex literals, so `rgb(var(--bg-base) / 0.5)` is valid wherever
+ * this file writes it by hand; the previous `rgba(var(--bg-base), 0.5)` form
+ * silently dropped to the user-agent default and gave us white inputs in dark
+ * mode. Utility opacity modifiers (`bg-bg-secondary/50`) no longer go through
+ * the triplet: Tailwind 4 composes them with `color-mix()`.
  * ============================================================================= */
 
 :root,
@@ -172,8 +339,8 @@
      instead of the app's face, and the 21 in FreeleechPool.vue wrote
      `var(--font-mono)` with no fallback at all, which makes the whole
      declaration invalid — those elements were not monospace, they were Inter.
-     Kept identical to tailwind.config.ts `fontFamily.mono` so the token and
-     the `font-mono` utility can never drift apart. */
+     The `font-mono` utility compiles to this very token (`@theme inline`, at
+     the top of this file), so the two cannot drift apart. */
   --font-mono:      'JetBrains Mono', ui-monospace, SFMono-Regular, Menlo, monospace;
   /* The other two roles, named for the same reason. `--font-sans` had never
      existed even though `tailwind.config.ts` declared the stack, so a theme had
@@ -181,9 +348,9 @@
      FreeleechPool.vue, pointing at 'Iowan Old Style' — a face this site never
      loads — while the `.font-display` utility below and some eighty
      declarations across a dozen pages spell Fraunces out by hand with four
-     different fallback stacks. All three are now one name each, kept identical
-     to what `tailwind.config.ts` resolves so a token and its utility cannot
-     drift.
+     different fallback stacks. All three are now one name each, and the
+     utilities compile to these tokens (`@theme inline`), so a token and its
+     utility cannot drift.
      These hold the STACK. What a theme stores is a short name — `manrope`,
      `fira-code` — and the emitter looks the stack up in `FONT_STACKS`
      (packages/shared/src/theme.ts), for the same reason the background pattern
@@ -725,7 +892,11 @@
    * `.eyebrow` is for actual eyebrow labels (above a section title, in form
    * field labels, inside table headers). NEVER use it as a heading.
    * --------------------------------------------------------------------------- */
-  .eyebrow {
+  /* One rule for both, rather than `@apply eyebrow` in the mono one: Tailwind 4
+     only applies utilities, and making `.eyebrow` one would move it out of this
+     layer. The mono variant's own declarations come after and win. */
+  .eyebrow,
+  .eyebrow-mono {
     font-size: 0.6875rem;
     font-weight: 600;
     color: rgb(var(--fg-subtle));
@@ -734,7 +905,6 @@
     line-height: 1.4;
   }
   .eyebrow-mono {
-    @apply eyebrow;
     font-family: var(--font-mono);
     font-weight: 500;
   }
diff --git a/apps/web/app/components/CategorySidebar.vue b/apps/web/app/components/CategorySidebar.vue
index 89e2f0ea..eccfb3a6 100644
--- a/apps/web/app/components/CategorySidebar.vue
+++ b/apps/web/app/components/CategorySidebar.vue
@@ -47,7 +47,7 @@
   >
     <div
       v-if="mobileOpen"
-      class="lg:hidden fixed inset-0 z-50 bg-bg-primary/80 backdrop-blur-sm"
+      class="lg:hidden fixed inset-0 z-50 bg-bg-primary/80 backdrop-blur-xs"
       @click.self="mobileOpen = false"
     />
   </Transition>
diff --git a/apps/web/app/components/CategorySidebarItems.vue b/apps/web/app/components/CategorySidebarItems.vue
index 9054090d..d3aa3432 100644
--- a/apps/web/app/components/CategorySidebarItems.vue
+++ b/apps/web/app/components/CategorySidebarItems.vue
@@ -31,13 +31,13 @@
       @click="$emit('toggle', category)"
     >
       <span class="flex items-center gap-2 min-w-0">
-        <Icon :name="getCategoryIcon(category.slug)" class="text-sm flex-shrink-0" />
+        <Icon :name="getCategoryIcon(category.slug)" class="text-sm shrink-0" />
         <span class="truncate">{{ category.name }}</span>
       </span>
       <Icon
         v-if="category.subcategories?.length"
         name="ph:caret-right-bold"
-        class="text-[10px] text-text-muted transition-transform flex-shrink-0"
+        class="text-[10px] text-text-muted transition-transform shrink-0"
         :class="{ 'rotate-90': expandedIds.has(category.id) }"
       />
     </button>
diff --git a/apps/web/app/components/CommandPalette.vue b/apps/web/app/components/CommandPalette.vue
index dfc57b66..49bc3211 100644
--- a/apps/web/app/components/CommandPalette.vue
+++ b/apps/web/app/components/CommandPalette.vue
@@ -24,7 +24,7 @@
           <div class="palette-field">
             <Icon
               name="ph:magnifying-glass"
-              class="w-4 h-4 flex-shrink-0 text-text-muted"
+              class="w-4 h-4 shrink-0 text-text-muted"
             />
             <input
               ref="inputRef"
diff --git a/apps/web/app/components/ConfirmHost.vue b/apps/web/app/components/ConfirmHost.vue
index 4625a214..f90e6d00 100644
--- a/apps/web/app/components/ConfirmHost.vue
+++ b/apps/web/app/components/ConfirmHost.vue
@@ -10,7 +10,7 @@
     >
       <div
         v-if="current"
-        class="fixed inset-0 z-50 flex items-center justify-center p-4 bg-black/60 backdrop-blur-sm"
+        class="fixed inset-0 z-50 flex items-center justify-center p-4 bg-black/60 backdrop-blur-xs"
         @click.self="onCancel"
         @keydown.esc.stop="onCancel"
       >
diff --git a/apps/web/app/components/DescriptionRender.vue b/apps/web/app/components/DescriptionRender.vue
index 44ce2d72..fc057965 100644
--- a/apps/web/app/components/DescriptionRender.vue
+++ b/apps/web/app/components/DescriptionRender.vue
@@ -7,6 +7,8 @@
        WysiwygEditor's preview mode, the upload/edit pages' preview
        panels — should route through this component so the rendered
        output is byte-for-byte the same everywhere. -->
+  <!-- toEditorHtml: sanitizeRichHtml / sanitizeHtml (DOMPurify). -->
+  <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
   <div
     class="description-render prose prose-invert prose-sm max-w-none"
     :class="$attrs.class"
diff --git a/apps/web/app/components/Modal.vue b/apps/web/app/components/Modal.vue
index 8c46c33f..7b17fd4f 100644
--- a/apps/web/app/components/Modal.vue
+++ b/apps/web/app/components/Modal.vue
@@ -33,7 +33,7 @@
               <Icon
                 v-if="icon"
                 :name="icon"
-                class="text-base flex-shrink-0"
+                class="text-base shrink-0"
                 :style="iconStyle"
               />
               <!-- L'id porte sur le conteneur, pas sur le `<h3>` par défaut.
diff --git a/apps/web/app/components/SearchBar.vue b/apps/web/app/components/SearchBar.vue
index 82b56410..62ef263a 100644
--- a/apps/web/app/components/SearchBar.vue
+++ b/apps/web/app/components/SearchBar.vue
@@ -191,6 +191,10 @@ onUnmounted(() => {
 </script>
 
 <style scoped>
+/* Tailwind 4 compiles a component's styles on their own: `@apply` below only
+   knows the theme (`bg-bg-tertiary`, `rounded-lg`…) through this reference.
+   It emits nothing. */
+@reference "../assets/css/main.css";
 .search-bar-wrapper {
   display: flex;
   flex-direction: column;
diff --git a/apps/web/app/components/TagInput.vue b/apps/web/app/components/TagInput.vue
index bc543ae1..da3f1b95 100644
--- a/apps/web/app/components/TagInput.vue
+++ b/apps/web/app/components/TagInput.vue
@@ -260,6 +260,10 @@ defineExpose({ focus: focusInput });
 </script>
 
 <style scoped>
+/* Tailwind 4 compiles a component's styles on their own: `@apply` below only
+   knows the theme (`bg-bg-tertiary`, `rounded-lg`…) through this reference.
+   It emits nothing. */
+@reference "../assets/css/main.css";
 .tag-input {
   @apply relative w-full min-h-[38px] flex flex-wrap items-center gap-1.5
          bg-bg-tertiary border border-border rounded px-2 py-1.5
@@ -285,11 +289,11 @@ defineExpose({ focus: focusInput });
   @apply w-2.5 h-2.5;
 }
 
-/* `outline-none` is deliberate: the focus treatment belongs to the wrapper,
+/* `outline-hidden` is deliberate: the focus treatment belongs to the wrapper,
    `.tag-input:focus-within` above, so that the ring frames the whole chip
    field rather than the bare caret slot inside it. */
 .tag-input-field {
-  @apply flex-1 min-w-[80px] bg-transparent outline-none border-0
+  @apply flex-1 min-w-[80px] bg-transparent outline-hidden border-0
          text-text-primary placeholder-text-muted text-xs;
 }
 .tag-input-field:disabled {
diff --git a/apps/web/app/components/WysiwygEditor.vue b/apps/web/app/components/WysiwygEditor.vue
index 485ec82c..1d178d26 100644
--- a/apps/web/app/components/WysiwygEditor.vue
+++ b/apps/web/app/components/WysiwygEditor.vue
@@ -542,7 +542,7 @@ const editor = useEditor({
   editorProps: {
     attributes: {
       /**
-       * `focus:outline-none` is deliberate here, and one of only two places
+       * `focus:outline-hidden` is deliberate here, and one of only two places
        * that keeps it. This is the editing surface: the caret is the focus
        * indicator, a 2px ring around the whole body would sit there for the
        * length of every edit, and the wrapper below already carries
@@ -550,7 +550,7 @@ const editor = useEditor({
        * see the note in main.css.
        */
       class:
-        'prose prose-invert prose-sm max-w-none focus:outline-none min-h-[140px]',
+        'prose prose-invert prose-sm max-w-none focus:outline-hidden min-h-[140px]',
     },
     /**
      * Detect BBCode / Markdown / HTML on paste and convert before
diff --git a/apps/web/app/components/admin/Branding.vue b/apps/web/app/components/admin/Branding.vue
index f1a69588..e2a80570 100644
--- a/apps/web/app/components/admin/Branding.vue
+++ b/apps/web/app/components/admin/Branding.vue
@@ -407,12 +407,16 @@
                   <Icon v-else :name="form.siteLogo" class="nav-logo-icon" />
                 </div>
                 <div class="nav-id">
+                  <!-- sanitizeHtml (DOMPurify). -->
+                  <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
                   <span
                     class="nav-name"
                     :class="{ 'nav-name--bold': form.siteNameBold }"
                     :style="form.siteNameColor ? { color: form.siteNameColor } : {}"
                     v-html="sanitizeHtml(form.siteName) || 'Trackarr'"
                   />
+                  <!-- sanitizeHtml (DOMPurify). -->
+                  <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
                   <span
                     v-if="form.siteSubtitle"
                     class="nav-subtitle"
@@ -460,9 +464,13 @@
             <div class="sample-surface sample-surface--hero">
               <span class="hero-badge">
                 <span class="hero-badge-dot" />
-                {{ form.statusBadgeText || $t('admin.homepage.statusBadgePlaceholder') }}
+                {{ form.statusBadgeText || $t('home.live') }}
               </span>
+              <!-- sanitizeHtml (DOMPurify). -->
+              <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
               <h3 class="hero-title" v-html="sanitizeHtml(form.heroTitle) || 'Trackarr'" />
+              <!-- sanitizeHtml (DOMPurify). -->
+              <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
               <p
                 v-if="form.heroSubtitle"
                 class="hero-subtitle"
@@ -561,10 +569,10 @@ function defaultForm(): BrandingForm {
     heroTitle: 'Trackarr',
     heroSubtitle:
       'High-performance, minimalist P2P tracking engine. Search through our indexed database of verified torrents.',
-    statusBadgeText: 'Tracker Online & Operational',
+    statusBadgeText: '',
     features: [
       { title: 'High Performance', description: 'Built with Node.js and Redis for sub-millisecond response times and high concurrency support.' },
-      { title: 'Multi-Protocol', description: 'Supports HTTP, UDP, and WebSocket protocols for maximum compatibility with all BitTorrent clients.' },
+      { title: 'Multi-Protocol', description: 'Supports HTTP and UDP announces for maximum compatibility with all BitTorrent clients.' },
       { title: 'Open Source', description: 'Fully transparent and community-driven. Designed for privacy and efficiency in the P2P ecosystem.' },
     ],
   };
diff --git a/apps/web/app/components/admin/Endpoints.vue b/apps/web/app/components/admin/Endpoints.vue
index e96f731f..1eba04dd 100644
--- a/apps/web/app/components/admin/Endpoints.vue
+++ b/apps/web/app/components/admin/Endpoints.vue
@@ -56,20 +56,14 @@ const rows = computed(() => [
     icon: 'ph:lightning-bold',
     url: (config.public.trackerUdpUrl as string) || '',
   },
-  {
-    kind: 'ws' as const,
-    label: t('admin.endpoints.websocket'),
-    icon: 'ph:plugs-connected-bold',
-    url: (config.public.trackerWsUrl as string) || '',
-  },
 ]);
 
 // Briefly swap the copy icon for a check so the user gets a visual
 // confirmation without us having to wire a toast.
-const copied = ref<'http' | 'udp' | 'ws' | null>(null);
+const copied = ref<'http' | 'udp' | null>(null);
 let copyTimer: ReturnType<typeof setTimeout> | null = null;
 
-async function copy(kind: 'http' | 'udp' | 'ws', url: string) {
+async function copy(kind: 'http' | 'udp', url: string) {
   if (!url) return;
   try {
     await navigator.clipboard.writeText(url);
diff --git a/apps/web/app/components/admin/HomepageContent.vue b/apps/web/app/components/admin/HomepageContent.vue
index 7f881ccc..e07a9997 100644
--- a/apps/web/app/components/admin/HomepageContent.vue
+++ b/apps/web/app/components/admin/HomepageContent.vue
@@ -136,7 +136,7 @@ const features = ref([
   {
     title: 'Multi-Protocol',
     description:
-      'Supports HTTP, UDP, and WebSocket protocols for maximum compatibility with all BitTorrent clients.',
+      'Supports HTTP and UDP announces for maximum compatibility with all BitTorrent clients.',
   },
   {
     title: 'Open Source',
diff --git a/apps/web/app/components/admin/Protocols.vue b/apps/web/app/components/admin/Protocols.vue
index 9cc86d9e..c2a29319 100644
--- a/apps/web/app/components/admin/Protocols.vue
+++ b/apps/web/app/components/admin/Protocols.vue
@@ -37,7 +37,7 @@ const props = defineProps<{
   protocols: Record<string, boolean> | undefined;
 }>();
 
-const defaultProtocols = { http: false, udp: false, ws: false };
+const defaultProtocols = { http: false, udp: false };
 
 const activeCount = computed(() => {
   const p = props.protocols ?? defaultProtocols;
@@ -48,7 +48,7 @@ const totalCount = computed(() => {
   return Object.keys(p).length;
 });
 
-const ORDER: Record<string, number> = { http: 0, udp: 1, ws: 2 };
+const ORDER: Record<string, number> = { http: 0, udp: 1 };
 function index(name: string | number): number {
   return ORDER[String(name).toLowerCase()] ?? 99;
 }
@@ -57,7 +57,6 @@ function protocolIcon(name: string | number): string {
   const k = String(name).toLowerCase();
   if (k === 'http') return 'ph:globe-bold';
   if (k === 'udp') return 'ph:lightning-bold';
-  if (k === 'ws') return 'ph:plugs-connected-bold';
   return 'ph:plug-bold';
 }
 </script>
diff --git a/apps/web/app/components/admin/Shop.vue b/apps/web/app/components/admin/Shop.vue
index 7f1418bc..ec76727e 100644
--- a/apps/web/app/components/admin/Shop.vue
+++ b/apps/web/app/components/admin/Shop.vue
@@ -372,7 +372,7 @@
             role="switch"
             :aria-label="$t('admin.shop.fields.enabled')"
             :aria-checked="form.enabled"
-            class="relative w-9 h-5 rounded-full transition-colors flex-shrink-0"
+            class="relative w-9 h-5 rounded-full transition-colors shrink-0"
             :class="form.enabled ? 'bg-accent' : 'bg-fg-default/15'"
             @click="form.enabled = !form.enabled"
           >
@@ -388,7 +388,7 @@
           class="flex items-center gap-2 px-3 py-2 rounded bg-error/10 border border-error/30 text-xs text-error"
           role="alert"
         >
-          <Icon name="ph:warning-circle-bold" class="text-base flex-shrink-0" />
+          <Icon name="ph:warning-circle-bold" class="text-base shrink-0" />
           <span>{{ formError }}</span>
         </p>
       </form>
diff --git a/apps/web/app/components/admin/System.vue b/apps/web/app/components/admin/System.vue
index 16681c88..1e5dbe2a 100644
--- a/apps/web/app/components/admin/System.vue
+++ b/apps/web/app/components/admin/System.vue
@@ -54,7 +54,7 @@
               </a>
             </p>
           </div>
-          <div class="flex items-center gap-2 flex-shrink-0">
+          <div class="flex items-center gap-2 shrink-0">
             <span
               class="px-3 py-1.5 bg-bg-tertiary border border-border rounded font-mono text-sm text-text-primary"
             >
diff --git a/apps/web/app/components/admin/TemplateSettings.vue b/apps/web/app/components/admin/TemplateSettings.vue
index 11e875e3..40606fce 100644
--- a/apps/web/app/components/admin/TemplateSettings.vue
+++ b/apps/web/app/components/admin/TemplateSettings.vue
@@ -36,7 +36,7 @@
                change every admin panel. The name has to come from somewhere,
                and duplicating the group's own string is the smallest honest
                way to say it.
-               `focus:outline-none` is deliberately absent — the app's global
+               `focus:outline-hidden` is deliberately absent — the app's global
                focus-visible ring (main.css) is the visible one, and replacing
                it with a 20%-opacity border left the field with no perceptible
                focus state at all. -->
diff --git a/apps/web/app/components/admin/TorznabRateLimiting.vue b/apps/web/app/components/admin/TorznabRateLimiting.vue
index 30435107..d4fcb9b8 100644
--- a/apps/web/app/components/admin/TorznabRateLimiting.vue
+++ b/apps/web/app/components/admin/TorznabRateLimiting.vue
@@ -59,8 +59,9 @@
         </div>
         <div class="mt-2">
           <div class="h-1.5 bg-bg-tertiary rounded-full overflow-hidden">
+            <!-- `/srgb`: Tailwind 3's blend. Tailwind 4 mixes gradients in oklab. -->
             <div
-              class="h-full bg-gradient-to-r from-success to-yellow-500"
+              class="h-full bg-linear-to-r/srgb from-success to-yellow-500"
               :style="{
                 width: `${Math.min((localSearchLimit / 100) * 100, 100)}%`,
               }"
@@ -95,7 +96,7 @@
         <div class="mt-2">
           <div class="h-1.5 bg-bg-tertiary rounded-full overflow-hidden">
             <div
-              class="h-full bg-gradient-to-r from-success to-yellow-500"
+              class="h-full bg-linear-to-r/srgb from-success to-yellow-500"
               :style="{
                 width: `${Math.min((localDownloadLimit / 50) * 100, 100)}%`,
               }"
diff --git a/apps/web/app/components/admin/UploadRules.vue b/apps/web/app/components/admin/UploadRules.vue
index a543a73e..25660d70 100644
--- a/apps/web/app/components/admin/UploadRules.vue
+++ b/apps/web/app/components/admin/UploadRules.vue
@@ -664,7 +664,10 @@ async function save() {
     notifications.success(t('admin.uploadRules.saved'));
     await refreshRules();
   } catch (err: any) {
-    const invalid = err?.data?.invalidFields as string[] | undefined;
+    // `err.data` est le corps de la réponse, et le `data` de `createError` y est
+    // imbriqué : lus un cran trop haut, les champs refusés par le serveur ne
+    // s'entouraient jamais de rouge.
+    const invalid = err?.data?.data?.invalidFields as string[] | undefined;
     if (Array.isArray(invalid)) {
       for (const path of invalid) {
         if (path === 'titleBlocklist') errors.titleBlocklist = true;
diff --git a/apps/web/app/components/template/TemplateEditorModal.vue b/apps/web/app/components/template/TemplateEditorModal.vue
index 321466cc..abc10e0e 100644
--- a/apps/web/app/components/template/TemplateEditorModal.vue
+++ b/apps/web/app/components/template/TemplateEditorModal.vue
@@ -196,7 +196,7 @@
         </div>
 
         <p v-if="formError" class="tpl-form-error" role="alert">
-          <Icon name="ph:warning-circle-bold" class="text-base flex-shrink-0" />
+          <Icon name="ph:warning-circle-bold" class="text-base shrink-0" />
           <span>{{ formError }}</span>
         </p>
       </section>
@@ -255,8 +255,8 @@
             <Icon name="ph:arrows-out-line-horizontal" class="text-2xl" />
             <p>{{ $t('components.templateEditor.previewTooLarge') }}</p>
           </div>
-          <!-- eslint-disable-next-line vue/no-v-html -->
-          <div v-else-if="preview" class="tpl-preview" v-html="preview" />
+          <!-- eslint-disable-next-line vue/no-v-html -- sanitizeRichHtml (DOMPurify) -->
+          <div v-else-if="preview" class="tpl-preview" v-html="preview" /> <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
           <div v-else class="tpl-panel-empty">
             <Icon name="ph:file-dashed" class="text-2xl" />
             <p>{{ $t('components.templateEditor.previewEmpty') }}</p>
diff --git a/apps/web/app/composables/useBranding.ts b/apps/web/app/composables/useBranding.ts
index 7b130ac5..c5d273b6 100644
--- a/apps/web/app/composables/useBranding.ts
+++ b/apps/web/app/composables/useBranding.ts
@@ -23,6 +23,8 @@ export interface BrandingPayload {
   pageTitleSuffix: string | null;
   /** Gates the federation nav items. False when federation was never set up. */
   federationEnabled: boolean;
+  /** Whether staff wrote site rules — the footer links to `/rules` then. */
+  hasRules?: boolean;
   /** Les réglages du catalogue choisis par l'opérateur (voir `getCatalogueSettings`). */
   catalogue?: {
     defaultView: 'grouped' | 'simple';
diff --git a/apps/web/app/layouts/default.vue b/apps/web/app/layouts/default.vue
index 82fdbf44..6ab2b2d4 100644
--- a/apps/web/app/layouts/default.vue
+++ b/apps/web/app/layouts/default.vue
@@ -39,7 +39,7 @@
       >
         <NuxtLink to="/" class="flex items-center gap-2.5 group min-w-0">
           <div
-            class="w-7 h-7 bg-accent rounded-sm flex items-center justify-center transition-transform group-hover:rotate-12 overflow-hidden flex-shrink-0"
+            class="w-7 h-7 bg-accent rounded-sm flex items-center justify-center transition-transform group-hover:rotate-12 overflow-hidden shrink-0"
           >
             <img
               v-if="branding?.siteLogoImage"
@@ -54,6 +54,8 @@
             />
           </div>
           <div class="flex flex-col leading-none min-w-0">
+            <!-- sanitizeHtml (DOMPurify). -->
+            <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
             <span
               class="text-sm tracking-tighter transition-colors truncate"
               :class="{
@@ -63,6 +65,8 @@
               :style="{ color: branding?.siteNameColor || '' }"
               v-html="sanitizeHtml(branding?.siteName)"
             ></span>
+            <!-- sanitizeHtml (DOMPurify). -->
+            <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
             <span class="text-[10px] text-text-muted font-mono truncate"
               v-html="sanitizeHtml(branding?.siteSubtitle)"
             ></span>
@@ -94,7 +98,7 @@
              son icône et son `title`. La recherche, elle, n'a pas de repli
              dans cette barre — le commentaire du formulaire l'appelle « the
              centerpiece ». -->
-        <nav class="hidden md:flex items-center gap-1 flex-shrink-0">
+        <nav class="hidden md:flex items-center gap-1 shrink-0">
           <template v-for="link in visibleNavLinks" :key="link.to">
             <!-- « Torrents » porte un menu : les raccourcis et les catégories, au survol
                  ou au chevron. Le lien lui-même mène toujours au catalogue. -->
@@ -165,7 +169,7 @@
           </div>
         </form>
 
-        <div class="flex items-center gap-3 flex-shrink-0">
+        <div class="flex items-center gap-3 shrink-0">
           <!-- Palette affordance. A shortcut nobody is told about is a
                shortcut nobody uses, so the key sits where people already look
                for chrome rather than only in a help page. -->
@@ -315,7 +319,7 @@
                     </div>
                     <Icon
                       name="ph:arrow-right"
-                      class="text-text-muted group-hover:text-text-primary transition-colors flex-shrink-0"
+                      class="text-text-muted group-hover:text-text-primary transition-colors shrink-0"
                     />
                   </div>
                   <div
@@ -489,7 +493,7 @@
     >
       <div
         v-if="showMobileNav"
-        class="md:hidden fixed inset-0 z-50 bg-bg-primary/80 backdrop-blur-sm"
+        class="md:hidden fixed inset-0 z-50 bg-bg-primary/80 backdrop-blur-xs"
         @click.self="showMobileNav = false"
       />
     </Transition>
@@ -571,7 +575,7 @@
           @click="showMobileNav = false"
         >
           <div
-            class="w-12 h-12 rounded-md bg-bg-elevated border border-border flex items-center justify-center overflow-hidden flex-shrink-0"
+            class="w-12 h-12 rounded-md bg-bg-elevated border border-border flex items-center justify-center overflow-hidden shrink-0"
           >
             <Icon
               name="ph:user-circle-light"
@@ -602,7 +606,7 @@
               >{{ $t('nav.mod') }}</span>
             </div>
           </div>
-          <Icon name="ph:arrow-right-bold" class="text-text-muted text-base flex-shrink-0" />
+          <Icon name="ph:arrow-right-bold" class="text-text-muted text-base shrink-0" />
         </NuxtLink>
 
         <!-- Stats strip — three cells, mono numerics -->
@@ -640,7 +644,7 @@
             active-class="bg-fg-default/10 text-text-strong"
             @click="showMobileNav = false"
           >
-            <Icon :name="link.icon" class="text-lg flex-shrink-0" />
+            <Icon :name="link.icon" class="text-lg shrink-0" />
             <!-- `$t(link.labelKey)`, like the desktop bar two hundred lines
                  up. `label` is not a field of these items, so every entry in
                  the mobile drawer rendered with an empty name. -->
@@ -659,7 +663,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-primary hover:bg-fg-default/5 transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:sign-in" class="text-lg flex-shrink-0" />
+            <Icon name="ph:sign-in" class="text-lg shrink-0" />
             <span>{{ $t('nav.signIn') }}</span>
           </NuxtLink>
         </div>
@@ -669,7 +673,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-secondary hover:bg-fg-default/5 hover:text-text-primary transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:star-bold" class="text-lg flex-shrink-0 text-amber-500" />
+            <Icon name="ph:star-bold" class="text-lg shrink-0 text-amber-500" />
             <span>{{ $t('nav.favorites') }}</span>
           </NuxtLink>
           <NuxtLink
@@ -677,7 +681,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-secondary hover:bg-fg-default/5 hover:text-text-primary transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:bookmark-simple-bold" class="text-lg flex-shrink-0 text-sky-500" />
+            <Icon name="ph:bookmark-simple-bold" class="text-lg shrink-0 text-sky-500" />
             <span>{{ $t('nav.alerts') }}</span>
           </NuxtLink>
           <NuxtLink
@@ -685,7 +689,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-secondary hover:bg-fg-default/5 hover:text-text-primary transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:users-three-bold" class="text-lg flex-shrink-0 text-emerald-500" />
+            <Icon name="ph:users-three-bold" class="text-lg shrink-0 text-emerald-500" />
             <span>{{ $t('nav.following') }}</span>
           </NuxtLink>
           <NuxtLink
@@ -694,7 +698,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-secondary hover:bg-fg-default/5 hover:text-text-primary transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:chat-circle-bold" class="text-lg flex-shrink-0" />
+            <Icon name="ph:chat-circle-bold" class="text-lg shrink-0" />
             <span>{{ $t('messaging.title') }}</span>
           </NuxtLink>
           <NuxtLink
@@ -702,7 +706,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-secondary hover:bg-fg-default/5 hover:text-text-primary transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:download-simple-bold" class="text-lg flex-shrink-0" />
+            <Icon name="ph:download-simple-bold" class="text-lg shrink-0" />
             <span>{{ $t('nav.downloads', 'Downloads') }}</span>
           </NuxtLink>
           <NuxtLink
@@ -710,7 +714,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-secondary hover:bg-fg-default/5 hover:text-text-primary transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:upload-simple-bold" class="text-lg flex-shrink-0" />
+            <Icon name="ph:upload-simple-bold" class="text-lg shrink-0" />
             <span>{{ $t('torrents.upload') }}</span>
           </NuxtLink>
           <NuxtLink
@@ -718,7 +722,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-secondary hover:bg-fg-default/5 hover:text-text-primary transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:storefront-bold" class="text-lg flex-shrink-0" />
+            <Icon name="ph:storefront-bold" class="text-lg shrink-0" />
             <span class="flex-1">{{ $t('nav.shop') }}</span>
             <span
               v-if="user && (user as any).bonusPoints !== undefined"
@@ -732,7 +736,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-secondary hover:bg-fg-default/5 hover:text-text-primary transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:envelope-simple-bold" class="text-lg flex-shrink-0" />
+            <Icon name="ph:envelope-simple-bold" class="text-lg shrink-0" />
             <span>{{ $t('nav.invitations', 'Invitations') }}</span>
           </NuxtLink>
           <NuxtLink
@@ -740,7 +744,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-secondary hover:bg-fg-default/5 hover:text-text-primary transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:flag-bold" class="text-lg flex-shrink-0" />
+            <Icon name="ph:flag-bold" class="text-lg shrink-0" />
             <span>{{ $t('nav.reports', 'My reports') }}</span>
           </NuxtLink>
           <NuxtLink
@@ -748,7 +752,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-text-secondary hover:bg-fg-default/5 hover:text-text-primary transition-colors"
             @click="showMobileNav = false"
           >
-            <Icon name="ph:gear" class="text-lg flex-shrink-0" />
+            <Icon name="ph:gear" class="text-lg shrink-0" />
             <span>{{ $t('nav.settings') }}</span>
           </NuxtLink>
           <button
@@ -756,7 +760,7 @@
             class="flex items-center gap-3 px-3 py-3 rounded-md text-sm font-medium text-error hover:bg-error/10 transition-colors text-left"
             @click="onMobileLogout"
           >
-            <Icon name="ph:sign-out" class="text-lg flex-shrink-0" />
+            <Icon name="ph:sign-out" class="text-lg shrink-0" />
             <span>{{ $t('nav.signOut') }}</span>
           </button>
         </div>
@@ -792,7 +796,7 @@
             <Icon
               :name="announcementStyles[announcement.type || 'info'].icon"
               :class="[
-                'text-lg flex-shrink-0',
+                'text-lg shrink-0',
                 announcementStyles[announcement.type || 'info'].text,
               ]"
             />
@@ -806,7 +810,7 @@
             </p>
             <button
               @click="dismissAnnouncement"
-              class="p-1 rounded hover:bg-fg-default/10 transition-colors flex-shrink-0"
+              class="p-1 rounded hover:bg-fg-default/10 transition-colors shrink-0"
               title="Dismiss"
             >
               <Icon
@@ -826,7 +830,7 @@
     <main
       id="main"
       tabindex="-1"
-      class="flex-grow max-w-[var(--container-max)] w-full mx-auto px-4 py-6"
+      class="grow max-w-[var(--container-max)] w-full mx-auto px-4 py-6"
     >
       <slot />
     </main>
@@ -871,17 +875,18 @@
             to="/privacy"
             class="inline-flex items-center min-h-[1.5rem] text-[10px] font-mono uppercase tracking-widest text-text-muted hover:text-text-strong transition-colors"
           >{{ $t('privacy.eyebrow') }}</NuxtLink>
+          <!-- The rules from Admin → Branding, once staff wrote some. -->
+          <NuxtLink
+            v-if="branding?.hasRules"
+            to="/rules"
+            class="inline-flex items-center min-h-[1.5rem] text-[10px] font-mono uppercase tracking-widest text-text-muted hover:text-text-strong transition-colors"
+          >{{ $t('rules.eyebrow') }}</NuxtLink>
+          <!-- The project's source. This footer used to carry the upstream
+               author's personal site, the upstream repository and the
+               upstream Discord invite, hard-coded: every instance of this
+               fork advertised them, with no setting to change it. -->
           <a
-            href="https://n0w.me/"
-            target="_blank"
-            rel="noopener"
-            :aria-label="$t('nav.footerSite')"
-            :title="$t('nav.footerSite')"
-            class="inline-flex items-center justify-center min-w-[1.5rem] min-h-[1.5rem] text-text-muted hover:text-text-strong transition-colors"
-            ><Icon name="ph:globe" class="text-xl"
-          /></a>
-          <a
-            href="https://github.com/florianjs/trackarr"
+            href="https://github.com/Dim145/opentracker"
             target="_blank"
             rel="noopener"
             :aria-label="$t('nav.footerSource')"
@@ -889,15 +894,6 @@
             class="inline-flex items-center justify-center min-w-[1.5rem] min-h-[1.5rem] text-text-muted hover:text-text-strong transition-colors"
             ><Icon name="ph:github-logo" class="text-xl"
           /></a>
-          <a
-            href="https://discord.gg/GRFu35djvz"
-            target="_blank"
-            rel="noopener"
-            :aria-label="$t('nav.footerChat')"
-            :title="$t('nav.footerChat')"
-            class="inline-flex items-center justify-center min-w-[1.5rem] min-h-[1.5rem] text-text-muted hover:text-text-strong transition-colors"
-            ><Icon name="ph:discord-logo" class="text-xl"
-          /></a>
         </div>
       </div>
     </footer>
diff --git a/apps/web/app/middleware/auth.global.ts b/apps/web/app/middleware/auth.global.ts
index da453958..68999167 100644
--- a/apps/web/app/middleware/auth.global.ts
+++ b/apps/web/app/middleware/auth.global.ts
@@ -36,7 +36,7 @@ export default defineNuxtRouteMiddleware(async (to) => {
    * own retention notice.
    */
   const authRoutes = ['/auth/login', '/auth/register'];
-  const openRoutes = ['/privacy'];
+  const openRoutes = ['/privacy', '/rules'];
   const isAuthRoute = authRoutes.includes(to.path);
   const isPublicRoute = isAuthRoute || openRoutes.includes(to.path);
 
diff --git a/apps/web/app/pages/admin.vue b/apps/web/app/pages/admin.vue
index dfa52ad2..9762ffb4 100644
--- a/apps/web/app/pages/admin.vue
+++ b/apps/web/app/pages/admin.vue
@@ -7,7 +7,7 @@
       class="flex flex-col md:flex-row gap-8"
       :inert="drawerOpen || undefined"
     >
-      <aside class="w-full md:w-64 flex-shrink-0">
+      <aside class="w-full md:w-64 shrink-0">
         <!-- Below md the whole sidebar collapses to one row naming the page
              you are on, and the list moves into a sheet. It used to be a
              horizontally scrolling strip: it showed four of twenty entries
@@ -28,12 +28,12 @@
         >
           <Icon
             :name="currentItem?.icon ?? 'ph:layout'"
-            class="w-4 h-4 flex-shrink-0 text-text-muted"
+            class="w-4 h-4 shrink-0 text-text-muted"
           />
           <span class="truncate">{{ currentTitle }}</span>
           <Icon
             name="ph:caret-down-bold"
-            class="ml-auto w-3.5 h-3.5 flex-shrink-0 text-text-muted"
+            class="ml-auto w-3.5 h-3.5 shrink-0 text-text-muted"
           />
         </button>
 
@@ -104,7 +104,7 @@
     >
       <div
         v-if="drawerOpen"
-        class="md:hidden fixed inset-0 z-50 bg-bg-primary/80 backdrop-blur-sm"
+        class="md:hidden fixed inset-0 z-50 bg-bg-primary/80 backdrop-blur-xs"
         @click.self="drawerOpen = false"
       />
     </Transition>
diff --git a/apps/web/app/pages/auth/login.vue b/apps/web/app/pages/auth/login.vue
index 09fa5f12..9daf363d 100644
--- a/apps/web/app/pages/auth/login.vue
+++ b/apps/web/app/pages/auth/login.vue
@@ -18,6 +18,8 @@
             class="text-accent-fg text-4xl"
           />
         </div>
+        <!-- sanitizeHtml (DOMPurify). -->
+        <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
         <h1
           class="text-2xl font-bold tracking-tighter"
           v-html="sanitizeHtml(branding?.authTitle || branding?.siteName || 'TRACKARR')"
@@ -339,9 +341,14 @@ async function handleLogin() {
     // « ce compte n'existe pas » révélerait l'existence d'un compte, ce que le
     // backend prend soin de ne pas faire (sel factice déterministe).
     const code = err.statusCode ?? err.status;
+    // Deux 429 : la limite par adresse, et le verrou du compte, dont un
+    // navigateur déjà utilisé pour s'y connecter est exempté — d'où un message
+    // qui le dit.
     error.value =
       code === 429
-        ? t('auth.login.errors.rateLimited')
+        ? err.data?.data?.reason === 'account-locked'
+          ? t('auth.login.errors.accountLocked')
+          : t('auth.login.errors.rateLimited')
         : code === 403
           ? err.data?.message || t('auth.login.errors.invalidCredentials')
           : t('auth.login.errors.invalidCredentials');
diff --git a/apps/web/app/pages/auth/register.vue b/apps/web/app/pages/auth/register.vue
index c81c5ec9..7fe0e321 100644
--- a/apps/web/app/pages/auth/register.vue
+++ b/apps/web/app/pages/auth/register.vue
@@ -18,6 +18,8 @@
             class="text-accent-fg text-4xl"
           />
         </div>
+        <!-- sanitizeHtml (DOMPurify). -->
+        <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
         <h1
           class="text-2xl font-bold tracking-tighter"
           v-html="sanitizeHtml(branding?.authTitle || branding?.siteName || 'TRACKARR')"
diff --git a/apps/web/app/pages/index.vue b/apps/web/app/pages/index.vue
index 70ee3b9a..1f3535aa 100644
--- a/apps/web/app/pages/index.vue
+++ b/apps/web/app/pages/index.vue
@@ -53,13 +53,34 @@
             {{
               trackerOnline === false
                 ? $t('home.trackerOffline')
-                : $t('home.live')
+                : content?.statusBadgeText || $t('home.live')
             }}
           </span>
           <span class="mc-clock" aria-hidden="true">{{ liveClock }}</span>
         </span>
       </header>
 
+      <!-- The staff's welcome note (Admin → Branding). Fetched on the client
+           only: whether it was dismissed lives in this browser. -->
+      <aside
+        v-if="welcomeHtml && !welcomeDismissed"
+        class="mc-welcome"
+        :aria-label="$t('home.welcomeLabel')"
+      >
+        <!-- sanitizeRichHtml (DOMPurify). -->
+        <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
+        <div class="mc-welcome-body" v-html="welcomeHtml" />
+        <button
+          type="button"
+          class="mc-welcome-close"
+          :aria-label="$t('home.welcomeDismiss')"
+          :title="$t('home.welcomeDismiss')"
+          @click="dismissWelcome"
+        >
+          <Icon name="ph:x-bold" />
+        </button>
+      </aside>
+
       <!-- Hero block — viewport corners + massive monospace title -->
       <div class="mc-hero">
         <span class="mc-hero-corner mc-hero-corner--tl" aria-hidden="true">⌜</span>
@@ -74,10 +95,14 @@
           <span class="mc-dot" aria-hidden="true" />
           <span>ZERO&nbsp;KNOWLEDGE</span>
         </p>
+        <!-- sanitizeHtml (DOMPurify). -->
+        <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
         <h1
           class="mc-hero-title"
           v-html="sanitizeHtml(content?.heroTitle || displaySiteName || 'TRACKARR')"
         />
+        <!-- sanitizeHtml (DOMPurify). -->
+        <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
         <div
           class="mc-hero-tagline"
           v-html="sanitizeHtml(content?.heroSubtitle || $t('home.tagline'))"
@@ -247,7 +272,7 @@
           </p>
         </article>
 
-        <!-- Tile B · Protocol health — three rows, dot status. -->
+        <!-- Tile B · Protocol health — one row per transport, dot status. -->
         <article class="mc-tile mc-tile--proto">
           <header class="mc-tile-head">
             <span class="mc-tile-mark">⏚</span>
@@ -304,10 +329,14 @@
         >
           <span class="mc-manifesto-mark">M{{ i + 1 }}</span>
           <span class="mc-manifesto-rule" aria-hidden="true" />
+          <!-- sanitizeHtml (DOMPurify). -->
+          <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
           <h3
             class="mc-manifesto-title"
             v-html="sanitizeHtml(feature.title)"
           />
+          <!-- sanitizeHtml (DOMPurify). -->
+          <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
           <div
             class="mc-manifesto-body"
             v-html="sanitizeHtml(feature.description)"
@@ -338,7 +367,6 @@ interface TrackerStats {
   protocols: {
     http: boolean;
     udp: boolean;
-    ws: boolean;
   };
 }
 
@@ -536,7 +564,6 @@ const last24hLabel = computed(() => {
 const protocolRows = computed(() => [
   { key: 'HTTP', up: stats.value?.protocols?.http === true },
   { key: 'UDP', up: stats.value?.protocols?.udp === true },
-  { key: 'WS', up: stats.value?.protocols?.ws === true },
 ]);
 
 // ── Releases & swarm ────────────────────────────────────────────────
@@ -597,6 +624,55 @@ function formatClock(d: Date): string {
     d.getUTCSeconds(),
   )} UTC`;
 }
+// ── Staff welcome note ───────────────────────────────────────────────
+//
+// Dismissed per browser, and per version of the note: the dismissal stores a
+// fingerprint of the text, so a new note shows again. Client-only, because
+// `localStorage` decides whether it renders at all — rendering it on the
+// server would hand hydration a card the client then removes.
+const { data: welcome } = useLazyFetch<{ message: string }>('/api/welcome', {
+  server: false,
+});
+// The note comes from the rich-text editor, which lets staff colour and align
+// text: the rich profile is the one its own preview uses, so members see what
+// the admin composed.
+const welcomeHtml = computed(() => sanitizeRichHtml(welcome.value?.message));
+const WELCOME_DISMISSED_KEY = 'trackarr:welcome-dismissed';
+const welcomeDismissed = ref(true);
+function fingerprint(text: string): string {
+  let h = 5381;
+  for (let i = 0; i < text.length; i++) h = ((h << 5) + h + text.charCodeAt(i)) | 0;
+  return String(h >>> 0);
+}
+watch(
+  () => welcome.value?.message,
+  (message) => {
+    if (!message) return;
+    try {
+      welcomeDismissed.value =
+        localStorage.getItem(WELCOME_DISMISSED_KEY) === fingerprint(message);
+    } catch {
+      welcomeDismissed.value = false;
+    }
+  },
+  { immediate: true },
+);
+function dismissWelcome(event: MouseEvent) {
+  // The button leaves with the card. Focus it held would drop back to the top
+  // of the document; the page's main landmark is where a keyboard user expects
+  // to carry on.
+  const hadFocus = event.currentTarget === document.activeElement;
+  welcomeDismissed.value = true;
+  if (hadFocus) document.getElementById('main')?.focus({ preventScroll: true });
+  try {
+    if (welcome.value?.message) {
+      localStorage.setItem(WELCOME_DISMISSED_KEY, fingerprint(welcome.value.message));
+    }
+  } catch {
+    /* private window: dismissed for this visit only */
+  }
+}
+
 if (import.meta.client) {
   let clockTick: ReturnType<typeof setInterval> | null = null;
   onMounted(() => {
@@ -929,6 +1005,50 @@ function useCounter(target: Ref<number>) {
   to   { opacity: 1; transform: translateY(0); letter-spacing: calc(-0.04em * var(--tracking-scale)); }
 }
 
+.mc-welcome {
+  position: relative;
+  margin: 0 0 1.5rem;
+  padding: 0.9rem 2.75rem 0.9rem 1rem;
+  border: 1px solid rgb(var(--line-default));
+  border-left: 3px solid rgb(var(--accent));
+  border-radius: var(--radius-sm);
+  background: rgb(var(--bg-surface));
+  color: rgb(var(--fg-default));
+  font-family: var(--font-sans);
+  font-size: 0.95rem;
+  line-height: 1.55;
+}
+.mc-welcome-body :deep(p) {
+  margin: 0 0 0.5rem;
+}
+.mc-welcome-body :deep(p:last-child) {
+  margin-bottom: 0;
+}
+.mc-welcome-body :deep(a) {
+  color: rgb(var(--accent));
+  text-decoration: underline;
+}
+.mc-welcome-close {
+  position: absolute;
+  top: 0.5rem;
+  right: 0.5rem;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 2rem;
+  height: 2rem;
+  border-radius: var(--radius-sm);
+  color: rgb(var(--fg-muted));
+  background: transparent;
+}
+.mc-welcome-close:hover {
+  color: rgb(var(--fg-strong));
+  background: rgb(var(--bg-elevated));
+}
+.mc-welcome-close:focus-visible {
+  outline: 2px solid rgb(var(--accent));
+  outline-offset: 2px;
+}
 .mc-hero-tagline {
   margin: 1rem 0 0;
   font-family: var(--font-sans);
diff --git a/apps/web/app/pages/mod.vue b/apps/web/app/pages/mod.vue
index 7dd0337d..48f62d66 100644
--- a/apps/web/app/pages/mod.vue
+++ b/apps/web/app/pages/mod.vue
@@ -1,7 +1,7 @@
 <template>
   <div class="flex flex-col md:flex-row gap-8">
     <!-- Sidebar: horizontal scroll on mobile, vertical sticky on md+. -->
-    <aside class="w-full md:w-64 flex-shrink-0">
+    <aside class="w-full md:w-64 shrink-0">
       <div
         class="
           flex md:flex-col gap-2 md:gap-1
@@ -20,7 +20,7 @@
           :key="item.path"
           :to="item.path"
           class="
-            flex-shrink-0 inline-flex items-center gap-2
+            shrink-0 inline-flex items-center gap-2
             px-3 py-2 text-sm font-medium rounded-md
             transition-colors whitespace-nowrap
             md:gap-3
@@ -31,7 +31,7 @@
               : 'text-text-muted hover:text-text-primary hover:bg-bg-secondary/50 border border-transparent',
           ]"
         >
-          <Icon :name="item.icon" class="w-4 h-4 flex-shrink-0" />
+          <Icon :name="item.icon" class="w-4 h-4 shrink-0" />
           <span>{{ item.label }}</span>
         </NuxtLink>
       </div>
diff --git a/apps/web/app/pages/rules.vue b/apps/web/app/pages/rules.vue
new file mode 100644
index 00000000..aa226ec4
--- /dev/null
+++ b/apps/web/app/pages/rules.vue
@@ -0,0 +1,126 @@
+<template>
+  <div class="ru">
+    <header class="ru-head">
+      <p class="ru-eyebrow">
+        <span class="ru-eyebrow-rule" aria-hidden="true" />
+        {{ $t('rules.eyebrow') }}
+      </p>
+      <h1 class="ru-title">{{ $t('rules.title', { instance: siteName }) }}</h1>
+    </header>
+
+    <!-- A failed read is not "there are no rules": said apart. -->
+    <p v-if="pending" class="ru-state">{{ $t('rules.loading') }}</p>
+    <p v-else-if="error" class="ru-state ru-state--bad" role="alert">
+      {{ $t('rules.unavailable') }}
+    </p>
+    <p v-else-if="!rulesHtml" class="ru-state">{{ $t('rules.empty') }}</p>
+    <!-- Staff-written rich text, sanitised with the editor's own profile so
+         it reads as the admin composed it. -->
+    <!-- sanitizeRichHtml (DOMPurify). -->
+    <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
+    <div v-else class="ru-body" v-html="rulesHtml" />
+  </div>
+</template>
+
+<script setup lang="ts">
+/**
+ * The site rules from Admin → Branding. Readable signed out too (see the
+ * route's `openRoutes` entry): an invitation is accepted after reading them.
+ */
+const { t } = useI18n();
+const branding = await useBranding();
+const siteName = computed(() => branding.value?.siteName || 'Trackarr');
+
+const { data, pending, error } = await useFetch<{ rules: string }>('/api/rules');
+const rulesHtml = computed(() => sanitizeRichHtml(data.value?.rules));
+
+useHead({ title: () => t('rules.eyebrow') });
+</script>
+
+<style scoped>
+.ru {
+  max-width: 46rem;
+  margin: 0 auto;
+  padding: 3rem 1.25rem 5rem;
+}
+
+.ru-eyebrow {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  margin: 0 0 1.25rem;
+  color: rgb(var(--fg-subtle));
+  font-family: var(--font-mono);
+  font-size: 0.6875rem;
+  text-transform: uppercase;
+  letter-spacing: 0.18em;
+}
+.ru-eyebrow-rule {
+  width: 2.5rem;
+  height: 1px;
+  background: rgb(var(--line-strong));
+}
+
+.ru-title {
+  margin: 0 0 2.5rem;
+  font-family: var(--font-display);
+  font-size: clamp(2rem, 6vw, 3rem);
+  font-weight: 400;
+  line-height: 1.05;
+  letter-spacing: -0.01em;
+  color: rgb(var(--fg-strong));
+}
+
+.ru-state {
+  margin: 0;
+  padding: 1.25rem 0;
+  border-top: 1px solid rgb(var(--line-default));
+  border-bottom: 1px solid rgb(var(--line-default));
+  font-size: 0.875rem;
+  color: rgb(var(--fg-muted));
+}
+.ru-state--bad {
+  color: rgb(var(--danger));
+}
+
+.ru-body {
+  padding-top: 2rem;
+  border-top: 1px solid rgb(var(--line-default));
+  color: rgb(var(--fg-default));
+  font-size: 1rem;
+  line-height: 1.7;
+}
+.ru-body :deep(h1),
+.ru-body :deep(h2),
+.ru-body :deep(h3) {
+  margin: 2rem 0 0.75rem;
+  color: rgb(var(--fg-strong));
+  line-height: 1.25;
+}
+.ru-body :deep(h1) { font-size: 1.5rem; }
+.ru-body :deep(h2) { font-size: 1.25rem; }
+.ru-body :deep(h3) { font-size: 1.0625rem; }
+.ru-body :deep(p) {
+  margin: 0 0 1rem;
+}
+.ru-body :deep(ul),
+.ru-body :deep(ol) {
+  margin: 0 0 1rem;
+  padding-left: 1.5rem;
+}
+.ru-body :deep(ul) { list-style: disc; }
+.ru-body :deep(ol) { list-style: decimal; }
+.ru-body :deep(li) {
+  margin: 0.25rem 0;
+}
+.ru-body :deep(a) {
+  color: rgb(var(--accent));
+  text-decoration: underline;
+}
+.ru-body :deep(blockquote) {
+  margin: 0 0 1rem;
+  padding-left: 1rem;
+  border-left: 3px solid rgb(var(--line-strong));
+  color: rgb(var(--fg-muted));
+}
+</style>
diff --git a/apps/web/app/pages/settings.vue b/apps/web/app/pages/settings.vue
index c2d9d630..35d9bce7 100644
--- a/apps/web/app/pages/settings.vue
+++ b/apps/web/app/pages/settings.vue
@@ -1492,18 +1492,20 @@ async function revokeAllSessions() {
     await clearSession();
     router.push({ path: '/auth/login', query: { revoked: 'all' } });
   } catch (err: unknown) {
+    // `e.data` est le corps de la réponse ; le `data` de `createError` y est
+    // imbriqué. Lu un cran trop haut, le motif ne correspondait jamais et une
+    // session déjà révoquée finissait sur le message de ré-authentification.
     const e = err as {
       statusCode?: number;
       data?: {
         message?: string;
-        data?: { reauthRequired?: boolean };
-        reason?: string;
+        data?: { reauthRequired?: boolean; reason?: string };
       };
       message?: string;
     };
     // Déjà révoquée : la demande a abouti, par nous ou depuis un autre
     // appareil. Le résultat voulu est le même, donc on va au bout.
-    if (e?.data?.reason === 'session-revoked') {
+    if (e?.data?.data?.reason === 'session-revoked') {
       await clearSession();
       router.push({ path: '/auth/login', query: { revoked: 'all' } });
       return;
diff --git a/apps/web/app/pages/templates.vue b/apps/web/app/pages/templates.vue
index 18b3553d..bf55df47 100644
--- a/apps/web/app/pages/templates.vue
+++ b/apps/web/app/pages/templates.vue
@@ -59,7 +59,7 @@
            `title`: a disabled control takes no focus and fires no hover, so a
            tooltip is the one place the reason can never be read. -->
       <p v-if="quotaFull && quota" class="tpl-quota-note" role="status">
-        <Icon name="ph:info" class="text-sm flex-shrink-0" aria-hidden="true" />
+        <Icon name="ph:info" class="text-sm shrink-0" aria-hidden="true" />
         {{ $t('templates.quotaReached', { max: quota.max }) }}
       </p>
     </header>
@@ -68,7 +68,7 @@
          look identical otherwise, and telling a user "you have no templates"
          when the server never answered is a lie. -->
     <p v-if="loadError" class="tpl-load-error" role="alert">
-      <Icon name="ph:warning-circle-bold" class="text-base flex-shrink-0" />
+      <Icon name="ph:warning-circle-bold" class="text-base shrink-0" />
       <span>{{ $t('templates.errors.loadFailed') }}</span>
       <button type="button" class="btn btn-xs btn-ghost" @click="reload">
         {{ $t('templates.actions.retry') }}
diff --git a/apps/web/app/pages/torrents/fiche.vue b/apps/web/app/pages/torrents/fiche.vue
index a2059281..91d6c7dd 100644
--- a/apps/web/app/pages/torrents/fiche.vue
+++ b/apps/web/app/pages/torrents/fiche.vue
@@ -1199,7 +1199,7 @@ onMounted(() => {
           <aside class="fiche-preview-panel">
             <h3 class="aside-name">{{ $t('fiche.preview.title') }}</h3>
             <!-- eslint-disable-next-line vue/no-v-html -- passé par sanitizeRichHtml -->
-            <div class="fiche-preview" v-html="preview" />
+            <div class="fiche-preview" v-html="preview" /> <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html -->
           </aside>
         </div>
       </section>
diff --git a/apps/web/app/pages/torrents/index.vue b/apps/web/app/pages/torrents/index.vue
index 7598ca3d..94970f23 100644
--- a/apps/web/app/pages/torrents/index.vue
+++ b/apps/web/app/pages/torrents/index.vue
@@ -1375,12 +1375,14 @@ async function saveCurrentSearch() {
     // 4xx bodies here are English sentences written for a log — "You can keep up
     // to 20 saved searches. Delete one first." — and echoing them put English in
     // front of a French member at the one moment they needed to understand what
-    // to do next.
-    const e = err as { data?: { reason?: string; max?: number } };
-    const reason = e?.data?.reason;
+    // to do next. `err.data` is the response body, and `createError` nests its
+    // own `data` inside it: read one level up, the reason never matched and
+    // every refusal fell through to the generic "failed".
+    const e = err as { data?: { data?: { reason?: string; max?: number } } };
+    const reason = e?.data?.data?.reason;
     savedSearchNotifications.error(
       reason === 'limit'
-        ? t('search.saveSearch.limit', { max: e?.data?.max ?? 20 })
+        ? t('search.saveSearch.limit', { max: e?.data?.data?.max ?? 20 })
         : reason === 'no-criteria'
           ? t('search.saveSearch.noCriteria')
           : t('search.saveSearch.failed')
diff --git a/apps/web/app/plugins/runtime-config.client.ts b/apps/web/app/plugins/runtime-config.client.ts
index d733af84..b2376079 100644
--- a/apps/web/app/plugins/runtime-config.client.ts
+++ b/apps/web/app/plugins/runtime-config.client.ts
@@ -44,7 +44,6 @@ export default defineNuxtPlugin({
       const remote = await $fetch<{
         trackerHttpUrl: string;
         trackerUdpUrl: string;
-        trackerWsUrl: string;
         appVersion: string;
       }>('/api/runtime-config', { timeout: 4000 });
 
@@ -54,8 +53,6 @@ export default defineNuxtPlugin({
         cfg.public.trackerHttpUrl = remote.trackerHttpUrl;
       if (remote.trackerUdpUrl)
         cfg.public.trackerUdpUrl = remote.trackerUdpUrl;
-      if (remote.trackerWsUrl)
-        cfg.public.trackerWsUrl = remote.trackerWsUrl;
       if (remote.appVersion) cfg.public.appVersion = remote.appVersion;
     } catch {
       // Fail-soft: keep the build-time values. The /me announce URL
diff --git a/apps/web/app/utils/crypto.ts b/apps/web/app/utils/crypto.ts
index 308cdc13..523d5044 100644
--- a/apps/web/app/utils/crypto.ts
+++ b/apps/web/app/utils/crypto.ts
@@ -135,16 +135,19 @@ export async function generateLoginProof(
  * Solve Proof of Work challenge.
  * Finds nonce such that SHA256(challenge:nonce) starts with N zeros.
  *
- * Bounded by `maxMs` (default 60s) so a misconfigured server-side
- * difficulty doesn't hang the browser tab indefinitely. The expected
- * runtime at difficulty 4 is sub-second on a modern laptop; one minute
- * already covers difficulty ~6-7 with comfortable margin.
+ * Bounded by `maxMs` so a misconfigured server-side difficulty doesn't hang
+ * the browser tab indefinitely. At the server's 5 hex zeros a solve takes
+ * 16⁵ ≈ 1 M hashes on average; measured at ~175 000 WebCrypto hashes/s in a
+ * desktop Chromium, that is ~6 s. A phone is several times slower, and the
+ * count is geometric — at 30 000 hashes/s about one registration in six ran
+ * past the old 60 s and failed. Four minutes still fits inside the challenge's
+ * five-minute life on the server (`utils/pow.ts`).
  */
 export async function solvePoW(
   challenge: string,
   difficulty: number,
   onProgress?: (hashesComputed: number) => void,
-  maxMs: number = 60_000
+  maxMs: number = 240_000
 ): Promise<PoWSolution> {
   const target = '0'.repeat(difficulty);
   const deadline = Date.now() + maxMs;
diff --git a/apps/web/docker/static/nginx.conf b/apps/web/docker/static/nginx.conf
index 124bd10e..7dadf56f 100644
--- a/apps/web/docker/static/nginx.conf
+++ b/apps/web/docker/static/nginx.conf
@@ -71,7 +71,7 @@ http {
   add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   add_header Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()" always;
   # No third-party origin: `@nuxt/fonts` downloads Inter, JetBrains Mono and
-  # Fraunces at build time and this image serves them from `/_fonts/`, so
+  # Fraunces at build time and this image serves them from `/_nuxt/fonts/`, so
   # `'self'` covers the faces as well as the stylesheet. Keep it that way — the
   # point of self-hosting was that a visitor's IP never reaches a font CDN.
   add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'" always;
@@ -114,29 +114,11 @@ http {
       try_files  $uri =404;
     }
 
-    # Self-hosted font faces (`@nuxt/fonts`). Content-addressed filenames, so
-    # they are as immutable as the bundle — a returning visitor should never
-    # revalidate them.
-    #
-    # `^~` and not a plain prefix, deliberately: nginx lets a matching regex
-    # location beat a remembered prefix, and the `\.woff2?$` block further down
-    # would otherwise capture these and hand back 7 days instead of a year.
-    location ^~ /_fonts/ {
-      # `add_header` here drops EVERY header inherited from the http block —
-      # nginx's inheritance is all-or-nothing — so the whole set is repeated.
-      # Keep it in sync with the http block above. Omitting it is how this file
-      # came to declare a policy it never sent; see the note there.
-      #
-      # One `Cache-Control`, not `expires` plus an `add_header`: the pair emits
-      # the header twice and browsers are entitled to take either.
-      add_header Cache-Control "public, max-age=31536000, immutable" always;
-      add_header X-Frame-Options "SAMEORIGIN" always;
-      add_header X-Content-Type-Options "nosniff" always;
-      add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-      add_header Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()" always;
-      add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'" always;
-      try_files  $uri =404;
-    }
+    # No `/_fonts/` block any more. @nuxt/fonts 1.x writes the self-hosted
+    # faces under the build assets directory, `/_nuxt/fonts/`, so the `^~ /_nuxt/`
+    # block above already serves them for a year as `immutable` — their names are
+    # content-addressed like the rest of the bundle — and the `\.woff2?$` regex
+    # below never sees them.
 
     # Nuxt's hydration payload files (`_payload.json`, `_payload.js`).
     # These ONLY exist for routes that were pre-rendered at build
diff --git a/apps/web/i18n/locales/en.json b/apps/web/i18n/locales/en.json
index 62e27d0d..ae0defd6 100644
--- a/apps/web/i18n/locales/en.json
+++ b/apps/web/i18n/locales/en.json
@@ -98,9 +98,7 @@
     "signIn": "Sign in",
     "signUp": "Sign up",
     "skipToContent": "Skip to content",
-    "footerSite": "The author’s site",
     "footerSource": "Source code on GitHub",
-    "footerChat": "Community Discord",
     "menu": "Menu",
     "toggleTheme": "Toggle theme",
     "languageSelector": "Select language",
@@ -129,6 +127,8 @@
     }
   },
   "home": {
+    "welcomeLabel": "Welcome note from the staff",
+    "welcomeDismiss": "Dismiss the welcome note",
     "trackerOnline": "Tracker online & operational",
     "trackerOffline": "Tracker offline",
     "tagline": "High-performance, minimalist P2P tracking engine. Search through our indexed database of verified torrents.",
@@ -181,7 +181,7 @@
       },
       "multiProtocol": {
         "title": "Multi-Protocol",
-        "description": "Supports HTTP, UDP, and WebSocket protocols for maximum compatibility with all BitTorrent clients."
+        "description": "Supports HTTP and UDP announces for maximum compatibility with all BitTorrent clients."
       },
       "openSource": {
         "title": "Open Source",
@@ -220,7 +220,8 @@
       "errors": {
         "invalidCredentials": "Invalid username or password.",
         "invalidCode": "That code didn't match. Try again.",
-        "rateLimited": "Too many attempts. Try again later."
+        "rateLimited": "Too many attempts. Try again later.",
+        "accountLocked": "Too many failed sign-ins for this account. Try again in a few minutes, or sign in from a browser you have used before."
       },
       "sessionsRevoked": "Every device has been signed out, this one included. Sign in again to continue.",
       "sessionRevokedRemote": "This session was signed out from another device. Sign in again to continue."
@@ -4217,7 +4218,6 @@
       "subtitle": "Announce URLs",
       "httpAnnounce": "HTTP Announce",
       "udpAnnounce": "UDP Announce",
-      "websocket": "WebSocket",
       "copy": "Copy URL"
     },
     "stats": {
@@ -6329,6 +6329,13 @@
       "forever": "Every change made from the moderation or admin console — a ban, a role, a setting, a rejected upload — is recorded with who made it and when, and kept indefinitely. Readable by admins only. The entry cannot be edited or removed by the staffer who caused it."
     }
   },
+  "rules": {
+    "eyebrow": "Site rules",
+    "title": "The rules of {instance}",
+    "loading": "Reading the rules…",
+    "unavailable": "The rules could not be read just now. Reload, and tell the staff if it persists.",
+    "empty": "The staff have not written any rules yet."
+  },
   "tickets": {
     "title": "Tickets",
     "openTab": "Open",
diff --git a/apps/web/i18n/locales/fr.json b/apps/web/i18n/locales/fr.json
index 95b252e8..85360a94 100644
--- a/apps/web/i18n/locales/fr.json
+++ b/apps/web/i18n/locales/fr.json
@@ -98,9 +98,7 @@
     "signIn": "Se connecter",
     "signUp": "S'inscrire",
     "skipToContent": "Aller au contenu",
-    "footerSite": "Le site de l’auteur",
     "footerSource": "Code source sur GitHub",
-    "footerChat": "Discord de la communauté",
     "menu": "Menu",
     "toggleTheme": "Changer de thème",
     "languageSelector": "Choisir la langue",
@@ -129,6 +127,8 @@
     }
   },
   "home": {
+    "welcomeLabel": "Mot d’accueil de l’équipe",
+    "welcomeDismiss": "Masquer le mot d’accueil",
     "trackerOnline": "Tracker en ligne et opérationnel",
     "trackerOffline": "Tracker hors ligne",
     "tagline": "Moteur de tracking P2P haute performance et minimaliste. Cherchez dans notre base indexée de torrents vérifiés.",
@@ -181,7 +181,7 @@
       },
       "multiProtocol": {
         "title": "Multi-protocole",
-        "description": "Supporte les protocoles HTTP, UDP et WebSocket pour une compatibilité maximale avec tous les clients BitTorrent."
+        "description": "Prend en charge les annonces HTTP et UDP pour une compatibilité maximale avec tous les clients BitTorrent."
       },
       "openSource": {
         "title": "Open source",
@@ -220,7 +220,8 @@
       "errors": {
         "invalidCredentials": "Identifiant ou mot de passe invalide.",
         "invalidCode": "Le code ne correspond pas. Réessayez.",
-        "rateLimited": "Trop de tentatives. Réessayez plus tard."
+        "rateLimited": "Trop de tentatives. Réessayez plus tard.",
+        "accountLocked": "Trop d'échecs de connexion pour ce compte. Réessayez dans quelques minutes, ou connectez-vous depuis un navigateur que vous avez déjà utilisé."
       },
       "sessionsRevoked": "Tous vos appareils ont été déconnectés, celui-ci compris. Reconnectez-vous pour continuer.",
       "sessionRevokedRemote": "Cette session a été déconnectée depuis un autre appareil. Reconnectez-vous pour continuer."
@@ -4217,7 +4218,6 @@
       "subtitle": "URLs d'annonce",
       "httpAnnounce": "Annonce HTTP",
       "udpAnnounce": "Annonce UDP",
-      "websocket": "WebSocket",
       "copy": "Copier l'URL"
     },
     "stats": {
@@ -6329,6 +6329,13 @@
       "forever": "Chaque changement fait depuis la console de modération ou d'administration — un bannissement, un rôle, un réglage, une mise en ligne refusée — est enregistré avec son auteur et sa date, et conservé sans limite de durée. Lisible par les administrateurs uniquement. L'entrée ne peut être ni modifiée ni supprimée par le membre du personnel qui l'a provoquée."
     }
   },
+  "rules": {
+    "eyebrow": "Règles du site",
+    "title": "Les règles de {instance}",
+    "loading": "Lecture des règles…",
+    "unavailable": "Les règles n’ont pas pu être lues. Rechargez la page, et prévenez l’équipe si cela persiste.",
+    "empty": "L’équipe n’a pas encore rédigé de règles."
+  },
   "tickets": {
     "title": "Tickets",
     "openTab": "Ouverts",
diff --git a/apps/web/nuxt.config.ts b/apps/web/nuxt.config.ts
index e419e8ca..b9b38e62 100644
--- a/apps/web/nuxt.config.ts
+++ b/apps/web/nuxt.config.ts
@@ -1,3 +1,4 @@
+import tailwindcss from '@tailwindcss/vite';
 import pkg from './package.json';
 
 // Set NUXT_STATIC_BUILD=true at build time to disable SSR and produce
@@ -42,10 +43,10 @@ export default defineNuxtConfig({
     // esbuild target for the Nitro server bundle. Nitro defaults to
     // `es2019`, which is older than every runtime we ship and old
     // enough to refuse BigInt literal syntax (`0n` / `1024n`). Pinning
-    // to `node24` matches the production runtime (distroless
-    // `gcr.io/distroless/nodejs24-debian13:nonroot`) and unlocks
-    // ES2025 features V8 13.6 ships — iterator helpers, Set methods,
-    // `Promise.try`, `RegExp.escape`, JSON modules.
+    // to `node26` matches the production runtime (distroless
+    // `gcr.io/distroless/nodejs26-debian13:nonroot`) and unlocks the
+    // ES2025 features — iterator helpers, Set methods, `Promise.try`,
+    // `RegExp.escape`, JSON modules — and what V8 14.6 adds on top.
     //
     // Note: this only governs the SSR / server bundle. The client
     // bundle is emitted by Vite and is left at its default
@@ -53,7 +54,7 @@ export default defineNuxtConfig({
     // back rather than a Node runtime.
     esbuild: {
       options: {
-        target: 'node24',
+        target: 'node26',
       },
     },
     ...(STATIC_BUILD
@@ -76,7 +77,6 @@ export default defineNuxtConfig({
 
   modules: [
     '@pinia/nuxt',
-    '@nuxtjs/tailwindcss',
     '@nuxt/icon',
     '@nuxtjs/i18n',
     '@nuxt/fonts',
@@ -93,7 +93,9 @@ export default defineNuxtConfig({
   // (`fonts.googleapis.com` in `style-src`, `fonts.gstatic.com` in `font-src`).
   // Both are gone now — see `server/plugins/csp.ts` and
   // `docker/static/nginx.conf`. The module downloads the faces at build time
-  // and serves them from `/_fonts/`, so the running site talks to nobody.
+  // and serves them from `/_nuxt/fonts/` — `/_fonts/` until @nuxt/fonts 1.0
+  // moved them under the build assets directory — so the running site talks to
+  // nobody.
   //
   // ## Why every family is listed by hand
   //
@@ -129,8 +131,8 @@ export default defineNuxtConfig({
   // a rate-limit or an offline machine FAILS the build rather than quietly
   // shipping an image with no faces — which is the right way round, but it does
   // mean a release now needs network. 336 kB across eight `.woff2`, cached in
-  // `node_modules/.cache/nuxt/fonts` between builds on the same machine and
-  // therefore cold on a CI runner. The alternative was committing the files, and
+  // `apps/web/node_modules/.cache/nuxt/fonts` between builds on the same machine
+  // and therefore cold on a CI runner. The alternative was committing the files, and
   // it is still the escape hatch if that ever bites: `provider: 'local'` with
   // the faces under `public/fonts/`.
   //
@@ -527,10 +529,11 @@ export default defineNuxtConfig({
     typeCheck: false,
   },
 
-  tailwindcss: {
-    cssPath: '~/assets/css/main.css',
-    configPath: 'tailwind.config.ts',
-  },
+  // Tailwind 4 through its own Vite plugin (`vite.plugins` below), not a Nuxt
+  // module: @nuxtjs/tailwindcss stops at Tailwind 3. The configuration lives
+  // in `main.css` now (`@theme inline`, `@custom-variant`) — there is no
+  // tailwind.config.ts any more — so this line is all Nuxt needs to know.
+  css: ['~/assets/css/main.css'],
 
   runtimeConfig: {
     // Used by SSR fetches (server-side) to reach the API container directly.
@@ -540,8 +543,8 @@ export default defineNuxtConfig({
       appVersion: pkg.version,
       // Tracker URLs are read at RUNTIME from NUXT_PUBLIC_TRACKER_*_URL env vars.
       trackerHttpUrl: 'http://localhost:8080/announce',
-      trackerUdpUrl: 'udp://localhost:8081/announce',
-      trackerWsUrl: 'ws://localhost:8082',
+      // Empty unless configured: no UDP tier is advertised by default.
+      trackerUdpUrl: '',
     },
   },
 
@@ -701,6 +704,7 @@ export default defineNuxtConfig({
   },
 
   vite: {
+    plugins: [tailwindcss()],
     build: {
       // We knowingly bundle the Phosphor icon collection in full
       // (~4.5 MB of `chunks/_/icons.mjs`, ~940 kB gzip) so SSR can
diff --git a/apps/web/package.json b/apps/web/package.json
index 8768e489..256631f2 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -14,28 +14,27 @@
     "typecheck": "nuxt typecheck"
   },
   "dependencies": {
-    "@iconify-json/simple-icons": "^1.2.94",
+    "@iconify-json/simple-icons": "^1.2.100",
     "@nuxtjs/i18n": "^10.6.0",
-    "@nuxtjs/tailwindcss": "6.14.0",
-    "@pinia/nuxt": "1.0.2",
-    "@simplewebauthn/browser": "^13.3.0",
-    "@tiptap/extension-color": "^3.31.0",
-    "@tiptap/extension-image": "^3.31.0",
-    "@tiptap/extension-link": "^3.31.0",
-    "@tiptap/extension-placeholder": "^3.31.0",
-    "@tiptap/extension-text-align": "^3.31.0",
-    "@tiptap/extension-text-style": "^3.31.0",
-    "@tiptap/starter-kit": "^3.31.0",
-    "@tiptap/vue-3": "^3.31.0",
+    "@pinia/nuxt": "1.0.3",
+    "@simplewebauthn/browser": "^14.0.0",
+    "@tiptap/extension-color": "^3.32.0",
+    "@tiptap/extension-image": "^3.32.0",
+    "@tiptap/extension-link": "^3.32.0",
+    "@tiptap/extension-placeholder": "^3.32.0",
+    "@tiptap/extension-text-align": "^3.32.0",
+    "@tiptap/extension-text-style": "^3.32.0",
+    "@tiptap/starter-kit": "^3.32.0",
+    "@tiptap/vue-3": "^3.32.0",
     "@trackarr/shared": "workspace:*",
-    "@vueuse/core": "^14.4.0",
-    "chart.js": "^4.5.1",
+    "@vueuse/core": "^15.0.0",
+    "chart.js": "^4.6.1",
     "chartjs-plugin-zoom": "^2.2.0",
-    "isomorphic-dompurify": "^4.1.0",
-    "marked": "^18.0.9",
-    "mediainfo.js": "^0.3.7",
+    "isomorphic-dompurify": "^4.6.0",
+    "marked": "^18.1.1",
+    "mediainfo.js": "^0.3.8",
     "nuxt": "^4.6.2",
-    "pinia": "^4.0.3",
+    "pinia": "^4.1.0",
     "turndown": "^7.2.4",
     "vue": "^3.5.44",
     "vue-chartjs": "^5.3.4",
@@ -43,11 +42,13 @@
   },
   "devDependencies": {
     "@iconify-json/ph": "^1.2.2",
-    "@nuxt/fonts": "^0.14.0",
-    "@nuxt/icon": "^2.5.1",
+    "@nuxt/fonts": "^1.1.0",
+    "@nuxt/icon": "^2.6.0",
+    "@tailwindcss/vite": "^4.3.3",
     "@types/turndown": "^5.0.6",
-    "typescript": "~5.9.3",
-    "vitest": "^4.1.12",
-    "vue-tsc": "^3.3.11"
+    "tailwindcss": "^4.3.3",
+    "typescript": "~6.0.3",
+    "vitest": "^5.0.5",
+    "vue-tsc": "^3.3.13"
   }
 }
diff --git a/apps/web/scripts/run-unit-tests.sh b/apps/web/scripts/run-unit-tests.sh
index 0ae06f82..1228bea1 100755
--- a/apps/web/scripts/run-unit-tests.sh
+++ b/apps/web/scripts/run-unit-tests.sh
@@ -15,9 +15,9 @@ docker run --rm \
   -v trackarr-itest-nm-root:/app/node_modules \
   -v trackarr-itest-nm-web:/app/apps/web/node_modules \
   -v trackarr-itest-nm-shared:/app/packages/shared/node_modules \
-  node:24-alpine sh -c "
+  node:26-alpine sh -c "
     set -e
-    corepack enable
+    npm install --global --silent --allow-scripts=pnpm \"\$(node -p \"require('./package.json').packageManager\")\"
     pnpm config set store-dir /pnpm-store >/dev/null
     pnpm install --filter '@trackarr/web...' --ignore-scripts
     # \`--ignore-scripts\` skips the postinstall that generates .nuxt, and
diff --git a/apps/web/server/plugins/csp.ts b/apps/web/server/plugins/csp.ts
index 3380cf7b..5beb920a 100644
--- a/apps/web/server/plugins/csp.ts
+++ b/apps/web/server/plugins/csp.ts
@@ -86,7 +86,7 @@ function buildPolicy(nonce: string): string {
     //
     // The `fonts.googleapis.com` origin that used to be here is gone —
     // `@nuxt/fonts` downloads the faces at build time and serves them from
-    // `/_fonts/`, so `'self'` covers both the stylesheet and the files.
+    // `/_nuxt/fonts/`, so `'self'` covers both the stylesheet and the files.
     "style-src 'self' 'unsafe-inline'",
     `style-src-elem 'self' 'nonce-${nonce}'`,
     "style-src-attr 'unsafe-inline'",
@@ -120,6 +120,8 @@ export default defineNitroPlugin((nitro) => {
 
     const stamp = (chunk: string) =>
       chunk
+        // The nonce is randomBytes(16) drawn for this response, not input.
+        // nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
         .replace(INLINE_SCRIPT, `<script nonce="${nonce}"`)
         .replace(INLINE_STYLE, `<style nonce="${nonce}"`);
 
diff --git a/apps/web/server/routes/api/[...path].ts b/apps/web/server/routes/api/[...path].ts
index 9aa3e387..4fd8e726 100644
--- a/apps/web/server/routes/api/[...path].ts
+++ b/apps/web/server/routes/api/[...path].ts
@@ -48,15 +48,15 @@ export default defineEventHandler(async (event) => {
   //
   // `event.path` est brut : `GET /api/../uploads/x` (avec un client qui ne
   // normalise pas — `curl --path-as-is`) correspond quand même à ce
-  // catch-all, puis l'analyse d'URL d'undici replie le `..` et produit
-  // `http://api:4000/uploads/x`. La portée est bornée — l'API ne monte que
+  // catch-all, puis l'analyse d'URL d'undici replie le `..` et produit une
+  // cible en `/uploads/x` sur l'API. La portée est bornée — l'API ne monte que
   // `/api` et `/uploads`, et `/uploads` est joignable directement — mais cela
   // permettait d'atteindre `/uploads` par l'origine web, et c'est une ligne.
   //
   // Sur le chemin DÉCODÉ, pas sur la chaîne brute. `includes('..')` ne voyait
   // pas `%2e%2e` — mesuré : `/api/%2e%2e/uploads/x` passait la garde, et le
   // parseur d'URL WHATWG repliait ensuite l'encodage en un vrai segment
-  // double-point, donnant `http://api:4000/uploads/x`. Une garde écrite exprès
+  // double-point, redonnant `/uploads/x` sur l'API. Une garde écrite exprès
   // qui ne fait pas ce qu'elle annonce est pire qu'aucune garde : elle donne
   // la certitude d'être couvert.
   //
diff --git a/apps/web/tailwind.config.ts b/apps/web/tailwind.config.ts
deleted file mode 100644
index d2316a16..00000000
--- a/apps/web/tailwind.config.ts
+++ /dev/null
@@ -1,154 +0,0 @@
-import type { Config } from 'tailwindcss';
-
-/**
- * Tailwind config — token-driven via CSS variables stored as RGB triplets.
- *
- * Why triplets and not hex literals: Tailwind's opacity modifiers
- * (`bg-bg-secondary/50`, `text-fg-default/10`, etc.) substitute the
- * `<alpha-value>` placeholder below into the colour value at compile time.
- * Because every colour resolves to `rgb(R G B / a)`, *every* token now
- * supports `/N` opacity. The previous `var(--bg-surface)` form silently
- * dropped the alpha and the input fell back to user-agent white in dark
- * mode (the SearchBar bug).
- *
- * Class names match the legacy markup: `bg-bg-primary`, `text-text-muted`,
- * `border-border` are unchanged. New `fg.*` group is for opacity-aware
- * foreground tints (used by header nav active state, hover overlays, etc.).
- */
-export default {
-  content: [
-    './app/**/*.{vue,ts}',
-    './components/**/*.{vue,ts}',
-    './layouts/**/*.vue',
-    './pages/**/*.vue',
-  ],
-  darkMode: ['selector', '[data-theme="dark"]'],
-  theme: {
-    extend: {
-      colors: {
-        // Surfaces
-        bg: {
-          primary:   'rgb(var(--bg-base) / <alpha-value>)',
-          secondary: 'rgb(var(--bg-surface) / <alpha-value>)',
-          tertiary:  'rgb(var(--bg-elevated) / <alpha-value>)',
-          hover:     'rgb(var(--bg-hover) / <alpha-value>)',
-          inset:     'rgb(var(--bg-inset) / <alpha-value>)',
-        },
-        // Foreground (text *and* opacity-aware fills)
-        text: {
-          primary:   'rgb(var(--fg-default) / <alpha-value>)',
-          secondary: 'rgb(var(--fg-muted) / <alpha-value>)',
-          muted:     'rgb(var(--fg-subtle) / <alpha-value>)',
-          faint:     'rgb(var(--fg-faint) / <alpha-value>)',
-          strong:    'rgb(var(--fg-strong) / <alpha-value>)',
-        },
-        // `fg.*` is the same set, but exposed as bg/border-friendly names so
-        // `bg-fg-default/10` and `border-fg-default/20` (the new "neutral
-        // overlay" pattern) work without ambiguity.
-        fg: {
-          default: 'rgb(var(--fg-default) / <alpha-value>)',
-          strong:  'rgb(var(--fg-strong) / <alpha-value>)',
-          muted:   'rgb(var(--fg-muted) / <alpha-value>)',
-          subtle:  'rgb(var(--fg-subtle) / <alpha-value>)',
-          faint:   'rgb(var(--fg-faint) / <alpha-value>)',
-        },
-        border: {
-          DEFAULT: 'rgb(var(--line-default) / <alpha-value>)',
-          hover:   'rgb(var(--line-strong) / <alpha-value>)',
-          // La bordure d'un CHAMP. `border-border` est le filet décoratif des
-          // cartes et des tableaux : à 1,21:1 en sombre et 1,26:1 en clair, il
-          // ne peut pas porter la frontière d'un contrôle, que WCAG 1.4.11
-          // veut à 3:1. `.input` passe par `--line-field` dans `main.css` ; les
-          // champs habillés en utilitaires ont besoin du même jeton.
-          field:   'rgb(var(--line-field) / <alpha-value>)',
-        },
-        line: {
-          DEFAULT: 'rgb(var(--line-default) / <alpha-value>)',
-          strong:  'rgb(var(--line-strong) / <alpha-value>)',
-        },
-        accent: {
-          DEFAULT: 'rgb(var(--accent) / <alpha-value>)',
-          hover:   'rgb(var(--accent-hover) / <alpha-value>)',
-          fg:      'rgb(var(--accent-fg) / <alpha-value>)',
-          muted:   'rgb(var(--fg-subtle) / <alpha-value>)',
-        },
-        success: 'rgb(var(--online) / <alpha-value>)',
-        online:  'rgb(var(--online) / <alpha-value>)',
-        warning: 'rgb(var(--warning) / <alpha-value>)',
-        error:   'rgb(var(--danger) / <alpha-value>)',
-        danger:  'rgb(var(--danger) / <alpha-value>)',
-        info:    'rgb(var(--info) / <alpha-value>)',
-      },
-      // The stacks live in `main.css` as `--font-sans` / `--font-mono` /
-      // `--font-display`, and these utilities read them rather than restating
-      // them. Two copies of a font stack is how you end up with `font-mono`
-      // and `var(--font-mono)` rendering two different faces, which is exactly
-      // what this codebase had.
-      // No `display` entry: `main.css` already defines `.font-display` by hand,
-      // with the feature settings and optical sizing a utility would not carry.
-      fontFamily: {
-        sans: 'var(--font-sans)',
-        mono: 'var(--font-mono)',
-      },
-      fontSize: {
-        '2xs': ['0.65rem', { lineHeight: '0.85rem' }],
-      },
-
-      // The utilities read the tokens, for the same reason `fontFamily` does:
-      // 213 `rounded-*` classes in the templates were on Tailwind's own scale
-      // and followed no theme at all, so a theme could round every hand-written
-      // `border-radius` and leave every utility square.
-      //
-      // The mapping is exact rather than approximate, which is a happy accident
-      // worth stating: Tailwind's default steps are 2 / 4 / 6 / 8 / 12 px, and
-      // so is `--radius`'s derived scale. Nothing shifts by a pixel.
-      borderRadius: {
-        none: '0',
-        sm: 'var(--radius-xs)',
-        DEFAULT: 'var(--radius-sm)',
-        md: 'var(--radius-md)',
-        lg: 'var(--radius-lg)',
-        xl: 'var(--radius-xl)',
-        '2xl': 'calc(var(--radius) * 2.6667)',
-        '3xl': 'calc(var(--radius) * 4)',
-        full: 'var(--radius-pill)',
-      },
-
-      // Durations already carry `--motion-scale` inside them, so
-      // `motion-scale: 0` stops the utility-driven transitions too rather than
-      // only the hand-written ones.
-      transitionDuration: {
-        DEFAULT: 'var(--dur-2)',
-        75: 'calc(75ms * var(--motion-scale))',
-        100: 'calc(100ms * var(--motion-scale))',
-        150: 'var(--dur-2)',
-        200: 'var(--dur-4)',
-        300: 'var(--dur-slow)',
-        500: 'calc(500ms * var(--motion-scale))',
-        700: 'calc(700ms * var(--motion-scale))',
-        1000: 'calc(1000ms * var(--motion-scale))',
-      },
-      transitionTimingFunction: {
-        DEFAULT: 'var(--ease-standard)',
-        standard: 'var(--ease-standard)',
-        emphasis: 'var(--ease-emphasis)',
-      },
-
-      // Tailwind's own shadows are `rgb(0 0 0 / 0.1)` and up, which no theme
-      // could tint or flatten. Same two levers as everything else.
-      boxShadow: {
-        sm: '0 1px 2px 0 rgb(var(--shadow-color) / calc(0.05 * var(--shadow-strength)))',
-        DEFAULT:
-          '0 1px 3px 0 rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength))), 0 1px 2px -1px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength)))',
-        md: '0 4px 6px -1px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength))), 0 2px 4px -2px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength)))',
-        lg: '0 10px 15px -3px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength))), 0 4px 6px -4px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength)))',
-        xl: '0 20px 25px -5px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength))), 0 8px 10px -6px rgb(var(--shadow-color) / calc(0.1 * var(--shadow-strength)))',
-        '2xl': '0 25px 50px -12px rgb(var(--shadow-color) / calc(0.25 * var(--shadow-strength)))',
-        inner:
-          'inset 0 2px 4px 0 rgb(var(--shadow-color) / calc(0.05 * var(--shadow-strength)))',
-        none: 'none',
-      },
-    },
-  },
-  plugins: [],
-} satisfies Config;
diff --git a/apps/web/test/errorDataPath.test.ts b/apps/web/test/errorDataPath.test.ts
new file mode 100644
index 00000000..91888f69
--- /dev/null
+++ b/apps/web/test/errorDataPath.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, it } from 'vitest';
+import { readFileSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { join, relative } from 'node:path';
+
+// Where the API's error details live in a caught `$fetch` error.
+//
+// A route that refuses with `createError({ statusCode, message, data })` answers
+// `{ statusCode, statusMessage, message, data }`, and `$fetch` hands that body
+// back as `err.data`. So whatever the route put in `data` is at `err.data.data`.
+//
+// Three pages read it one level up and never found it: the saved-search limit
+// fell through to a generic "failed" (`torrents/index.vue`), a session already
+// revoked ended on the re-authentication prompt (`settings.vue`), and the
+// fields the server refused were never outlined (`admin/UploadRules.vue`). Each
+// looked right in review — the name is `data` either way.
+//
+// The check is textual: a caught error's `.data.` followed by anything but a
+// field of the error body itself. `response._data` in an `onResponseError` hook
+// IS the body, so it reads `.data.reason` correctly and does not match.
+
+const APP = fileURLToPath(new URL('../app', import.meta.url));
+
+/** The error body's own fields; anything else under `err.data` is one level too high. */
+const BODY_FIELDS = ['statusCode', 'statusMessage', 'message', 'data', 'url', 'stack', 'error'];
+
+const TOO_HIGH = new RegExp(
+  String.raw`\b(?:e|err|error|ex)\??\.data\??\.(?!(?:${BODY_FIELDS.join('|')})\b)([A-Za-z_]\w*)`,
+);
+
+function walk(dir: string): string[] {
+  return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) return walk(full);
+    return /\.(vue|ts)$/.test(entry.name) ? [full] : [];
+  });
+}
+
+const FILES = walk(APP);
+
+describe("an API error's data is read where createError puts it", () => {
+  it('sweeps a realistic number of files', () => {
+    expect(FILES.length).toBeGreaterThan(150);
+  });
+
+  it('matches the shapes it is meant to, and only those', () => {
+    expect(TOO_HIGH.test('const reason = e?.data?.reason;')).toBe(true);
+    expect(TOO_HIGH.test('err?.data?.invalidFields as string[]')).toBe(true);
+    expect(TOO_HIGH.test('const reason = e?.data?.data?.reason;')).toBe(false);
+    expect(TOO_HIGH.test('err?.data?.message || err?.message')).toBe(false);
+    expect(TOO_HIGH.test('(response._data as Body)?.data?.reason')).toBe(false);
+  });
+
+  it.each(FILES.map((f) => [relative(APP, f), f]))('%s', (rel, full) => {
+    const offenders = readFileSync(full, 'utf8')
+      .split('\n')
+      .map((line, i) => [i + 1, line] as const)
+      .filter(([, line]) => TOO_HIGH.test(line))
+      .map(([n, line]) => `${rel}:${n} ${line.trim()}`);
+    expect(
+      offenders,
+      `${rel} reads an API error's details at err.data.<field>. createError nests ` +
+        'them: the body is err.data, its data is err.data.data.',
+    ).toEqual([]);
+  });
+});
diff --git a/apps/web/test/focusRing.test.ts b/apps/web/test/focusRing.test.ts
index 5a7487a9..ea95e93f 100644
--- a/apps/web/test/focusRing.test.ts
+++ b/apps/web/test/focusRing.test.ts
@@ -24,6 +24,11 @@ import { join, relative } from 'node:path';
 // composite to 1.34:1 and 1.90:1. WCAG 2.4.11 asks 3:1. They were decoration.
 // The global ring measures 7.77:1 on the same background.
 //
+// Tailwind 4 split the utility in two, and both suppress the ring: `outline-hidden`
+// is the old `outline-none` (`outline: 2px solid transparent`), and the new
+// `outline-none` is `outline-style: none`. Both live in `@layer utilities`, which
+// beats the `@layer base` the global indicator sits in, whatever the specificity.
+//
 // This check is textual and deliberately narrow, like `sfcImports.test.ts`:
 // it guards the Tailwind utility form, which is the one that drifted. The
 // scoped-CSS `outline: none` form is nearly always paired with a real custom
@@ -45,7 +50,7 @@ const DELIBERATE: Record<string, string> = {
 };
 
 /** Tailwind's outline-killing utilities, in both the bare and `focus:` forms. */
-const SUPPRESSOR = /(?:^|[\s'"`:])(?:focus:)?outline-none(?:[\s'"`]|$)/;
+const SUPPRESSOR = /(?:^|[\s'"`:])(?:focus:)?outline-(?:none|hidden)(?:[\s'"`]|$)/;
 
 function walk(dir: string): string[] {
   return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
diff --git a/deploy/helm/trackarr/Chart.lock b/deploy/helm/trackarr/Chart.lock
index 68230399..54024551 100644
--- a/deploy/helm/trackarr/Chart.lock
+++ b/deploy/helm/trackarr/Chart.lock
@@ -1,15 +1,15 @@
 dependencies:
 - name: cluster
   repository: https://cloudnative-pg.github.io/charts
-  version: 0.8.1
+  version: 0.9.0
 - name: cloudnative-pg
   repository: https://cloudnative-pg.github.io/charts
-  version: 0.29.0
+  version: 0.29.1
 - name: valkey
   repository: https://valkey.io/valkey-helm
-  version: 0.11.0
+  version: 0.12.0
 - name: rustfs
   repository: https://charts.rustfs.com
-  version: 0.12.0
-digest: sha256:5c228d8b0f8dbfc1209d16438d33a72c5e916c0781fea85c178cb4ea24f25c9e
-generated: "2026-08-24T10:06:25.730137+02:00"
+  version: 1.0.3
+digest: sha256:7398ede678d43444de7df0af659f4e584d4bc79fa740df3698b00ea79d1c48bb
+generated: "2026-10-24T16:15:38.30862075Z"
diff --git a/deploy/helm/trackarr/Chart.yaml b/deploy/helm/trackarr/Chart.yaml
index 0f922241..98cb6823 100644
--- a/deploy/helm/trackarr/Chart.yaml
+++ b/deploy/helm/trackarr/Chart.yaml
@@ -36,7 +36,7 @@ maintainers:
 dependencies:
   - name: cluster
     alias: postgresql
-    version: 0.8.1
+    version: 0.9.0
     repository: https://cloudnative-pg.github.io/charts
     condition: postgresql.enabled
 
@@ -45,16 +45,16 @@ dependencies:
   # once (see README). The flag exists for throwaway and CI clusters.
   - name: cloudnative-pg
     alias: postgresqlOperator
-    version: 0.29.0
+    version: 0.29.1
     repository: https://cloudnative-pg.github.io/charts
     condition: postgresqlOperator.enabled
 
   - name: valkey
-    version: 0.11.0
+    version: 0.12.0
     repository: https://valkey.io/valkey-helm
     condition: valkey.enabled
 
   - name: rustfs
-    version: 0.12.0
+    version: 1.0.3
     repository: https://charts.rustfs.com
     condition: rustfs.enabled
diff --git a/deploy/helm/trackarr/README.md b/deploy/helm/trackarr/README.md
index 07039293..814e5522 100644
--- a/deploy/helm/trackarr/README.md
+++ b/deploy/helm/trackarr/README.md
@@ -58,7 +58,7 @@ helm upgrade --install trackarr deploy/helm/trackarr \
 | Component | Off with | Then set |
 | --- | --- | --- |
 | Postgres | `postgresql.enabled=false` | `externalDatabase.url` (and `externalDatabase.migrationsUrl`), or `externalDatabase.existingSecret` |
-| Valkey / Redis | `valkey.enabled=false` | `externalRedis.host`, optionally `externalRedis.existingSecret` |
+| Valkey / Redis | `valkey.enabled=false` | `externalRedis.host`, optionally `externalRedis.existingSecret`, and `externalRedis.tls=true` for a Redis reached over TLS |
 | Object store | `rustfs.enabled=false` (the default) | nothing, unless `storage.driver=s3` — then `storage.s3.endpoint` and credentials for the external store. With `rustfs.enabled=true` the credentials are generated |
 | Ingress | `ingress.enabled=false` | see below — nothing else is required, but check `trustProxy` |
 | Web | `web.enabled=false` | — |
@@ -91,7 +91,8 @@ recommends anyway: Sentinel-style replication rather than sharding, because Redi
 was measured at 0.60 of a core while serving 4 811 announces/s.
 
 To keep Redis proper, set `valkey.enabled=false` and point `externalRedis` at
-your own.
+your own. A managed Redis usually takes TLS: `externalRedis.tls=true` hands the
+apps a `rediss://` URL, which the API, the tracker and the relay all speak.
 
 **Object store — [RustFS](https://charts.rustfs.com).** The RustFS project's own
 chart, and off by default: it does nothing unless `storage.driver: s3`. It is
@@ -440,7 +441,7 @@ has `postgresql.cluster.monitoring.enabled`.
 ## Upgrading from a release older than the uid alignment
 
 The pods used to run as uid 1001 while all three images are built for 65532 —
-`gcr.io/distroless/nodejs24-debian13:nonroot` for the api and web, an explicit
+`gcr.io/distroless/nodejs26-debian13:nonroot` for the api and web, an explicit
 `USER 65532:65532` for the tracker. It worked only because the bundles are
 world-readable. The chart now runs them as the uid they were built for.
 
diff --git a/deploy/helm/trackarr/check-render.sh b/deploy/helm/trackarr/check-render.sh
index f649c5d0..e913629e 100755
--- a/deploy/helm/trackarr/check-render.sh
+++ b/deploy/helm/trackarr/check-render.sh
@@ -121,6 +121,12 @@ assert_absent "aucun REDIS_PASSWORD quand il n'y en a pas" "name: REDIS_PASSWORD
 assert_contains "la clé lue est REDIS_PASSWORD pour un Redis externe" "key: REDIS_PASSWORD" \
   $HOST --set valkey.enabled=false --set externalRedis.host=10.0.0.5 \
   --set externalRedis.existingSecret=my-redis
+# Un Redis externe joint en TLS : les trois apps reçoivent rediss://, et rien
+# ne change pour qui n'a pas posé la valeur.
+assert_contains "externalRedis.tls : les apps reçoivent rediss://" "rediss://10.0.0.5:6379" \
+  $HOST --set valkey.enabled=false --set externalRedis.host=10.0.0.5 --set externalRedis.tls=true
+assert_absent "externalRedis sans tls : pas de rediss://" "rediss://" \
+  $HOST --set valkey.enabled=false --set externalRedis.host=10.0.0.5
 assert_fails_with "valkey off sans externalRedis.host" "set externalRedis.host" \
   $HOST --set valkey.enabled=false
 
@@ -145,7 +151,14 @@ assert_absent "s3 : plus de UPLOADS_DIR" "name: UPLOADS_DIR" $HOST $S3
 assert_contains "s3 : endpoint dérivé du Service RustFS" "http://chk-rustfs-svc:9000" $HOST $S3
 assert_fails_with "s3 sans endpoint ni rustfs" "storage.s3.endpoint is empty" \
   $HOST --set storage.driver=s3
-assert_fails_with "s3 + rustfs sans identifiants" "must be set to non-default" \
+# Sans identifiants, le rendu doit RÉUSSIR : depuis 3eba6d5, le chart génère la
+# paire (templates/storage-auth.yaml) et la passe au sous-chart par le nom de
+# Secret. L'assertion d'avant attendait le refus de RustFS (« must be set to
+# non-default ») ; elle datait d'avant ce commit et échouait depuis, constaté
+# sur les sous-charts d'origine comme sur les nouveaux le 2026-10-24.
+assert_secret_refs_resolve "s3 + rustfs sans identifiants — le chart les génère" "$CNPG_SECRET" \
+  $HOST --set storage.driver=s3 --set rustfs.enabled=true
+assert_contains "s3 + rustfs sans identifiants — Secret généré" "name: trackarr-s3-auth" \
   $HOST --set storage.driver=s3 --set rustfs.enabled=true
 assert_fails_with "driver de stockage inconnu" "storage.driver must be" \
   $HOST --set storage.driver=minio
diff --git a/deploy/helm/trackarr/templates/_env.tpl b/deploy/helm/trackarr/templates/_env.tpl
index 5c544f84..ef511282 100644
--- a/deploy/helm/trackarr/templates/_env.tpl
+++ b/deploy/helm/trackarr/templates/_env.tpl
@@ -67,7 +67,9 @@ connection leaks to whoever borrows it next.
 
 {{- define "trackarr.redisEnv" -}}
 {{- if .Values.valkey.enabled }}
+# The bundled Valkey, on the pod network the NetworkPolicy closes.
 - name: REDIS_URL
+  # nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
   value: {{ printf "redis://%s:6379" (include "trackarr.valkeyHost" .) | quote }}
 {{- if .Values.valkey.auth.enabled }}
 - name: REDIS_PASSWORD
@@ -78,7 +80,7 @@ connection leaks to whoever borrows it next.
 {{- end }}
 {{- else if .Values.externalRedis.host }}
 - name: REDIS_URL
-  value: {{ printf "redis://%s:%v" .Values.externalRedis.host (.Values.externalRedis.port | default 6379) | quote }}
+  value: {{ printf "%s://%s:%v" (ternary "rediss" "redis" (default false .Values.externalRedis.tls)) .Values.externalRedis.host (.Values.externalRedis.port | default 6379) | quote }}
 {{- if .Values.externalRedis.existingSecret }}
 - name: REDIS_PASSWORD
   valueFrom:
@@ -182,7 +184,7 @@ runAsNonRoot: true
 {{/*
 65532 because that is what all three images actually are, verified in their
 Dockerfiles rather than assumed: the api and web runtimes are
-gcr.io/distroless/nodejs24-debian13:nonroot, whose `nonroot` user is 65532, and
+gcr.io/distroless/nodejs26-debian13:nonroot, whose `nonroot` user is 65532, and
 apps/tracker/Dockerfile says `USER 65532:65532` with a comment about staying
 consistent with them.
 
diff --git a/deploy/helm/trackarr/templates/_helpers.tpl b/deploy/helm/trackarr/templates/_helpers.tpl
index 44b4d58b..9ac43850 100644
--- a/deploy/helm/trackarr/templates/_helpers.tpl
+++ b/deploy/helm/trackarr/templates/_helpers.tpl
@@ -301,10 +301,6 @@ true
 {{- .Values.site.trackerUdpUrl | default (printf "udp://%s:%v/announce" .Values.site.host .Values.tracker.udp.port) -}}
 {{- end -}}
 
-{{- define "trackarr.trackerWsUrl" -}}
-{{- .Values.site.trackerWsUrl | default (printf "wss://%s/ws" .Values.site.host) -}}
-{{- end -}}
-
 {{- define "trackarr.tlsSecretName" -}}
 {{- .Values.ingress.tls.secretName | default (printf "%s-tls" (include "trackarr.fullname" .)) -}}
 {{- end -}}
diff --git a/deploy/helm/trackarr/templates/configmap.yaml b/deploy/helm/trackarr/templates/configmap.yaml
index 537fc6f0..22845096 100644
--- a/deploy/helm/trackarr/templates/configmap.yaml
+++ b/deploy/helm/trackarr/templates/configmap.yaml
@@ -15,7 +15,10 @@ data:
   # not in-cluster service names.
   NUXT_PUBLIC_TRACKER_HTTP_URL: {{ include "trackarr.trackerHttpUrl" . | quote }}
   NUXT_PUBLIC_TRACKER_UDP_URL: {{ include "trackarr.trackerUdpUrl" . | quote }}
-  NUXT_PUBLIC_TRACKER_WS_URL: {{ include "trackarr.trackerWsUrl" . | quote }}
+  # Read by the API as well as the tracker: it decides whether a `.torrent`
+  # carries the UDP tier. The tracker alone used to receive it, so every file
+  # advertised a UDP endpoint the default install does not serve.
+  TRACKER_UDP_ENABLED: {{ .Values.tracker.udp.enabled | quote }}
 
   # In-cluster, service to service.
   API_INTERNAL_URL: {{ printf "http://%s-api:%v" (include "trackarr.fullname" .) .Values.api.service.port | quote }}
diff --git a/deploy/helm/trackarr/templates/tracker.yaml b/deploy/helm/trackarr/templates/tracker.yaml
index a1f0f1dc..219557b1 100644
--- a/deploy/helm/trackarr/templates/tracker.yaml
+++ b/deploy/helm/trackarr/templates/tracker.yaml
@@ -108,8 +108,10 @@ spec:
             periodSeconds: 3
             failureThreshold: 20
           readinessProbe:
-            # /health reports on Postgres AND Redis, which is right here: a
-            # tracker that cannot reach either should not be sent announces.
+            # /health fails only without Postgres: a tracker that cannot
+            # reach Redis still answers announces in degraded mode, and pulling
+            # every replica out of the Service on a Redis outage left no
+            # announce answered at all.
             httpGet: { path: /health, port: http }
             periodSeconds: 10
           livenessProbe:
diff --git a/deploy/helm/trackarr/values.yaml b/deploy/helm/trackarr/values.yaml
index 73600f65..e2e07846 100644
--- a/deploy/helm/trackarr/values.yaml
+++ b/deploy/helm/trackarr/values.yaml
@@ -45,7 +45,6 @@ site:
   # a different name or port than the website.
   trackerHttpUrl: ""   # default: https://{host}/announce
   trackerUdpUrl: ""    # default: udp://{host}:{tracker.udp.port}/announce
-  trackerWsUrl: ""     # default: wss://{host}/ws
   timezone: Europe/Paris
 
 # -----------------------------------------------------------------------------
@@ -127,6 +126,10 @@ web:
     type: ClusterIP
     port: 3000
     annotations: {}
+  # A CPU request, a memory limit and no CPU limit, here and in every resources
+  # block below. A CFS quota throttles a container that bursts past it even on
+  # an idle node, and an announce or an SSR render pays that as latency; the
+  # request is what the scheduler needs, the memory limit what protects the node.
   resources:
     requests: { cpu: 100m, memory: 256Mi }
     limits: { memory: 512Mi }
@@ -791,6 +794,13 @@ valkey:
   resources:
     requests: { cpu: 100m, memory: 1280Mi }
     limits: { memory: 1536Mi }
+  # The init container, which only writes valkey.conf and the ACL file before
+  # Valkey starts. With no numbers of its own it ran BestEffort, and a namespace
+  # whose ResourceQuota covers memory rejects such a pod unless a LimitRange
+  # fills the gap.
+  initResources:
+    requests: { cpu: 10m, memory: 16Mi }
+    limits: { memory: 64Mi }
 
 # Used when valkey.enabled is false. Point it at your own Redis or Valkey —
 # including a Sentinel-fronted one, which is what doc/guide/high-availability.md
@@ -798,6 +808,12 @@ valkey:
 externalRedis:
   host: ""
   port: 6379
+  # `true` for a Redis reached over TLS, as most managed offers are: the apps
+  # then get `rediss://`, which all three (API, tracker, relay) speak. Off by
+  # default, for the common case of a plain Redis on the same private network.
+  # Without it the password and every key crossed the network in clear, whatever
+  # the server accepted.
+  tls: false
 
   # Bring your own Secret for the password. WHICH KEY IS READ DEPENDS ON THE
   # CASE, which is a trap worth spelling out:
diff --git a/doc/Dockerfile b/doc/Dockerfile
index bad72ee0..8ba47d74 100644
--- a/doc/Dockerfile
+++ b/doc/Dockerfile
@@ -1,4 +1,6 @@
-# syntax=docker/dockerfile:1.7
+# syntax=docker/dockerfile:1.28
+# hadolint global ignore=DL3007
+# (the one `:latest` in this file is Chainguard's: see the runner stage)
 #
 # Trackarr documentation — VitePress static build, distroless nginx
 # runtime. Final image lands around 12 MB.
@@ -25,7 +27,7 @@
 # Stage 1 — install dependencies. Cached on package-lock.json + package.json
 # alone so source-only edits don't bust the deps layer.
 # -----------------------------------------------------------------------------
-FROM node:24-alpine AS deps
+FROM node:26-alpine AS deps
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci --no-audit --no-fund
@@ -36,7 +38,7 @@ RUN npm ci --no-audit --no-fund
 #     (passed through to vitepress via process.env, see config.ts).
 #   - Output lives at .vitepress/dist/.
 # -----------------------------------------------------------------------------
-FROM node:24-alpine AS builder
+FROM node:26-alpine AS builder
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
@@ -55,6 +57,9 @@ RUN npm run build
 #   - listens on 8080 by default (no need for cap_net_bind_service)
 #   - signed image — `cosign verify` will check the provenance
 # -----------------------------------------------------------------------------
+# `:latest` is the only tag Chainguard's free tier publishes (the image already
+# runs as 65532).
+# trivy:ignore:AVD-DS-0001
 FROM cgr.dev/chainguard/nginx:latest AS runner
 
 # Configuration first so the image fails fast on a config typo
@@ -95,6 +100,10 @@ STOPSIGNAL SIGQUIT
 # La sonde revient donc à l'orchestrateur, qui sait le faire depuis l'extérieur :
 # `readinessProbe: httpGet: { path: /healthz }` côté Kubernetes, ou un
 # `healthcheck:` dans le compose si l'on veut la garder ici.
+#
+# `HEALTHCHECK NONE` le dit aux analyseurs (trivy DS-0026) sans rien changer :
+# l'image de base n'en déclare aucun.
+HEALTHCHECK NONE
 
 # The Chainguard image's default ENTRYPOINT runs `nginx -g 'daemon off;'`
 # from the right user. No overrides needed.
diff --git a/doc/guide/anti-cheat.md b/doc/guide/anti-cheat.md
index f6ad53ae..10c29a8e 100644
--- a/doc/guide/anti-cheat.md
+++ b/doc/guide/anti-cheat.md
@@ -54,7 +54,7 @@ Transmission, Deluge, libtorrent-rasterbar, BitTorrent Mainline,
 real clients either. Only fires when there's actual upload
 delta — pure leechers with custom clients don't get tagged.
 
-Severity is always `medium`. Some legitimate niche clients
+Severity is always `low`. Some legitimate niche clients
 (developer builds, very old releases) trip this too, so the
 detector errs on the lighter side — a moderator reviewing the
 case can distinguish a curious user from a hand-rolled cheater
@@ -137,10 +137,23 @@ match a typical private-tracker workload:
 
 | Setting | Default | Override |
 | --- | --- | --- |
-| Max upload bytes/sec (velocity cap) | 80 MB/s | `ANTICHEAT_MAX_BYTES_PER_SECOND` env (bytes/sec) |
+| Max upload bytes/sec (velocity cap) | 80 MiB/s | `ANTICHEAT_MAX_BYTES_PER_SECOND` env (bytes/sec), read once at start-up |
+| One flag per member, torrent and kind | every 15 min | hard-coded (the minimum announce interval) |
 | Detection runs in goroutine | yes | hard-coded (announce hot path stays fast) |
 | Detection happens **before** the 1 TiB delta clamp | yes | hard-coded (detector sees raw client claims) |
 
+The variable was documented here long before anything read it;
+the tracker reads it since October 2026. It only moves the
+threshold for **flagging**: what an announce can credit is bounded
+separately, in code, at 1 GiB/s per peer and per account.
+
+A detector that fires on every announce would bury the queue — a
+client announcing every few seconds, or rotating its peer_id,
+added a row each time. A kind of flag is now recorded at most once
+per member and torrent every fifteen minutes, across replicas; no
+honest client announces faster than that, so evidence arriving at
+a normal pace is still recorded every time.
+
 Increasing the velocity cap is the safest tuning knob if you
 serve a community with symmetric 10 Gb/s connections. Lowering
 it is risky — the false-positive rate climbs fast below ~50 MB/s.
diff --git a/doc/guide/architecture.md b/doc/guide/architecture.md
index c0c5d3a4..51d83f99 100644
--- a/doc/guide/architecture.md
+++ b/doc/guide/architecture.md
@@ -16,7 +16,7 @@ plus the usual Postgres + Redis pair. They share zero process state
                                   ▼            ▼           ▼
                        ┌─────────────┐ ┌─────────────┐ ┌──────────────┐
                        │  apps/web   │ │  apps/api   │ │ apps/tracker │
-                       │  Nuxt 4 SSR │ │ Nitro 4     │ │ Go 1.25      │
+                       │  Nuxt 4 SSR │ │ Nitro 4     │ │ Go 1.27      │
                        │  Vue 3      │ │ Drizzle ORM │ │ sqlc         │
                        │  TypeScript │ │ Zod, h3     │ │ HTTP + UDP   │
                        └─────────────┘ └──────┬──────┘ └──────┬───────┘
@@ -67,9 +67,9 @@ replaces only `apps/web`.
 
 | Container | Base image |
 | --- | --- |
-| `apps/web` (SSR) | `gcr.io/distroless/nodejs24-debian13:nonroot` |
+| `apps/web` (SSR) | `gcr.io/distroless/nodejs26-debian13:nonroot` |
 | `apps/web` (static) | `cgr.dev/chainguard/nginx` |
-| `apps/api` | `gcr.io/distroless/nodejs24-debian13:nonroot` |
+| `apps/api` | `gcr.io/distroless/nodejs26-debian13:nonroot` |
 | `apps/tracker` | `scratch` |
 
 No shells, no package managers, signed images, non-root by default.
@@ -86,6 +86,10 @@ No shells, no package managers, signed images, non-root by default.
 
 - **Sessions** — h3 sealed cookie (iron-webcrypto), 7-day TTL,
   HttpOnly + SameSite=lax. Encryption key from `NUXT_SESSION_SECRET`.
+- **Known devices** — a second, stateless cookie (`trackarr_kd`, 180 days,
+  HMAC keyed from `NUXT_SESSION_SECRET`) on every browser that completed a
+  sign-in. It exempts that browser from the per-account sign-in lockout and
+  from nothing else; see `apps/api/utils/knownDevices.ts`.
 - **Notification fan-out** — every event-emitting route calls
   `notify(userId, type, payload, link)`. The row hits Postgres,
   then a Redis pub/sub broadcast lets every Nitro replica with
diff --git a/doc/guide/backup-restore.md b/doc/guide/backup-restore.md
index 902df9df..05c7d86f 100644
--- a/doc/guide/backup-restore.md
+++ b/doc/guide/backup-restore.md
@@ -40,11 +40,26 @@ Key secrets to preserve:
 | Variable                  | Purpose                                                                                                                        |
 | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
 | `IP_HASH_SECRET`          | Hashes peer IPs in the tracker — losing this breaks peer tracking continuity but doesn't compromise security                   |
-| `NUXT_SESSION_SECRET`     | Encrypts sessions and (as fallback) notification-channel configs — losing this logs out all users and breaks every channel row |
-| `CHANNEL_ENCRYPTION_KEY`  | Optional dedicated key for notification-channel configs. When set, this is the variable that must survive the move (not the session secret). |
+| `NUXT_SESSION_SECRET`     | Seals sessions, and is the last fallback of both keys below. Unless you set them, losing it logs everyone out **and** loses every password verifier and TOTP secret, every notification channel's credentials and the instance's federation key |
+| `CREDENTIAL_ENCRYPTION_KEY` | Encrypts `users.auth_verifier` and `users.totp_secret` at rest. Falls back to `CHANNEL_ENCRYPTION_KEY`, then to the session secret. Lost, every member must reset their password and re-enrol TOTP — the API refuses to start on a changed key rather than tell everyone "Invalid credentials" |
+| `CHANNEL_ENCRYPTION_KEY`  | Encrypts the notification-channel configs and the federation private key. Optional; falls back to the session secret. When set, this is the variable that must survive the move (not the session secret). |
 
 Store a copy of your `.env` file in a secure location (password manager, encrypted storage) separate from your database backups.
 
+### Beyond the database
+
+`pg_dump` holds the rows and nothing else:
+
+- **Uploaded files.** The site logo, the favicon and uploaded fonts live in the
+  `uploads_data` volume — or in the bucket, with `STORAGE_DRIVER=s3`. Back that
+  up too, or the restored site comes back without them.
+- **Redis** holds the live swarm, the stats accumulator and the caches. Losing
+  it costs at most a minute of credit and one announce interval for the swarm
+  to rebuild; it is not worth restoring across a move.
+- **Backups taken before a [Panic](./panic-mode)** hold, in clear, everything
+  the panic encrypted afterwards. Keep that in mind when deciding how long they
+  live and where.
+
 ## Restoring a Backup
 
 To restore your database on a new VPS:
diff --git a/doc/guide/bittorrent-v2.md b/doc/guide/bittorrent-v2.md
index e262c325..3a7d76a7 100644
--- a/doc/guide/bittorrent-v2.md
+++ b/doc/guide/bittorrent-v2.md
@@ -80,6 +80,25 @@ That second one is the cryptographic upgrade of `content_signature`, which the
 [Cross-seed](./cross-seed.md) surface uses today: same shape, but the root
 proves the bytes where paths-and-sizes only guessed them.
 
+## The file members download
+
+The site edits a `.torrent` without decoding it. At upload it removes the
+uploader's own `announce`, `announce-list`, `url-list`, `comment` and
+`created by`, and sets `private` to 1; at download it writes the member's own
+announce URLs in. Both used to decode the whole file and encode it again, and
+the decoder re-spells in hex any dictionary key that is not valid UTF-8 —
+which is every key of `piece layers`, a 32-byte binary Merkle root. Every v2
+and hybrid file the site served had its piece layers renamed, and a v2 client
+cannot verify a single piece without them. The edits now splice the bytes
+(`apps/api/utils/torrentBytes.ts`) and never touch `info` beyond that flag.
+
+The files stored before that change carried the same damage, and kept the
+uploader's announce URL — their passkey — at rest. A resumable sweep
+(`plugins/backfill-torrent-files.ts`) rewrites them once: uploader fields
+removed, hex keys turned back into the roots they spell when they match the
+file's own. It checks that `info` comes out byte-identical, so no infohash
+moves under a swarm, and leaves alone any row that fails the check.
+
 ## Upgrading
 
 Nothing to do. Uploads are addressed as they arrive, and a boot-mounted sweep
diff --git a/doc/guide/bonus-events.md b/doc/guide/bonus-events.md
index f376a7f8..5c7d2aba 100644
--- a/doc/guide/bonus-events.md
+++ b/doc/guide/bonus-events.md
@@ -36,7 +36,7 @@ The popup is fed by `GET /api/bonus/active` which is polled every 60s by the glo
 
 ## How the multipliers reach the tracker
 
-1. **API** — every mutation on `bonus_events` (create / patch / toggle / delete) recomputes the active row and writes a JSON snapshot to Redis under `ot:bonus:active`. The snapshot carries the multipliers (basis points × 100), the window start / end (Unix ms), and the row id.
+1. **API** — every mutation on `bonus_events` (create / patch / toggle / delete) recomputes the active row and writes a JSON snapshot to Redis under `ot:bonus:active`. The snapshot carries the multipliers (basis points × 100), the window start / end (Unix ms), and the row id. `plugins/bonus-event-sync.ts` also recomputes it every minute: the snapshot lives five minutes, and until October 2026 only a mutation or a page load re-stamped it — an event scheduled ahead began only when somebody opened the site, and lapsed on a quiet night.
 2. **Tracker (Go)** — the announce handler reads `ot:bonus:active` through a `bonus.Resolver` with a 30-second in-memory cache. Cache miss = one Redis `GET`; cache hit = no I/O at all. The hot path costs are bounded.
 3. **Apply step** — `delta * multiplier / 100`. Integer-only, no float drift. The handler caps the per-announce delta at **1 TiB** before applying multipliers so a malicious client claiming `Int64.Max` can't overflow the multiplication.
 4. **Failure modes**:
@@ -44,6 +44,7 @@ The popup is fed by `GET /api/bonus/active` which is polled every 60s by the glo
    - Negative multipliers (corrupted JSON) → `Identity`.
    - Redis unreachable → `Identity` + 1-second short TTL so the next announce retries quickly.
    - **Trackers always fail open**. A misconfigured event can never silently apply an unintended freeleech to a torrent.
+5. **Minimum ratio** — while an event counts no download at all (download multiplier `0`), the tracker does not refuse members under the minimum ratio: nothing they download moves their ratio, and refusing them held out the very members the event was meant for.
 
 ## Storage
 
diff --git a/doc/guide/branding.md b/doc/guide/branding.md
index 8cb42269..0f65cdc4 100644
--- a/doc/guide/branding.md
+++ b/doc/guide/branding.md
@@ -63,12 +63,12 @@ Each row is a free-form `(key, value)` pair (both `text`). The keys are enumerat
 | ------------------- | ------------------------------------------------------------------- |
 | `hero_title`        | Big headline on `/`.                                                |
 | `hero_subtitle`     | Subheading.                                                         |
-| `status_badge_text` | The pill text next to the hero (e.g. "Beta", "Invite-only").       |
+| `status_badge_text` | Label of the live pill above the hero (e.g. "Beta", "Invite-only"). Empty, the pill reads the translated "Live"; it reads "Tracker offline" whenever the tracker is down, whatever the label. |
 | `feature_1_title`   | Card 1 title under the hero.                                        |
 | `feature_1_desc`    | Card 1 description.                                                 |
 | `feature_2_*`       | Card 2.                                                             |
 | `feature_3_*`       | Card 3.                                                             |
-| `welcome_message`   | Markdown shown in a dismissible welcome banner after first login.   |
+| `welcome_message`   | Rich text shown to signed-in members as a card at the top of `/`. A member can dismiss it; the dismissal is kept in their browser, per version of the note, so editing the note shows it again. |
 
 ### Footer
 
@@ -80,7 +80,7 @@ Each row is a free-form `(key, value)` pair (both `text`). The keys are enumerat
 
 | Key          | Effect                                                                            |
 | ------------ | --------------------------------------------------------------------------------- |
-| `site_rules` | Markdown. Surfaces on the registration page and in the user's dropdown menu.      |
+| `site_rules` | Rich text, shown at `/rules` — readable signed out, since an invitation is accepted after reading them — and linked from the footer once set. |
 
 ### Announcement banner
 
@@ -141,7 +141,7 @@ The endpoints overwrite the previous file (one logo + one favicon active at a ti
 
 - **First-boot defaults**: `registration_open` defaults to `false` (opt-in registration), `staffBypass` defaults to `true`. The first admin should sweep `/admin/settings` once after install.
 - **Cache staleness on rollback**: if you roll back a setting by editing `settings` directly in the DB (e.g. a recovery action), publish a manual invalidation: `redis-cli PUBLISH settings:invalidate <key>`. Without it, every Nitro replica keeps the stale value until the 60 s TTL expires.
-- **Markdown surfaces**: `site_rules`, `footer_text`, `welcome_message`, `announcement_message` are all rendered as Markdown. Sanitisation happens on the client; don't paste raw HTML you wouldn't trust.
+- **What renders how**: `welcome_message` comes from the rich-text editor and is stored as HTML; the home page sanitises it with the editor's own profile (DOMPurify, which keeps colours and alignment) before rendering. `footer_text` is sanitised HTML, inline. `announcement_message` is plain text. `site_rules` is rich text too, rendered the same way on `/rules`.
 
 ## Implementation reference
 
diff --git a/doc/guide/configuration.md b/doc/guide/configuration.md
index d58d71a8..279a6526 100644
--- a/doc/guide/configuration.md
+++ b/doc/guide/configuration.md
@@ -39,7 +39,7 @@ The production stack ships **three independent application containers** behind C
 | -------------- | --------------------------------------------------------------------------------- |
 | `web` (`front-ssr`) | Nuxt 4 SSR — UI shell + page chunks                                          |
 | `api`          | Nitro 4 standalone — every `/api/*`, `/uploads/*`, SSE notifications              |
-| `tracker`      | Go 1.25 — BEP 3 HTTP announce on `:8080`, BEP 15 UDP announce on `:6969`          |
+| `tracker`      | Go 1.27 — BEP 3 HTTP announce on `:8080`, BEP 15 UDP announce on `:6969`          |
 | `postgres`     | PostgreSQL 18                                                                     |
 | `pgbouncer`    | Transaction-mode pool between `api`/`tracker` and `postgres`                      |
 | `redis`        | Redis 8 — peer hashes, sessions, rate-limit windows, pub/sub bus                  |
diff --git a/doc/guide/favorites.md b/doc/guide/favorites.md
index 65c0de51..22bcd0e7 100644
--- a/doc/guide/favorites.md
+++ b/doc/guide/favorites.md
@@ -47,6 +47,17 @@ Three sort modes:
 - There's no public "X people starred this" counter on the
   torrent surface.
 
+## What you can star, and what the list shows
+
+Only torrents you can see. Starring one you cannot — still in
+moderation, rejected, or adult content your settings hide — is
+refused as if it did not exist, and the same check guards
+comments. The list applies the catalogue's own visibility rules
+too: a favourite whose torrent was rejected or deactivated since,
+or is adult content you have since hidden, drops out of
+`/favorites` rather than staying there whatever it became. Both
+used to work by hash alone.
+
 ## Schema
 
 ```
diff --git a/doc/guide/getting-started.md b/doc/guide/getting-started.md
index 541daa4a..d4b28482 100644
--- a/doc/guide/getting-started.md
+++ b/doc/guide/getting-started.md
@@ -111,8 +111,12 @@ DB_PASSWORD=$(openssl rand -hex 32)
 REDIS_PASSWORD=$(openssl rand -hex 32)
 
 NUXT_PUBLIC_TRACKER_HTTP_URL=https://tracker.your-domain.com/announce
-NUXT_PUBLIC_TRACKER_UDP_URL=udp://tracker.your-domain.com:6969/announce
-NUXT_PUBLIC_TRACKER_WS_URL=wss://tracker.your-domain.com/ws
+
+# UDP is off by default. To serve it, uncomment both: the tracker and the API
+# read the same switch, so .torrent files carry the UDP tier only when the
+# listener is actually on.
+# TRACKER_UDP_ENABLED=true
+# NUXT_PUBLIC_TRACKER_UDP_URL=udp://tracker.your-domain.com:6969/announce
 EOF
 ```
 
@@ -205,8 +209,8 @@ the minimum you must set for production:
 | `TRACKER_DOMAIN`                | Announce subdomain (Caddy TLS)                      |
 | `ACME_EMAIL`                    | Let's Encrypt contact email                         |
 | `NUXT_PUBLIC_TRACKER_HTTP_URL`  | Announce URL embedded in `.torrent` files (runtime) |
-| `NUXT_PUBLIC_TRACKER_UDP_URL`   | UDP announce URL (informational, UDP is disabled)   |
-| `NUXT_PUBLIC_TRACKER_WS_URL`    | WS announce URL (informational, WS is disabled)     |
+| `TRACKER_UDP_ENABLED`           | Turns the UDP tracker on (off by default)           |
+| `NUXT_PUBLIC_TRACKER_UDP_URL`   | UDP announce URL, added to `.torrent` files when UDP is on |
 
 `ADMIN_API_KEY` is the one line in that table you can leave empty. It is not
 part of the boot-time secret check, and no route calls the header gate today
diff --git a/doc/guide/high-availability.md b/doc/guide/high-availability.md
index efc52f0f..3cba436f 100644
--- a/doc/guide/high-availability.md
+++ b/doc/guide/high-availability.md
@@ -15,7 +15,7 @@ you do not need is the main thing this page argues against.
 | Component | Replicas | If it dies | State |
 | --- | --- | --- | --- |
 | **Postgres** | 1 | total outage | the whole site |
-| **Redis** | 1 | announces answer, credit stops | swarm state, dedup markers, caches |
+| **Redis** | 1 | announces answer without peers, credit stops | swarm state, dedup markers, caches |
 | **PgBouncer** | 1 | total outage | none — it is a proxy |
 | **Caddy** | 1 | total outage | TLS certificates |
 | Web, API, Tracker | N | degraded | none |
@@ -119,7 +119,8 @@ Sentinel quorum of 3 (they can be co-located with the app nodes — they are tin
    handles the primary discovery and reconnection itself.
 2. **Tracker client** — `redis.NewFailoverClient(&redis.FailoverOptions{...})`.
    This returns a `*redis.Client`, so the six fields do **not** need to change
-   for Sentinel. They only need to become `redis.UniversalClient` if you later
+   for Sentinel. Keep the breaker: `peers.NewClientFromURL` installs it with
+   `AddHook`, and a client built another way would go without it. They only need to become `redis.UniversalClient` if you later
    want Cluster as well; doing it now costs nothing and keeps the option open.
 3. **`enableOfflineQueue: false`** in `redis/client.ts` is the decision.
    Combined with `maxRetriesPerRequest: 3`, every command fails immediately
@@ -136,7 +137,7 @@ before choosing:
 
 | Subsystem | During the window |
 | --- | --- |
-| Peer writes | fail; the announce still answers with the swarm it could read |
+| Swarm | neither written nor read: the announce is answered with no peers and an `interval` of five minutes, so clients come back soon after Redis does. Credit stops — without its stored baseline an announce has no delta to credit |
 | Credit dedup | `checkRedis` returns **true** on error — it degrades to per-process dedup, which is the deliberate single-instance fallback. With several tracker instances behind a balancer, that reopens the double-credit window for the duration |
 | Passkey cache | misses fall through to Postgres; correct, just slower |
 | Rate limiting | the identity-keyed limiter cannot read its counters |
@@ -144,6 +145,26 @@ before choosing:
 The dedup row is the one that matters. It is a correctness window, not a
 performance one, and it is the argument for keeping the failover short.
 
+**The tracker stops asking a Redis that is gone.** A circuit breaker on its
+client (`apps/tracker/internal/peers/breaker.go`) opens on a refused
+connection, an unresolvable host, or three timeouts in a row; while it is open,
+every Redis call fails at once, and one call a second goes through to see
+whether Redis is back. Without it, finding out was the slow part: go-redis
+dials five times and retries each command three times, about two seconds per
+command, and an announce issues half a dozen. Measured with Redis stopped:
+the first announce took two seconds, every one after it 31 ms — the latency
+floor — and 120 concurrent announces had a p99 of 148 ms.
+
+What is left is the transition. The announces already under way when Redis
+disappears pay for discovering it: two seconds against a refused connection;
+against a Redis that accepts connections and never answers (a frozen process),
+they run into the five-second announce deadline and fail until three timeouts
+have opened the breaker. `/health` answers 200 with `"status":"degraded"`
+throughout, so the replicas stay in the Service; it turns 503 only when
+Postgres is unreachable. A tracker that *starts* without Redis still exits —
+deliberately, so that a wrong `REDIS_URL` is a crash loop rather than a site
+that quietly serves empty swarms.
+
 ### Independent of HA: where the memory ceiling actually sits
 
 Measured on the bench: a peer costs **~290 bytes** in Redis — 226 bytes of JSON
@@ -260,6 +281,10 @@ path is worth more than saving the tracker one hop.
 `transaction` mode. Tested directly against PgBouncer 1.25.2 with
 `postgres.js` 3.4.9 and Postgres 18.6: 80 statements reused across separate
 transactions, no error, behaviour identical to connecting straight to Postgres.
+Re-run on PgBouncer 1.26.1 (the `edoburu/pgbouncer:v1.26.1-p0` image the compose
+file pins, configured by the same environment variables): 400 executions of four
+prepared statements interleaved over ten client connections, explicit
+transactions included, SCRAM authentication, no error.
 
 The measurement was right and its earlier explanation was wrong. This page used
 to say "postgres.js accounts for the pooling mode itself"; the actual reason is
diff --git a/doc/guide/hit-and-run.md b/doc/guide/hit-and-run.md
index 554a26ac..1ccc46b8 100644
--- a/doc/guide/hit-and-run.md
+++ b/doc/guide/hit-and-run.md
@@ -23,7 +23,7 @@ One row per (user, torrent). The unique index `hnr_user_torrent_idx` guarantees
 | `userId`          | FK → `users` (cascade delete).                                       |
 | `torrentId`       | FK → `torrents` (cascade delete).                                    |
 | `downloadedAt`    | When the user first either clicked Download or completed the torrent.|
-| `seedTime`        | Accumulated seconds seeded (incremented by the tracker on every announce). |
+| `seedTime`        | Accumulated seconds seeded, credited by the tracker on each seeding announce (see below). |
 | `requiredSeedTime`| Snapshot of the threshold at insert time. Lets the operator change the global default without retroactively re-graded existing rows. |
 | `isHnr`           | `true` once the grace window expired without completion.             |
 | `isExempt`        | Manual moderator waiver.                                             |
@@ -62,21 +62,29 @@ One row per (user, torrent). The unique index `hnr_user_torrent_idx` guarantees
 
 ## Where the seed-time delta comes from
 
-The Go tracker's announce handler diffs `uploaded` / `downloaded` against the previous peer entry on every announce and persists them into `hnr_tracking` in the same transaction it updates `users.uploaded` / `users.downloaded`. A separate ticker calls `updateSeedTime(user, torrent, secondsSeeded)` to bump `seedTime`. Exempt or completed rows short-circuit early so no further state churn happens on them.
+The Go tracker's announce handler diffs `uploaded` / `downloaded` against the previous peer entry on every announce, adds the increments to `hnr_tracking`, and books them on the member's totals (batched through Redis — see [Scaling](./scaling)).
 
-The previous-announce snapshot lives in Redis with a **24 h TTL by default**, configurable via `TRACKER_PEER_TTL` (Go duration string — `24h`, `90m`, `7200s`; values below `15m` are clamped to that floor). Two cases used to silently zero the delta:
+Seed time is credited on the same path, by an announce that reports the torrent complete (`left=0`; a BEP 21 partial seed does not count). It credits the stretch since the account was last credited on that torrent — or since this peer's previous announce, if that is later — and at most two announce intervals, an hour, at once. How far each account has been credited is a mark in Redis (`seedtime:<torrent>:<user>`), so the stretches never overlap:
 
-- **First announce ever** for a given (peer_id, info_hash) pair — Redis has no `prev`, so a naive diff produced `0`.
+- a member seeding from three clients earns real time, not three times it;
+- a client that re-announces every 30 minutes earns all 30 (until October 2026 it earned 15: each credit was capped at the minimum interval, which doubled every requirement);
+- a client silent for longer than an hour is credited the hour, not the gap.
+
+Exempt or completed rows are left alone: the update matches only `is_exempt = false AND completed_at IS NULL`.
+
+The previous-announce snapshot lives in Redis with a **24 h TTL by default**, configurable via `TRACKER_PEER_TTL` (Go duration string — `24h`, `90m`, `7200s`; values below `15m` are clamped to that floor). Two cases credit nothing:
+
+- **First announce ever** for a given (peer_id, info_hash) pair — Redis has no `prev`, so there is nothing to diff against.
 - **Gap longer than the TTL** — same effect, the peer hash expired between announces.
 
-To recover those bytes, when the very first announce for a peer carries `event=started`, the tracker trusts the client's declared cumulative `uploaded` / `downloaded` as the initial delta. That covers honest clients that resume a session or rejoin after sleep without losing what they already pushed. The existing 1 TiB/announce cap bounds the worst-case spoofing window, and a `started` announce is still rate-limited like any other.
+Both only re-establish the baseline; the next announce credits normally. The tracker never takes a client's declared cumulative counters as a delta: a client looping `started(uploaded=1TiB)` → `stopped` → `started` would otherwise mint credit without end. A restart forfeits at most one announce interval.
 
 ## When rows get flagged
 
-`checkAndMarkHnrs()` runs from the API plugin loop. On each pass:
+`checkAndMarkHnrs()` runs every ten minutes from `apps/api/plugins/hnr-sweep.ts` (first pass two minutes after boot), under a cross-replica lock so each member is notified once. Opening the moderation queue with `?check=true` still runs it on demand. Until October 2026 that was the only way it ran — on an instance nobody moderated by hand, nobody was ever flagged. On each pass:
 
 1. It reads the current grace period from `/admin/settings` (`getHnrGracePeriod`).
-2. It selects every row where `isHnr = false`, `isExempt = false`, `completedAt IS NULL`, and `downloadedAt < now - graceWindow`.
+2. It selects every row where `isHnr = false`, `isExempt = false`, `completedAt IS NULL`, `downloadedAt < now - graceWindow`, and `downloaded > 0` — the row is created when the member clicks Download, and one who never started the torrent took nothing from the swarm.
 3. It flips those rows to `isHnr = true` in a single `UPDATE … RETURNING`.
 4. For each flipped row it fans out a `hnr_violation_marked` notification to the user (resolving the torrent name so the inbox row is meaningful).
 
@@ -144,6 +152,6 @@ See [Seed Bonus](./seed-bonus.md).
 | Schema                                   | `packages/db/src/schema.ts` (`hnr_tracking`)                      |
 | HnR logic (insert / update / mark)       | `apps/api/utils/hnr.ts`                                           |
 | Tracker-side delta updates               | `apps/tracker/internal/server/handler.go` (announce path)         |
-| Mark-as-HnR sweeper                      | called from the API plugin loop (`checkAndMarkHnrs`)              |
+| Mark-as-HnR sweeper                      | `apps/api/plugins/hnr-sweep.ts` (`checkAndMarkHnrs`, every 10 min) |
 | Moderator queue                          | `apps/api/routes/api/admin/hnr/*`, `apps/web/app/pages/mod/hnr.vue` |
 | User downloads page                      | `apps/web/app/pages/downloads.vue`                                |
diff --git a/doc/guide/kubernetes.md b/doc/guide/kubernetes.md
index 3f7200dc..e584439a 100644
--- a/doc/guide/kubernetes.md
+++ b/doc/guide/kubernetes.md
@@ -70,6 +70,8 @@ tracker's Lua scripts run against it unchanged. Its lack of cluster mode matches
 what [High availability](./high-availability) recommends anyway.
 
 To keep Redis proper, disable the subchart and point `externalRedis` at your own.
+A managed Redis usually takes TLS: `externalRedis.tls=true` hands the apps a
+`rediss://` URL, which the API, the tracker and the relay all speak.
 
 ## Three things that will bite
 
diff --git a/doc/guide/panic-mode.md b/doc/guide/panic-mode.md
index 48d15872..12389086 100644
--- a/doc/guide/panic-mode.md
+++ b/doc/guide/panic-mode.md
@@ -38,7 +38,9 @@ running code rather than against this page.
 │  • Forum posts    → Encrypted                                     │
 │  • Comments       → Encrypted                                     │
 │                                                                   │
-│  • Private messages, tickets, 2FA secrets,                        │
+│  • Writes refused (503) until restored                            │
+│                                                                   │
+│  • Private messages, tickets, NFOs, IMDb/TMDb ids,                │
 │    audit log, login history → UNTOUCHED, still readable           │
 └───────────────────────────────────────────────────────────────────┘
                               │
@@ -68,7 +70,26 @@ To activate Panic Mode:
 1. Go to **Admin Settings** → **Panic Mode**
 2. Confirm with the Panic Password
 
-Encryption begins immediately and cannot be interrupted.
+Encryption begins immediately. If it is cut short — a proxy timeout, a
+restarted container — the instance stays in the `encrypting` phase with its
+salt already saved: run **Encrypt** again and it resumes with the same key,
+leaving the rows already done as they are. `GET /api/admin/panic` reports the
+phase (`idle`, `encrypting`, `encrypted`, `restoring`); `isEncrypted` alone
+stays false for the whole pass.
+
+### While Panic Mode stands
+
+From the moment the encrypt pass starts until a restore completes, the API is
+**read-only**. Every `POST`, `PUT`, `PATCH` and `DELETE` is refused with `503`
+and `{"reason": "panic-lock"}`, except the panic routes themselves (resuming
+the encrypt pass, restoring) and logging out.
+
+Sessions already open are not ended — on purpose, so that staff keep a way in
+to restore. Before the lock, those sessions could go on uploading, posting,
+registering members: every such row landed in clear in a database announced
+as encrypted. Federation is suspended and the catalogue's background sweeps
+pause over the same span. Another replica notices within five seconds; the
+state is cached in Redis for that long.
 
 ## What Gets Encrypted
 
@@ -97,16 +118,46 @@ Mode buys you. They are the lists the API itself returns.
 |--------|----------------|
 | `messages.body`, `room_messages.body` | Private conversations, in full |
 | `tickets.*`, `ticket_messages.*` | Support threads, in full |
-| `users.totp_secret` | A 2FA secret is enough to mint valid codes |
-| `federation_config.private_key` | The instance's own signing key |
+| `torrents.nfo`, `torrents.imdb_id` … `openlibrary_id` | They name the content as well as the encrypted title does |
+| `catalog_records.body`, `work_titles.*` | The signed copy of each name and description, and the titles index |
 | `users.bio`, `users.display_name` | Member-authored identity |
 | `forum_topics.title` | The posts are encrypted; their titles are not |
-| `notification_channels.server_config` | Webhook URLs and channel credentials |
+| `reports.*`, `upload_requests.*`, `upload_request_comments.*` | What members flagged and asked for |
+| `torrent_moderation_messages.*`, `user_warnings.*` | The moderation record |
+| `banned_ips.*` | Addresses, and the reasons they were banned |
+| `notifications.payload`, `saved_searches.*`, `search_misses.*` | What members were told and what they looked for |
+| `messaging_broadcasts.*` | Staff announcements |
 | `login_events.*` | Who connected, from where, when |
 | `anticheat_flags.ip`, `anticheat_flags.user_agent` | Member IP addresses |
 | `audit_log.*` | The administrative record |
 | `remote_torrents.*` | Federated catalogue |
 
+### Encrypted at rest, but not by the panic password
+
+| Column | What protects it |
+|--------|------------------|
+| `users.totp_secret` | `CREDENTIAL_ENCRYPTION_KEY` |
+| `notification_channels.server_config` | `CHANNEL_ENCRYPTION_KEY` |
+| `federation_config.private_key_enc` | the channel key |
+
+These were listed as cleartext until October 2026. They are out of reach of a
+database dump alone, and within reach of whoever holds the server — its
+environment carries the key.
+
+### Outside the database
+
+Panic Mode works on Postgres rows and nothing else:
+
+- **Redis.** `peers:<info_hash>` keeps each peer's raw IP and member id for up
+  to 24 h (`TRACKER_PEER_TTL`); the Torznab logs keep address, query and user
+  agent for 7 days; the tracker caches passkeys for 60 s. The reference stack
+  persists Redis to disk.
+- **Postgres itself.** Dead tuples, the WAL and every backup taken before the
+  panic still hold the rows in clear.
+- **Proxy logs.** The reference Caddy configuration masks client addresses
+  and drops the passkey, peer id and address parameters from what it logs —
+  your own proxy may not.
+
 Extending the covered half is a schema and restore-path change, not a
 setting: every encrypted column needs its decrypt on the way back, and
 `restore` has to stay able to bring an instance encrypted by an older
@@ -123,6 +174,13 @@ To restore from Panic Mode:
 
 The system will decrypt all data and return to normal operation.
 
+If the restore stops part way — a timeout, a restarted container, a row that
+will not decrypt — it keeps the salt and the `restoring` phase, and the API
+stays read-only. Rows that fail are reported: `500` with their count and a
+sample. Fix the cause and run it again. The rows a previous attempt already
+restored are kept as they are, `.torrent` files included, and so is a row
+that was in clear all along — written before the lock above existed.
+
 ## Encryption Details
 
 | Component | Algorithm |
diff --git a/doc/guide/reports.md b/doc/guide/reports.md
index 59c51580..a912aee1 100644
--- a/doc/guide/reports.md
+++ b/doc/guide/reports.md
@@ -154,7 +154,11 @@ clears it.
 
 - **Web** — the login form rejects with "Your account has been
   banned" + the reason if set. Active sessions die at the
-  next API call (every protected route re-reads `is_banned`).
+  next API call (every protected route re-reads `is_banned`),
+  and for good: the ban also advances the account's session
+  epoch, so a cookie not presented during the ban — a stolen
+  copy, a device left offline — does not come back to life
+  when the ban ends.
 - **Torznab API** — every request returns the standard
   `ACCOUNT_SUSPENDED` error code.
 - **Tracker** — announces are rejected with "User is banned"
diff --git a/doc/guide/roadmap.md b/doc/guide/roadmap.md
index dcd2f1c3..b9370bfe 100644
--- a/doc/guide/roadmap.md
+++ b/doc/guide/roadmap.md
@@ -10,7 +10,7 @@ Trackarr is actively developed with a focus on performance, security, and usabil
 - [x] **Torrent lifecycle** — Three things a catalogue needs once it is a few years old. **Superseding**: a release can be marked as replaced by a better one, with the older one staying online, keeping its swarm and its hit-and-run obligations — people are seeding it, and retiring it under them would be a tidy-up that behaves like a hit and run. Guarded against self-reference, cycles, and pointers into pages a member may not be allowed to read. **Reseed requests**: a torrent at zero seeders was a silent dead end, and the site already knew exactly who could fix it; past snatchers now get asked, once per torrent per day site-wide. **Unregistered infohashes**: one request tells a client which of its torrents this tracker still serves, which is also the entry point automated cross-seeding needed. See [Torrent lifecycle](./torrent-lifecycle.md).
 - [x] **Separate RSS and API keys** — One secret used to authenticate the announce, the feeds and the API alike, so a member who pasted their feed URL into a third-party service handed over the credential that announces on their behalf — and the only remedy broke every torrent in their client. Members now hold three keys, each revocable on its own, minted on first use rather than at registration. The announce passkey still opens the read surfaces while `legacy_passkey_read_access` allows it, because every feed already configured anywhere carries it; an operator closes that door once their members have moved. Panic mode encrypts all three, Caddy strips all three from its access log, and the read surfaces now share one resolver — the RSS gate used to accept a key the Torznab gate would reject, and vice versa. See [Keys](./api-keys.md).
 - [x] **Saved searches** — A stored filter that notifies its owner when a matching upload is accepted: the server-side half of what members do with autobrr, for the member with no seedbox and no bot. The filter's vocabulary is the catalogue's own, so it is created from a "save this search" button rather than retyped into a second form. The stored query drops the prefix marker the live search appends — settled intent should not fire "The Crown" on everything that merely starts the same way — and the evaluation is inverted, one query asking which filters match this torrent rather than replaying each filter's search. It will not push adult content to somebody who turned it off, and it never names an anonymous uploader. See [Saved searches](./saved-searches.md).
-- [x] **Login history** — Every attempt to open a session, successful or refused, with the method, the client, and the address as a per-day ordinal. Members read their own; staff read any member's from their profile, where the question of account sharing actually comes up. Failures matter most: there is no per-account lockout on this site, so an attempt spread across addresses meets nothing at the time and this is the only trace it leaves. The daily salt means addresses compare within a day and not across weeks; the ordinal restarts each day so the numbering says that for itself instead of leaving it to a footnote. See [Security](./security.md).
+- [x] **Login history** — Every attempt to open a session, successful or refused, with the method, the client, and the address as a per-day ordinal. Members read their own; staff read any member's from their profile, where the question of account sharing actually comes up. Failures matter most: an attempt spread across addresses now meets the per-account lockout at the time, and this is where it shows afterwards, address by address. The daily salt means addresses compare within a day and not across weeks; the ordinal restarts each day so the numbering says that for itself instead of leaving it to a footnote. See [Security](./security.md).
 - [x] **Invite tree** — The genealogy has always been in `invitations`; both pages that read it only ever rendered one generation. `/admin/invite-tree` walks both directions — who vouched for a member, and who they let in — which is the standard procedure after a ban for cheating. Erased accounts render as tombstones: erasure keeps every edge intact and only takes the name, which is exactly the property a genealogy needs. Bounded at ten generations and four hundred members, and honest when it truncates. See [Invitations](./invitations.md).
 - [x] **Prowlarr indexer definition** — `GET /api/torznab/cardigann.yml` generates a Cardigann definition for the instance, with its name, URL and own categories filled in — a static file in the repo could describe every instance's categories except the one the member is joining. Downloadable from the member's own profile beside the key it needs. See [Torznab](../integrations/torznab.md).
 - [x] **BEP 21 partial seeds** — A client holding every piece it asked for but not the whole torrent reports `left=0` with `event=paused`; qBittorrent does it whenever somebody downloads part of a multi-file torrent. The tracker never rejected it, as some do, but counted the peer as a seed — inflating the seeder count and making a torrent look healthier than it was. Such a peer now stays in the swarm, counts as a leecher, and banks no seed time towards a hit-and-run requirement it cannot meet. Non-compact responses stay unsupported, and the guide now says so instead of leaving it to be discovered. See [UDP tracker](./udp-tracker.md).
diff --git a/doc/guide/scaling.md b/doc/guide/scaling.md
index cbf35e62..87fcae86 100644
--- a/doc/guide/scaling.md
+++ b/doc/guide/scaling.md
@@ -380,11 +380,16 @@ Not throughput. Two things:
 Adding a read replica does nothing for either. Both are properties of the write
 path, and both are fixed in the schema and in the announce handler.
 
-**Still not done — batching the stat increments.** Accumulate deltas in Redis
-and flush periodically in one multi-row `UPDATE`. It is the change that turns
-per-announce writes into grouped transactions, and it moves the crash-loss
-window from "one announce" to "one flush interval" — a trade to make
-deliberately rather than by accident.
+**Done — batching the stat increments.** The tracker adds each credit to an
+accumulator in Redis and pours it into `users` once a minute
+(`TRACKER_STATS_FLUSH_INTERVAL`), ten rows per transaction
+(`TRACKER_STATS_FLUSH_CHUNK`) — `apps/tracker/internal/stats/stats.go`. Measured
+at 50 000 members over five minutes: 2.7× less WAL and 26× fewer statements at
+a 60 s window. In chunks, not one transaction: a single `UPDATE` of 45 000 rows
+defeats HOT pruning and wrote *more* WAL than the per-announce writes it
+replaced. A chunk is taken out of Redis atomically and put back if its write
+fails, so the loss window is Redis's own (one second of AOF), not the flush
+interval; without Redis the credit is written directly, as before.
 
 **Done — the passkey lookup is cached.** `FindUserByPasskey` runs on every
 announce before anything else, and a duplicate announce cannot avoid it: the
@@ -665,7 +670,7 @@ Two traps that will waste an afternoon:
 - **An announce that fails still returns HTTP 200**, with a bencoded
   `failure reason` in the body. Read the body, never the status.
 - **Announces less than a second apart credit nothing at all.**
-  `maxByElapsed = 80 MiB × (elapsed_ms / 1000)` truncates to whole seconds, so a
+  `maxByElapsed = 1 GiB × (elapsed_ms / 1000)` truncates to whole seconds, so a
   sub-second gap allows zero bytes. Wait between the baseline and the credited
   announce or the experiment measures nothing and looks like a pass.
 
diff --git a/doc/guide/security.md b/doc/guide/security.md
index c9517179..88fc907f 100644
--- a/doc/guide/security.md
+++ b/doc/guide/security.md
@@ -20,10 +20,15 @@ Trackarr implements distributed rate limiting to prevent abuse:
 |----------|-------|-----------------|
 | Public API | 100/min | 100+ req/10s → auto-block |
 | Mutations | 10/min | Progressive penalties |
-| Auth | 5/5min | IP blacklisted after violations |
+| Password sign-in | 10/5min per address | `429`, nothing more |
+| Sign-in, per account | 10 failures/15min per username | `429` for that username, except on its known browsers |
+| Sign-in, per known browser | 10 failures/15min | That browser is no longer known |
+| Other auth (register, 2FA, password change) | 5/5min | IP blacklisted after violations |
 | Tracker | 200/min | Distributed sliding window |
 
-Every counter above is keyed on the **client** IP, which requires
+Every counter above but the per-account one is keyed on the **client** IP —
+its /64 for IPv6, the smallest block a subscriber is handed, since one host can
+pick a fresh address in it for every request. That requires
 `TRUST_PROXY=true` behind a reverse proxy — see
 [Configuration](./configuration.md). The one exception is the web container's
 own server-side rendering when nothing sits in front of it: those calls carry
@@ -76,11 +81,45 @@ profile page.
 
 ### Failures are the interesting half
 
-There is **no per-account lockout** on this site. Throttling is entirely per IP,
-so an attempt spread across addresses meets nothing at all. This table is what
-makes such an attempt visible afterwards even though nothing stopped it at the
-time — a run of refusals against one account, from addresses that differ, is a
-shape worth recognising.
+Password sign-in is held back two ways. Per address, ten attempts in five
+minutes, after which that address waits — and nothing more: sign-in used to
+share the strict `auth` bucket, whose sixth failure blacklisted the whole
+address, so on a VPN exit or a carrier NAT one stranger mistyping a password
+shut every member behind it out of the site. Per account, ten failures in
+fifteen minutes hold that username out of password sign-in for the rest of the
+window, from every address — the answer a guess spread over many addresses
+used to meet nowhere. Failures are counted for every username, existing or
+not, so a lockout never tells whether an account exists. Its open sessions are
+untouched.
+
+That lockout spares the member's own browsers. A browser that completes a
+sign-in — the password, and the second factor if the account has one — or a
+registration receives a **known-device cookie** (`trackarr_kd`, kept six
+months). On that browser the account's count does not apply: the browser
+answers to a count of its own, and ten failures there revoke its cookie for
+good, after which it is a browser like any other. Someone failing on purpose can
+still shut an account to new devices for the window, but no longer to the ones
+its member already uses — where before, one failure every ninety seconds kept
+the account shut everywhere, the right password included. Guessing gains
+nothing: a guesser never holds a valid cookie.
+
+The cookie skips nothing — not the password, not the second factor, not the
+per-address limit — which sets it apart from the opt-in *Trust this browser*
+cookie of [two-factor authentication](./two-factor-auth.md#trusted-devices-optional).
+It is stateless, an HMAC over the account, its session epoch and its stored
+verifier, so *Sign out everywhere*, a ban or a password change voids every one
+at once; Redis keeps only a failure count per device and the ids revoked. A
+successful sign-in from a browser that is not known clears the account's count;
+one from a known browser leaves it, since those failures came from somewhere
+else.
+
+Every refusal of credentials takes at least 300 ms, whatever its cause. A
+username with no account and a wrong password already got the same status and
+message, but not the same work — the second reads the account and hashes —
+and the few milliseconds between them told which usernames exist.
+
+This table is what makes an attempt visible afterwards — a run of refusals
+against one account, from addresses that differ, is a shape worth recognising.
 
 ### What the address column can and cannot tell you
 
diff --git a/doc/guide/seed-bonus.md b/doc/guide/seed-bonus.md
index 29c927db..60b6b464 100644
--- a/doc/guide/seed-bonus.md
+++ b/doc/guide/seed-bonus.md
@@ -75,10 +75,15 @@ Tiered curves are a first-class concept: every rule carries an array of
 custom code. The curves render as live previews in the admin UI so an
 operator can see the shape before saving.
 
-Granting happens on the announce hot path — every `event != stopped`
-seeder pings update the per-user accumulator, which a periodic batch
-flushes to `users.bonusPoints`. The accumulator is in Redis so a tracker
-restart doesn't drop in-flight points.
+Granting happens off the announce path, in the API's bonus collector
+(`apps/api/plugins/bonus-collector.ts`): once an hour
+(`BONUS_COLLECTION_INTERVAL`), under a cross-replica lock, it walks the
+swarms in Redis, credits each member for the torrents they seed, and records
+one-shot grants in a ledger so a rerun never pays twice. A seeder counts only
+while it is still announcing — seen within the last hour, the tracker's own
+notion of "in the swarm". A peer entry lives 24 h in Redis, and before that
+check a single `left=0` announce a day on a torrent nobody seeds was paid as a
+full day of seeding, rarity and first-seeder multipliers included.
 
 ## Admin levers
 
diff --git a/doc/guide/two-factor-auth.md b/doc/guide/two-factor-auth.md
index 528cba2d..38c40e3c 100644
--- a/doc/guide/two-factor-auth.md
+++ b/doc/guide/two-factor-auth.md
@@ -25,7 +25,11 @@ The user can rename or revoke individual passkeys, regenerate the recovery code
 
 When a user opts in (`Trust this browser` toggle in settings), completing a 2FA challenge also issues a long-lived **trusted-device cookie** (sha-256-hashed token, 30-day TTL). The next login from the same browser skips the 2FA step entirely. The toggle is **off by default** so the high-security stance stays in place for users who don't ask for the convenience.
 
-The user can list and revoke individual devices from `/settings#security` ("Trusted devices" tab).
+The user can list and revoke individual devices from `/settings#security` ("Trusted devices" tab). Changing the password and *Sign out everywhere* both revoke every one of them — the latter did not until October 2026, so a compromised device kept skipping the second factor at its next password sign-in.
+
+Not to be confused with the **known-device cookie** (`trackarr_kd`) that every browser receives after a complete sign-in, opted in or not. That one skips nothing: it only exempts the browser from the per-account sign-in lockout — see [Security](./security.md#failures-are-the-interesting-half).
+
+A sign-in completed with a passkey opens the same kind of session as one completed with a TOTP code. It used to open one without the account's session epoch: once a member had used *Sign out everywhere*, every passkey sign-in produced a session revoked at its first request.
 
 ## Forced enrolment (admin)
 
diff --git a/doc/guide/udp-tracker.md b/doc/guide/udp-tracker.md
index b142ec0e..47dd05c7 100644
--- a/doc/guide/udp-tracker.md
+++ b/doc/guide/udp-tracker.md
@@ -75,7 +75,8 @@ the file's announce list:
 
 - **Tier 0** — `http://host/announce?passkey=…` *(always)*
 - **Tier 1** — `udp://host:6969/announce/…` *(only when `TRACKER_UDP_ENABLED`
-  is true on the tracker AND `NUXT_PUBLIC_TRACKER_UDP_URL` is set)*
+  is true AND `NUXT_PUBLIC_TRACKER_UDP_URL` is set — both read by the API,
+  which builds the file)*
 
 Each tier is a separate BEP 12 list, which means clients try them
 **independently** rather than treating UDP as a fallback for HTTP. If you
@@ -84,10 +85,16 @@ it — clients won't waste announces on a dead endpoint.
 
 ## Operator configuration
 
+UDP is **off** in `docker-compose.prod.yml` and in the Helm chart
+(`tracker.udp.enabled: false`): the stack publishes `6969/udp`, but the
+listener only starts, and `.torrent` files only carry the UDP tier, once you
+turn it on. The binaries themselves default to on, for a tracker run outside
+those two.
+
 ```bash
-# Tracker (apps/tracker)
+# Tracker (apps/tracker) and API (apps/api) — the same value for both
+TRACKER_UDP_ENABLED=true       # Off in compose and Helm; the binaries default to on.
 TRACKER_UDP_PORT=6969          # Default. The de-facto BEP 15 port.
-TRACKER_UDP_ENABLED=true       # Default. Set to "false" to disable the listener.
 TRACKER_UDP_SCRAPE_ENABLED=true # Default. "false" closes UDP scrape, keeps announce.
 
 # Web / API (NUXT_PUBLIC_*) — surfaced in /api/runtime-config and
@@ -95,15 +102,20 @@ TRACKER_UDP_SCRAPE_ENABLED=true # Default. "false" closes UDP scrape, keeps anno
 NUXT_PUBLIC_TRACKER_UDP_URL=udp://tracker.example.com:6969/announce
 ```
 
-`TRACKER_UDP_ENABLED` is read by **three** processes:
+`TRACKER_UDP_ENABLED` is read in three places, by two processes:
 
 1. `apps/tracker` — controls the listener.
 2. `apps/api` — `/api/stats/public` reports the matrix; the homepage tile
    reflects reality.
-3. `apps/api` — `/api/torrents/[hash]/download` only adds the UDP tier
-   when this is true.
+3. `apps/api` — `/api/torrents/[hash]/download` and the Torznab download
+   only add the UDP tier when this is true.
 
-So flipping the env var in one place keeps all three honest.
+`docker-compose.prod.yml` and the Helm chart hand both processes the same
+value, so setting it once — in `.env`, or `tracker.udp.enabled` in the chart's
+values — keeps all three honest. Until they did, only the tracker received it:
+the API fell back to its default of `true`, and every `.torrent` advertised a
+UDP endpoint that a default install never served. If you run the tracker
+outside those two, give the API the same value.
 
 ### Reverse-proxy reality
 
@@ -188,10 +200,10 @@ incoming packet, so reflection nets the attacker a negative gain.
 TRACKER_UDP_ENABLED=false
 ```
 
-Restart the tracker container. The listener will stay down, the homepage
-tile will read `UDP — Offline`, the next `.torrent` download won't include
-a UDP tier, and clients that were already announcing on UDP will time out
-once and fall back to HTTP.
+Recreate the tracker and API containers — both read it. The listener will
+stay down, the homepage tile will read `UDP — Offline`, the next `.torrent`
+download won't include a UDP tier, and clients that were already announcing
+on UDP will time out once and fall back to HTTP.
 
 ## Troubleshooting
 
diff --git a/doc/guide/upgrading.md b/doc/guide/upgrading.md
index dbef5ad9..48e77185 100644
--- a/doc/guide/upgrading.md
+++ b/doc/guide/upgrading.md
@@ -65,7 +65,7 @@ getting out of a hole rather than for normal use.
 ## Upgrading to PostgreSQL 18 and Redis 8
 
 The compose files moved from `postgres:16-alpine` to `postgres:18.6-alpine` and
-from `redis:7` to `redis:8.10.1-alpine`. One of those is a restart. The other is
+from `redis:7` to `redis:8.10.2-alpine`. One of those is a restart. The other is
 not.
 
 ### Redis 8 is a restart
diff --git a/doc/guide/zero-knowledge-auth.md b/doc/guide/zero-knowledge-auth.md
index 8b452ca9..94557010 100644
--- a/doc/guide/zero-knowledge-auth.md
+++ b/doc/guide/zero-knowledge-auth.md
@@ -69,9 +69,9 @@ Trackarr uses a **Zero-Knowledge** authentication system where the server **neve
 
 Your password never leaves your device. Only cryptographic proofs derived from your password are sent to the server. Even if an attacker intercepts the network traffic, they cannot recover your password.
 
-### PBKDF2 with 100k Iterations
+### PBKDF2 with 600k Iterations
 
-Password-Based Key Derivation Function 2 (PBKDF2) with 100,000 iterations makes brute-force attacks computationally expensive. Each password guess requires significant CPU time.
+Password-Based Key Derivation Function 2 (PBKDF2-SHA256) with 600,000 iterations — the OWASP 2023 figure — makes brute-force attacks computationally expensive. Each password guess requires significant CPU time; on the member's side it costs a few hundred milliseconds per sign-in (`apps/web/app/utils/crypto.ts`).
 
 ### Unique Challenge Per Login
 
@@ -88,6 +88,8 @@ Registration requires solving a computational puzzle (Proof of Work). This:
 - Stops spam registrations
 - Makes bot attacks expensive
 
+The puzzle asks for five leading hex zeros: about a million SHA-256 hashes on average, some six seconds in a desktop browser (measured at ~175,000 WebCrypto hashes/s) and several times that on a phone — and the count is luck, so some take much longer. The browser keeps at it for up to four minutes, inside the challenge's five-minute life; it used to give up after one, which a slow phone could miss.
+
 ## What the Server Stores
 
 The server only stores:
diff --git a/doc/integrations/torznab.md b/doc/integrations/torznab.md
index e38da265..11513140 100644
--- a/doc/integrations/torznab.md
+++ b/doc/integrations/torznab.md
@@ -11,16 +11,27 @@ Torznab is an extension of the Newznab API tailored for torrent indexers. It pro
 - 🔍 **Full-text search** with category filtering
 - 📺 **TV search** with season/episode parsing
 - 🎬 **Movie search** with IMDB support
-- 🔐 **Passkey authentication** for secure API access
+- 🔐 **Read-key authentication** — the RSS / Torznab key reads the catalogue and cannot announce
 - 📦 **Personalized downloads** with announce URL injection
 
 ## Setup with Prowlarr
 
-### Step 1: Get Your Passkey
+### Step 1: Get your RSS / Torznab key
 
-1. Log in to Trackarr
-2. Click your username in the top-right → **Passkey**
-3. Copy your **Passkey** (40-character hex string)
+1. Log in to Trackarr and open your profile page (`/me`)
+2. In **Tracker credentials**, find **RSS / Torznab key**
+3. Reveal it and copy it
+
+Not the passkey. The passkey is what announces — what credits your ratio — and
+an \*arr app has no use for it: the `.torrent` files it downloads already carry
+it. Handing it to a third-party app hands over the one credential that acts as
+you on the tracker. See [Keys](../guide/api-keys.md).
+
+::: tip Older setups
+An indexer configured with the passkey keeps working for as long as the
+operator leaves *passkey access to feeds* on (the default). Move it to the RSS
+key: when that access is turned off, a passkey-configured indexer stops.
+:::
 
 ### Step 2: Add Indexer in Prowlarr
 
@@ -28,11 +39,14 @@ Torznab is an extension of the Newznab API tailored for torrent indexers. It pro
 2. Select **Generic Torznab**
 3. Configure:
 
-| Field   | Value                                  |
-| ------- | -------------------------------------- |
-| Name    | `Trackarr`                             |
-| URL     | `https://your-tracker.com/api/torznab` |
-| API Key | Your passkey from Step 1               |
+| Field   | Value                                      |
+| ------- | ------------------------------------------ |
+| Name    | `Trackarr`                                 |
+| URL     | `https://your-tracker.com/api/torznab/api` |
+| API Key | Your RSS / Torznab key from Step 1         |
+
+Or skip the form: your profile page offers a ready-made Prowlarr definition
+for this tracker (see [below](#prowlarr-a-ready-made-indexer-definition)).
 
 4. Click **Test** to verify the connection
 5. Click **Save**
@@ -46,7 +60,7 @@ Prowlarr will automatically sync Trackarr as an indexer to your connected Sonarr
 All endpoints are accessed via a single base URL with function parameters:
 
 ```
-GET /api/torznab?t={function}&apikey={passkey}&...
+GET /api/torznab/api?t={function}&apikey={rss_key}&...
 ```
 
 ### Capabilities (`t=caps`)
@@ -54,7 +68,7 @@ GET /api/torznab?t={function}&apikey={passkey}&...
 Returns XML describing indexer capabilities. No authentication required.
 
 ```bash
-curl "https://your-tracker.com/api/torznab?t=caps"
+curl "https://your-tracker.com/api/torznab/api?t=caps"
 ```
 
 **Response:** XML with supported search types and categories.
@@ -64,7 +78,7 @@ curl "https://your-tracker.com/api/torznab?t=caps"
 General torrent search.
 
 ```bash
-curl "https://your-tracker.com/api/torznab?t=search&apikey=YOUR_PASSKEY&q=ubuntu"
+curl "https://your-tracker.com/api/torznab/api?t=search&apikey=YOUR_RSS_KEY&q=ubuntu"
 ```
 
 | Parameter | Type    | Required | Description                          |
@@ -79,7 +93,7 @@ curl "https://your-tracker.com/api/torznab?t=search&apikey=YOUR_PASSKEY&q=ubuntu
 Search with TV-specific parameters.
 
 ```bash
-curl "https://your-tracker.com/api/torznab?t=tvsearch&apikey=YOUR_PASSKEY&q=Breaking+Bad&season=1&ep=1"
+curl "https://your-tracker.com/api/torznab/api?t=tvsearch&apikey=YOUR_RSS_KEY&q=Breaking+Bad&season=1&ep=1"
 ```
 
 | Parameter | Type   | Description    |
@@ -92,7 +106,7 @@ curl "https://your-tracker.com/api/torznab?t=tvsearch&apikey=YOUR_PASSKEY&q=Brea
 Search with movie-specific parameters.
 
 ```bash
-curl "https://your-tracker.com/api/torznab?t=movie&apikey=YOUR_PASSKEY&imdbid=tt0111161"
+curl "https://your-tracker.com/api/torznab/api?t=movie&apikey=YOUR_RSS_KEY&imdbid=tt0111161"
 ```
 
 | Parameter | Type   | Description                 |
@@ -101,10 +115,11 @@ curl "https://your-tracker.com/api/torznab?t=movie&apikey=YOUR_PASSKEY&imdbid=tt
 
 ### Download
 
-Download a torrent file with your passkey embedded.
+Download a torrent file. The request takes your RSS key; the file it returns
+carries your announce passkey, which is what lets your client announce.
 
 ```bash
-curl -O "https://your-tracker.com/api/torznab/download?id=INFO_HASH&apikey=YOUR_PASSKEY"
+curl -O "https://your-tracker.com/api/torznab/download?id=INFO_HASH&apikey=YOUR_RSS_KEY"
 ```
 
 ## Federated releases (opt-in)
@@ -266,8 +281,11 @@ Errors are returned as XML:
 
 ## Security Notes
 
-- **HTTPS Only**: Always use HTTPS to protect your passkey
-- **Passkey = Identity**: Treat your passkey as a secret; anyone with it can download as you
+- **HTTPS Only**: Always use HTTPS — the key travels in the URL
+- **The RSS key still exposes the passkey**: it cannot announce, but anyone holding
+  it can download `.torrent` files, and every one of them carries your announce
+  passkey. Keep it as secret as the passkey, and rotate it from your profile if it
+  leaks (then rotate the passkey too)
 - **Rate Limits**: API is rate limited to prevent abuse (see below)
 
 ## Rate Limits
@@ -358,7 +376,8 @@ unchanged.
 
 ### "Incorrect user credentials" error
 
-- Verify your passkey is correct (40 hex characters)
+- Verify you pasted the **RSS / Torznab key**, not the passkey — the passkey only
+  works on feeds while the operator allows it
 - Check that your account is not banned
 - Ensure you're using the correct tracker URL
 
diff --git a/doc/package-lock.json b/doc/package-lock.json
index 57c0a29f..8f007b55 100644
--- a/doc/package-lock.json
+++ b/doc/package-lock.json
@@ -8,10 +8,10 @@
       "name": "trackarr-docs",
       "version": "1.0.0",
       "devDependencies": {
-        "@tailwindcss/vite": "^4.3.0",
-        "tailwindcss": "^4.3.0",
+        "@tailwindcss/vite": "^4.3.3",
+        "tailwindcss": "^4.3.3",
         "vitepress": "^1.6.4",
-        "vue": "^3.5.42"
+        "vue": "^3.5.44"
       }
     },
     "node_modules/@algolia/abtesting": {
@@ -374,9 +374,9 @@
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
-      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.2.tgz",
+      "integrity": "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==",
       "cpu": [
         "ppc64"
       ],
@@ -391,9 +391,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
-      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.2.tgz",
+      "integrity": "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==",
       "cpu": [
         "arm"
       ],
@@ -408,9 +408,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
-      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.2.tgz",
+      "integrity": "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==",
       "cpu": [
         "arm64"
       ],
@@ -425,9 +425,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
-      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.2.tgz",
+      "integrity": "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==",
       "cpu": [
         "x64"
       ],
@@ -442,9 +442,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
-      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.2.tgz",
+      "integrity": "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==",
       "cpu": [
         "arm64"
       ],
@@ -459,9 +459,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
-      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.2.tgz",
+      "integrity": "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==",
       "cpu": [
         "x64"
       ],
@@ -476,9 +476,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==",
       "cpu": [
         "arm64"
       ],
@@ -493,9 +493,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.2.tgz",
+      "integrity": "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==",
       "cpu": [
         "x64"
       ],
@@ -510,9 +510,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
-      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.2.tgz",
+      "integrity": "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==",
       "cpu": [
         "arm"
       ],
@@ -527,9 +527,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
-      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.2.tgz",
+      "integrity": "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==",
       "cpu": [
         "arm64"
       ],
@@ -544,9 +544,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
-      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.2.tgz",
+      "integrity": "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==",
       "cpu": [
         "ia32"
       ],
@@ -561,9 +561,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
-      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.2.tgz",
+      "integrity": "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==",
       "cpu": [
         "loong64"
       ],
@@ -578,9 +578,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
-      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.2.tgz",
+      "integrity": "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==",
       "cpu": [
         "mips64el"
       ],
@@ -595,9 +595,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
-      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.2.tgz",
+      "integrity": "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==",
       "cpu": [
         "ppc64"
       ],
@@ -612,9 +612,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
-      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.2.tgz",
+      "integrity": "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==",
       "cpu": [
         "riscv64"
       ],
@@ -629,9 +629,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
-      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.2.tgz",
+      "integrity": "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==",
       "cpu": [
         "s390x"
       ],
@@ -646,9 +646,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
-      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.2.tgz",
+      "integrity": "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==",
       "cpu": [
         "x64"
       ],
@@ -663,9 +663,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==",
       "cpu": [
         "arm64"
       ],
@@ -680,9 +680,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==",
       "cpu": [
         "x64"
       ],
@@ -697,9 +697,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==",
       "cpu": [
         "arm64"
       ],
@@ -714,9 +714,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==",
       "cpu": [
         "x64"
       ],
@@ -731,9 +731,9 @@
       }
     },
     "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
-      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.2.tgz",
+      "integrity": "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==",
       "cpu": [
         "arm64"
       ],
@@ -748,9 +748,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
-      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.2.tgz",
+      "integrity": "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==",
       "cpu": [
         "x64"
       ],
@@ -765,9 +765,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
-      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.2.tgz",
+      "integrity": "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==",
       "cpu": [
         "arm64"
       ],
@@ -782,9 +782,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
-      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.2.tgz",
+      "integrity": "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==",
       "cpu": [
         "ia32"
       ],
@@ -799,9 +799,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
-      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.2.tgz",
+      "integrity": "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==",
       "cpu": [
         "x64"
       ],
@@ -1359,49 +1359,49 @@
       "license": "MIT"
     },
     "node_modules/@tailwindcss/node": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.0.tgz",
-      "integrity": "sha512-aFb4gUhFOgdh9AXo4IzBEOzBkkAxm9VigwDJnMIYv3lcfXCJVesNfbEaBl4BNgVRyid92AmdviqwBUBRKSeY3g==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz",
+      "integrity": "sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/remapping": "^2.3.5",
-        "enhanced-resolve": "^5.21.0",
-        "jiti": "^2.6.1",
+        "enhanced-resolve": "^5.24.1",
+        "jiti": "^2.7.0",
         "lightningcss": "1.32.0",
         "magic-string": "^0.30.21",
         "source-map-js": "^1.2.1",
-        "tailwindcss": "4.3.0"
+        "tailwindcss": "4.3.3"
       }
     },
     "node_modules/@tailwindcss/oxide": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.0.tgz",
-      "integrity": "sha512-F7HZGBeN9I0/AuuJS5PwcD8xayx5ri5GhjYUDBEVYUkexyA/giwbDNjRVrxSezE3T250OU2K/wp/ltWx3UOefg==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.3.tgz",
+      "integrity": "sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 20"
       },
       "optionalDependencies": {
-        "@tailwindcss/oxide-android-arm64": "4.3.0",
-        "@tailwindcss/oxide-darwin-arm64": "4.3.0",
-        "@tailwindcss/oxide-darwin-x64": "4.3.0",
-        "@tailwindcss/oxide-freebsd-x64": "4.3.0",
-        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.0",
-        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.0",
-        "@tailwindcss/oxide-linux-arm64-musl": "4.3.0",
-        "@tailwindcss/oxide-linux-x64-gnu": "4.3.0",
-        "@tailwindcss/oxide-linux-x64-musl": "4.3.0",
-        "@tailwindcss/oxide-wasm32-wasi": "4.3.0",
-        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.0",
-        "@tailwindcss/oxide-win32-x64-msvc": "4.3.0"
+        "@tailwindcss/oxide-android-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-x64": "4.3.3",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.3",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.3",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.3",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.3",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.3"
       }
     },
     "node_modules/@tailwindcss/oxide-android-arm64": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.0.tgz",
-      "integrity": "sha512-TJPiq67tKlLuObP6RkwvVGDoxCMBVtDgKkLfa/uyj7/FyxvQwHS+UOnVrXXgbEsfUaMgiVvC4KbJnRr26ho4Ng==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.3.tgz",
+      "integrity": "sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==",
       "cpu": [
         "arm64"
       ],
@@ -1416,9 +1416,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-arm64": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.0.tgz",
-      "integrity": "sha512-oMN/WZRb+SO37BmUElEgeEWuU8E/HXRkiODxJxLe1UTHVXLrdVSgfaJV7pSlhRGMSOiXLuxTIjfsF3wYvz8cgQ==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.3.tgz",
+      "integrity": "sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==",
       "cpu": [
         "arm64"
       ],
@@ -1433,9 +1433,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-x64": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.0.tgz",
-      "integrity": "sha512-N6CUmu4a6bKVADfw77p+iw6Yd9Q3OBhe0veaDX+QazfuVYlQsHfDgxBrsjQ/IW+zywL8mTrNd0SdJT/zgtvMdA==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.3.tgz",
+      "integrity": "sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==",
       "cpu": [
         "x64"
       ],
@@ -1450,9 +1450,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-freebsd-x64": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.0.tgz",
-      "integrity": "sha512-zDL5hBkQdH5C6MpqbK3gQAgP80tsMwSI26vjOzjJtNCMUo0lFgOItzHKBIupOZNQxt3ouPH7RPhvNhiTfCe5CQ==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.3.tgz",
+      "integrity": "sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==",
       "cpu": [
         "x64"
       ],
@@ -1467,9 +1467,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.0.tgz",
-      "integrity": "sha512-R06HdNi7A7OEoMsf6d4tjZ71RCWnZQPHj2mnotSFURjNLdBC+cIgXQ7l81CqeoiQftjf6OOblxXMInMgN2VzMA==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.3.tgz",
+      "integrity": "sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==",
       "cpu": [
         "arm"
       ],
@@ -1484,9 +1484,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.0.tgz",
-      "integrity": "sha512-qTJHELX8jetjhRQHCLilkVLmybpzNQAtaI/gaoVoidn/ufbNDbAo8KlK2J+yPoc8wQxvDxCmh/5lr8nC1+lTbg==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.3.tgz",
+      "integrity": "sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==",
       "cpu": [
         "arm64"
       ],
@@ -1504,9 +1504,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.0.tgz",
-      "integrity": "sha512-Z6sukiQsngnWO+l39X4pPbiWT81IC+PLKF+PHxIlyZbGNb9MODfYlXEVlFvej5BOZInWX01kVyzeLvHsXhfczQ==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.3.tgz",
+      "integrity": "sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==",
       "cpu": [
         "arm64"
       ],
@@ -1524,9 +1524,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.0.tgz",
-      "integrity": "sha512-DRNdQRpSGzRGfARVuVkxvM8Q12nh19l4BF/G7zGA1oe+9wcC6saFBHTISrpIcKzhiXtSrlSrluCfvMuledoCTQ==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.3.tgz",
+      "integrity": "sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==",
       "cpu": [
         "x64"
       ],
@@ -1544,9 +1544,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-musl": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.0.tgz",
-      "integrity": "sha512-Z0IADbDo8bh6I7h2IQMx601AdXBLfFpEdUotft86evd/8ZPflZe9COPO8Q1vw+pfLWIUo9zN/JGZvwuAJqduqg==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.3.tgz",
+      "integrity": "sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==",
       "cpu": [
         "x64"
       ],
@@ -1564,9 +1564,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-wasm32-wasi": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.0.tgz",
-      "integrity": "sha512-HNZGOUxEmElksYR7S6sC5jTeNGpobAsy9u7Gu0AskJ8/20FR9GqebUyB+HBcU/ax6BHuiuJi+Oda4B+YX6H1yA==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz",
+      "integrity": "sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==",
       "bundleDependencies": [
         "@napi-rs/wasm-runtime",
         "@emnapi/core",
@@ -1582,11 +1582,11 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.10.0",
-        "@emnapi/runtime": "^1.10.0",
-        "@emnapi/wasi-threads": "^1.2.1",
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
         "@napi-rs/wasm-runtime": "^1.1.4",
-        "@tybys/wasm-util": "^0.10.1",
+        "@tybys/wasm-util": "^0.10.2",
         "tslib": "^2.8.1"
       },
       "engines": {
@@ -1594,18 +1594,18 @@
       }
     },
     "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
-      "version": "1.10.0",
+      "version": "1.11.1",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/wasi-threads": "1.2.1",
+        "@emnapi/wasi-threads": "1.2.2",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
+      "version": "1.11.1",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -1615,7 +1615,7 @@
       }
     },
     "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.1",
+      "version": "1.2.2",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -1643,7 +1643,7 @@
       }
     },
     "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
-      "version": "0.10.1",
+      "version": "0.10.2",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -1660,9 +1660,9 @@
       "optional": true
     },
     "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.0.tgz",
-      "integrity": "sha512-Pe+RPVTi1T+qymuuRpcdvwSVZjnll/f7n8gBxMMh3xLTctMDKqpdfGimbMyioqtLhUYZxdJ9wGNhV7MKHvgZsQ==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
+      "integrity": "sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==",
       "cpu": [
         "arm64"
       ],
@@ -1677,9 +1677,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.0.tgz",
-      "integrity": "sha512-Mvrf2kXW/yeW/OTezZlCGOirXRcUuLIBx/5Y12BaPM7wJoryG6dfS/NJL8aBPqtTEx/Vm4T4vKzFUcKDT+TKUA==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.3.tgz",
+      "integrity": "sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==",
       "cpu": [
         "x64"
       ],
@@ -1694,15 +1694,15 @@
       }
     },
     "node_modules/@tailwindcss/vite": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.0.tgz",
-      "integrity": "sha512-t6J3OrB5Fc0ExuhohouH0fWUGMYL6PTLhW+E7zIk/pdbnJARZDCwjBznFnkh5ynRnIRSI4YjtTH0t6USjJISrw==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.3.tgz",
+      "integrity": "sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@tailwindcss/node": "4.3.0",
-        "@tailwindcss/oxide": "4.3.0",
-        "tailwindcss": "4.3.0"
+        "@tailwindcss/node": "4.3.3",
+        "@tailwindcss/oxide": "4.3.3",
+        "tailwindcss": "4.3.3"
       },
       "peerDependencies": {
         "vite": "^5.2.0 || ^6 || ^7 || ^8"
@@ -2189,9 +2189,9 @@
       "license": "MIT"
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.21.2",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.2.tgz",
-      "integrity": "sha512-xe9vQb5kReirPUxgQrXA3ihgbCqssmTiM7cOZ+Gzu+VeGWgpV98lLZvp0dl4yriyAePcewxGUs9UpKD8PET9KQ==",
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.26.0.tgz",
+      "integrity": "sha512-9vhedylFonb2YGogzUKX6+Ja72gOJbN1QHAqdrvqLwhdl/QWbKopzoUC9EbQNVsAns/bx/4uyqalrQAoy1IByw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2216,9 +2216,9 @@
       }
     },
     "node_modules/esbuild": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
-      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
+      "integrity": "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -2229,32 +2229,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.1",
-        "@esbuild/android-arm": "0.28.1",
-        "@esbuild/android-arm64": "0.28.1",
-        "@esbuild/android-x64": "0.28.1",
-        "@esbuild/darwin-arm64": "0.28.1",
-        "@esbuild/darwin-x64": "0.28.1",
-        "@esbuild/freebsd-arm64": "0.28.1",
-        "@esbuild/freebsd-x64": "0.28.1",
-        "@esbuild/linux-arm": "0.28.1",
-        "@esbuild/linux-arm64": "0.28.1",
-        "@esbuild/linux-ia32": "0.28.1",
-        "@esbuild/linux-loong64": "0.28.1",
-        "@esbuild/linux-mips64el": "0.28.1",
-        "@esbuild/linux-ppc64": "0.28.1",
-        "@esbuild/linux-riscv64": "0.28.1",
-        "@esbuild/linux-s390x": "0.28.1",
-        "@esbuild/linux-x64": "0.28.1",
-        "@esbuild/netbsd-arm64": "0.28.1",
-        "@esbuild/netbsd-x64": "0.28.1",
-        "@esbuild/openbsd-arm64": "0.28.1",
-        "@esbuild/openbsd-x64": "0.28.1",
-        "@esbuild/openharmony-arm64": "0.28.1",
-        "@esbuild/sunos-x64": "0.28.1",
-        "@esbuild/win32-arm64": "0.28.1",
-        "@esbuild/win32-ia32": "0.28.1",
-        "@esbuild/win32-x64": "0.28.1"
+        "@esbuild/aix-ppc64": "0.28.2",
+        "@esbuild/android-arm": "0.28.2",
+        "@esbuild/android-arm64": "0.28.2",
+        "@esbuild/android-x64": "0.28.2",
+        "@esbuild/darwin-arm64": "0.28.2",
+        "@esbuild/darwin-x64": "0.28.2",
+        "@esbuild/freebsd-arm64": "0.28.2",
+        "@esbuild/freebsd-x64": "0.28.2",
+        "@esbuild/linux-arm": "0.28.2",
+        "@esbuild/linux-arm64": "0.28.2",
+        "@esbuild/linux-ia32": "0.28.2",
+        "@esbuild/linux-loong64": "0.28.2",
+        "@esbuild/linux-mips64el": "0.28.2",
+        "@esbuild/linux-ppc64": "0.28.2",
+        "@esbuild/linux-riscv64": "0.28.2",
+        "@esbuild/linux-s390x": "0.28.2",
+        "@esbuild/linux-x64": "0.28.2",
+        "@esbuild/netbsd-arm64": "0.28.2",
+        "@esbuild/netbsd-x64": "0.28.2",
+        "@esbuild/openbsd-arm64": "0.28.2",
+        "@esbuild/openbsd-x64": "0.28.2",
+        "@esbuild/openharmony-arm64": "0.28.2",
+        "@esbuild/sunos-x64": "0.28.2",
+        "@esbuild/win32-arm64": "0.28.2",
+        "@esbuild/win32-ia32": "0.28.2",
+        "@esbuild/win32-x64": "0.28.2"
       }
     },
     "node_modules/estree-walker": {
@@ -2814,9 +2814,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.18",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
-      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
+      "version": "3.3.20",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz",
+      "integrity": "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==",
       "dev": true,
       "funding": [
         {
@@ -2872,9 +2872,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.26",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
-      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
+      "version": "8.5.31",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.31.tgz",
+      "integrity": "sha512-YUbWYCgErwnMAVkjUnYa+KlMBzGpHwiIt/DE7f0G33AuX2LH9UcTk6KgWxd3zRU+pN3u/C+Xl3EnMLM4Hea7Sg==",
       "dev": true,
       "funding": [
         {
@@ -2892,9 +2892,9 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.17",
+        "nanoid": "^3.3.20",
         "picocolors": "^1.1.1",
-        "source-map-js": "^1.2.1"
+        "source-map-js": "^1.2.2"
       },
       "engines": {
         "node": "^10 || ^12 || >=14"
@@ -3093,9 +3093,9 @@
       "license": "MIT"
     },
     "node_modules/tailwindcss": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.0.tgz",
-      "integrity": "sha512-y6nxMGB1nMW9R6k96e5gdIFzcfL/gTJRNaqGes1YvkLnPVXzWgbqFF2yLC0T8G774n24cx3Pe8XrKoniCOAH+Q==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.3.tgz",
+      "integrity": "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==",
       "dev": true,
       "license": "MIT"
     },
diff --git a/doc/package.json b/doc/package.json
index 50b3b867..5e24107f 100644
--- a/doc/package.json
+++ b/doc/package.json
@@ -8,15 +8,18 @@
     "preview": "vitepress preview"
   },
   "devDependencies": {
-    "@tailwindcss/vite": "^4.3.0",
-    "tailwindcss": "^4.3.0",
+    "@tailwindcss/vite": "^4.3.3",
+    "tailwindcss": "^4.3.3",
     "vitepress": "^1.6.4",
-    "vue": "^3.5.42"
+    "vue": "^3.5.44"
   },
   "overrides": {
-    "esbuild": "^0.28.1",
+    "esbuild": "^0.28.2",
     "vite": "^7.3.7",
-    "postcss": "^8.5.23",
+    "postcss": "^8.5.31",
     "source-map-js": "^1.2.2"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }
diff --git a/doc/reference/api.md b/doc/reference/api.md
index 3bd4fe2c..9ed65a7b 100644
--- a/doc/reference/api.md
+++ b/doc/reference/api.md
@@ -37,12 +37,26 @@ GET /announce?info_hash=...&peer_id=...&port=...
 
 Passkey is read from the path (`/announce/PASSKEY`) **or** the `?passkey=` query parameter. Response is the standard bencoded peer list.
 
+What the answer depends on, over both transports:
+
+| Situation | Answer |
+| --- | --- |
+| The announcer is a seeder (`left=0`) | Leechers only — a seeder has nothing to fetch from another. `complete` / `incomplete` still count the whole swarm |
+| A member's sixth live client session on one torrent | Accepted; their oldest entry is evicted. Five per member per torrent |
+| A `peer_id` another member is announcing under | Served from an entry of its own (`peer_id:user_id`); neither member can read, overwrite or remove the other's |
+| 120 unknown passkeys from one address within a minute (an IPv6 /64 counts as one) | `Too many invalid requests, retry later` for the rest of that minute, valid passkeys included. Counted per tracker replica |
+| Redis unreachable | No peers, `interval` 300 and `min interval` 60, so clients come back soon after it does; nothing is credited |
+
 ### UDP announce (BEP 15) — `:6969/udp`
 
 Stateless connect-then-announce. Passkey extracted from the BEP 41 URL_DATA option. See [UDP Tracker](../guide/udp-tracker.md) for the wire format, connection-id HMAC scheme, and reverse-proxy caveats.
 
-::: warning No `/scrape`, no `wss://`
-The tracker does not currently implement a multi-hash scrape endpoint or the WebTorrent (WebSocket) announce path. Don't advertise a `wss://` URL or a scrape URL in `.torrent` files — clients will hang.
+### HTTP scrape (BEP 48) — `GET /scrape`
+
+Up to 64 `info_hash` parameters per request, and the **passkey is required** (`?passkey=`): BEP 48 does not ask for one, a private tracker does, or anyone could confirm what the site carries and how popular it is. Clients derive the scrape URL from the announce URL, query string included, so nothing needs configuring. Unknown passkeys count towards the same per-address limit as announces. UDP scrape takes no passkey, by protocol, and can be closed with `TRACKER_UDP_SCRAPE_ENABLED=false`.
+
+::: warning No `wss://`
+The tracker has no WebTorrent (WebSocket) announce path. Don't advertise a `wss://` URL in `.torrent` files — clients will hang on it.
 :::
 
 ## Public (no auth)
@@ -53,6 +67,7 @@ The tracker does not currently implement a multi-hash scrape endpoint or the Web
 | GET    | `/api/branding`               | Site title, tagline, logo URL, favicon URL, feature flags.             |
 | GET    | `/api/runtime-config`         | Public Nuxt runtime config (announce URLs, etc.) for the static SPA.   |
 | GET    | `/api/announcement`           | Operator-set homepage banner (text + level).                           |
+| GET    | `/api/rules`                  | The site rules from Admin → Branding, as HTML (`{ rules }`), shown at `/rules`. |
 | GET    | `/api/homepage-content`       | Featured rails, custom blocks (operator-curated).                      |
 | GET    | `/api/categories`             | Hierarchical category tree.                                            |
 | GET    | `/api/tags`                   | Tag master list (autocomplete source).                                 |
@@ -109,6 +124,7 @@ Zero-Knowledge: the password never leaves the browser. See the [Zero-Knowledge A
 | Method | Path                                  | Auth | Purpose                                                                  |
 | ------ | ------------------------------------- | ---- | ------------------------------------------------------------------------ |
 | GET    | `/api/me`                             | user | Full profile snapshot (KPIs, role badges, bio, locale, theme).           |
+| GET    | `/api/welcome`                        | user | The staff's welcome note (`{ message }`, HTML), shown on the home page.  |
 | PATCH  | `/api/me`                             | user | Update display name, bio, locale, theme, last-seen privacy toggle.       |
 | GET    | `/api/me/downloads`                   | user | `.torrent` downloads + per-download HnR state.                           |
 | GET    | `/api/me/seeds`                       | user | Active seeds with live swarm stats.                                      |
@@ -436,7 +452,7 @@ See [Invitations](../guide/invitations.md).
 
 | Method | Path                          | Purpose                                                              |
 | ------ | ----------------------------- | -------------------------------------------------------------------- |
-| GET    | `/api/admin/panic`            | Encryption state + last-activation timestamp.                        |
+| GET    | `/api/admin/panic`            | Encryption state, last-activation timestamp and `phase` (`idle`, `encrypting`, `encrypted`, `restoring`). |
 | POST   | `/api/admin/panic/encrypt`    | Activate. Body: `{ confirmation: "ENCRYPT_ALL_DATA" }`.              |
 | POST   | `/api/admin/panic/restore`    | Restore. Body: `{ password }`.                                       |
 
diff --git a/doc/reference/env.md b/doc/reference/env.md
index e042d748..9d6be321 100644
--- a/doc/reference/env.md
+++ b/doc/reference/env.md
@@ -24,7 +24,6 @@ The application refuses to start without these. The tracker (Go binary) prints
 | `REDIS_URL`             | api, tracker    | Redis DSN. `redis://` or `rediss://` for TLS. Pair with `REDIS_PASSWORD` when needed.         |
 | `IP_HASH_SECRET`        | api, tracker    | Daily-rotated salt for SHA-256 peer-IP fingerprinting. Also keys the UDP `connection_id` HMAC.|
 | `NUXT_SESSION_SECRET`   | api, web        | h3 sealed-cookie key (iron-webcrypto). 32+ chars. Fallback for `CHANNEL_ENCRYPTION_KEY`.      |
-| `ADMIN_API_KEY`         | api             | Bearer token for internal admin endpoints. The API returns `503` while it is unset.           |
 
 ## Application & runtime
 
@@ -83,17 +82,17 @@ the running app never reads them directly.
 | ------------------------------ | ------------ | -------------------------------- | ---------------------------------------------------------------------- |
 | `TRACKER_HTTP_PORT`            | tracker      | `8080`                           | BEP 3 (HTTP) announce port.                                            |
 | `TRACKER_UDP_PORT`             | tracker      | `6969`                           | BEP 15 (UDP) announce port.                                            |
-| `TRACKER_UDP_ENABLED`          | tracker, api | `true`                           | Toggles the UDP listener **and** UDP-tier inclusion in `.torrent` downloads. Three processes read this: the tracker (listener), the API stats endpoint (`/api/stats/public`), and `/api/torrents/:hash/download`. |
-| `TRACKER_UDP_SCRAPE_ENABLED`   | tracker      | `true`                           | Answers BEP 15 scrape requests. `false` makes the tracker drop them silently — BEP 15 has no field for authentication data in a scrape request, so a private tracker that does not want its swarm sizes published closes the door rather than guarding it. Announce is unaffected. The reference Caddy configuration does not route HTTP `/scrape` either, for the same reason. |
+| `TRACKER_UDP_ENABLED`          | tracker, api | `true`; `false` in compose and Helm | Toggles the UDP listener **and** UDP-tier inclusion in `.torrent` downloads. The tracker reads it for the listener, the API for the stats matrix (`/api/stats/public`) and the files it hands out. Give both the same value — `docker-compose.prod.yml` and the chart do. |
+| `TRACKER_UDP_SCRAPE_ENABLED`   | tracker      | `true`                           | Answers BEP 15 scrape requests. `false` makes the tracker drop them silently — BEP 15 has no field for authentication data in a scrape request, so a private tracker that does not want its swarm sizes published closes the door rather than guarding it. Announce is unaffected. HTTP `/scrape` is another matter: it requires the passkey, like `/announce`, and the reference Caddy configuration routes it on the tracker's subdomain. |
 | `TRACKER_DEBUG`                | tracker      | `false`                          | Verbose announce + dispatch logging.                                   |
 | `TRACKER_PEER_TTL`             | tracker      | `24h`                            | How long a peer's Redis entry survives between announces. Go duration syntax (`24h`, `90m`, `7200s`). Values below `15m` are clamped — anything shorter would zero the delta computation. Raise it for very forgiving deployments; lower it on huge swarms to reclaim Redis memory. |
+| `ANTICHEAT_MAX_BYTES_PER_SECOND` | tracker    | `83886080` (80 MiB/s)            | Upload rate above which an announce is flagged `velocity` for review. It flags, it never refuses: credit has its own ceilings in the code (1 GiB/s per peer and per account). Read once at start-up. |
 | `TRACKER_INTERNAL_URL`         | api          | `http://tracker:8080`            | Internal URL the API hits for `/api/tracker-health`.                   |
 | `TRACKER_HEALTH_URL`           | api          | `TRACKER_INTERNAL_URL`           | Override the health-probe URL specifically.                            |
 | `TRUST_PROXY`                  | api, tracker | `false`                          | Honour `X-Forwarded-For` / `X-Real-IP` for client IP. Set to `true` only behind a *trusted* reverse proxy. The rightmost token is used (the one your proxy appended). |
 | `TRUST_CF_CONNECTING_IP`       | api, tracker | `false`                          | Honour `CF-Connecting-IP`. Keep `false` unless fronted by **Cloudflare** with ingress locked to its IP ranges — otherwise the header is client-spoofable (the Caddyfile strips it by default) and trusting it bypasses IP bans/rate limits. Requires `TRUST_PROXY=true`. |
 | `NUXT_PUBLIC_TRACKER_HTTP_URL` | api, web     | `http://localhost:8080/announce` | Announce URL embedded in `.torrent` files (runtime).                   |
 | `NUXT_PUBLIC_TRACKER_UDP_URL`  | api, web     | unset                            | UDP tier added when `TRACKER_UDP_ENABLED=true` and this URL is set.    |
-| `NUXT_PUBLIC_TRACKER_WS_URL`   | api, web     | unset                            | Reserved; WebTorrent (wss) is **not** implemented yet — don't advertise it. |
 
 ::: tip Tracker tunables aren't env-driven
 Announce interval (`1800` s), min interval (`900` s) and per-response peer cap
@@ -135,7 +134,7 @@ none of these are read.
 | ------------------------- | ------- | -------------------------------- | -------------------------------------------------------------------- |
 | `NUXT_SESSION_SECRET`     | api, web| —                                | **Required**. h3 sealed-cookie key. 32+ chars.                       |
 | `IP_HASH_SECRET`          | api, tracker | —                           | **Required**. Salt for IP fingerprints + UDP connection-id HMAC.    |
-| `ADMIN_API_KEY`           | api     | —                                | **Required**. Bearer token for internal admin endpoints.            |
+| `ADMIN_API_KEY`           | api     | —                                | Optional. Keys the header gate `requireAdmin` (`apps/api/utils/auth.ts`), which no route uses today — the admin panel authenticates by session. Not part of the boot check. |
 | `CHANNEL_ENCRYPTION_KEY`  | api     | falls back to `NUXT_SESSION_SECRET` | AES key for notification-channel configs at rest (SMTP password, Telegram token, VAPID private key). Generate with `openssl rand -hex 32`. |
 | `TRUST_PROXY`             | api, tracker | `false`                     | See *Tracker* — same flag, same semantics, same caveats.            |
 | `TRUST_CF_CONNECTING_IP`  | api, tracker | `false`                     | See *Tracker* — only enable behind Cloudflare with locked ingress.  |
@@ -144,6 +143,13 @@ none of these are read.
 | `CREDENTIAL_ENCRYPTION_SALT` | api  | `trackarr:credentials:v1`        | KDF salt for the key above. **Never change it on a deployment that already holds encrypted credentials** — every account would stop being able to log in. |
 | `FEDERATION_REQUIRE_AUDIENCE` | api | `false`                          | Refuse anything that carries only an audience-less signature — **both** the inbound S2S request signature and a relay's countersignature on a record. Each now binds the recipient's `instanceId`, which stops one partner replaying a signed request, or forwarding a countersignature made for somebody else, to another instance. Until every peer runs a version that emits the bound form, an attacker can strip it and downgrade. Turn this on once all partners are upgraded — turned on too early it silently stops accepting a partner's relayed records. |
 
+`NUXT_SESSION_SECRET`, `IP_HASH_SECRET`, `CREDENTIAL_ENCRYPTION_KEY`,
+`CREDENTIAL_ENCRYPTION_KEY_PREVIOUS` and `CHANNEL_ENCRYPTION_KEY` also accept
+`<NAME>_FILE`, the path of a Docker or Kubernetes secret mount. The API reads
+the file once at boot (`plugins/00.0-secret-files.ts`) and every reader sees
+that value; before, only the boot check read the file, and a deployment using
+`NUXT_SESSION_SECRET_FILE` booted and then failed its first sign-in.
+
 ## Two-factor auth & WebAuthn
 
 | Variable          | Read by | Default                | Purpose                                                                  |
@@ -244,7 +250,8 @@ These were read by previous versions and **no longer have any effect**. If
 you carry them over from a `<= v0.5.x` `.env`, delete them — the new code
 ignores them silently and that's confusing.
 
-- `TRACKER_HTTP_URL`, `TRACKER_UDP_URL`, `TRACKER_WS_URL` → replaced by the `NUXT_PUBLIC_*` variants
+- `TRACKER_HTTP_URL`, `TRACKER_UDP_URL` → replaced by the `NUXT_PUBLIC_*` variants
+- `TRACKER_WS_URL`, `NUXT_PUBLIC_TRACKER_WS_URL` → there is no WebSocket tracker; nothing reads them
 - `NUXT_PUBLIC_SITE_NAME`, `NUXT_PUBLIC_SITE_URL` → site title/URL are now in the `settings` table, edited from `/admin/settings`
 - `NUXT_PUBLIC_ANNOUNCE_URL` → use `NUXT_PUBLIC_TRACKER_HTTP_URL`
 - `POSTGRES_USER`, `POSTGRES_PASSWORD`, `POSTGRES_DB`, `POSTGRES_HOST`, `POSTGRES_PORT` → renamed to `DB_*` to match the compose surface
diff --git a/doc/reference/metrics.md b/doc/reference/metrics.md
index d69186a0..90d4e850 100644
--- a/doc/reference/metrics.md
+++ b/doc/reference/metrics.md
@@ -161,7 +161,7 @@ The contributory pool: members fund a shared pot until the target is hit, then a
 
 ### Default Node.js metrics
 
-`prom-client`'s default collector ships under the `trackarr_` prefix: CPU, heap usage, event-loop lag, GC pauses, etc. (Useful when you want to alert on Node-side trouble.)
+The default collector of `@prometheus-io/client` (the Prometheus project's successor to `prom-client`) ships under the `trackarr_` prefix: CPU, heap usage, event-loop lag and utilisation, GC pauses, etc. (Useful when you want to alert on Node-side trouble.)
 
 ## Example dashboard queries
 
diff --git a/docker-compose.loadtest.yml b/docker-compose.loadtest.yml
index c659f3d6..029a439b 100644
--- a/docker-compose.loadtest.yml
+++ b/docker-compose.loadtest.yml
@@ -21,13 +21,15 @@ services:
       NODE_ENV: production
       DATABASE_URL: postgres://${DB_USER:-tracker}:${DB_PASSWORD:-tracker}@postgres:5432/${DB_NAME:-trackarr}
       DB_SSL: "false"
-      REDIS_URL: redis://redis:6379
+      # The load-test stack's own network: Redis is never published.
+      REDIS_URL: redis://redis:6379  # nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
       REDIS_PASSWORD: ${REDIS_PASSWORD:-loadtest}
       IP_HASH_SECRET: ${IP_HASH_SECRET:-loadtest-ip-hash-secret}
       TRACKER_HTTP_PORT: 8080
       TRACKER_DEBUG: ${TRACKER_DEBUG:-false}
     ports:
-      - "8080:8080"
+      # A local load-test target, meant to be reached from the host.
+      - "8080:8080"  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
     networks:
       - trackarr-loadtest
     depends_on:
@@ -70,7 +72,7 @@ services:
       - trackarr-loadtest
 
   redis:
-    image: redis:8.10.1-alpine
+    image: redis:8.10.2-alpine
     container_name: trackarr-loadtest-redis
     restart: unless-stopped
     command: >
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 982c2489..e57d7129 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -25,7 +25,7 @@ services:
   caddy:
     # Pinned rather than floating on 2-alpine: a rescheduled container should
     # not pull a different Caddy than the one the TLS setup was verified on.
-    image: caddy:2.11.4-alpine
+    image: caddy:2.11.7-alpine
     container_name: trackarr-caddy
     restart: always
     # Caddy already runs from a tight image; lock the rootfs and only
@@ -41,9 +41,10 @@ services:
     security_opt:
       - no-new-privileges:true
     ports:
-      - "80:80"
-      - "443:443"
-      - "443:443/udp" # HTTP/3
+      # Caddy is the public entry point: these ports are meant for every interface.
+      - "80:80"  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
+      - "443:443"  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
+      - "443:443/udp" # HTTP/3 · nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
     environment:
       DOMAIN: ${DOMAIN:-localhost}
       TRACKER_DOMAIN: ${TRACKER_DOMAIN:-tracker.localhost}
@@ -105,8 +106,7 @@ services:
       API_INTERNAL_URL: http://api:4000
       # Tracker URLs displayed to users (read at runtime by Nuxt)
       NUXT_PUBLIC_TRACKER_HTTP_URL: ${NUXT_PUBLIC_TRACKER_HTTP_URL:-https://localhost/announce}
-      NUXT_PUBLIC_TRACKER_UDP_URL: ${NUXT_PUBLIC_TRACKER_UDP_URL:-udp://localhost:6969/announce}
-      NUXT_PUBLIC_TRACKER_WS_URL: ${NUXT_PUBLIC_TRACKER_WS_URL:-ws://localhost:8082}
+      NUXT_PUBLIC_TRACKER_UDP_URL: ${NUXT_PUBLIC_TRACKER_UDP_URL:-}
     expose:
       - "3000"
     networks:
@@ -152,12 +152,14 @@ services:
       NITRO_PORT: 4000
       NITRO_HOST: 0.0.0.0
       # Database (through PgBouncer at runtime)
-      DATABASE_URL: postgres://${DB_USER:-tracker}:${DB_PASSWORD:?DB_PASSWORD must be set in .env — see .env.example}@pgbouncer:6432/${DB_NAME:-trackarr}?sslmode=disable
-      MIGRATIONS_DATABASE_URL: postgres://${DB_USER:-tracker}:${DB_PASSWORD:?DB_PASSWORD must be set in .env — see .env.example}@postgres:5432/${DB_NAME:-trackarr}?sslmode=disable
+      # Postgres behind PgBouncer on the compose network; TLS is DB_SSL's call (doc/guide/configuration.md).
+      DATABASE_URL: postgres://${DB_USER:-tracker}:${DB_PASSWORD:?DB_PASSWORD must be set in .env — see .env.example}@pgbouncer:6432/${DB_NAME:-trackarr}?sslmode=disable  # nosemgrep: trailofbits.generic.postgres-insecure-sslmode.postgres-insecure-sslmode
+      MIGRATIONS_DATABASE_URL: postgres://${DB_USER:-tracker}:${DB_PASSWORD:?DB_PASSWORD must be set in .env — see .env.example}@postgres:5432/${DB_NAME:-trackarr}?sslmode=disable  # nosemgrep: trailofbits.generic.postgres-insecure-sslmode.postgres-insecure-sslmode
       DB_SSL: "false"
       DB_POOL_MAX: ${DB_POOL_MAX:-10}
       # Redis
-      REDIS_URL: redis://redis:6379
+      # Redis on the compose network, never published.
+      REDIS_URL: redis://redis:6379  # nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
       REDIS_PASSWORD: ${REDIS_PASSWORD}
       # Auth/session secrets
       NUXT_SESSION_SECRET: ${NUXT_SESSION_SECRET}
@@ -194,8 +196,11 @@ services:
       # Tracker URLs are also exposed by the API for endpoints like
       # GET /api/torrents/[hash]/download (announce embedded in .torrent files).
       NUXT_PUBLIC_TRACKER_HTTP_URL: ${NUXT_PUBLIC_TRACKER_HTTP_URL:-https://localhost/announce}
-      NUXT_PUBLIC_TRACKER_UDP_URL: ${NUXT_PUBLIC_TRACKER_UDP_URL:-udp://localhost:6969/announce}
-      NUXT_PUBLIC_TRACKER_WS_URL: ${NUXT_PUBLIC_TRACKER_WS_URL:-ws://localhost:8082}
+      NUXT_PUBLIC_TRACKER_UDP_URL: ${NUXT_PUBLIC_TRACKER_UDP_URL:-}
+      # Same value, same default as the tracker below: the API decides whether a
+      # `.torrent` carries the UDP tier, and without it every file advertised a UDP
+      # endpoint (`udp://localhost:6969` by default) that nothing served.
+      TRACKER_UDP_ENABLED: ${TRACKER_UDP_ENABLED:-false}
       # Reached over the internal compose network for /api/tracker-health
       # probes. Override only if the tracker lives outside this stack.
       TRACKER_INTERNAL_URL: ${TRACKER_INTERNAL_URL:-http://tracker:8080}
@@ -251,9 +256,10 @@ services:
       - no-new-privileges:true
     environment:
       NODE_ENV: production
-      DATABASE_URL: postgres://${DB_USER:-tracker}:${DB_PASSWORD:?DB_PASSWORD must be set in .env — see .env.example}@pgbouncer:6432/${DB_NAME:-trackarr}?sslmode=disable
+      # Postgres behind PgBouncer on the compose network; TLS is DB_SSL's call.
+      DATABASE_URL: postgres://${DB_USER:-tracker}:${DB_PASSWORD:?DB_PASSWORD must be set in .env — see .env.example}@pgbouncer:6432/${DB_NAME:-trackarr}?sslmode=disable  # nosemgrep: trailofbits.generic.postgres-insecure-sslmode.postgres-insecure-sslmode
       DB_SSL: "false"
-      REDIS_URL: redis://redis:6379
+      REDIS_URL: redis://redis:6379  # nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
       REDIS_PASSWORD: ${REDIS_PASSWORD}
       IP_HASH_SECRET: ${IP_HASH_SECRET}
       TRACKER_HTTP_PORT: 8080
@@ -285,7 +291,8 @@ services:
     expose:
       - "8080"
     ports:
-      - "6969:6969/udp"
+      # The UDP tracker is public by design.
+      - "6969:6969/udp"  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
     networks:
       # `trackarr-public` retiré : le tracker ne parle qu'à Postgres et à
       # Redis — c'est écrit dans son propre Dockerfile, qui n'embarque même
@@ -328,7 +335,8 @@ services:
     security_opt:
       - no-new-privileges:true
     environment:
-      REDIS_URL: redis://redis:6379
+      # Redis on the compose network, never published.
+      REDIS_URL: redis://redis:6379  # nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
       REDIS_PASSWORD: ${REDIS_PASSWORD}
       # Shared with the API, which mints the tokens this verifies. The two
       # must match or every connection is rejected as forged.
@@ -445,7 +453,7 @@ services:
   pgbouncer:
     # NOTE: consider running non-root + read_only with a tmpfs for its runtime
     # dir once verified against the image (finding L14).
-    image: edoburu/pgbouncer:v1.25.2-p0
+    image: edoburu/pgbouncer:v1.26.1-p0
     container_name: trackarr-pgbouncer
     restart: always
     # Match the privilege reduction every other service in the stack gets —
@@ -500,7 +508,7 @@ services:
     # in-place bump — stop, pull, start. The 8.0 breaking change was ACL
     # categories absorbing the Search/JSON/timeseries commands, and this stack
     # authenticates with requirepass rather than ACLs, so it is unaffected.
-    image: redis:8.10.1-alpine
+    image: redis:8.10.2-alpine
     container_name: trackarr-redis
     restart: always
     # Redis only writes to /data (volume-mounted below) — locking the
@@ -546,8 +554,14 @@ services:
       - "6379"
     volumes:
       - redis_data:/data
+    environment:
+      # Only for the healthcheck below, which hands it to redis-cli through
+      # REDISCLI_AUTH rather than `-a`: an argument shows in `ps` on the host
+      # every thirty seconds. (The server's own `--requirepass` does not — Redis
+      # rewrites its process title to `redis-server *:6379`; measured.)
+      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set in .env — see .env.example}
     healthcheck:
-      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      test: ["CMD-SHELL", "REDISCLI_AUTH=\"$$REDIS_PASSWORD\" redis-cli ping | grep -q PONG"]
       interval: 30s
       timeout: 10s
       retries: 5
diff --git a/docker/caddy/Caddyfile b/docker/caddy/Caddyfile
index 1a03722b..bc3e0eb9 100644
--- a/docker/caddy/Caddyfile
+++ b/docker/caddy/Caddyfile
@@ -187,6 +187,24 @@
 					delete rsskey
 					delete token
 				}
+				# The address, truncated. Every download is a URL carrying its
+				# info hash, so a full address beside it is "who took what" —
+				# the record the app's daily-salted IP hash exists to never
+				# keep, written here for thirty days, and which panic mode does
+				# not touch. A /16 or /32 still points at a network for abuse
+				# work; it no longer points at a member. The headers that repeat
+				# the address behind a CDN go the same way.
+				request>remote_ip ip_mask {
+					ipv4 16
+					ipv6 32
+				}
+				request>client_ip ip_mask {
+					ipv4 16
+					ipv6 32
+				}
+				request>headers>X-Forwarded-For delete
+				request>headers>X-Real-Ip delete
+				request>headers>Cf-Connecting-Ip delete
 			}
 		}
 	}
@@ -236,6 +254,13 @@
 	# Same passkey scrub as on the main domain — every request to this
 	# subdomain is an announce, so every line otherwise carries a
 	# passkey in the URL.
+	#
+	# And no address at all, nor anything that ties one announce to the next:
+	# an announce line is a client's IP beside the info hash it is seeding or
+	# downloading — the swarm membership the tracker itself keeps hashed —
+	# kept with no age limit, out of panic mode's reach. `peer_id` and `key`
+	# identify a client across addresses; `ip`, `ipv4` and `ipv6` are
+	# addresses the client volunteers.
 	log {
 		output file /var/log/caddy/tracker.log {
 			roll_size 100mb
@@ -250,7 +275,17 @@
 					delete apikey
 					delete rsskey
 					delete token
+					delete peer_id
+					delete key
+					delete ip
+					delete ipv4
+					delete ipv6
 				}
+				request>remote_ip delete
+				request>client_ip delete
+				request>headers>X-Forwarded-For delete
+				request>headers>X-Real-Ip delete
+				request>headers>Cf-Connecting-Ip delete
 			}
 		}
 	}
diff --git a/osv-scanner.toml b/osv-scanner.toml
new file mode 100644
index 00000000..024e880c
--- /dev/null
+++ b/osv-scanner.toml
@@ -0,0 +1,13 @@
+# Accepted findings, each with its reason. osv-scanner reads this file next to
+# pnpm-lock.yaml on its own; `ignoreUntil` makes an entry lapse so it gets
+# looked at again. See .trivyignore.yaml for the same decisions on trivy's side.
+
+[[IgnoredVulns]]
+id = "GHSA-86w9-cpqp-85rv"
+ignoreUntil = 2027-01-31
+reason = "node-forge: no fixed release exists (1.4.0 is the latest and the last affected). Pulled only by nitropack -> listhen, the dev server's self-signed-certificate helper, which never verifies a signature; no production image ships it (checked 2026-10-25)."
+
+[[IgnoredVulns]]
+id = "GHSA-vjh5-4x84-xrqp"
+ignoreUntil = 2027-04-30
+reason = "False positive: 4.6.2 IS the fixed release of nuxt and @nuxt/nitro-server 4.x. The advisory also lists the 3.x line as an open-ended range with no fix, which matches every later version."
diff --git a/package.json b/package.json
index 9aeea502..db26a71b 100644
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
   "version": "0.37.4",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@11.22.0",
+  "packageManager": "pnpm@12.15.0",
   "scripts": {
     "dev": "pnpm -r --parallel run dev",
     "build": "pnpm -r run build",
@@ -18,8 +18,8 @@
     "check:schema-parity": "pnpm --filter @trackarr/db run check:schema-parity"
   },
   "devDependencies": {
-    "@types/node": "^24.13.3",
-    "tsx": "^4.23.13",
+    "@types/node": "^26.6.5",
+    "tsx": "^4.23.15",
     "typescript": "^7.0.2"
   }
 }
diff --git a/packages/db/package.json b/packages/db/package.json
index e244b2f6..1d159cc6 100644
--- a/packages/db/package.json
+++ b/packages/db/package.json
@@ -15,10 +15,10 @@
     "db:baseline": "node scripts/baseline.mjs"
   },
   "dependencies": {
-    "drizzle-orm": "^0.45.2",
+    "drizzle-orm": "^0.45.4",
     "postgres": "^3.4.9"
   },
   "devDependencies": {
-    "drizzle-kit": "^0.31.10"
+    "drizzle-kit": "^0.31.11"
   }
 }
diff --git a/packages/shared/src/theme.ts b/packages/shared/src/theme.ts
index c956596b..f00cf28c 100644
--- a/packages/shared/src/theme.ts
+++ b/packages/shared/src/theme.ts
@@ -5,7 +5,8 @@
  *
  * Not a preference: a constraint. Tailwind freezes utility names at build time
  * and compiles their values to `var(--token)`, so `bg-bg-primary` exists because
- * `tailwind.config.ts` said so months ago. A row in a table cannot invent a
+ * the `@theme inline` block of apps/web's main.css says so (tailwind.config.ts
+ * did, before Tailwind 4). A row in a table cannot invent a
  * utility. What a theme CAN do is supply a different value for a name the build
  * already knows — which is exactly what this file enumerates.
  *
@@ -403,7 +404,7 @@ export const THEME_TOKENS: readonly TokenDef[] = [
  * bundler would otherwise never emit their `@font-face`. The stacks named
  * `system-*` download nothing.
  *
- * The fallbacks are not decoration. A face served from `/_fonts/` still has to
+ * The fallbacks are not decoration. A face served from `/_nuxt/fonts/` still has to
  * arrive, and until it does the browser renders the next entry, so every stack
  * ends in something that is already on the machine.
  */
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 77b43ce4..26932ffe 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1,3 +1,161 @@
+---
+lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      pnpm:
+        specifier: 12.15.0
+        version: 12.15.0
+
+packages:
+
+  '@pnpm/exe.android-arm64@12.15.0':
+    resolution: {integrity: sha512-eVCqmscY70LGvgRzu3mi8IBWBFGix+a6mNZoWmXxESsBdeiKEF9xQSuaeel10yn+zI7TXy2jlI63vFLzETk+aQ==}
+    cpu: [arm64]
+    os: [android]
+
+  '@pnpm/exe.android-x64@12.15.0':
+    resolution: {integrity: sha512-Gx/WbkFcdUFUg8g8AShezcS9EiQxfYvdAm2hfKLO8sfJmJvKOCt5fzlgHWDzmGhoclibgW+tUGZ/KF4F4wOTCA==}
+    cpu: [x64]
+    os: [android]
+
+  '@pnpm/exe.darwin-arm64@12.15.0':
+    resolution: {integrity: sha512-N0ZykiDWCvqSBJvt71j7cSoBR993FqvYZFtmpCtqvW3pguiI+NAgraLPA5OTwu5mV+/d8hYpVcPktJA3xFDLtA==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@pnpm/exe.darwin-x64@12.15.0':
+    resolution: {integrity: sha512-7Ntr2HlBUxzwWOg7NwDxCbRW/3vXuqKO+hcXm+w3SBi9rrHY53li1wLqWVT7Gjxd+lVEHM1QJZo6WJEGFU8C6A==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@pnpm/exe.freebsd-x64@12.15.0':
+    resolution: {integrity: sha512-btOiyL7fL7W4uQGH0aqFai2TNC3IoKcZ7gNHBVbEFZt2dWrnrD0SufL3iGs3fLlmb4OtuU35uf4Zpr9V9Jh9mA==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@pnpm/exe.linux-arm64-musl@12.15.0':
+    resolution: {integrity: sha512-pNC38k+O+90FOjbPNSnw0E7apq1PKTmz3fFe1amn+lys/U5kL++uzir8bRiho8ONcyA3d9EU7wdqcY0DKkj+JA==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-arm64@12.15.0':
+    resolution: {integrity: sha512-qML/8aCXslh8td/w4U+HJNqUcZ2+m6EfTbWScIzZRmyPsRFN+xB4LP1U/hymxc1iSJiKtG56HJx2fvUErWFIGw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-ppc64@12.15.0':
+    resolution: {integrity: sha512-tjRDUUl7RCJ6T/6eoNPxOqkwU4Mzi5RtTXmSAxujyz37OTwwsMU7Ps087Zk4gHcUvRSeyF40ZFsew3vtE+nmUA==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-riscv64@12.15.0':
+    resolution: {integrity: sha512-bF1uBWEfbwaeryz6lIiaJ8AWD082otZfvzGX5l+6LZRpRwUEpJHUsJrORaYP5/cNMv5ZR2p6TvvcJcQzwtDzmw==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-s390x@12.15.0':
+    resolution: {integrity: sha512-zKMhIzsexYMToeLmqV5jPsvV/f9vwsJb2kUH2NFYzalbxImeBrlA4kL7GwF8gD4pagV6jYYcJb8RjbZIdjHptg==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-x64-musl@12.15.0':
+    resolution: {integrity: sha512-A9J0Jg0Rdx+qQU4qXtwyST5tto9IOu1zi4fDk35nbc6DWahggbcKtFvZPKFwL2qgUXGXOX//hXv6z/sp6emO8A==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-x64@12.15.0':
+    resolution: {integrity: sha512-yc+QlZR+9+nr29J4fRzhMoapgxTBDndq/+peyoq1XUufnQFnfbXUMFudDIKzHi545linGqmOmXfn0NoufNgcOg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.win32-arm64@12.15.0':
+    resolution: {integrity: sha512-fPXZxuY1VclkOga9bc53qNCXcegfeoBR8+Ue+AospDwKzuGGSHll0oDxkLfkmpjyRqpe7bH5DyQPYp/xSMaIVA==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@pnpm/exe.win32-x64@12.15.0':
+    resolution: {integrity: sha512-nrd+Tp1We1DGj4DGG5Bea9lZNh9y1PjlLBdEwdInS4D0h0UIDtM7JaGGGDJhNzIwcHASyihWI7HLV+dtG+fhYg==}
+    cpu: [x64]
+    os: [win32]
+
+  pnpm@12.15.0:
+    resolution: {integrity: sha512-s5UdbW/0qfE9x89WzSjSuOs328ycaOUuHhGRhz6p+CoBcoerULqtxczElPA2xnwOR+sTYIwvo29HcRth6hKOYQ==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+snapshots:
+
+  '@pnpm/exe.android-arm64@12.15.0':
+    optional: true
+
+  '@pnpm/exe.android-x64@12.15.0':
+    optional: true
+
+  '@pnpm/exe.darwin-arm64@12.15.0':
+    optional: true
+
+  '@pnpm/exe.darwin-x64@12.15.0':
+    optional: true
+
+  '@pnpm/exe.freebsd-x64@12.15.0':
+    optional: true
+
+  '@pnpm/exe.linux-arm64-musl@12.15.0':
+    optional: true
+
+  '@pnpm/exe.linux-arm64@12.15.0':
+    optional: true
+
+  '@pnpm/exe.linux-ppc64@12.15.0':
+    optional: true
+
+  '@pnpm/exe.linux-riscv64@12.15.0':
+    optional: true
+
+  '@pnpm/exe.linux-s390x@12.15.0':
+    optional: true
+
+  '@pnpm/exe.linux-x64-musl@12.15.0':
+    optional: true
+
+  '@pnpm/exe.linux-x64@12.15.0':
+    optional: true
+
+  '@pnpm/exe.win32-arm64@12.15.0':
+    optional: true
+
+  '@pnpm/exe.win32-x64@12.15.0':
+    optional: true
+
+  pnpm@12.15.0:
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.15.0
+      '@pnpm/exe.android-x64': 12.15.0
+      '@pnpm/exe.darwin-arm64': 12.15.0
+      '@pnpm/exe.darwin-x64': 12.15.0
+      '@pnpm/exe.freebsd-x64': 12.15.0
+      '@pnpm/exe.linux-arm64': 12.15.0
+      '@pnpm/exe.linux-arm64-musl': 12.15.0
+      '@pnpm/exe.linux-ppc64': 12.15.0
+      '@pnpm/exe.linux-riscv64': 12.15.0
+      '@pnpm/exe.linux-s390x': 12.15.0
+      '@pnpm/exe.linux-x64': 12.15.0
+      '@pnpm/exe.linux-x64-musl': 12.15.0
+      '@pnpm/exe.win32-arm64': 12.15.0
+      '@pnpm/exe.win32-x64': 12.15.0
+
+---
 lockfileVersion: '9.0'
 
 settings:
@@ -25,7 +183,7 @@ overrides:
   undici@8: ^8.10.2
   svgo@4: ^4.1.0
   '@babel/core@7': ^7.29.6
-  '@types/node': ^24.13.3
+  '@types/node': ^26.6.5
   '@peculiar/asn1-android': ^2.9.4
   '@peculiar/asn1-cms': ^2.9.4
   '@peculiar/asn1-csr': ^2.9.4
@@ -43,8 +201,6 @@ overrides:
   source-map-js: ^1.2.2
   fast-copy: ^4.1.0
   vite: ^8.2.4
-  prosemirror-view: ^1.42.3
-  prosemirror-model: ^1.25.12
   vue-router: ^5.4.0
   unhead: ^3.4.3
   serialize-javascript: ^7.1.3
@@ -54,11 +210,11 @@ importers:
   .:
     devDependencies:
       '@types/node':
-        specifier: ^24.13.3
-        version: 24.13.3
+        specifier: ^26.6.5
+        version: 26.6.5
       tsx:
-        specifier: ^4.23.13
-        version: 4.23.13
+        specifier: ^4.23.15
+        version: 4.23.15
       typescript:
         specifier: ^7.0.2
         version: 7.0.2
@@ -69,11 +225,14 @@ importers:
         specifier: ^1.2.2
         version: 1.2.2
       '@iconify/utils':
-        specifier: ^3.1.4
-        version: 3.1.4
+        specifier: ^3.1.7
+        version: 3.1.7
+      '@prometheus-io/client':
+        specifier: ^0.16.1
+        version: 0.16.1
       '@simplewebauthn/server':
-        specifier: ^13.3.3
-        version: 13.3.3
+        specifier: ^14.0.3
+        version: 14.0.3
       '@trackarr/db':
         specifier: workspace:*
         version: link:../../packages/db
@@ -83,15 +242,12 @@ importers:
       bencode:
         specifier: ^4.0.1
         version: 4.0.1
-      create-torrent:
-        specifier: ^6.1.3
-        version: 6.1.3
       css-tree:
         specifier: ^3.2.1
         version: 3.2.1
       drizzle-orm:
-        specifier: ^0.45.2
-        version: 0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)
+        specifier: ^0.45.4
+        version: 0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)
       h3:
         specifier: ^1.15.11
         version: 1.15.11
@@ -99,11 +255,11 @@ importers:
         specifier: ^6.0.0
         version: 6.0.0(supports-color@10.2.2)
       marked:
-        specifier: ^18.0.9
-        version: 18.0.10
+        specifier: ^18.1.1
+        version: 18.1.1
       nitropack:
-        specifier: ^2.13.4
-        version: 2.13.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9))(oxc-parser@0.141.0)(rolldown@1.2.15)(supports-color@10.2.2)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+        specifier: ^2.13.5
+        version: 2.13.5(@parcel/watcher@2.5.6)(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9))(oxc-parser@0.141.0)(rolldown@1.2.15)(srvx@1.0.6)(supports-color@10.2.2)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       nodemailer:
         specifier: ^10.2.1
         version: 10.2.1
@@ -114,30 +270,24 @@ importers:
         specifier: ^11.0.24
         version: 11.0.24
       pino:
-        specifier: ^10.3.1
-        version: 10.3.1
-      prom-client:
-        specifier: ^15.1.3
-        version: 15.1.3
+        specifier: ^10.4.0
+        version: 10.4.0
       qrcode:
         specifier: ^1.5.4
         version: 1.5.4
       uuid:
-        specifier: ^14.0.1
-        version: 14.0.2
+        specifier: ^14.0.3
+        version: 14.0.3
       web-push:
         specifier: ^3.6.7
         version: 3.6.7(supports-color@10.2.2)
       zod:
-        specifier: ^4.6.6
+        specifier: ^4.6.7
         version: 4.6.7
     devDependencies:
       '@types/bencode':
         specifier: ^4.0.0
         version: 4.0.0
-      '@types/create-torrent':
-        specifier: ^6.1.1
-        version: 6.1.1
       '@types/css-tree':
         specifier: ^3.2.0
         version: 3.2.0
@@ -151,146 +301,145 @@ importers:
         specifier: ^3.6.4
         version: 3.6.4
       pino-pretty:
-        specifier: ^13.1.3
-        version: 13.1.3
+        specifier: ^13.2.0
+        version: 13.2.0
       vitest:
-        specifier: ^4.1.12
-        version: 4.1.12(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.2.0))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+        specifier: ^5.0.5
+        version: 5.0.5(@opentelemetry/api@1.9.1)(@types/node@26.6.5)(jsdom@30.1.3(@noble/hashes@2.2.0))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
 
   apps/web:
     dependencies:
       '@iconify-json/simple-icons':
-        specifier: ^1.2.94
-        version: 1.2.94
+        specifier: ^1.2.100
+        version: 1.2.100
       '@nuxtjs/i18n':
         specifier: ^10.6.0
-        version: 10.6.0(@vue/compiler-dom@3.5.41)(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(esbuild@0.28.2)(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(ioredis@5.10.1(supports-color@10.2.2))(magicast@0.5.5)(pinia@4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3)))(rolldown@1.2.15)(rollup@4.60.3)(supports-color@10.2.2)(typescript@5.9.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
-      '@nuxtjs/tailwindcss':
-        specifier: 6.14.0
-        version: 6.14.0(magicast@0.5.5)(supports-color@10.2.2)(tsx@4.23.13)(yaml@2.9.0)
+        version: 10.6.0(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(esbuild@0.28.2)(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(magicast@0.5.5)(pinia@4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3)))(rolldown@1.2.15)(rollup@4.65.0)(supports-color@10.2.2)(typescript@6.0.3)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
       '@pinia/nuxt':
-        specifier: 1.0.2
-        version: 1.0.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(pinia@4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3)))(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+        specifier: 1.0.3
+        version: 1.0.3(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(pinia@4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3)))(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       '@simplewebauthn/browser':
-        specifier: ^13.3.0
-        version: 13.3.0
+        specifier: ^14.0.0
+        version: 14.0.0
       '@tiptap/extension-color':
-        specifier: ^3.31.0
-        version: 3.31.0(@tiptap/extension-text-style@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0)))
+        specifier: ^3.32.0
+        version: 3.32.0(@tiptap/extension-text-style@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0)))
       '@tiptap/extension-image':
-        specifier: ^3.31.0
-        version: 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
+        specifier: ^3.32.0
+        version: 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
       '@tiptap/extension-link':
-        specifier: ^3.31.0
-        version: 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
+        specifier: ^3.32.0
+        version: 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
       '@tiptap/extension-placeholder':
-        specifier: ^3.31.0
-        version: 3.31.0(@tiptap/extensions@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))
+        specifier: ^3.32.0
+        version: 3.32.0(@tiptap/extensions@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))
       '@tiptap/extension-text-align':
-        specifier: ^3.31.0
-        version: 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
+        specifier: ^3.32.0
+        version: 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
       '@tiptap/extension-text-style':
-        specifier: ^3.31.0
-        version: 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
+        specifier: ^3.32.0
+        version: 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
       '@tiptap/starter-kit':
-        specifier: ^3.31.0
-        version: 3.31.0
+        specifier: ^3.32.0
+        version: 3.32.0
       '@tiptap/vue-3':
-        specifier: ^3.31.0
-        version: 3.31.0(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)(vue@3.5.44(typescript@5.9.3))
+        specifier: ^3.32.0
+        version: 3.32.0(@floating-ui/dom@1.7.6)(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)(vue@3.5.44(typescript@6.0.3))
       '@trackarr/shared':
         specifier: workspace:*
         version: link:../../packages/shared
       '@vueuse/core':
-        specifier: ^14.4.0
-        version: 14.4.0(vue@3.5.44(typescript@5.9.3))
+        specifier: ^15.0.0
+        version: 15.0.0(vue@3.5.44(typescript@6.0.3))
       chart.js:
-        specifier: ^4.5.1
-        version: 4.5.1
+        specifier: ^4.6.1
+        version: 4.6.1
       chartjs-plugin-zoom:
         specifier: ^2.2.0
-        version: 2.2.0(chart.js@4.5.1)
+        version: 2.2.0(chart.js@4.6.1)
       isomorphic-dompurify:
-        specifier: ^4.1.0
-        version: 4.1.0(@noble/hashes@2.2.0)
+        specifier: ^4.6.0
+        version: 4.6.0(@noble/hashes@2.2.0)
       marked:
-        specifier: ^18.0.9
-        version: 18.0.10
+        specifier: ^18.1.1
+        version: 18.1.1
       mediainfo.js:
-        specifier: ^0.3.7
-        version: 0.3.7
+        specifier: ^0.3.8
+        version: 0.3.8
       nuxt:
         specifier: ^4.6.2
-        version: 4.6.2(770feae4848205a63c0a1ab5684c5cdb)
+        version: 4.6.2(0aa2e1ff7ec74578bd134c9d216ec795)
       pinia:
-        specifier: ^4.0.3
-        version: 4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3))
+        specifier: ^4.1.0
+        version: 4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3))
       turndown:
         specifier: ^7.2.4
         version: 7.2.4
       vue:
         specifier: ^3.5.44
-        version: 3.5.44(typescript@5.9.3)
+        version: 3.5.44(typescript@6.0.3)
       vue-chartjs:
         specifier: ^5.3.4
-        version: 5.3.4(chart.js@4.5.1)(vue@3.5.44(typescript@5.9.3))
+        version: 5.3.4(chart.js@4.6.1)(vue@3.5.44(typescript@6.0.3))
       vue-router:
         specifier: ^5.4.0
-        version: 5.4.0(@vue/compiler-sfc@3.5.41)(esbuild@0.28.2)(pinia@4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3)))(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
+        version: 5.4.0(@vue/compiler-sfc@3.5.41)(esbuild@0.28.2)(pinia@4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3)))(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
     devDependencies:
       '@iconify-json/ph':
         specifier: ^1.2.2
         version: 1.2.2
       '@nuxt/fonts':
-        specifier: ^0.14.0
-        version: 0.14.0(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(esbuild@0.28.2)(ioredis@5.10.1(supports-color@10.2.2))(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+        specifier: ^1.1.0
+        version: 1.1.0(@nuxt/schema@4.6.2)(cac@7.0.0)(confbox@0.3.1)(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(dotenv@17.4.2)(esbuild@0.28.2)(giget@3.2.0)(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(lightningcss@1.33.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(postcss@8.5.26)(rolldown@1.2.15)(rollup@4.65.0)(srvx@1.0.6)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       '@nuxt/icon':
-        specifier: ^2.5.1
-        version: 2.5.1(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
+        specifier: ^2.6.0
+        version: 2.6.0(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
+      '@tailwindcss/vite':
+        specifier: ^4.3.3
+        version: 4.3.3(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       '@types/turndown':
         specifier: ^5.0.6
         version: 5.0.6
+      tailwindcss:
+        specifier: ^4.3.3
+        version: 4.3.3
       typescript:
-        specifier: ~5.9.3
-        version: 5.9.3
+        specifier: ~6.0.3
+        version: 6.0.3
       vitest:
-        specifier: ^4.1.12
-        version: 4.1.12(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.2.0))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+        specifier: ^5.0.5
+        version: 5.0.5(@opentelemetry/api@1.9.1)(@types/node@26.6.5)(jsdom@30.1.3(@noble/hashes@2.2.0))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       vue-tsc:
-        specifier: ^3.3.11
-        version: 3.3.11(typescript@5.9.3)
+        specifier: ^3.3.13
+        version: 3.3.13(typescript@6.0.3)
 
   packages/db:
     dependencies:
       drizzle-orm:
-        specifier: ^0.45.2
-        version: 0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)
+        specifier: ^0.45.4
+        version: 0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)
       postgres:
         specifier: ^3.4.9
         version: 3.4.9
     devDependencies:
       drizzle-kit:
-        specifier: ^0.31.10
-        version: 0.31.10
+        specifier: ^0.31.11
+        version: 0.31.11
 
   packages/shared: {}
 
 packages:
 
-  '@alloc/quick-lru@5.2.0':
-    resolution: {integrity: sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==}
-    engines: {node: '>=10'}
-
-  '@antfu/install-pkg@1.1.0':
-    resolution: {integrity: sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==}
+  '@antfu/install-pkg@2.1.0':
+    resolution: {integrity: sha512-sdg9NxU3zR4Mnawfbc/x6GB5Wf17WYud5qOuEuxXjaKpYpMkISSJEjItGebXJ2bQ4DIcly4NYH23mtkGJjvKUw==}
 
-  '@asamuzakjp/css-color@6.0.7':
-    resolution: {integrity: sha512-vC/bk1Lz7Tn/EfU9/apOTBk80/8dyGyWMowPoV1tJ52muDGsDqt2HPT2klrFUiY60MQmQv9q8yIht15JnBgDGw==}
-    engines: {node: ^22.13.0 || >=24.0.0}
+  '@asamuzakjp/css-color@7.1.7':
+    resolution: {integrity: sha512-Q7ioeear07HwixdIitIn9KS1LZi97CEDFCSjPNm9v+y8KNbsu9q4Lrd4zUQW4faED+E7qxvfeVnbNRW46wFKuw==}
+    engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}
 
-  '@asamuzakjp/dom-selector@8.3.2':
-    resolution: {integrity: sha512-93Z1N+BQNXysodoicpOIyNh2drHfz/CTf9nnT0FEx72GJcIiwgydD7tGAr78j41LsYn3hlRn+LdGPuBLn1Bl8Q==}
-    engines: {node: ^22.13.0 || >=24.0.0}
+  '@asamuzakjp/dom-selector@10.0.5':
+    resolution: {integrity: sha512-EgmJ7oEaGQECTn3H3wmnQpEy4hKY66VvM7VQndwPIQob3p877BgbyOUE3EX0LgXQCciF2H8KMdR+RznqjMNOLw==}
+    engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}
 
   '@babel/code-frame@7.29.7':
     resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
@@ -358,10 +507,6 @@ packages:
     resolution: {integrity: sha512-brcMGQaVzIeUb+6/bs1Av0f8YuNNjKY2JyvfRCsFuFsdKccEQ5Ges2y74D74NZ1Rz8lKJ9ksJkfqwQFJ/iNEyQ==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-string-parser@7.27.1':
-    resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/helper-string-parser@7.29.7':
     resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
     engines: {node: '>=6.9.0'}
@@ -370,10 +515,6 @@ packages:
     resolution: {integrity: sha512-+6HYEBnsDRZHJtUTAEfMQd0zMDqdFHS7C+5vAsEZqBUr3vEMWOWlHJ0Jz1gS8jJIlCvLsuA6ivmeoqzH936YcA==}
     engines: {node: ^22.18.0 || >=24.11.0}
 
-  '@babel/helper-validator-identifier@7.28.5':
-    resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/helper-validator-identifier@7.29.7':
     resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
     engines: {node: '>=6.9.0'}
@@ -390,11 +531,6 @@ packages:
     resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/parser@7.29.3':
-    resolution: {integrity: sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==}
-    engines: {node: '>=6.0.0'}
-    hasBin: true
-
   '@babel/parser@7.29.8':
     resolution: {integrity: sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==}
     engines: {node: '>=6.0.0'}
@@ -436,10 +572,6 @@ packages:
     resolution: {integrity: sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/types@7.29.0':
-    resolution: {integrity: sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/types@7.29.8':
     resolution: {integrity: sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==}
     engines: {node: '>=6.9.0'}
@@ -471,32 +603,32 @@ packages:
   '@colordx/core@7.3.0':
     resolution: {integrity: sha512-LVzTTPhX7wpy7TkGjouA9zbbCBIw92RGm7ZQqSKFE0oYE3sMx2FGXz90eVpgw7k/+wrrY+qJ86nHXifZWMS5jA==}
 
-  '@csstools/color-helpers@6.1.1':
-    resolution: {integrity: sha512-gLNsunvwf3mCi5u5o46/Z/JcJMnhbHSaZ69rkgPzNM3J4s8hWwpPUQB6/tt0EDFyCiWzxANlx+2LJwpYj4zS1w==}
+  '@csstools/color-helpers@6.1.2':
+    resolution: {integrity: sha512-grhRy3OKmniaAEKXMjua5z/EODX0MSqBGjunw8+j/3HQjOnahs2AGhvEOIYVUWcU6ScApbhLhVrQTX8XqrMrow==}
     engines: {node: '>=20.19.0'}
 
-  '@csstools/css-calc@3.3.0':
-    resolution: {integrity: sha512-c5ihYsPkdG6JCkU2zTMm4+k6r7RXuGxtWYhu5DHMIiF1FHzrfmHL5so11AoFpUv/tu61xfcmT4AmKoFfMPoqdQ==}
+  '@csstools/css-calc@3.4.3':
+    resolution: {integrity: sha512-iex20d8CHVkyvg6B7UKV7uHnI2Bqo9g+EFfT9E0y+GvTvhZ/DwONJ+9aKb1dlqm0ZiGsL5RXjp0fCoJYnkeDjA==}
     engines: {node: '>=20.19.0'}
     peerDependencies:
-      '@csstools/css-parser-algorithms': ^4.0.0
-      '@csstools/css-tokenizer': ^4.0.0
+      '@csstools/css-parser-algorithms': ^4.0.2
+      '@csstools/css-tokenizer': ^4.0.2
 
-  '@csstools/css-color-parser@4.2.0':
-    resolution: {integrity: sha512-5+5LEmFuY1AjXdYhmgjTJogtQnP1evJ1zrBZGUNZ0thkpwnnmKxcHdAMn/OtFjAb25zA+jKDVYVRl+5G7rjv1A==}
+  '@csstools/css-color-parser@4.2.6':
+    resolution: {integrity: sha512-iiPQ3iRWwnJkeEn6RIu6SJPr7hYrLz6XZ9s/QZl+2/LI5KQVjpl2fdmDSZKuD4xP6GMmMPgHFFXg6k1Wkz0Trg==}
     engines: {node: '>=20.19.0'}
     peerDependencies:
-      '@csstools/css-parser-algorithms': ^4.0.0
-      '@csstools/css-tokenizer': ^4.0.0
+      '@csstools/css-parser-algorithms': ^4.0.2
+      '@csstools/css-tokenizer': ^4.0.2
 
-  '@csstools/css-parser-algorithms@4.0.0':
-    resolution: {integrity: sha512-+B87qS7fIG3L5h3qwJ/IFbjoVoOe/bpOdh9hAjXbvx0o8ImEmUsGXN0inFOnk2ChCFgqkkGFQ+TpM5rbhkKe4w==}
+  '@csstools/css-parser-algorithms@4.0.2':
+    resolution: {integrity: sha512-40cSKyMvK+tq4qz6Awrlye2WGuOKt3FwPgtGg6KTfbHOWNw+Rk1rzbAtZnZ6IBhsY491HLRnDXwoyBAijmmILA==}
     engines: {node: '>=20.19.0'}
     peerDependencies:
-      '@csstools/css-tokenizer': ^4.0.0
+      '@csstools/css-tokenizer': ^4.0.2
 
-  '@csstools/css-syntax-patches-for-csstree@1.1.8':
-    resolution: {integrity: sha512-CpMLjAvwQg3BL5S0IeqsZNMH7EQrEWi0kLKOC13ZBF0ZwERiLWlibNPJr8G1kdU3Ms/r2KiNrF81pUh2HwAHdg==}
+  '@csstools/css-syntax-patches-for-csstree@1.1.15':
+    resolution: {integrity: sha512-J0u7HkVl2nzSlhsiTOp4AmwcUQ3D+mGEEKfBy/7To5/y7F2OHwyLrXfrhR0SMgr4p5Lo+eaMVSeai24zUcBIxA==}
     peerDependencies:
       css-tree: ^3.2.1
     peerDependenciesMeta:
@@ -507,18 +639,6 @@ packages:
     resolution: {integrity: sha512-OoKoR0f76dCY666JlcbhmVTs2drYj1GUXZTYTcbUgJjh9Nv41aFfZ21bPQTERm5+L5cBDo466NltB2lplS5GBw==}
     engines: {node: '>=20.19.0'}
 
-  '@csstools/selector-resolve-nested@3.1.0':
-    resolution: {integrity: sha512-mf1LEW0tJLKfWyvn5KdDrhpxHyuxpbNwTIwOYLIvsTffeyOf85j5oIzfG0yosxDgx/sswlqBnESYUcQH0vgZ0g==}
-    engines: {node: '>=18'}
-    peerDependencies:
-      postcss-selector-parser: ^7.1.6
-
-  '@csstools/selector-specificity@5.0.0':
-    resolution: {integrity: sha512-PCqQV3c4CoVm3kdPhyeZ07VmBRdH2EpMFA/pd9OASpOEC3aXNGoqPDAZ80D0cLpMBxnmk0+yNhGsEx31hq7Gtw==}
-    engines: {node: '>=18'}
-    peerDependencies:
-      postcss-selector-parser: ^7.1.6
-
   '@drizzle-team/brocli@0.10.2':
     resolution: {integrity: sha512-z33Il7l5dKjUgGULTqBsQBQwckHh5AbIuxhdsIxDDiZAzBOrZO6q9ogcWC65kU382AfynTfgNumVcNIjuIua6w==}
 
@@ -731,8 +851,8 @@ packages:
     resolution: {integrity: sha512-rZAP3aVgB9ds9KOeUSL+zZ21hPmo8dh6fnIFwRQj5EAZl9gzR7wxYbYXYysAM8CTqGmUGyp2S4kUdV17MnGuWQ==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  '@exodus/bytes@1.15.1':
-    resolution: {integrity: sha512-S6mL0yNB/Abt9Ei4tq8gDhcczc4S3+vQ4ra7vxnAf+YHC02srtqxKKZghx2Dq6p0e66THKwR6r8N6P95wEty7Q==}
+  '@exodus/bytes@1.16.0':
+    resolution: {integrity: sha512-IcpW84uEn3N7ETtNZMlxKhfl6Pec8rUNGOTBtWbK1FKhJxIFAptZyVrvVRVBimAJxJCgc3PxepxkdWWG4DVzfA==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
     peerDependencies:
       '@noble/hashes': ^1.8.0 || ^2.0.0
@@ -775,20 +895,20 @@ packages:
   '@iconify-json/ph@1.2.2':
     resolution: {integrity: sha512-PgkEZNtqa8hBGjHXQa4pMwZa93hmfu8FUSjs/nv4oUU6yLsgv+gh9nu28Kqi8Fz9CCVu4hj1MZs9/60J57IzFw==}
 
-  '@iconify-json/simple-icons@1.2.94':
-    resolution: {integrity: sha512-l8UWzVxKaqZd9ABsE/M/9p6NyGkQnmCnOoZyhQmjlXCtY5PuL2rcWxOFk2l9pk7ux3ERMPkTLE4jl6kQpTkwxA==}
+  '@iconify-json/simple-icons@1.2.100':
+    resolution: {integrity: sha512-536pN2RCEQyy5bYwzayrs4e9egr8cmtVcbdSHLaQl/ULUsihzn1eZ0+Hhn50zgz9cbEotiynKsKQSEjFJ7qKmw==}
 
-  '@iconify/collections@1.0.727':
-    resolution: {integrity: sha512-n+ipAqz5A6TWExnndwdT6qVX7KfXiw5GNDSxO2otXs6rxFWdHqizHTW1WvmWmT6m2BqQ8lhzUyWSJvm4M3nMAg==}
+  '@iconify/collections@1.0.755':
+    resolution: {integrity: sha512-X5ek7eriIl25N6LQ1fNOsAJdNtlnQOaxpb4/NOW0d4qiif4K5ppr7j0Ow7+eiTuQcKK4YXBNHlw82t7DPcwhPg==}
 
   '@iconify/types@2.0.0':
     resolution: {integrity: sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==}
 
-  '@iconify/utils@3.1.4':
-    resolution: {integrity: sha512-b1S7B1k9ohZ+iNTi2ATxbRYG9fTrJmUT0rc46bvVnNxqNRGW7dyo/vRREwyniI5IRN2RSJHDcm+s3BjWrSAjHw==}
+  '@iconify/utils@3.1.7':
+    resolution: {integrity: sha512-JZHlwdID+dy+lTgbYC8NEC4zeugqeYsc6jewvzb4c58kHauJn+X7rNwQjxz5p2qSjqaEeQoLkCIQ9v/H4PK0/w==}
 
-  '@iconify/vue@5.0.1':
-    resolution: {integrity: sha512-aumwwooJlFJ5H5qYWB6ZTAyM0C8hpfcSVLB9/a3qnH1GGvIJ+FEbpEs4s/HfErYe/M5qZeLjwmESR5fFm3lXEw==}
+  '@iconify/vue@5.0.4':
+    resolution: {integrity: sha512-9yP5PjOv5G9vStHfyPtQ69Ay1CSNAC3AZTRDJ4LX3UMX7nEH0GO8OKhc3qhcrXp1KS2GnlLufGbFCwD+U4Fi5A==}
     peerDependencies:
       vue: '>=3.0.0'
 
@@ -870,8 +990,8 @@ packages:
       vue-i18n:
         optional: true
 
-  '@ioredis/commands@1.5.1':
-    resolution: {integrity: sha512-JH8ZL/ywcJyR9MmJ5BNqZllXNZQqQbnVZOqpPQqE1vHiFgAw4NHbvE0FOduNU8IX9babitBT46571OnPTT0Zcw==}
+  '@ioredis/commands@1.10.0':
+    resolution: {integrity: sha512-UmeW7z4LfctwoQ5wkhVzgq8tXkreED2xZGpX+Bg+zA+WJFZCT6c062AfCK/Dfk81xZnnwdhJCUMkitihRaoC2Q==}
 
   '@ioredis/commands@2.0.0':
     resolution: {integrity: sha512-vrx0AE/T0h7cRZwfo1M39Cr+ZhZrkf0V8mQN75wucKCxCLD9l/VX6no3gFvrLqD1IlG/1LtzWovqEw3t0Vr9zg==}
@@ -906,11 +1026,6 @@ packages:
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
-  '@koa/router@12.0.2':
-    resolution: {integrity: sha512-sYcHglGKTxGF+hQ6x67xDfkE9o+NhVlRHBqq6gLywaMc6CojK/5vFZByphdonKinYlMLkEkacm+HEse9HzwgTA==}
-    engines: {node: '>= 12'}
-    deprecated: Please upgrade to v15 or higher. All reported bugs in this version are fixed in newer releases, dependencies have been updated, and security has been improved.
-
   '@kurkle/color@0.3.4':
     resolution: {integrity: sha512-M5UknZPHRu3DEDWoipU6sE8PdkZ6Z/S+v4dD+Ke8IaNlpdSQah50lz1KtcFBa2vsdOnwbbnxJwVM4wty6udA5w==}
 
@@ -930,6 +1045,13 @@ packages:
     peerDependencies:
       rollup: ^1.20.0 || ^2.0.0 || ^3.0.0 || ^4.0.0
 
+  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
+    resolution: {integrity: sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ==}
+    engines: {node: ^22.20 || ^24.12 || >=25}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
   '@napi-rs/wasm-runtime@1.2.3':
     resolution: {integrity: sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=23.5.0}
@@ -981,16 +1103,6 @@ packages:
   '@nuxt/devalue@2.0.2':
     resolution: {integrity: sha512-GBzP8zOc7CGWyFQS6dv1lQz8VVpz5C2yRszbXufwG/9zhStTIH50EtD87NmWbTMwXDvZLNg8GIpb1UFdH93JCA==}
 
-  '@nuxt/devtools-kit@3.4.1':
-    resolution: {integrity: sha512-6ltPm2yUW8GvDdf3VJna7+flLi+ej7xRfSr+S4ovevKt/CuPf9EqYOn1jW7Kw/U1MXt/71zkn+/O2vu3G6O9Hg==}
-    peerDependencies:
-      vite: ^8.2.4
-
-  '@nuxt/devtools-kit@3.4.2':
-    resolution: {integrity: sha512-TPPbmH9xrExagYxfCe6JgtbHmgchfgDdA656Yws18rn8I/oCvB+gcw3kTWBBp2sC9ipZPXsgbsW/yZnVnGNBiA==}
-    peerDependencies:
-      vite: ^8.2.4
-
   '@nuxt/devtools-kit@3.4.4':
     resolution: {integrity: sha512-q3aRKpnriK/kITYlYUXSE3O0R7WeJwSMLvtbo1HfcKXYg/q8688iIb5VURl0fbkSaFTk7ndU5HIbW+5f0JOJPQ==}
     peerDependencies:
@@ -1010,15 +1122,19 @@ packages:
       '@vitejs/devtools':
         optional: true
 
-  '@nuxt/fonts@0.14.0':
-    resolution: {integrity: sha512-4uXQl9fa5F4ibdgU8zomoOcyMdnwgdem+Pi8JEqeDYI5yPR32Kam6HnuRr47dTb97CstaepAvXPWQUUHMtjsFQ==}
-
-  '@nuxt/icon@2.5.1':
-    resolution: {integrity: sha512-zBP72Po7BS+tXzoeDRA/Y9TTY77OIcNCyzfgXsOmep7zZShTEoe4p1WZBXce/9oJDK3YXmbYC3ILQ7XvqM4/XA==}
+  '@nuxt/fonts@1.1.0':
+    resolution: {integrity: sha512-qFyraSRExjeUkbxBrJOt4isXYFFJtBTOAgDWjajPaCjD6t8waRRPFMQDwQ0LjpputoltWdkj4t7oH1lxMmN10g==}
+    peerDependencies:
+      lightningcss: ^1.33.0
+      subset-font: ^2.9.0
+    peerDependenciesMeta:
+      lightningcss:
+        optional: true
+      subset-font:
+        optional: true
 
-  '@nuxt/kit@3.21.4':
-    resolution: {integrity: sha512-XDWhQJsA5hpdFpVSmImQIVXcsANJI07TjT1LZC/AUKJxl/dcM52Rq4uU+b3uqyVl4LZR1fODSDEzLxcdXq4Rmg==}
-    engines: {node: '>=18.12.0'}
+  '@nuxt/icon@2.6.0':
+    resolution: {integrity: sha512-cMT2gOK0AS8+CFI45Upz0Erzm9wud+iJ/eX/YeWbcw9UmSdU16PjbYyHpRKSALFHoSi3E7j7WRgT/KyU7UG7iA==}
 
   '@nuxt/kit@4.5.2':
     resolution: {integrity: sha512-l66LU9DcJYjmNwqwAj2I5UGRrUbnG2DOKGChnN70zIGtn0eq/z87gi/FRgha6eMb9/FmB1PFHgtx6PWVml1C2Q==}
@@ -1112,9 +1228,6 @@ packages:
     resolution: {integrity: sha512-20YXYOcc8cSh/pSpNgj+MHAn11qUbsFR1IBJh6qYtRPVhUUmgqJ1DyMu39MB+uEYYL/fsberL2ByMYrFaROslw==}
     engines: {node: '>=20.11.1'}
 
-  '@nuxtjs/tailwindcss@6.14.0':
-    resolution: {integrity: sha512-30RyDK++LrUVRgc2A85MktGWIZoRQgeQKjE4CjjD64OXNozyl+4ScHnnYgqVToMM6Ch2ZG2W4wV2J0EN6F0zkQ==}
-
   '@opentelemetry/api@1.9.1':
     resolution: {integrity: sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==}
     engines: {node: '>=8.0.0'}
@@ -1495,6 +1608,10 @@ packages:
     resolution: {integrity: sha512-SYHm4SoWSI0nRCoos6jpGusIqhPH9bbGBqv7ohlZ+H6BunrDzzQPk2ePgDuEUzV82OdvbLgtW4twUDwhU9P3YQ==}
     engines: {node: '>=14'}
 
+  '@peculiar/asn1-asym-key@2.11.0':
+    resolution: {integrity: sha512-r2957WdSZle/Zt4t9og7OMQYXNJ9/3ANXVtFwLCDJuHORlBZ4AFmDt1Qee0CzyTbHQg4ZZApBGEz5/6cFsyCRg==}
+    engines: {node: '>=14'}
+
   '@peculiar/asn1-cms@2.9.4':
     resolution: {integrity: sha512-cben7oxmQsUGZqotus7yt0srYdncOT6RNWcTQ77T2RFOXejYVYkXadrfePdRcrVpO9K95IRLKKglG2k38jKXuw==}
     engines: {node: '>=14'}
@@ -1531,6 +1648,10 @@ packages:
     resolution: {integrity: sha512-ehQXbpQaQYycgu8OrvigwSPTFfVRcu0ECNYCWw+yzBp02Lw5paRqzzhUpfOgO2K38+WfFZuEz/0RPtam5g0OMg==}
     engines: {node: '>=14'}
 
+  '@peculiar/asn1-x509-post-quantum@2.11.0':
+    resolution: {integrity: sha512-K6EnquTX3xJ2G+uLPFH0jVkh7W8y6eTzoCxvSoXAj0sWS5uvVB2PEvpBPdzY4+ytaedUM3x9ZVgX0AZKb316ew==}
+    engines: {node: '>=14'}
+
   '@peculiar/asn1-x509@2.9.4':
     resolution: {integrity: sha512-CxhBo/RdEbMMob7T31ZdQjGuoyRFLVwrDzTn25bihzBasRg9kRm/0IxIPvhgQtcK/9dNcO1XQL2fuPugwELL0Q==}
     engines: {node: '>=14'}
@@ -1538,14 +1659,14 @@ packages:
   '@peculiar/utils@2.0.3':
     resolution: {integrity: sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==}
 
-  '@peculiar/x509@1.14.3':
-    resolution: {integrity: sha512-C2Xj8FZ0uHWeCXXqX5B4/gVFQmtSkiuOolzAgutjTfseNOHT3pUjljDZsTSxXFGgio54bCzVFqmEOUrIVk8RDA==}
+  '@peculiar/x509@2.2.0':
+    resolution: {integrity: sha512-adpW58ySPQMOUPv8pTKT3RIyCFqfUFt8X05ukPdtkQToXDVr8dMtxuenik1yx8tNFTbpApWsM/Hi5SzlIx48+Q==}
     engines: {node: '>=20.0.0'}
 
-  '@pinia/nuxt@1.0.2':
-    resolution: {integrity: sha512-x+G/zz7SDjLq3TUf0jpaXiOb03ZY+O3i0q8aMP76Lz3MS/NaE71SJCCZjYiF8dNsz/0oOnCPT2DKghkumXlVRw==}
+  '@pinia/nuxt@1.0.3':
+    resolution: {integrity: sha512-riI5CHfiQUNqFJjY+KuopkOtxSiex2CQYEHdQHiZRhS20ebtkiXQXtYbL/ecni3vhOJvW1PyVfPT7j5SzwvpLQ==}
     peerDependencies:
-      pinia: ^4.0.3
+      pinia: ^4.1.0
 
   '@pinojs/redact@0.4.0':
     resolution: {integrity: sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==}
@@ -1566,6 +1687,10 @@ packages:
   '@poppinss/exception@1.2.3':
     resolution: {integrity: sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==}
 
+  '@prometheus-io/client@0.16.1':
+    resolution: {integrity: sha512-XkFPsGFGoSs/UMg/vh0QLDpanl/tsrOV5PLHdpGe8Ho+ir/Llhytr15j6y8ZwLrpIGzK9gTVVpIalA6C4UjUZw==}
+    engines: {node: ^22 || ^24 || >=26}
+
   '@rolldown/binding-android-arm-eabi@1.2.15':
     resolution: {integrity: sha512-aLcgK9gIJ3YRvrrtfSBbRa27F5WrpiTaPulnFpsHPxpUHgFlSgnU4854MHwoRGEBhfRJDWCS2WQ7lIjskE9Olw==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -1674,8 +1799,8 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/plugin-commonjs@29.0.2':
-    resolution: {integrity: sha512-S/ggWH1LU7jTyi9DxZOKyxpVd4hF/OZ0JrEbeLjXk/DFXwRny0tjD2c992zOUYQobLrVkRVMDdmHP16HKP7GRg==}
+  '@rollup/plugin-commonjs@29.0.3':
+    resolution: {integrity: sha512-ZaOxZceP7SOUW7Lqw5IRVweSQYWaeIPnXIGLiB690EBA3FGJTO40EEr2L5yZplJWsgTCogILRSpcAe7+U0Otdg==}
     engines: {node: '>=16.0.0 || 14 >= 14.17'}
     peerDependencies:
       rollup: ^2.68.0||^3.0.0||^4.0.0
@@ -1746,152 +1871,152 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/rollup-android-arm-eabi@4.60.3':
-    resolution: {integrity: sha512-x35CNW/ANXG3hE/EZpRU8MXX1JDN86hBb2wMGAtltkz7pc6cxgjpy1OMMfDosOQ+2hWqIkag/fGok1Yady9nGw==}
+  '@rollup/rollup-android-arm-eabi@4.65.0':
+    resolution: {integrity: sha512-t2AnVba25baFdq7gczzS13JyVcdubLVbFX1X04mxrggDrTQPUXNv3XM0k9H1hr5tqvg7AVvtQ720QHAj0iYqhg==}
     cpu: [arm]
     os: [android]
 
-  '@rollup/rollup-android-arm64@4.60.3':
-    resolution: {integrity: sha512-xw3xtkDApIOGayehp2+Rz4zimfkaX65r4t47iy+ymQB2G4iJCBBfj0ogVg5jpvjpn8UWn/+q9tprxleYeNp3Hw==}
+  '@rollup/rollup-android-arm64@4.65.0':
+    resolution: {integrity: sha512-dNONUaEwPGhl/nuO2KV8VABWlcjYyU6KtZGN8dQv5OS5JU7JSCxPijVNKXbRJd0iuTzTiJ4TjPt/4bbvDRNiMQ==}
     cpu: [arm64]
     os: [android]
 
-  '@rollup/rollup-darwin-arm64@4.60.3':
-    resolution: {integrity: sha512-vo6Y5Qfpx7/5EaamIwi0WqW2+zfiusVihKatLvtN1VFVy3D13uERk/6gZLU1UiHRL6fDXqj/ELIeVRGnvcTE1g==}
+  '@rollup/rollup-darwin-arm64@4.65.0':
+    resolution: {integrity: sha512-zWQqUH+9zavr2Bxuzfpuv2SIF3X31cr58TvSQC9o1GhpOvkqRwr60GkZdQcudyT/BEgdpdSafjgd2I13MbTL7g==}
     cpu: [arm64]
     os: [darwin]
 
-  '@rollup/rollup-darwin-x64@4.60.3':
-    resolution: {integrity: sha512-D+0QGcZhBzTN82weOnsSlY7V7+RMmPuF1CkbxyMAGE8+ZHeUjyb76ZiWmBlCu//AQQONvxcqRbwZTajZKqjuOw==}
+  '@rollup/rollup-darwin-x64@4.65.0':
+    resolution: {integrity: sha512-RQYreBFWtO4//hIuOaZkYUnF/lPU4lz35dveDimDshWCJvVisVtJ/shmT9bkXK8wFJY+FJF89X6F3Cq1qI3LCw==}
     cpu: [x64]
     os: [darwin]
 
-  '@rollup/rollup-freebsd-arm64@4.60.3':
-    resolution: {integrity: sha512-6HnvHCT7fDyj6R0Ph7A6x8dQS/S38MClRWeDLqc0MdfWkxjiu1HSDYrdPhqSILzjTIC/pnXbbJbo+ft+gy/9hQ==}
+  '@rollup/rollup-freebsd-arm64@4.65.0':
+    resolution: {integrity: sha512-A0NfMj6Cuh/9BE5k3awJKv6HoxFVXIcLAb6SZqAMoxUHPA1ZNNK4RsGuUPD/vL7nEAm9LG+ZzXWWTrnC0XtkpA==}
     cpu: [arm64]
     os: [freebsd]
 
-  '@rollup/rollup-freebsd-x64@4.60.3':
-    resolution: {integrity: sha512-KHLgC3WKlUYW3ShFKnnosZDOJ0xjg9zp7au3sIm2bs/tGBeC2ipmvRh/N7JKi0t9Ue20C0dpEshi8WUubg+cnA==}
+  '@rollup/rollup-freebsd-x64@4.65.0':
+    resolution: {integrity: sha512-BI6/H7q3aP0I7S7GOrjyxTjgEJlSnovXE38+bdxBpuKN6z+d//uF+T+VQ3Q7ltJL/71p17ufartARX9Ja5gOGQ==}
     cpu: [x64]
     os: [freebsd]
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.60.3':
-    resolution: {integrity: sha512-DV6fJoxEYWJOvaZIsok7KrYl0tPvga5OZ2yvKHNNYyk/2roMLqQAbGhr78EQ5YhHpnhLKJD3S1WFusAkmUuV5g==}
+  '@rollup/rollup-linux-arm-gnueabihf@4.65.0':
+    resolution: {integrity: sha512-W1vUprf09RWaVWnsFP1vlUkEWJzTZlpObOEAYZXt9Fq0UVAOYEkeGr7wBX7McKqqIQskXdBnpiOMgwPujordgA==}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-arm-musleabihf@4.60.3':
-    resolution: {integrity: sha512-mQKoJAzvuOs6F+TZybQO4GOTSMUu7v0WdxEk24krQ/uUxXoPTtHjuaUuPmFhtBcM4K0ons8nrE3JyhTuCFtT/w==}
+  '@rollup/rollup-linux-arm-musleabihf@4.65.0':
+    resolution: {integrity: sha512-s8QTcZWgrl9haFzEGIqyE5BWyo89pFDGLMBFZ752WYxk8DJwNU/O1X6pZgPw829d9/sm6CCHyrMP3aurt76p1Q==}
     cpu: [arm]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-arm64-gnu@4.60.3':
-    resolution: {integrity: sha512-Whjj2qoiJ6+OOJMGptTYazaJvjOJm+iKHpXQM1P3LzGjt7Ff++Tp7nH4N8J/BUA7R9IHfDyx4DJIflifwnbmIA==}
+  '@rollup/rollup-linux-arm64-gnu@4.65.0':
+    resolution: {integrity: sha512-ke1f6dLRzkqveyjjF2fkEwQYZvxHtNNwjegY8nJrwcO0Bdqr8CzFO/pKE0Bns13cx0qz2Ba2Y0Hs3dSwMdnHxA==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-arm64-musl@4.60.3':
-    resolution: {integrity: sha512-4YTNHKqGng5+yiZt3mg77nmyuCfmNfX4fPmyUapBcIk+BdwSwmCWGXOUxhXbBEkFHtoN5boLj/5NON+u5QC9tg==}
+  '@rollup/rollup-linux-arm64-musl@4.65.0':
+    resolution: {integrity: sha512-926SMeUcy4y18Rz/w2aJiUKOnyAnm6czg72bXkQEaeemsll+Wr0hnsjb2BGRpHvWgwAMYy5ACJCotbvfLCfj0A==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-loong64-gnu@4.60.3':
-    resolution: {integrity: sha512-SU3kNlhkpI4UqlUc2VXPGK9o886ZsSeGfMAX2ba2b8DKmMXq4AL7KUrkSWVbb7koVqx41Yczx6dx5PNargIrEA==}
+  '@rollup/rollup-linux-loong64-gnu@4.65.0':
+    resolution: {integrity: sha512-6T7JNRP1hc4hqF2dUsEoVLOt9K8tmODoCLldtQRYnrddGGQY8Gqe2pM/qMMUo7EMowpP7oa2N95k0/8sYK/ipw==}
     cpu: [loong64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-loong64-musl@4.60.3':
-    resolution: {integrity: sha512-6lDLl5h4TXpB1mTf2rQWnAk/LcXrx9vBfu/DT5TIPhvMhRWaZ5MxkIc8u4lJAmBo6klTe1ywXIUHFjylW505sg==}
+  '@rollup/rollup-linux-loong64-musl@4.65.0':
+    resolution: {integrity: sha512-SImGFl1Je5kpyAgOCPONVT7h6ASV8mAUwGRjY7eZvVjPg//PfHOXgI+P241RF/+HqsA4PP3qD527ysWFKNQyhQ==}
     cpu: [loong64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-ppc64-gnu@4.60.3':
-    resolution: {integrity: sha512-BMo8bOw8evlup/8G+cj5xWtPyp93xPdyoSN16Zy90Q2QZ0ZYRhCt6ZJSwbrRzG9HApFabjwj2p25TUPDWrhzqQ==}
+  '@rollup/rollup-linux-ppc64-gnu@4.65.0':
+    resolution: {integrity: sha512-XeDTbmPF1Yu5asfXGPrMkWoxTDhgryQbmw5Q1+R582O51VNCk23J6f2pDrsAp5YkneBVBwtExx6ZGOb9D2aQ6A==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-ppc64-musl@4.60.3':
-    resolution: {integrity: sha512-E0L8X1dZN1/Rph+5VPF6Xj2G7JJvMACVXtamTJIDrVI44Y3K+G8gQaMEAavbqCGTa16InptiVrX6eM6pmJ+7qA==}
+  '@rollup/rollup-linux-ppc64-musl@4.65.0':
+    resolution: {integrity: sha512-VS55JUI/1nsljmV/jfqNkLZXFw8uMO8nNlfoHmSevNf6fO3neuhyDvx9dv3c/Ytt8r/431SL8Qax1dpYvOMZTg==}
     cpu: [ppc64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-riscv64-gnu@4.60.3':
-    resolution: {integrity: sha512-oZJ/WHaVfHUiRAtmTAeo3DcevNsVvH8mbvodjZy7D5QKvCefO371SiKRpxoDcCxB3PTRTLayWBkvmDQKTcX/sw==}
+  '@rollup/rollup-linux-riscv64-gnu@4.65.0':
+    resolution: {integrity: sha512-Vblw84TbX7RS4la1Y4+yQ7aore/oSyaNtFbppuBr5Vs/4LfBeXKq9dIfoExw6zOvRERqd2rRAjnZRaMhH/0x5w==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-riscv64-musl@4.60.3':
-    resolution: {integrity: sha512-Dhbyh7j9FybM3YaTgaHmVALwA8AkUwTPccyCQ79TG9AJUsMQqgN1DDEZNr4+QUfwiWvLDumW5vdwzoeUF+TNxQ==}
+  '@rollup/rollup-linux-riscv64-musl@4.65.0':
+    resolution: {integrity: sha512-7+gHjtONvKgwR9InTKFaLq53f6YzBJkgeMRBENdWTsQr+spahGqQm8HF5aXpq8i4JaRrOqYyv6Zn1WltDTxaZQ==}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-s390x-gnu@4.60.3':
-    resolution: {integrity: sha512-cJd1X5XhHHlltkaypz1UcWLA8AcoIi1aWhsvaWDskD1oz2eKCypnqvTQ8ykMNI0RSmm7NkTdSqSSD7zM0xa6Ig==}
+  '@rollup/rollup-linux-s390x-gnu@4.65.0':
+    resolution: {integrity: sha512-KvNDC0J6s4vVHhtJ6KrDXU0Er0au/hmRIBq/+1maCV8TseGupeKizq0bWcrbp2HE1T8xoknvN0Q/KZ/YF0qX3w==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-x64-gnu@4.60.3':
-    resolution: {integrity: sha512-DAZDBHQfG2oQuhY7mc6I3/qB4LU2fQCjRvxbDwd/Jdvb9fypP4IJ4qmtu6lNjes6B531AI8cg1aKC2di97bUxA==}
+  '@rollup/rollup-linux-x64-gnu@4.65.0':
+    resolution: {integrity: sha512-GExdD15WPvu/x/drELjVam7vX8EsPgvTMOa/iJL/p/4m/oOqzbb7JXZg8fXR4hlXtg/sF2zyTZ3bR0AEtEMlhQ==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-x64-musl@4.60.3':
-    resolution: {integrity: sha512-cRxsE8c13mZOh3vP+wLDxpQBRrOHDIGOWyDL93Sy0Ga8y515fBcC2pjUfFwUe5T7tqvTvWbCpg1URM/AXdWIXA==}
+  '@rollup/rollup-linux-x64-musl@4.65.0':
+    resolution: {integrity: sha512-8sT9PemIZfIMED4Vd4KGoOXVDj5CMSWNcGdbheRUx9TYS03yOWdT2Q0lXPyEyNBB9YTilwewIQKNIBk6Nxi0Kg==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-openbsd-x64@4.60.3':
-    resolution: {integrity: sha512-QaWcIgRxqEdQdhJqW4DJctsH6HCmo5vHxY0krHSX4jMtOqfzC+dqDGuHM87bu4H8JBeibWx7jFz+h6/4C8wA5Q==}
+  '@rollup/rollup-openbsd-x64@4.65.0':
+    resolution: {integrity: sha512-pO6Ehi0jo5yE0R6PltKhJhv9mlIiyzBJk5N5NUF2OF6xtVKI+1bdXxj/rb0jGXy3hck1ELVT0QPY3tzkAm360w==}
     cpu: [x64]
     os: [openbsd]
 
-  '@rollup/rollup-openharmony-arm64@4.60.3':
-    resolution: {integrity: sha512-AaXwSvUi3QIPtroAUw1t5yHGIyqKEXwH54WUocFolZhpGDruJcs8c+xPNDRn4XiQsS7MEwnYsHW2l0MBLDMkWg==}
+  '@rollup/rollup-openharmony-arm64@4.65.0':
+    resolution: {integrity: sha512-vo7N3/+cjjPDYr8vtxC+qSNgWa9sDvJ7g8N8R5SWqFY4WiNH1ULcAU70SKVyHeiIZOYYwNP9pTipmhN5sl1NPw==}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rollup/rollup-win32-arm64-msvc@4.60.3':
-    resolution: {integrity: sha512-65LAKM/bAWDqKNEelHlcHvm2V+Vfb8C6INFxQXRHCvaVN1rJfwr4NvdP4FyzUaLqWfaCGaadf6UbTm8xJeYfEg==}
+  '@rollup/rollup-win32-arm64-msvc@4.65.0':
+    resolution: {integrity: sha512-ArwvgFAbjKcDM7qqotZ4OVYf+UMT9xH2YzkCzK4+AuZSDihMlz1Ekoe4INwBVXzn2mnJzuIYOcSx07iTBijGRQ==}
     cpu: [arm64]
     os: [win32]
 
-  '@rollup/rollup-win32-ia32-msvc@4.60.3':
-    resolution: {integrity: sha512-EEM2gyhBF5MFnI6vMKdX1LAosE627RGBzIoGMdLloPZkXrUN0Ckqgr2Qi8+J3zip/8NVVro3/FjB+tjhZUgUHA==}
+  '@rollup/rollup-win32-ia32-msvc@4.65.0':
+    resolution: {integrity: sha512-QGMmK4/cxKE/36FoLMSHQBCyymv/eFTnsCvvsBF0rgmOvVbvX78VWZRerL3dHa77f4pM6Xcc2iGDhJ10w/svKQ==}
     cpu: [ia32]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-gnu@4.60.3':
-    resolution: {integrity: sha512-E5Eb5H/DpxaoXH++Qkv28RcUJboMopmdDUALBczvHMf7hNIxaDZqwY5lK12UK1BHacSmvupoEWGu+n993Z0y1A==}
+  '@rollup/rollup-win32-x64-gnu@4.65.0':
+    resolution: {integrity: sha512-XfKYFWHIPs4HPODIMsGF1IKlS3H1e3WokUZIgpmn4+uNnZBlnRDDHEylNyazbQXwhMKZre68OjtRYbKqb5+j8w==}
     cpu: [x64]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-msvc@4.60.3':
-    resolution: {integrity: sha512-hPt/bgL5cE+Qp+/TPHBqptcAgPzgj46mPcg/16zNUmbQk0j+mOEQV/+Lqu8QRtDV3Ek95Q6FeFITpuhl6OTsAA==}
+  '@rollup/rollup-win32-x64-msvc@4.65.0':
+    resolution: {integrity: sha512-wPWi++K4Bs1VR4XihOhfGi4IGX6Cub7FlerTf8X2v+2BtDHddgSqWCXwGD+h2yAe4/niIhNDwAltioOC+wEogQ==}
     cpu: [x64]
     os: [win32]
 
   '@scure/base@2.2.0':
     resolution: {integrity: sha512-b8XEupJibegiXV+tDUseI8oLQc8ei3d/4Jkb2RpbHh3MfE054ov3uIz2dhFkB3FI8iwYkEh0gGCApkrYggkPNg==}
 
-  '@simplewebauthn/browser@13.3.0':
-    resolution: {integrity: sha512-BE/UWv6FOToAdVk0EokzkqQQDOWtNydYlY6+OrmiZ5SCNmb41VehttboTetUM3T/fr6EAFYVXjz4My2wg230rQ==}
+  '@simplewebauthn/browser@14.0.0':
+    resolution: {integrity: sha512-1odWVqeEBTl7lJ9zMKLEsmTlnyrDO5iRcTvfMKKk1WThUnp/i8JJdffdj2icP+tty159s4PgwE3BiMoEW9NFow==}
 
-  '@simplewebauthn/server@13.3.3':
-    resolution: {integrity: sha512-LelX/lcy5cjc15A86i/aNxHhB5eU7dd20QsbP0VLAf9e38+SLlsnqCCyecx3xqfGofhmX05h1J9fKRYWxw+luA==}
+  '@simplewebauthn/server@14.0.3':
+    resolution: {integrity: sha512-D39/0fiDiYmGV+nraY9s63D1Ho2AX/waMLy22/9gUadTUuvbAnstfb4bpbHYbwZuV5ZLDYN1SmzDKuiHzKAA4Q==}
     engines: {node: '>=20.0.0'}
 
   '@sindresorhus/is@7.2.0':
@@ -1905,184 +2030,275 @@ packages:
   '@speed-highlight/core@1.2.15':
     resolution: {integrity: sha512-BMq1K3DsElxDWawkX6eLg9+CKJrTVGCBAWVuHXVUV2u0s2711qiChLSId6ikYPfxhdYocLNt3wWwSvDiTvFabw==}
 
-  '@standard-schema/spec@1.1.0':
-    resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
+  '@tailwindcss/node@4.3.3':
+    resolution: {integrity: sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==}
+
+  '@tailwindcss/oxide-android-arm64@4.3.3':
+    resolution: {integrity: sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==}
+    engines: {node: '>= 20'}
+    cpu: [arm64]
+    os: [android]
+
+  '@tailwindcss/oxide-darwin-arm64@4.3.3':
+    resolution: {integrity: sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==}
+    engines: {node: '>= 20'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@tailwindcss/oxide-darwin-x64@4.3.3':
+    resolution: {integrity: sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==}
+    engines: {node: '>= 20'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@tailwindcss/oxide-freebsd-x64@4.3.3':
+    resolution: {integrity: sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==}
+    engines: {node: '>= 20'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@tailwindcss/oxide-linux-arm-gnueabihf@4.3.3':
+    resolution: {integrity: sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==}
+    engines: {node: '>= 20'}
+    cpu: [arm]
+    os: [linux]
+
+  '@tailwindcss/oxide-linux-arm64-gnu@4.3.3':
+    resolution: {integrity: sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==}
+    engines: {node: '>= 20'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@tailwindcss/oxide-linux-arm64-musl@4.3.3':
+    resolution: {integrity: sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==}
+    engines: {node: '>= 20'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@tailwindcss/oxide-linux-x64-gnu@4.3.3':
+    resolution: {integrity: sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==}
+    engines: {node: '>= 20'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@tailwindcss/oxide-linux-x64-musl@4.3.3':
+    resolution: {integrity: sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==}
+    engines: {node: '>= 20'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@tailwindcss/oxide-wasm32-wasi@4.3.3':
+    resolution: {integrity: sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==}
+    engines: {node: '>=14.0.0'}
+    cpu: [wasm32]
+    bundledDependencies:
+      - '@napi-rs/wasm-runtime'
+      - '@emnapi/core'
+      - '@emnapi/runtime'
+      - '@tybys/wasm-util'
+      - '@emnapi/wasi-threads'
+      - tslib
+
+  '@tailwindcss/oxide-win32-arm64-msvc@4.3.3':
+    resolution: {integrity: sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==}
+    engines: {node: '>= 20'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@tailwindcss/oxide-win32-x64-msvc@4.3.3':
+    resolution: {integrity: sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==}
+    engines: {node: '>= 20'}
+    cpu: [x64]
+    os: [win32]
+
+  '@tailwindcss/oxide@4.3.3':
+    resolution: {integrity: sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==}
+    engines: {node: '>= 20'}
+
+  '@tailwindcss/vite@4.3.3':
+    resolution: {integrity: sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw==}
+    peerDependencies:
+      vite: ^8.2.4
 
   '@thaunknown/thirty-two@1.0.6':
     resolution: {integrity: sha512-Uz2kFb0cNeHg7hds8BtI/umcwzaSMUdbkeQgZrIZQbp3gWRFjrvrvBHNEB6SQYChVxC3rWHovKx1Ya/vSRRMYA==}
     engines: {node: '>=0.2.6'}
 
-  '@tiptap/core@3.31.0':
-    resolution: {integrity: sha512-SY3yE2ACharFvk0BKgotV6SbwV8R4tN5fGtWOM6deY4JNF3v6CXOD78RFwjs2HSohGWBRyJVPDvrX9nfi8Nsxg==}
+  '@tiptap/core@3.32.0':
+    resolution: {integrity: sha512-Ghh2h02GKSqzytQGcLV4espYOG4EHxjj0MsrUB2Vnr47xmlZYRf6r7k2J09H+JpBdaGrWwrTkyBEi5i3c3yy2Q==}
     peerDependencies:
-      '@tiptap/pm': 3.31.0
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-blockquote@3.31.0':
-    resolution: {integrity: sha512-E1EcYp28NOEKLkMqf9Z4t/ZjVO5hOX/c5r9nu/sfp5+KePj4TaxGDcruijP5DYJuKxlsZx2lr6/lldiK9KilXw==}
+  '@tiptap/extension-blockquote@3.32.0':
+    resolution: {integrity: sha512-wmuthEdlYVArNoUbqFPH35giutBABFu7fqEB0lTD1k0UXJUs4dFvcbRyGWWgnHFZgP3TT4u8e+xiayYw0eQ0NQ==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-bold@3.31.0':
-    resolution: {integrity: sha512-KB3V3/8/XSrXNM0m7Svgg8xjwG/mr9nYh0krGznmDK1eArxj2GQd5h2g0QiBy8e+G//NMEbWQxSKbhKUKz7aoQ==}
+  '@tiptap/extension-bold@3.32.0':
+    resolution: {integrity: sha512-SQYewnYDoIBN+8oH53IDcD8p+Pz+Jnyq3hrxjy/FAo5ctc+96d3ZLdqc9gzLVSqFFo/SUINv2FVGoq9PvU7yqw==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-bubble-menu@3.31.0':
-    resolution: {integrity: sha512-CNuyfYH2KfcREASRh280UkGqYTwuKlMNcyBR7KsZrpzAVwFVo9D6qMkE6/q7I8mNMt2+/Xebe9UFZIYnVccCJA==}
+  '@tiptap/extension-bubble-menu@3.32.0':
+    resolution: {integrity: sha512-X3ll8i9Z8QNvt7+tcqlwopJG+68ugO13Av0Ox4Ico+jXcTnFdDuKQJBSI9sLuMR5vTQOeTHhKYXhjF88aahMSA==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-bullet-list@3.31.0':
-    resolution: {integrity: sha512-jLrzWDzBhfeOK/idnrpyncTuRamBNGCscDC7omG1S+CD3CFuDrp5Ws2tcv5fgASt2Vc/f9Y9zC+gOPkeIEpYFA==}
+  '@tiptap/extension-bullet-list@3.32.0':
+    resolution: {integrity: sha512-Y5P/l06pVCUG46vXpBl3z0fW2b6JpSMX4Cvr+5sfQh8zB3TxwSiLQaaPwI3R5MFD1KfRk3AjiPRieEyXdWcNHw==}
     peerDependencies:
-      '@tiptap/extension-list': 3.31.0
+      '@tiptap/extension-list': 3.32.0
 
-  '@tiptap/extension-code-block@3.31.0':
-    resolution: {integrity: sha512-y/A6N96gBPjEHqVYZ3u/yO/Anyo92iDWgYqShMXAvHprn2Ipmn32wIkX05Kv983fa6j6ySXF7A1nJdHcGCl5aQ==}
+  '@tiptap/extension-code-block@3.32.0':
+    resolution: {integrity: sha512-9NZW/yXP9j9XKr+hRS5m58xiyZI+tQo1PJ7eLHXjGNFWaF601NG/h6741mbKh5uCY51XsbyqG+7que+RavngPA==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-code@3.31.0':
-    resolution: {integrity: sha512-QWo9oItNzyzNMXoCOG4/PiCNYoTjhUKtI5NE7iRJhd9op3KsLoyIO+og+P+0ORxG59Ic76SkXl2/lILaVsB48g==}
+  '@tiptap/extension-code@3.32.0':
+    resolution: {integrity: sha512-I+aEVl0dTmkfnU6HzBGEefb9U7ja2MkucwBBwrmoMwU+uIKpC4xw8NcHC9X6sjAcom3Pxs2HX+8WEo4Vp13R/Q==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-color@3.31.0':
-    resolution: {integrity: sha512-5gfS5jl8DBZumwrBckWMsZLuMq1SBmcZHt/xlCwPbtUMFogE068YJq+BbxcgbJKx333G+2JWAO9ea6GyEkih8A==}
+  '@tiptap/extension-color@3.32.0':
+    resolution: {integrity: sha512-whRpuiEZ94FXBbFryWAYJ9rOQrLe4CVQ7GAjWDh+fpm5MJfjtshFvMXtGFIlcmo3e1XBzCcAetmk0zMKoIU0RA==}
     peerDependencies:
-      '@tiptap/extension-text-style': 3.31.0
+      '@tiptap/extension-text-style': 3.32.0
 
-  '@tiptap/extension-document@3.31.0':
-    resolution: {integrity: sha512-C2eDFoBlcRAb4sgbc9ZH+mrFFbjIS9VyoERGeDum3QRdqLEKU1h14Th7isHpGQzTvTywhXQxqXC64mgeSGXLsA==}
+  '@tiptap/extension-document@3.32.0':
+    resolution: {integrity: sha512-GugeKE6AnZDluRXJUNBuX43TPcaJxy5wck6vT2J4a0/EnKStJ43suSZZf1IPfb1ij9EL9bYvAwg9DOcrvdEzTQ==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-dropcursor@3.31.0':
-    resolution: {integrity: sha512-hIZOPfM0sGkAhPV69IK1zWMbWBd3wmhS0XCKBRcXUWrE2MW4kkaSyYprSFqtqFuUa3lVIEFrlME1WOEBJ2/2rg==}
+  '@tiptap/extension-dropcursor@3.32.0':
+    resolution: {integrity: sha512-t4Ug8hFLt30dwwYvrh63BVUt6N1Yg5PVI3tMllhCmN3Q68oD47v4MB/i5nGfzIsQqMyXUOetwHJWcZ4MoLTx4Q==}
     peerDependencies:
-      '@tiptap/extensions': 3.31.0
+      '@tiptap/extensions': 3.32.0
 
-  '@tiptap/extension-floating-menu@3.31.0':
-    resolution: {integrity: sha512-NFwv1Kah3zGLmjj53Z+pA2584GdgMDClgvebJPqSunsSdHwHlFwfu+Op1u73xuEYOd6wGgCgzzDZ3V4CKwkJqg==}
+  '@tiptap/extension-floating-menu@3.32.0':
+    resolution: {integrity: sha512-AzKCWceL+4Q1pTc8Whw1kPqN/aYGPQ70/jXPsblWl501t/pXi6Kz0Pi/NggKkuu73VGjykh68YYf/dcOJ/mPZQ==}
     peerDependencies:
       '@floating-ui/dom': ^1.0.0
-      '@tiptap/core': 3.31.0
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-gapcursor@3.31.0':
-    resolution: {integrity: sha512-TY1S9D9x86iIHiPiDU4KtRmLYTgE6RKa54jXubFyekUYFmgNfHuUunWmpK/Rvy6tkG1CKHNL7X+wdo8QXi+hcw==}
+  '@tiptap/extension-gapcursor@3.32.0':
+    resolution: {integrity: sha512-HUpKKWJLtthnpQY5LIjHlJJOmh562RusmOMIe/4iP/H7y+WUR9ZFiZjEs1NBkRjig9fwj8F3BfsrVPYBnM4nLA==}
     peerDependencies:
-      '@tiptap/extensions': 3.31.0
+      '@tiptap/extensions': 3.32.0
 
-  '@tiptap/extension-hard-break@3.31.0':
-    resolution: {integrity: sha512-e3e3YwTSxzO1bYalphs3A3zr+nYRWASMKFPzviO0C2P7vKE4kT4rvCYCWuUxIpfit8Vnh6TFVIkhrQ/6IFlDzw==}
+  '@tiptap/extension-hard-break@3.32.0':
+    resolution: {integrity: sha512-IKUYvK+bO2hGrDWhhTVg0CSh9C2belWg9GyLzvpyd3SZyQ9EgdccLfoytNjOBKbAE/TQ4Oo3kSP+XF6RsUIKPA==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-heading@3.31.0':
-    resolution: {integrity: sha512-ryQnvq2iUW2IwjbLniGlRZliNA5YserRTX2mCKyQcv8z/u062J01JDLlX73o47tu4DjuBzmkx6t5SsiXNODRcg==}
+  '@tiptap/extension-heading@3.32.0':
+    resolution: {integrity: sha512-XRiZxZuhfjvbgwCvoBHj04gOsPANEXxxRwrFCQVuFi5yeTHYIzMEioc81j6iAH9pV7aQeJCwLxuh6VHNz3dXEQ==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-horizontal-rule@3.31.0':
-    resolution: {integrity: sha512-RTKLnuEmGJOlxzLOmKo85hstXfuLlg+zQSKAggdD6BrSTDR5fdPZXnZTb/gDCo6chCR5BoKHu7Xv1spnPzRmEw==}
+  '@tiptap/extension-horizontal-rule@3.32.0':
+    resolution: {integrity: sha512-Iry7ynsG4xgcxnH1cm+uXJnEtUzoop4sGA10NUN9I+08TOjhj/GrDiRKMQHKAiVI/R7t2MVav1MJlxFf2FdzGw==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-image@3.31.0':
-    resolution: {integrity: sha512-oQyFPUl3N0eA/X+06km0m1qoV/4inoTDWxSEnGAj0ZP7LkIpjqLTjpp4VRSmflTwun8lXe9PGtqJh+oCKUv77Q==}
+  '@tiptap/extension-image@3.32.0':
+    resolution: {integrity: sha512-nv/YlOMwFUp2ItffQbHb14yAJjrn9sdxKl0WK5rH8PPiNoXVkvasieoBLNTHan9gjhrSp7LjVG2ZsMoSe/I7gg==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-italic@3.31.0':
-    resolution: {integrity: sha512-8Top75aMS9feCtKYADWOYLrJjx3SGvazETWZdEwDYDGZtEOB7q2+FxcRu2xi+K6Lx9LhzxS9ChULtNdBuRevkQ==}
+  '@tiptap/extension-italic@3.32.0':
+    resolution: {integrity: sha512-KB/i1xoHilbBGcQ+UotDWhi60KpdCde3RzRIpl2na0Yol4z4Fe2IRWg8ljIrlsssDRwel/fsHJbG7a13EP8oKA==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-link@3.31.0':
-    resolution: {integrity: sha512-arzZYxyf6in2BzdB3GR53VhSlE3ZwmY8CflXRo1xHpSpxq393myLP6FnaxLPxcfcScfOOsaYh2KAED0HJoBZfA==}
+  '@tiptap/extension-link@3.32.0':
+    resolution: {integrity: sha512-DRdQSgWPSEjrDg5EDBB5yxRygHtUVLhceVGzAsTz8RziiFyvcwAvzBHCO9hd9jutjCXQ2DLIuZB8P+aHhFWnpg==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-list-item@3.31.0':
-    resolution: {integrity: sha512-ayZa+KEMigJis0s8n3X3pqRxzsMuom9JoqE6byJ5NP2oaI2HOQ95yfcuILNKukg1nXG8vkgifEsXxjXz4O2o2g==}
+  '@tiptap/extension-list-item@3.32.0':
+    resolution: {integrity: sha512-FdJTCAeALixzyyGSSEmroXmkIEclbo/4t2Pl03aRERqpPOSPJcC3evDtIhLazTuP6v+FjCmJ+pXNql6ov7qitA==}
     peerDependencies:
-      '@tiptap/extension-list': 3.31.0
+      '@tiptap/extension-list': 3.32.0
 
-  '@tiptap/extension-list-keymap@3.31.0':
-    resolution: {integrity: sha512-bmZZmQyH0PibpIUA2thA3Cgm82cnrcC4oU4eNqiaoUqrva1NuOIqb71L2Br9keBnmtQKEtkzdODs4x+eI53kBg==}
+  '@tiptap/extension-list-keymap@3.32.0':
+    resolution: {integrity: sha512-vXFre18Dk2m5N/gjo408C02GSrolZ8ZIf0wz6/U8lNC4FcYOISgZFj3BND6uabVntGh2GCSPrVFuNpVPhFnn/A==}
     peerDependencies:
-      '@tiptap/extension-list': 3.31.0
+      '@tiptap/extension-list': 3.32.0
 
-  '@tiptap/extension-list@3.31.0':
-    resolution: {integrity: sha512-cED2TPewS3CtzZUdCZNG/qbc6vHJunKRzkFiT8x3RF+pmtIQlrPRH5Y9sbkzLt3yg0ua5KMGFtBH37AHaKUFDw==}
+  '@tiptap/extension-list@3.32.0':
+    resolution: {integrity: sha512-QdzS5nFz9agAQhBgIuQluobWib39W2cMKx1XB6tYSue7bHMJdgPFP0EnGfFajaeVX42CG6RXtQWrNfyQGKhBvg==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-ordered-list@3.31.0':
-    resolution: {integrity: sha512-KLCax7pI/3JTCkMY01n2+CXwZRPPsIVR1fvSmkFMryUPonkkMYWSUlXCuYKvF22+kM0gU0kiXsVjqsn/YFdeDg==}
+  '@tiptap/extension-ordered-list@3.32.0':
+    resolution: {integrity: sha512-htZ5hoMLBkGiDP6M5mGemjOoaBmkrj911wiGoTmMMKzO7qJq9QxUBkLY7ILPaKlUWL8U3ccLdDV2TB/nysp4Jg==}
     peerDependencies:
-      '@tiptap/extension-list': 3.31.0
+      '@tiptap/extension-list': 3.32.0
 
-  '@tiptap/extension-paragraph@3.31.0':
-    resolution: {integrity: sha512-78l9D/jpKvvWXrBBzYPfgqwonBY76+1MMgSovkPffIbya+jaYDJdZhIpeCZXtSBDnw8cYE/rheAeusN1QG3SVQ==}
+  '@tiptap/extension-paragraph@3.32.0':
+    resolution: {integrity: sha512-afKLMc7fWMkkar9H5FilizStSbhFzUoCzdwwdZf6DDsn3LUt8tJlFHACK78cAyx/TzMJBo0N8/8T1u9bL+N67Q==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-placeholder@3.31.0':
-    resolution: {integrity: sha512-zH1Z8xZX72P7wZ3HD6fUGJ7XTVWMgyN5Sy+OiD3tuuxfr/oUvS6ykaoGBdHGTMBdrXZpp+GfAcch1MrvLGn8oA==}
+  '@tiptap/extension-placeholder@3.32.0':
+    resolution: {integrity: sha512-TSjyQmVFq56gfURPotxbMsXU3seNTy9VzMACdb6b0bQ66yGWBcjBfWmhpiSRVLdBjQrRvl1+jQbWx0YPSCSpsw==}
     peerDependencies:
-      '@tiptap/extensions': 3.31.0
+      '@tiptap/extensions': 3.32.0
 
-  '@tiptap/extension-strike@3.31.0':
-    resolution: {integrity: sha512-M1X94ve0TNU7LrHCDn6nKf6vM8PEaKQt3FLTwhTIw5uTbx2Imw+uyRrySDdxLWHY/ul8x17I2w9MVLqK/D+Zvw==}
+  '@tiptap/extension-strike@3.32.0':
+    resolution: {integrity: sha512-J9Vw6wmh/wV6SxSsN9RhurvAGcXSY5J3p4EQrROD5PARBl0VOnDFi7/UVoz1RkSdqOKPgAiqDZpaLRgtdBO9Rg==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-text-align@3.31.0':
-    resolution: {integrity: sha512-40hsX0anPQv87M3rD8vncqBIgED2xWUDTU/uL1fKTgeOm5BeiPJupxAV41ttI96T1suEAlghaaYrjs28ElK1fQ==}
+  '@tiptap/extension-text-align@3.32.0':
+    resolution: {integrity: sha512-DdV/V86ds9VtQ1MkbovgI28xwSvOW03I8SexsaKljGqSN/HovBXEjlefSnbK4tlWmQLJPH9eNsxRcpHJMftYCA==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-text-style@3.31.0':
-    resolution: {integrity: sha512-eY8mIb/NS22sO1xJQqfzHtSdpL2UCQy1nbSCEohRUoW7eaP/nwp29x097+jjJnxg4LjLMsolyw11Q4mswbXDQQ==}
+  '@tiptap/extension-text-style@3.32.0':
+    resolution: {integrity: sha512-+U8FkrNAU45+fHgo4DYfndS/WuhhyttZ+zTyObF1W4VJ8wDiAYqXkl71nQcmMJyyK47yeNUY9CfjUomIaEHhpA==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-text@3.31.0':
-    resolution: {integrity: sha512-K+8nIKgNNBiL1+AarcuzvPoRpjuFk5qOe9MM/n9O3HyTTLeWNfRV/zFifcpSoHmhf0QvEAXqmnxDiIpyCpy9+g==}
+  '@tiptap/extension-text@3.32.0':
+    resolution: {integrity: sha512-sF0jIK67IHdZMnzv2mz5vPTyK7R0ui6/YZgFg+/bLnFCNmweVAoYcHZLlC7ISRnwu0mqJr+epNtzJepY1ZDCjg==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extension-underline@3.31.0':
-    resolution: {integrity: sha512-B4VK5nu0UdKl7OiMvIcjDPMYmhe8+v1B763Is/GzPSJOMstUHRqAqPx2AsPla6A4UGuZwTx//ajVa5QAGionZQ==}
+  '@tiptap/extension-underline@3.32.0':
+    resolution: {integrity: sha512-rMLdd4vg6sed/JnaXnaupLbCtYiWikTnQ8qir9ItKOXwf1Ui9P1Y4G0bYU4+gcnMsFzaSGtrOhMqG4/c66AogQ==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
+      '@tiptap/core': 3.32.0
 
-  '@tiptap/extensions@3.31.0':
-    resolution: {integrity: sha512-WOv9Y1VjhzAYycrIGPygwmLkoO/UdFYFE5uDWN+FJWMui5sLmLrmfKtOOYzeWIevxomFGix/wl5hqaVGIev1+g==}
+  '@tiptap/extensions@3.32.0':
+    resolution: {integrity: sha512-qO+ndNvlOjzU2MWCtQHoRg1tIortCXLvqPjDx58F1pUYFNCOVZegXi+jqLGDODUA31er+TVz66umzRbbN1bO1Q==}
     peerDependencies:
-      '@tiptap/core': 3.31.0
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/pm@3.31.0':
-    resolution: {integrity: sha512-JGPUSPLDFPjgFZHcNSghVJmEfvYp2SRPZQ1K8AZOuviEsUNvkYmJsBdudeYwUYNzYO38L4Yy0G6UMSuniBDIMg==}
+  '@tiptap/pm@3.32.0':
+    resolution: {integrity: sha512-H9eN+xHFboJybE7KPGVsu24S8aBlCIgYz38vCHRSnNv17nwmqm06owq/IQ5scza0n3Y7IfUfpgPOtm9SgeHmNQ==}
 
-  '@tiptap/starter-kit@3.31.0':
-    resolution: {integrity: sha512-P80nhDEsBf6EMTaRb/ld3BaQW7iqITPR6BiIjOjbO3QDivCz/rGDKSS6q4ngsXfXOpSBc/clo/g0OyAdA8+Q4Q==}
+  '@tiptap/starter-kit@3.32.0':
+    resolution: {integrity: sha512-aPYxaevci4PgMrTLsg+baiqI7M1ICd4V9H+zTTdrqs8OUZIbAvj/pNDuHU8uWZyKMu3Dh72t2D6ZdqRu/6aSWw==}
 
-  '@tiptap/vue-3@3.31.0':
-    resolution: {integrity: sha512-v/oIp43nvANe2upFMc/1JGPvMD6C7mY0JdiB7kUjFxjAnTmjVRxJY+4hJiJgoVXTiCyDaEJeEhPKLueDJfKYwg==}
+  '@tiptap/vue-3@3.32.0':
+    resolution: {integrity: sha512-FpYquLlZpfFzgWcQuOrXuUXDNn8YYomD3dLx92b61XxVMlwKkOH3p1XS/wlNNRBLaA7oSB5VRzy5E7EXtfgqpg==}
     peerDependencies:
       '@floating-ui/dom': ^1.0.0
-      '@tiptap/core': 3.31.0
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0
+      '@tiptap/pm': 3.32.0
       vue: ^3.0.0
 
   '@tybys/wasm-util@0.10.3':
@@ -2094,9 +2310,6 @@ packages:
   '@types/chai@5.2.3':
     resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
 
-  '@types/create-torrent@6.1.1':
-    resolution: {integrity: sha512-KCHRpqwMp+BsTebyR/5OCG4RmZ5s9w7iSpaarfKof3HEdd4eZxAt73dj20uZ2zgduoBQmYrzn+LLR34DgFxOfw==}
-
   '@types/css-tree@3.2.0':
     resolution: {integrity: sha512-J5KXmk6BFIepOT7280FdFyNs4c5fh0Uee0otjKEvzchrRs38Ii9qminqc4ds0L19X8Zd/rT+brR9jkBthygjWw==}
 
@@ -2106,9 +2319,6 @@ packages:
   '@types/esrecurse@4.3.1':
     resolution: {integrity: sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw==}
 
-  '@types/estree@1.0.8':
-    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
-
   '@types/estree@1.0.9':
     resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
 
@@ -2121,8 +2331,8 @@ packages:
   '@types/magnet-uri@5.1.5':
     resolution: {integrity: sha512-SbBjlb1KGe38VfjRR+mwqztJd/4skhdKkRbIzPDhTy7IAeEAPZWIVSEkZw00Qr4ZZOGR3/ATJ20WWPBfrKHGdA==}
 
-  '@types/node@24.13.3':
-    resolution: {integrity: sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==}
+  '@types/node@26.6.5':
+    resolution: {integrity: sha512-uMzsv9stDdofIZBx4UGh4Z9ZgXnGC9seRDscilBcTHAeOFk67MZg/k9bWVfO+bk4qZmG+l52hRnLwUiH2LnJTg==}
 
   '@types/parse-torrent@11.0.1':
     resolution: {integrity: sha512-rzk5O1sk/Fbu8grskEEbFb0FZyDdVIkreRs2br90Y5BNcExSAEeRJftqxvyniJcJzI1xRK4fWxS0PJfxVvVRVQ==}
@@ -2337,8 +2547,8 @@ packages:
       webpack:
         optional: true
 
-  '@vercel/nft@1.5.0':
-    resolution: {integrity: sha512-IWTDeIoWhQ7ZtRO/JRKH+jhmeQvZYhtGPmzw/QGDY+wDCQqfm25P9yIdoAFagu4fWsK4IwZXDFIjrmp5rRm/sA==}
+  '@vercel/nft@1.11.0':
+    resolution: {integrity: sha512-m1QFg+U+3yPOnP1xSYJ73UIRxLOXdts1JOhiOiyPYqEsALgrXFFINvgUaD6R6iNvaBFAjHllBCbkfx4FuOdpaA==}
     engines: {node: '>=20'}
     hasBin: true
 
@@ -2356,13 +2566,10 @@ packages:
       vite: ^8.2.4
       vue: ^3.2.25 || ^3.6.0-rc.10
 
-  '@vitest/expect@4.1.12':
-    resolution: {integrity: sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ==}
-
-  '@vitest/mocker@4.1.12':
-    resolution: {integrity: sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA==}
+  '@vitest/mocker@5.0.5':
+    resolution: {integrity: sha512-xLL3lkDegJZw+MGoGaCCsFayDZthGgpAtr3Vziyfc4p7xH89K7KRPcRBBh/kEYm0Aqkt5DtTmkYpBtRV/FrHZg==}
     peerDependencies:
-      msw: ^2.4.9
+      msw: ^2.4.9 || ^3.0.0
       vite: ^8.2.4
     peerDependenciesMeta:
       msw:
@@ -2370,20 +2577,8 @@ packages:
       vite:
         optional: true
 
-  '@vitest/pretty-format@4.1.12':
-    resolution: {integrity: sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==}
-
-  '@vitest/runner@4.1.12':
-    resolution: {integrity: sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w==}
-
-  '@vitest/snapshot@4.1.12':
-    resolution: {integrity: sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw==}
-
-  '@vitest/spy@4.1.12':
-    resolution: {integrity: sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg==}
-
-  '@vitest/utils@4.1.12':
-    resolution: {integrity: sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==}
+  '@vitest/spy@5.0.5':
+    resolution: {integrity: sha512-lwJRExuH417257Q5wv9QYugN9IMJkoxcrKrYxGPQkBzl7wlNpTUxD/5yNX4ESKVUIShKPgkGchYPFMWOOk0wzw==}
 
   '@volar/language-core@2.4.28':
     resolution: {integrity: sha512-w4qhIJ8ZSitgLAkVay6AbcnC7gP3glYM3fYwKV3srj8m494E3xtrCv6E+bWviiK/8hs6e6t1ij1s2Endql7vzQ==}
@@ -2477,8 +2672,8 @@ packages:
   '@vue/devtools-shared@8.2.1':
     resolution: {integrity: sha512-Fkac7lUdGReh6pVOi3AYPRGe82LQqRmAfThW7RRligOAP0ZA/Z1z9XLHDM9dv34pV2HRc79DK8uKPeG2fLnA/g==}
 
-  '@vue/language-core@3.3.11':
-    resolution: {integrity: sha512-QJmpliwAVpC/OxubIByPAhNzsQPRc8/gxlN2qnVzVfIMjMDz/9RnXRFoetjz5yEgXVXyp4LqhXq3V53PjmNzFw==}
+  '@vue/language-core@3.3.13':
+    resolution: {integrity: sha512-axA0Xemn5LuUKuKWob0/kVq7xQ2mJJM6VqA9Exvt35nM9yRC31goWVve/G/Zb2ZCLsXC8FHYjjfXlnshknSCew==}
 
   '@vue/reactivity@3.5.44':
     resolution: {integrity: sha512-u+QJdKeBBEADkPdevsL+6E12QlYVfBD8Zcw5qjDQKtamI6l14KyqazJMobhCKelhWN5zpyKUiEDoTyHE93cqWw==}
@@ -2501,16 +2696,19 @@ packages:
   '@vue/shared@3.5.44':
     resolution: {integrity: sha512-H82XLH0DjmSOdbEwO15x3QTo1f5PWEtv237eLpYKc0mqLu+B8hnq16lFWmuBmNurkeiG3wr+oM1FhOll/YVFRg==}
 
-  '@vueuse/core@14.4.0':
-    resolution: {integrity: sha512-X4WHz1HlCzCBoYXesUkifzzWBAcZgXG8Fi5iNPQg/epdzOB3gu8Fawj3hvuwYR1nGcXGnvxwYYcUC/71++svtQ==}
+  '@vueuse/core@15.0.0':
+    resolution: {integrity: sha512-Zv67h5mrk7YHDJsRObx+DXaCBz6RKBUpxqLesJ+3xZNPG6yuQs7ja7kg3veFrrouYLWAqydQ7CwGEbLVxB43Ng==}
+    engines: {node: '>=22'}
     peerDependencies:
       vue: ^3.5.0
 
-  '@vueuse/metadata@14.4.0':
-    resolution: {integrity: sha512-swx/255R6JyHZFJhx845iz5CRWDZdCfvkZOpACWc5+c5WHcG24mv8gUT1WIdFQaHt6dq79rvILd9QnCWiyVm9g==}
+  '@vueuse/metadata@15.0.0':
+    resolution: {integrity: sha512-sfWE5LADAKJ0KnjtGliMdSN8Ij/L7uP6rXIZlgPloAI4zvvefbw6H5Lt7KJA6RqQOYgVqWF5Guj50HHMIzygBg==}
+    engines: {node: '>=22'}
 
-  '@vueuse/shared@14.4.0':
-    resolution: {integrity: sha512-JRgY90Sz8DDtPMsaDflvPMp9xYk69JZAmbuDvAquUVXKr2gEjqtzGNTTthLfckH0BzBqvnu31gb4a8TGLRe79g==}
+  '@vueuse/shared@15.0.0':
+    resolution: {integrity: sha512-vbNXhGrbV53xPOMSyOzMHQRvhMgZf7oNDw2RChUetVxwTIEkInQ1joZ9JbT0G3z2n2AJNjvmCWeM9ySYrnvogA==}
+    engines: {node: '>=22'}
     peerDependencies:
       vue: ^3.5.0
 
@@ -2522,10 +2720,6 @@ packages:
     resolution: {integrity: sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==}
     engines: {node: '>=6.5'}
 
-  accepts@1.3.8:
-    resolution: {integrity: sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==}
-    engines: {node: '>= 0.6'}
-
   acorn-import-attributes@1.9.5:
     resolution: {integrity: sha512-n02Vykv5uA3eHGM/Z2dQrcD56kL8TyDb2p1+0P83PClMnC/nc+anbQRhIOWnSq4Ke/KvDPrY3C9hDtC/A3eHnQ==}
     peerDependencies:
@@ -2536,11 +2730,6 @@ packages:
     peerDependencies:
       acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
 
-  acorn@8.16.0:
-    resolution: {integrity: sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==}
-    engines: {node: '>=0.4.0'}
-    hasBin: true
-
   acorn@8.18.0:
     resolution: {integrity: sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==}
     engines: {node: '>=0.4.0'}
@@ -2576,9 +2765,6 @@ packages:
     resolution: {integrity: sha512-BJ8/l4R5LRE7hW9WdSuGYrLSHi2ynxeFpDFbH0K/CgNeY/tyhk+vO6TYxXC5r5CpUhNVX310xzPsN/H9lCdfOA==}
     engines: {node: '>=14'}
 
-  any-promise@1.3.0:
-    resolution: {integrity: sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
-
   anymatch@3.1.3:
     resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
     engines: {node: '>= 8'}
@@ -2591,9 +2777,6 @@ packages:
     resolution: {integrity: sha512-ZcbTaIqJOfCc03QwD468Unz/5Ir8ATtvAHsK+FdXbDIbGfihqh9mrvdcYunQzqn4HrvWWaFyaxJhGZagaJJpPQ==}
     engines: {node: '>= 14'}
 
-  arg@5.0.2:
-    resolution: {integrity: sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==}
-
   argparse@2.0.1:
     resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
 
@@ -2629,21 +2812,10 @@ packages:
   async@3.2.6:
     resolution: {integrity: sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==}
 
-  at-least-node@1.0.0:
-    resolution: {integrity: sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==}
-    engines: {node: '>= 4.0.0'}
-
   atomic-sleep@1.0.0:
     resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
     engines: {node: '>=8.0.0'}
 
-  autoprefixer@10.5.0:
-    resolution: {integrity: sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==}
-    engines: {node: ^10 || ^12 || >=14}
-    hasBin: true
-    peerDependencies:
-      postcss: ^8.5.23
-
   autoprefixer@10.6.1:
     resolution: {integrity: sha512-cL1Qz6ADZhcEbny/8HPfe99J6HhNoYtpX2LFLIbhgGE7Q1hlQVkYFdetDN7Id3KiQxhDrHwzlHr/YQCnZ8+xSA==}
     engines: {node: ^10 || ^12 || >=14}
@@ -2727,12 +2899,8 @@ packages:
     resolution: {integrity: sha512-sMm2sV5PRs0YOVk0LTKtjuIprVzxgTQUsrGX/7Yph2Rm4FO2Fqqtq7hNjsOB5xezM4v4+5rljCgK++UeQJZguA==}
     engines: {node: '>=12.20.0'}
 
-  bidi-js@1.0.3:
-    resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==}
-
-  binary-extensions@2.3.0:
-    resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
-    engines: {node: '>=8'}
+  bidi-js@1.1.0:
+    resolution: {integrity: sha512-fX1Onk0tdVPC7obPWB5EbJ1z7NVhLq4m2xZLq2YXBkxzMXIGRpNMU88n0EPgWseKl12J7zXs7qrDxPK4sRs2fg==}
 
   bindings@1.5.0:
     resolution: {integrity: sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==}
@@ -2749,15 +2917,9 @@ packages:
   birpc@4.2.0:
     resolution: {integrity: sha512-KxgKcZPfrtzJDDALHPguGpGJUrzdgpymyiQQgzFjWreHMOpWrnFNVREr5J48x2DBh8ZVioscrV1SBkDipGiX+Q==}
 
-  block-iterator@1.1.2:
-    resolution: {integrity: sha512-yAHUP44v2K25xLPdrgVTgwtuQctlullzjczu9CoUZom5AP3g4p1R1+aWHjS1GHG9JtcSUVUnbEPiuXiW5YZ24w==}
-
   bn.js@4.12.3:
     resolution: {integrity: sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==}
 
-  brace-expansion@1.1.21:
-    resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==}
-
   brace-expansion@2.1.7:
     resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==}
 
@@ -2807,22 +2969,6 @@ packages:
     resolution: {integrity: sha512-tixWYgm5ZoOD+3g6UTea91eow5z6AAHaho3g0V9CNSNb45gM8SmflpAc+GRd1InC4AqN/07Unrgp56Y94N9hJQ==}
     engines: {node: '>=20.19.0'}
 
-  cache-content-type@1.0.1:
-    resolution: {integrity: sha512-IKufZ1o4Ut42YUrZSo8+qnMTrFuKkvyoLXUywKz9GJ5BrhOFGhLdkx9sG4KAnVvbY6kEcSFjLQul+DVmBm2bgA==}
-    engines: {node: '>= 6.0.0'}
-
-  call-bind-apply-helpers@1.0.2:
-    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
-    engines: {node: '>= 0.4'}
-
-  call-bound@1.0.4:
-    resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
-    engines: {node: '>= 0.4'}
-
-  camelcase-css@2.0.1:
-    resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
-    engines: {node: '>= 6'}
-
   camelcase@5.3.1:
     resolution: {integrity: sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==}
     engines: {node: '>=6'}
@@ -2830,25 +2976,18 @@ packages:
   caniuse-api@4.0.0:
     resolution: {integrity: sha512-B0hQ1OLyJuHTQSOWXvwibWqM6DCoqJdvBA6X1S/53bd4XU7LJ1yurIPlrsouol3mw1jh9pGI4ivubSpmJeIqCA==}
 
-  caniuse-lite@1.0.30001792:
-    resolution: {integrity: sha512-hVLMUZFgR4JJ6ACt1uEESvQN1/dBVqPAKY0hgrV70eN3391K6juAfTjKZLKvOMsx8PxA7gsY1/tLMMTcfFLLpw==}
-
   caniuse-lite@1.0.30001809:
     resolution: {integrity: sha512-xxWVywk6a6Arlk+hymeycyn/VgqEfLDxupvhH/xiY5SJ/18kmi9o6MiO320DCUzypORHLtvh0I4i04tUhCNHNQ==}
 
   caniuse-lite@1.0.30001819:
     resolution: {integrity: sha512-LFUqIIAwpzsIuevnKnsR9qnStBcgzPShTX61lBwN9uFkkf8o8zLiebEjbW8AYtZiF+1YKDWfdt/pWDtMuG8Xwg==}
 
-  chai@6.2.2:
-    resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==}
+  chai@6.3.0:
+    resolution: {integrity: sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==}
     engines: {node: '>=18'}
 
-  chalk@4.1.2:
-    resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
-    engines: {node: '>=10'}
-
-  chart.js@4.5.1:
-    resolution: {integrity: sha512-GIjfiT9dbmHRiYi6Nl2yFCq7kkwdkp1W/lp2J99rX0yo9tgJGn3lKQATztIjb5tVtevcBtIdICNWqlq5+E8/Pw==}
+  chart.js@4.6.1:
+    resolution: {integrity: sha512-hJyniucsFmq//EvXYvJ6c6mahPoI3kaxdjVH8awTaJ/fDNWeSqqqArixMJWkWNN6fcYvPU3HneSANFNYtRi61g==}
     engines: {pnpm: '>=8'}
 
   chartjs-plugin-zoom@2.2.0:
@@ -2856,10 +2995,6 @@ packages:
     peerDependencies:
       chart.js: '>=3.2.0'
 
-  chokidar@3.6.0:
-    resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
-    engines: {node: '>= 8.10.0'}
-
   chokidar@5.0.0:
     resolution: {integrity: sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==}
     engines: {node: '>= 20.19.0'}
@@ -2881,10 +3016,6 @@ packages:
   cliui@6.0.0:
     resolution: {integrity: sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==}
 
-  cliui@8.0.1:
-    resolution: {integrity: sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==}
-    engines: {node: '>=12'}
-
   cliui@9.0.1:
     resolution: {integrity: sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w==}
     engines: {node: '>=20'}
@@ -2893,14 +3024,6 @@ packages:
     resolution: {integrity: sha512-rwHwUfXL40Chm1r08yrhU3qpUvdVlgkKNeyeGPOxnW8/SyVDvgRaed/Uz54AqWNaTCAThlj6QAs3TZcKI0xDEw==}
     engines: {node: '>=0.10.0'}
 
-  cluster-key-slot@1.1.2:
-    resolution: {integrity: sha512-RMr0FhtfXemyinomL4hrWcYJxmX6deFdCxpJzhDttxgO1+bcCnkk+9drydLVDmAMG7NE6aN/fl4F7ucU/90gAA==}
-    engines: {node: '>=0.10.0'}
-
-  co@4.6.0:
-    resolution: {integrity: sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==}
-    engines: {iojs: '>= 1.0.0', node: '>= 0.12.0'}
-
   color-convert@2.0.1:
     resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
     engines: {node: '>=7.0.0'}
@@ -2914,14 +3037,6 @@ packages:
   commander@2.20.3:
     resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==}
 
-  commander@4.1.1:
-    resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
-    engines: {node: '>= 6'}
-
-  commander@6.2.1:
-    resolution: {integrity: sha512-U7VdrJFnJgo4xjrHpTzu0yrHPGImdsmD95ZlgYSEajAn2JKzDhDTPG9kBTefmObL2w/ngeZnilk+OV9CG3d7UA==}
-    engines: {node: '>= 6'}
-
   commondir@1.0.1:
     resolution: {integrity: sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==}
 
@@ -2932,9 +3047,6 @@ packages:
     resolution: {integrity: sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg==}
     engines: {node: '>= 14'}
 
-  concat-map@0.0.1:
-    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
-
   confbox@0.1.8:
     resolution: {integrity: sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==}
 
@@ -2948,14 +3060,6 @@ packages:
     resolution: {integrity: sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA==}
     engines: {node: ^14.18.0 || >=16.10.0}
 
-  content-disposition@0.5.4:
-    resolution: {integrity: sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==}
-    engines: {node: '>= 0.6'}
-
-  content-type@1.0.5:
-    resolution: {integrity: sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==}
-    engines: {node: '>= 0.6'}
-
   convert-source-map@2.0.0:
     resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
 
@@ -2968,10 +3072,6 @@ packages:
   cookie-es@3.1.1:
     resolution: {integrity: sha512-UaXxwISYJPTr9hwQxMFYZ7kNhSXboMXP+Z3TRX6f1/NyaGPfuNUZOWP1pUEb75B2HjfklIYLVRfWiFZJyC6Npg==}
 
-  cookies@0.9.1:
-    resolution: {integrity: sha512-TG2hpqe4ELx54QER/S3HQ9SRVnQnGBtKUz5bLQWtYAQ+o6GpgMs6sYUvaiJjVxb+UXwhRhAEP3m7LbsIZ77Hmw==}
-    engines: {node: '>= 0.8'}
-
   core-util-is@1.0.3:
     resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==}
 
@@ -2984,11 +3084,6 @@ packages:
     resolution: {integrity: sha512-piICUB6ei4IlTv1+653yq5+KoqfBYmj9bw6LqXoOneTMDXk5nM1qt12mFW1caG3LlJXEKW1Bp0WggEmIfQB34g==}
     engines: {node: '>= 14'}
 
-  create-torrent@6.1.3:
-    resolution: {integrity: sha512-/XARuf6/TmOLICFkUU7pf4KPL/vlIFyk2xOJjQ4np8Xzl8xLt9W7KJps1EVnZyUCMHbAm5xYfCoDrgVw3F4FxA==}
-    engines: {node: '>=12'}
-    hasBin: true
-
   croner@10.0.1:
     resolution: {integrity: sha512-ixNtAJndqh173VQ4KodSdJEI6nuioBWI0V1ITNKhZZsO0pEMoDxz539T4FTTbSZ/xIOSuDnzxLVRqBVSvPNE2g==}
     engines: {node: '>=18.0'}
@@ -3003,14 +3098,17 @@ packages:
   crossws@0.3.5:
     resolution: {integrity: sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA==}
 
-  css-tree@3.2.1:
-    resolution: {integrity: sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA==}
-    engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0}
+  crossws@0.4.16:
+    resolution: {integrity: sha512-gKc2u346c6tZazImz8/4KkRRKW6cEHot3Z3+gzKNSkfHTWkYrXeiidMKYN0JnHqeszIs5++iDaVzP/pWl/efpw==}
+    peerDependencies:
+      srvx: '>=0.11.5'
+    peerDependenciesMeta:
+      srvx:
+        optional: true
 
-  cssesc@3.0.0:
-    resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==}
-    engines: {node: '>=4'}
-    hasBin: true
+  css-tree@3.2.1:
+    resolution: {integrity: sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA==}
+    engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0}
 
   cssnano@9.9.0:
     resolution: {integrity: sha512-JS914Th2NRk2979JHJvbE3UjPtLmyXtPnr23NNul9BOQwEt9r/A2aM1STrKtKHAPc3XRaUDwMoqkXnjEpgHkAw==}
@@ -3025,9 +3123,9 @@ packages:
     resolution: {integrity: sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A==}
     engines: {node: '>= 12'}
 
-  data-urls@7.0.0:
-    resolution: {integrity: sha512-23XHcCF+coGYevirZceTVD7NdJOqVn+49IHyxgszm+JIiHLoB2TkmPtsYkNWT1pvRSGkc35L6NHs0yHkN2SumA==}
-    engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
+  data-urls@8.0.0:
+    resolution: {integrity: sha512-JQUCCK+/CAGbGGx618PlFZMXH81Jtj7t73CHv9dd/zVWvxgGT2zLFRjnKb+Ng46GIwcy+f7f88qd4duqllK+WQ==}
+    engines: {node: ^22.14.0 || >=24.0.0}
 
   dateformat@4.6.3:
     resolution: {integrity: sha512-2P0p0pFGzHS5EMnhdxQi7aJN+iMheud0UhG4dlE1DLAlvL8JHjJJTX/CSm4JXwV0Ka5nGk3zC5mcb5bUQUxxMA==}
@@ -3055,14 +3153,6 @@ packages:
       sqlite3:
         optional: true
 
-  debug@3.2.7:
-    resolution: {integrity: sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==}
-    peerDependencies:
-      supports-color: '*'
-    peerDependenciesMeta:
-      supports-color:
-        optional: true
-
   debug@4.4.3:
     resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
     engines: {node: '>=6.0'}
@@ -3079,9 +3169,6 @@ packages:
   decimal.js@10.6.0:
     resolution: {integrity: sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==}
 
-  deep-equal@1.0.1:
-    resolution: {integrity: sha512-bHtC0iYvWhyaTzvV3CZgPeZQqCOBGyGsVV7v4eevpdkLHfiSrXUdBG+qAuSz4RI70sszvjQ1QSZ98An1yNwpSw==}
-
   deep-is@0.1.4:
     resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
 
@@ -3104,17 +3191,10 @@ packages:
   defu@6.1.7:
     resolution: {integrity: sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==}
 
-  delegates@1.0.0:
-    resolution: {integrity: sha512-bd2L678uiWATM6m5Z1VzNCErI3jiGzt6HGY8OVICs40JQq/HALfbyNJmp0UDakEY4pMMaN0Ly5om/B1VI/+xfQ==}
-
   denque@2.1.0:
     resolution: {integrity: sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw==}
     engines: {node: '>=0.10'}
 
-  depd@1.1.2:
-    resolution: {integrity: sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==}
-    engines: {node: '>= 0.6'}
-
   depd@2.0.0:
     resolution: {integrity: sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==}
     engines: {node: '>= 0.8'}
@@ -3122,10 +3202,6 @@ packages:
   destr@2.0.5:
     resolution: {integrity: sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==}
 
-  destroy@1.2.0:
-    resolution: {integrity: sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==}
-    engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16}
-
   detect-libc@2.1.2:
     resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
     engines: {node: '>=8'}
@@ -3137,8 +3213,17 @@ packages:
     resolution: {integrity: sha512-3woMEITftG1wKeO/4d/QXH1DVKctTSZg3jNGPpjp9hNr5Hos8MCFF5McTML5ZtgKDObm2R591B0spRp2IVernA==}
     engines: {node: '>=18'}
 
-  didyoumean@1.2.2:
-    resolution: {integrity: sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==}
+  devframe@1.2.6:
+    resolution: {integrity: sha512-mHzcm6ADzXgRMWdoSX+5PjwhmwAuC3SpDPi3+URznlpzxJF6tXwy5h1xr82zPKju38EVtdnYRnnP4hZwLK01vA==}
+    hasBin: true
+    peerDependencies:
+      '@devframes/agentic': 1.2.6
+      cac: ^7.0.0
+    peerDependenciesMeta:
+      '@devframes/agentic':
+        optional: true
+      cac:
+        optional: true
 
   diff@9.0.0:
     resolution: {integrity: sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw==}
@@ -3147,26 +3232,23 @@ packages:
   dijkstrajs@1.0.3:
     resolution: {integrity: sha512-qiSlmBq9+BCdCA/L46dw8Uy93mloxsPSbwnm5yrKn2vMPiy8KyAskTF6zuV/j5BMsmOGZDPs7KjU+mjb670kfA==}
 
-  dlv@1.1.3:
-    resolution: {integrity: sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==}
-
   dompurify@3.4.17:
     resolution: {integrity: sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==}
 
-  dot-prop@10.1.0:
-    resolution: {integrity: sha512-MVUtAugQMOff5RnBy2d9N31iG0lNwg1qAoAOn7pOK5wf94WIaE3My2p3uwTQuvS2AcqchkcR3bHByjaM0mmi7Q==}
+  dot-prop@10.2.0:
+    resolution: {integrity: sha512-BTJ9aZYL3vCfZlZOBLy9v8TUqWGQ0pzFnygKwFZt5udj6viBoFIBviKPUoZLDCPn1FoXffv6McQFDenrm5Krfw==}
     engines: {node: '>=20'}
 
   dotenv@17.4.2:
     resolution: {integrity: sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==}
     engines: {node: '>=12'}
 
-  drizzle-kit@0.31.10:
-    resolution: {integrity: sha512-7OZcmQUrdGI+DUNNsKBn1aW8qSoKuTH7d0mYgSP8bAzdFzKoovxEFnoGQp2dVs82EOJeYycqRtciopszwUf8bw==}
+  drizzle-kit@0.31.11:
+    resolution: {integrity: sha512-YCYqxTLIB2OCqf6w9/Vef13baBVbwQIPcbT4Y56AfO6B9ajZhDhD8Jkveg/hJvT/iuMloKD/IYYkyMMNhr7Kqg==}
     hasBin: true
 
-  drizzle-orm@0.45.2:
-    resolution: {integrity: sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q==}
+  drizzle-orm@0.45.4:
+    resolution: {integrity: sha512-NiM1YZpJ2UxyeE67DpDDZ+Tsw4YLX3trSlkNT7Tm9eKoUNb1LvaAaQzXgYQsWs+AQ9TUmmwMmBOCXuqqxUWKKQ==}
     peerDependencies:
       '@aws-sdk/client-rds-data': '>=3'
       '@cloudflare/workers-types': '>=4'
@@ -3174,6 +3256,7 @@ packages:
       '@libsql/client': '>=0.10.0'
       '@libsql/client-wasm': '>=0.10.0'
       '@neondatabase/serverless': '>=0.10.0'
+      '@netlify/db': '>=0.4.0'
       '@op-engineering/op-sqlite': '>=2'
       '@opentelemetry/api': ^1.4.1
       '@planetscale/database': '>=1.13'
@@ -3210,6 +3293,8 @@ packages:
         optional: true
       '@neondatabase/serverless':
         optional: true
+      '@netlify/db':
+        optional: true
       '@op-engineering/op-sqlite':
         optional: true
       '@opentelemetry/api':
@@ -3257,10 +3342,6 @@ packages:
       sqlite3:
         optional: true
 
-  dunder-proto@1.0.1:
-    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
-    engines: {node: '>= 0.4'}
-
   duplexer@0.1.2:
     resolution: {integrity: sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg==}
 
@@ -3285,10 +3366,6 @@ packages:
   emoji-regex@9.2.2:
     resolution: {integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==}
 
-  encodeurl@1.0.2:
-    resolution: {integrity: sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==}
-    engines: {node: '>= 0.8'}
-
   encodeurl@2.0.0:
     resolution: {integrity: sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==}
     engines: {node: '>= 0.8'}
@@ -3296,6 +3373,10 @@ packages:
   end-of-stream@1.4.5:
     resolution: {integrity: sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==}
 
+  enhanced-resolve@5.26.0:
+    resolution: {integrity: sha512-9vhedylFonb2YGogzUKX6+Ja72gOJbN1QHAqdrvqLwhdl/QWbKopzoUC9EbQNVsAns/bx/4uyqalrQAoy1IByw==}
+    engines: {node: '>=10.13.0'}
+
   entities@7.0.1:
     resolution: {integrity: sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==}
     engines: {node: '>=0.12'}
@@ -3316,10 +3397,6 @@ packages:
   errx@0.2.2:
     resolution: {integrity: sha512-HaPN6cxm6iZ9bIbQQ5orChcw7SY5smUzM08ZMc6OtV4UQhrrc3Ms1G8Ww2n/9lXkWqiioNTssF8bCvchrSbFEQ==}
 
-  es-define-property@1.0.1:
-    resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
-    engines: {node: '>= 0.4'}
-
   es-errors@1.3.0:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
@@ -3327,13 +3404,12 @@ packages:
   es-module-lexer@2.1.0:
     resolution: {integrity: sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==}
 
+  es-module-lexer@2.3.2:
+    resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==}
+
   es-module-lexer@3.0.4:
     resolution: {integrity: sha512-BldNY5mwkVu+cQ5Ymn3e6hB9Sx8XHx4ZevWbiUyZbfKxJxYO27Hf0wfzkxIaD5CAJMaGl3YspKELj0ff/7nCMA==}
 
-  es-object-atoms@1.1.1:
-    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
-    engines: {node: '>= 0.4'}
-
   esbuild@0.28.2:
     resolution: {integrity: sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==}
     engines: {node: '>=18'}
@@ -3435,13 +3511,10 @@ packages:
     resolution: {integrity: sha512-VyhnebXciFV2DESc+p6B+y0LjSm0krU4OgJN44qFAhBY0TJ+1V61tYD2+wHusZ6F9n5K+vl8k0sTy7PEfV4qpg==}
     engines: {node: '>=16.17'}
 
-  expect-type@1.3.0:
-    resolution: {integrity: sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==}
+  expect-type@1.4.0:
+    resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
     engines: {node: '>=12.0.0'}
 
-  exsolve@1.0.8:
-    resolution: {integrity: sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==}
-
   exsolve@1.1.1:
     resolution: {integrity: sha512-9U/jZUgjnSGyntRr6y5Muu1MJcwFl6kPu7k8qLF0IMNfLqvw0NZ4nnVDq0RVoZ0RvCyumib4Ez3KYrVfilrw+g==}
 
@@ -3471,9 +3544,6 @@ packages:
     resolution: {integrity: sha512-99jPl8JkCSCa4VlboNU1XuL98ijm74Pm9CGo6H4BoMVoVh1uhguQcvwLgXDT8Vkl2qj/UEQ0J9gD8beHjTFk1w==}
     hasBin: true
 
-  fast-readable-async-iterator@2.0.0:
-    resolution: {integrity: sha512-8Sld+DuyWRIftl86ZguJxR2oXCBccOiJxrY/Rj9/7ZBynW8pYMWzIcqxFL1da+25jaWJZVa+HHX/8SsA21JdTA==}
-
   fast-safe-stringify@2.1.1:
     resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==}
 
@@ -3538,20 +3608,37 @@ packages:
   fnv1a-64@0.1.2:
     resolution: {integrity: sha512-mJbcILTPybAR1jdOwt/lVv8N2cffeJFFP+gVbSAwLEx1ujXH27RpPd8Rokec/KX9c76UYIB6Co+H4lQzxPnJfA==}
 
-  fontaine@0.8.0:
-    resolution: {integrity: sha512-eek1GbzOdWIj9FyQH/emqW1aEdfC3lYRCHepzwlFCm5T77fBSRSyNRKE6/antF1/B1M+SfJXVRQTY9GAr7lnDg==}
-    engines: {node: '>=18.12.0'}
+  fontaine@1.0.3:
+    resolution: {integrity: sha512-mCeB9tcB2qeDJYVp/f55ZUQMOkOaZn4MFDlsCsy8Vggsju47egnH1+qzWwderp3BuX2EyezhdsjNX64df6M5mg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    peerDependencies:
+      postcss: ^8.5.23
+    peerDependenciesMeta:
+      postcss:
+        optional: true
 
   fontkitten@1.0.3:
     resolution: {integrity: sha512-Wp1zXWPVUPBmfoa3Cqc9ctaKuzKAV6uLstRqlR56kSjplf5uAce+qeyYym7F+PHbGTk+tCEdkCW6RD7DX/gBZw==}
     engines: {node: '>=20'}
 
-  fontless@0.2.1:
-    resolution: {integrity: sha512-mUWZ8w91/mw2KEcZ6gHNoNNmsAq9Wiw2IypIux5lM03nhXm+WSloXGUNuRETNTLqZexMgpt7Aj/v63qqrsWraQ==}
-    engines: {node: '>=18.12.0'}
+  fontless@1.3.4:
+    resolution: {integrity: sha512-GVj56LLcqGsBY9A2Pp2vJxmYFXNIAJUjPdLBFlJJXfKnZ/ta7mgT8a6kS2mx5tNsjWhhz6HiwSamzc2q80UpHQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
     peerDependencies:
+      devframe: ^1.2.0
+      jiti: ^2.6.1
+      lightningcss: ^1.33.0
+      subset-font: ^2.5.0
       vite: ^8.2.4
     peerDependenciesMeta:
+      devframe:
+        optional: true
+      jiti:
+        optional: true
+      lightningcss:
+        optional: true
+      subset-font:
+        optional: true
       vite:
         optional: true
 
@@ -3566,21 +3653,10 @@ packages:
   fraction.js@5.3.4:
     resolution: {integrity: sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==}
 
-  fresh@0.5.2:
-    resolution: {integrity: sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==}
-    engines: {node: '>= 0.6'}
-
   fresh@2.0.0:
     resolution: {integrity: sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==}
     engines: {node: '>= 0.8'}
 
-  fs-extra@9.1.0:
-    resolution: {integrity: sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==}
-    engines: {node: '>=10'}
-
-  fs.realpath@1.0.0:
-    resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
-
   fsevents@2.3.3:
     resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
@@ -3592,10 +3668,6 @@ packages:
   fuzzysort@4.0.2:
     resolution: {integrity: sha512-3c7yD6rK1EXIsqpcu1ZVzXJugODWNMzvUij6yTiziaAHrpNS8kzFOI9mJLE8pmG4K9JOaVgzQRgklfOEk8f4Tg==}
 
-  generator-function@2.0.1:
-    resolution: {integrity: sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==}
-    engines: {node: '>= 0.4'}
-
   generic-names@4.0.0:
     resolution: {integrity: sha512-ySFolZQfw9FoDb3ed9d80Cm9f0+r7qj+HJkWjeD9RBfpxEVTlVhol+gvaQB/78WbwYfbnNh8nWHHBSlg072y6A==}
 
@@ -3611,17 +3683,9 @@ packages:
     resolution: {integrity: sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==}
     engines: {node: '>=18'}
 
-  get-intrinsic@1.3.0:
-    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
-    engines: {node: '>= 0.4'}
-
   get-port-please@3.2.0:
     resolution: {integrity: sha512-I9QVvBw5U/hw3RmWpYKRumUeaDgxTPd401x364rLmWBJcOQ753eov1eTgzDqRG9bqFIfDc7gfzcQEWrUri3o1A==}
 
-  get-proto@1.0.1:
-    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
-    engines: {node: '>= 0.4'}
-
   get-stdin@10.0.0:
     resolution: {integrity: sha512-eWSePJ4zXFdqz+/Lyfopob4rIcoF/U2XfE8nJc7iZV6lnebWc9k7DoQQpX+2a9jc0AOvBsXvbe5YkjXl/MHbpg==}
     engines: {node: '>=20'}
@@ -3637,10 +3701,6 @@ packages:
     resolution: {integrity: sha512-GvHTWcykIR/fP8cj8dMpuMMkvaeJfPvYnhq0oW+chSeIr+ldX21ifU2Ms6KBoyKZQZmVaUAAhQ2EZ68KJF8a7A==}
     hasBin: true
 
-  giget@3.3.1:
-    resolution: {integrity: sha512-r+mvuDjrjMpsdw46Kmeydb8bdHm7wOKw8wNBtTndkjbPjgAp5oUJUxRE76wZFknxIPokfWvep2qSXK37aXE6zg==}
-    hasBin: true
-
   glob-parent@5.1.2:
     resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
     engines: {node: '>= 6'}
@@ -3658,22 +3718,14 @@ packages:
     resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==}
     engines: {node: 18 || 20 || >=22}
 
-  glob@7.2.3:
-    resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
-    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
-
   global-directory@4.0.1:
     resolution: {integrity: sha512-wHTUcDUoZ1H5/0iVqEudYW4/kAlN5cZ3j/bXn0Dpbizl9iaUVeWSHqiOjsgk6OW2bkLclbBjzewBz6weQ1zA2Q==}
     engines: {node: '>=18'}
 
-  globby@16.2.0:
-    resolution: {integrity: sha512-QrJia2qDf5BB/V6HYlDTs0I0lBahyjLzpGQg3KT7FnCdTonAyPy2RtY802m2k4ALx6Dp752f82WsOczEVr3l6Q==}
+  globby@16.2.4:
+    resolution: {integrity: sha512-c8B/VNLmxRcmqqenRA9t+9IyOjf9+V6lTxPaUJLqOCONdQkWZ0ETYgX0qbtJqPsgCNusT9MZ5Jeidw8Eb9tn2g==}
     engines: {node: '>=20'}
 
-  gopd@1.2.0:
-    resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
-    engines: {node: '>= 0.4'}
-
   graceful-fs@4.2.11:
     resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
 
@@ -3684,22 +3736,23 @@ packages:
   h3@1.15.11:
     resolution: {integrity: sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg==}
 
+  h3@2.0.8:
+    resolution: {integrity: sha512-ENuKlF9kC6E6PrvY1PUyE0qkrnnPTIt2/v48uyEEfTVfgoiqBCE0uwwf++2XrWwT1gxjQBDLQ8PAsmZVniKvTw==}
+    engines: {node: '>=20.19.0'}
+    hasBin: true
+    peerDependencies:
+      crossws: ^0.4.12
+      ocache: '>=0.3.0'
+    peerDependenciesMeta:
+      crossws:
+        optional: true
+      ocache:
+        optional: true
+
   hammerjs@2.0.8:
     resolution: {integrity: sha512-tSQXBXS/MWQOn/RKckawJ61vvsDpCom87JgxiYdGwHdOa0ht0vzUWDlfioofFCRU0L+6NGDt6XzbgoJvZkMeRQ==}
     engines: {node: '>=0.8.0'}
 
-  has-flag@4.0.0:
-    resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
-    engines: {node: '>=8'}
-
-  has-symbols@1.1.0:
-    resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
-    engines: {node: '>= 0.4'}
-
-  has-tostringtag@1.0.2:
-    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
-    engines: {node: '>= 0.4'}
-
   hasown@2.0.3:
     resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
     engines: {node: '>= 0.4'}
@@ -3716,21 +3769,9 @@ packages:
   hookable@6.1.2:
     resolution: {integrity: sha512-+abwxtiEA52GCVIsQqut3S/uKTbUwYIp4Pe/vv+6py5XiXBCqMZHg6pA6Y5qhgLSEys0/cYuPbO0z1QFj5ZCmg==}
 
-  html-encoding-sniffer@6.0.0:
-    resolution: {integrity: sha512-CV9TW3Y3f8/wT0BRFc1/KAVQ3TUHiXmaAb6VW9vtiMFf7SLoMd1PdAc4W3KFOFETBJUb90KatHqlsZMWV+R9Gg==}
-    engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
-
-  http-assert@1.5.0:
-    resolution: {integrity: sha512-uPpH7OKX4H25hBmU6G1jWNaqJGpTXxey+YOUizJUAgu0AjLUeC8D73hTrhvDS5D+GJN1DN1+hhc/eF/wpxtp0w==}
-    engines: {node: '>= 0.8'}
-
-  http-errors@1.6.3:
-    resolution: {integrity: sha512-lks+lVC8dgGyh97jxvxeYTWQFvh4uw4yC12gVl63Cg30sjPX4wuGcdkICVXDAESr6OJGjqGA8Iz5mkeN6zlD7A==}
-    engines: {node: '>= 0.6'}
-
-  http-errors@1.8.1:
-    resolution: {integrity: sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==}
-    engines: {node: '>= 0.6'}
+  html-encoding-sniffer@7.0.0:
+    resolution: {integrity: sha512-UikN5yr7xsCDAq87Or5or0PAlD3HJJOKVzM05az588WnpDJ4Ux7a2A53Qi6gofGg2/EtvF/H4hCi/TXfCW4Y6w==}
+    engines: {node: ^22.13.0 || >=24.0.0}
 
   http-errors@2.0.1:
     resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
@@ -3748,8 +3789,8 @@ packages:
     resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
     engines: {node: '>= 14'}
 
-  httpxy@0.5.1:
-    resolution: {integrity: sha512-JPhqYiixe1A1I+MXDewWDZqeudBGU8Q9jCHYN8ML+779RQzLjTi78HBvWz4jMxUD6h2/vUL12g4q/mFM0OUw1A==}
+  httpxy@0.5.6:
+    resolution: {integrity: sha512-iqc3nOxvNb5FxbhJozt8wNmHgjlmk4zzba512jMEXVwHCEBCbGAj49eGfy5PI8ts3/LFSFq8siiSNqwfY1AlfQ==}
 
   human-signals@5.0.0:
     resolution: {integrity: sha512-AXcZb6vzzrFAUE61HnN4mpLqd/cSIwNQjtNWR0euPm6y0iqx3G4gOXaIDdtdDwZmhwe82LA6+zinmW4UBWVePQ==}
@@ -3783,13 +3824,6 @@ packages:
     resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
     engines: {node: '>=0.8.19'}
 
-  inflight@1.0.6:
-    resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
-    deprecated: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
-
-  inherits@2.0.3:
-    resolution: {integrity: sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw==}
-
   inherits@2.0.4:
     resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
 
@@ -3797,8 +3831,8 @@ packages:
     resolution: {integrity: sha512-QQnnxNyfvmHFIsj7gkPcYymR8Jdw/o7mp5ZFihxn6h8Ci6fh3Dx4E1gPjpQEpIuPo9XVNY/ZUwh4BPMjGyL01g==}
     engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
 
-  ioredis@5.10.1:
-    resolution: {integrity: sha512-HuEDBTI70aYdx1v6U97SbNx9F1+svQKBDo30o0b9fw055LMepzpOOd0Ccg9Q6tbqmBSJaMuY0fB7yw9/vjBYCA==}
+  ioredis@5.11.1:
+    resolution: {integrity: sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A==}
     engines: {node: '>=12.22.0'}
 
   ioredis@6.0.0:
@@ -3811,19 +3845,10 @@ packages:
   iron-webcrypto@2.0.0:
     resolution: {integrity: sha512-rtffZKDUHciZElM8mjFCufBC7nVhCxHYyWHESqs89OioEDz4parOofd8/uhrejh/INhQFfYQfByS22LlezR9sQ==}
 
-  is-binary-path@2.1.0:
-    resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
-    engines: {node: '>=8'}
-
   is-core-module@2.16.2:
     resolution: {integrity: sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==}
     engines: {node: '>= 0.4'}
 
-  is-docker@2.2.1:
-    resolution: {integrity: sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==}
-    engines: {node: '>=8'}
-    hasBin: true
-
   is-docker@3.0.0:
     resolution: {integrity: sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -3833,17 +3858,10 @@ packages:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
 
-  is-file@1.0.0:
-    resolution: {integrity: sha512-ZGMuc+xA8mRnrXtmtf2l/EkIW2zaD2LSBWlaOVEF6yH4RTndHob65V4SwWWdtGKVthQfXPVKsXqw4TDUjbVxVQ==}
-
   is-fullwidth-code-point@3.0.0:
     resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
     engines: {node: '>=8'}
 
-  is-generator-function@1.1.2:
-    resolution: {integrity: sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==}
-    engines: {node: '>= 0.4'}
-
   is-glob@4.0.3:
     resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
     engines: {node: '>=0.10.0'}
@@ -3878,10 +3896,6 @@ packages:
   is-reference@1.2.1:
     resolution: {integrity: sha512-U82MsXXiFIrjCK4otLT+o2NA2Cd2g5MLoOVXUZjIOhLurrRxpEXzI8O0KZHr3IjLvlAH1kTPYSuqer5T9ZVBKQ==}
 
-  is-regex@1.2.1:
-    resolution: {integrity: sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==}
-    engines: {node: '>= 0.4'}
-
   is-stream@2.0.1:
     resolution: {integrity: sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==}
     engines: {node: '>=8'}
@@ -3890,10 +3904,6 @@ packages:
     resolution: {integrity: sha512-LnQR4bZ9IADDRSkvpqMGvt/tEJWclzklNgSw48V5EAaAeDd6qGvN8ei6k5p0tvxSR171VmGyHuTiAOfxAbr8kA==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
-  is-wsl@2.2.0:
-    resolution: {integrity: sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==}
-    engines: {node: '>=8'}
-
   is-wsl@3.1.1:
     resolution: {integrity: sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==}
     engines: {node: '>=16'}
@@ -3908,24 +3918,17 @@ packages:
     resolution: {integrity: sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==}
     engines: {node: '>=20'}
 
-  isomorphic-dompurify@4.1.0:
-    resolution: {integrity: sha512-vjQwQSxyEkJHO6g+KIDlWj8swAzUB01pJu9GU9cLGHjE10d59GFzJkgtB2Lj5WTOoq9JeHlYjR/FFuqeopPO0Q==}
+  isomorphic-dompurify@4.6.0:
+    resolution: {integrity: sha512-ZLYxxq2efNUsaUMViQXML/HMBkaJSd8WAFcNJQfWOGi+KLGQyZA8Ewpcj7yWur6KzMHlrZNXTXr8trbx/bkZRw==}
     engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}
 
   jackspeak@3.4.3:
     resolution: {integrity: sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==}
 
-  jiti@1.21.7:
-    resolution: {integrity: sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==}
-    hasBin: true
-
   jiti@2.7.0:
     resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
 
-  join-async-iterator@1.1.1:
-    resolution: {integrity: sha512-ATse+nuNeKZ9K1y27LKdvPe/GCe9R/u9dw9vI248e+vILeRK3IcJP4JUPAlSmKRCDK0cKhEwfmiw4Skqx7UnGQ==}
-
   joycon@3.1.1:
     resolution: {integrity: sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw==}
     engines: {node: '>=10'}
@@ -3936,15 +3939,12 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-tokens@9.0.1:
-    resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==}
-
   js-yaml@4.3.2:
     resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==}
     hasBin: true
 
-  jsdom@30.0.1:
-    resolution: {integrity: sha512-52v7mUVUfNQVYYqE1lcdaymWL0njO7lTLUog6ZvW2U5KsbiLk/GnZlVJ+qx0xfNJZ6Gn+KSpPNE52vurbxZwrA==}
+  jsdom@30.1.3:
+    resolution: {integrity: sha512-hQMUPvRgN7KxsfIytDQji7bimuJeRQa6Qo5+iuiZQk5CafeRxLIA10/cG5YCBFNpD9RO3oqIiN4CO1Y44kxqXg==}
     engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}
     peerDependencies:
       canvas: ^3.2.3
@@ -3975,23 +3975,12 @@ packages:
     resolution: {integrity: sha512-1e4qoRgnn448pRuMvKGsFFymUCquZV0mpGgOyIKNgD3JVDTsVJyRBGH/Fm0tBb8WsWGgmB1mDe6/yJMQM37DUA==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
-  jsonfile@6.2.1:
-    resolution: {integrity: sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==}
-
-  junk@4.0.1:
-    resolution: {integrity: sha512-Qush0uP+G8ZScpGMZvHUiRfI0YBWuB3gVBYlI0v0vvOJt5FLicco+IkP0a50LqTTQhmts/m6tP5SWE+USyIvcQ==}
-    engines: {node: '>=12.20'}
-
   jwa@2.0.1:
     resolution: {integrity: sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==}
 
   jws@4.0.1:
     resolution: {integrity: sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==}
 
-  keygrip@1.1.0:
-    resolution: {integrity: sha512-iYSchDJ+liQ8iwbSI2QqsQOvqv58eJCEanyJPJi+Khyu8smkcKSFUCbPwzFcL7YVtZ6eONjqRX/38caJ7QjRAQ==}
-    engines: {node: '>= 0.6'}
-
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
@@ -4006,25 +3995,6 @@ packages:
   knitwork@1.3.0:
     resolution: {integrity: sha512-4LqMNoONzR43B1W0ek0fhXMsDNW/zxa1NdFAVMY+k28pgZLovR4G3PB5MrpTxCy1QaZCqNoiaKPr5w5qZHfSNw==}
 
-  koa-compose@4.1.0:
-    resolution: {integrity: sha512-8ODW8TrDuMYvXRwra/Kh7/rJo9BtOfPc6qO8eAfC80CnCvSjSl0bkRM24X6/XBBEyj0v1nRUQ1LyOy3dbqOWXw==}
-
-  koa-convert@2.0.0:
-    resolution: {integrity: sha512-asOvN6bFlSnxewce2e/DK3p4tltyfC4VM7ZwuTuepI7dEQVcvpyFuBcEARu1+Hxg8DIwytce2n7jrZtRlPrARA==}
-    engines: {node: '>= 10'}
-
-  koa-send@5.0.1:
-    resolution: {integrity: sha512-tmcyQ/wXXuxpDxyNXv5yNNkdAMdFRqwtegBXUaowiQzUKqJehttS0x2j0eOZDQAyloAth5w6wwBImnFzkUz3pQ==}
-    engines: {node: '>= 8'}
-
-  koa-static@5.0.0:
-    resolution: {integrity: sha512-UqyYyH5YEXaJrf9S8E23GoJFQZXkBVJ9zYYMPGz919MSX1KuvAcycIuS0ci150HCoPf4XQVhQ84Qf8xRPWxFaQ==}
-    engines: {node: '>= 7.6.0'}
-
-  koa@2.16.4:
-    resolution: {integrity: sha512-3An0GCLDSR34tsCO4H8Tef8Pp2ngtaZDAZnsWJYelqXUK5wyiHvGItgK/xcSkmHLSTn1Jcho1mRQs2ehRzvKKw==}
-    engines: {node: ^4.8.4 || ^6.10.1 || ^7.10.1 || >= 8.1.4}
-
   launch-editor@2.14.2:
     resolution: {integrity: sha512-NHJEb30MGBCkmZXLZwz25t37QR4aY03ZzPYUJXOJaOa92uWwExI9SBQUuIznBYc1xkD7cJNGX7oc3Nl3sq2kQQ==}
 
@@ -4036,36 +4006,73 @@ packages:
     resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
     engines: {node: '>= 0.8.0'}
 
+  lightningcss-android-arm64@1.32.0:
+    resolution: {integrity: sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [android]
+
   lightningcss-android-arm64@1.33.0:
     resolution: {integrity: sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [android]
 
+  lightningcss-darwin-arm64@1.32.0:
+    resolution: {integrity: sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [darwin]
+
   lightningcss-darwin-arm64@1.33.0:
     resolution: {integrity: sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [darwin]
 
+  lightningcss-darwin-x64@1.32.0:
+    resolution: {integrity: sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [darwin]
+
   lightningcss-darwin-x64@1.33.0:
     resolution: {integrity: sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [darwin]
 
+  lightningcss-freebsd-x64@1.32.0:
+    resolution: {integrity: sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [freebsd]
+
   lightningcss-freebsd-x64@1.33.0:
     resolution: {integrity: sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [freebsd]
 
+  lightningcss-linux-arm-gnueabihf@1.32.0:
+    resolution: {integrity: sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm]
+    os: [linux]
+
   lightningcss-linux-arm-gnueabihf@1.33.0:
     resolution: {integrity: sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm]
     os: [linux]
 
+  lightningcss-linux-arm64-gnu@1.32.0:
+    resolution: {integrity: sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
   lightningcss-linux-arm64-gnu@1.33.0:
     resolution: {integrity: sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==}
     engines: {node: '>= 12.0.0'}
@@ -4073,6 +4080,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  lightningcss-linux-arm64-musl@1.32.0:
+    resolution: {integrity: sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
   lightningcss-linux-arm64-musl@1.33.0:
     resolution: {integrity: sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==}
     engines: {node: '>= 12.0.0'}
@@ -4080,6 +4094,13 @@ packages:
     os: [linux]
     libc: [musl]
 
+  lightningcss-linux-x64-gnu@1.32.0:
+    resolution: {integrity: sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
   lightningcss-linux-x64-gnu@1.33.0:
     resolution: {integrity: sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==}
     engines: {node: '>= 12.0.0'}
@@ -4087,6 +4108,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  lightningcss-linux-x64-musl@1.32.0:
+    resolution: {integrity: sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
   lightningcss-linux-x64-musl@1.33.0:
     resolution: {integrity: sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==}
     engines: {node: '>= 12.0.0'}
@@ -4094,35 +4122,49 @@ packages:
     os: [linux]
     libc: [musl]
 
+  lightningcss-win32-arm64-msvc@1.32.0:
+    resolution: {integrity: sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [win32]
+
   lightningcss-win32-arm64-msvc@1.33.0:
     resolution: {integrity: sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [win32]
 
+  lightningcss-win32-x64-msvc@1.32.0:
+    resolution: {integrity: sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [win32]
+
   lightningcss-win32-x64-msvc@1.33.0:
     resolution: {integrity: sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [win32]
 
+  lightningcss@1.32.0:
+    resolution: {integrity: sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==}
+    engines: {node: '>= 12.0.0'}
+
   lightningcss@1.33.0:
     resolution: {integrity: sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==}
     engines: {node: '>= 12.0.0'}
 
-  lilconfig@3.1.3:
-    resolution: {integrity: sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==}
-    engines: {node: '>=14'}
-
-  lines-and-columns@1.2.4:
-    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
-
   linkifyjs@4.3.3:
     resolution: {integrity: sha512-P8aEP5U/D1/IlTY2OeYsErdwh9bGuLE30NcXtKEjgdHcahveQoQwM2yZNsioQHsWFz0P7KKudisbrzCgR0sDHg==}
 
-  listhen@1.10.0:
-    resolution: {integrity: sha512-kfz4C0OrC6IpaVMtYDJtf6PFjurxe9NBBoDAh/o2p587INryFOO4DQ9OetbCdDrWFt1m1CJKvYrzkGsuPHw8nQ==}
+  listhen@1.10.1:
+    resolution: {integrity: sha512-6nt/86SkqUQSLW1ofz8MxC6RhRMqOl3ONISe6qqvJ3xj09aJWQx6DhgSZpugs3PX4PXdOas/WD6A9jx6J2N19A==}
     hasBin: true
+    peerDependencies:
+      '@parcel/watcher': ^2.5.6
+    peerDependenciesMeta:
+      '@parcel/watcher':
+        optional: true
 
   loader-utils@3.3.1:
     resolution: {integrity: sha512-FMJTLMXfCLMLfJxcX9PFqX5qD88Z5MRGaZCVzfuqeZSPsyiBzs+pahDQjbIWz2QIzPZz0NX9Zy4FX3lmK6YHIg==}
@@ -4140,12 +4182,6 @@ packages:
     resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
     engines: {node: '>=10'}
 
-  lodash.defaults@4.2.0:
-    resolution: {integrity: sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ==}
-
-  lodash.isarguments@3.1.0:
-    resolution: {integrity: sha512-chi4NHZlZqZD18a0imDHnZPrDeBbTtVN7GXMwuGdRH9qotxAjYs3aVLKc7zNOG9eddR5Ksd8rvFEBc9SsggPpg==}
-
   lodash@4.18.1:
     resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==}
 
@@ -4156,12 +4192,19 @@ packages:
     resolution: {integrity: sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==}
     engines: {node: 20 || >=22}
 
+  lru-cache@11.5.3:
+    resolution: {integrity: sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==}
+    engines: {node: 20 || >=22}
+
   lru-cache@5.1.1:
     resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
 
   magic-regexp@0.10.0:
     resolution: {integrity: sha512-Uly1Bu4lO1hwHUW0CQeSWuRtzCMNO00CmXtS8N6fyvB3B979GOEEeAkiTUDsmbYLAbvpUS/Kt5c4ibosAzVyVg==}
 
+  magic-regexp@0.11.2:
+    resolution: {integrity: sha512-s4i7mq2jJnkB5J1HDX67GmdRoWrgo8tE0cL91bKO+HaquxyR5TiqkjVfLhgS2PXretsN/Gv9kSnRBgQxrLO/Qw==}
+
   magic-string-ast@1.0.3:
     resolution: {integrity: sha512-CvkkH1i81zl7mmb94DsRiFeG9V2fR2JeuK8yDgS8oiZSFa++wWLEgZ5ufEOyLHbvSbD1gTRKv9NdX69Rnvr9JA==}
     engines: {node: '>=20.19.0'}
@@ -4175,9 +4218,6 @@ packages:
   magic-string@1.4.3:
     resolution: {integrity: sha512-z12OxmaPGE0F4xlpGdjuAUckipLpQlTAuAmyGhNoD7ODpYUzvDfvtxUbjM/jwznyP178oju/KDdyi220wNJ0RQ==}
 
-  magicast@0.5.2:
-    resolution: {integrity: sha512-E3ZJh4J3S9KfwdjZhe2afj6R9lGIN5Pher1pF39UGrXRqq/VDaGVIGN13BjHd2u8B61hArAGOnso7nBOouW3TQ==}
-
   magicast@0.5.5:
     resolution: {integrity: sha512-UicdXN8zQ3JHlxVq+28afMXPr1z7WNY6+7EJnzTdQWkTAlMLF5fNCCKxJHBQwGaNGR11581EiQmQzx73+MvszA==}
 
@@ -4185,24 +4225,16 @@ packages:
     resolution: {integrity: sha512-PjS/xWnvq9RK6P/8+dWG7ka3mFGGt/R9xiq5A+P8a8MpE40Dw6yNyTdjCFuJHS3apn6p5bJUCzMSceW3VxezRA==}
     engines: {node: '>=12.20.0'}
 
-  marked@18.0.10:
-    resolution: {integrity: sha512-FJeH4bRpYoXiggcgriCGItKCSv3xkngJc4QCZ/rkQCogU3VYaLxYJoZl8Nw/b4+x7iij/pd+09mZ6A1dXzpL0A==}
+  marked@18.1.1:
+    resolution: {integrity: sha512-zEGgrtUG8crk+TrMacJSVABU4DYDDkS8uqgU3ohrn/2fW9C2AEfUrO3m6IhpIpQpl7YcVpiXXC9cSMWDANT3dg==}
     engines: {node: '>= 20'}
     hasBin: true
 
-  math-intrinsics@1.1.0:
-    resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
-    engines: {node: '>= 0.4'}
-
   mdn-data@2.27.1:
     resolution: {integrity: sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==}
 
-  media-typer@0.3.0:
-    resolution: {integrity: sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==}
-    engines: {node: '>= 0.6'}
-
-  mediainfo.js@0.3.7:
-    resolution: {integrity: sha512-mgsmb2GrCTAguVcTohW7KrF+QXNaihrbljj75pLWDQcTTQyqfGoZG4Dy++AZ+FDVCT14LHvVGC9SXxcF5VePag==}
+  mediainfo.js@0.3.8:
+    resolution: {integrity: sha512-34ruGC47ytdp5IE9lXx4Yj8XMxESbzqLxDGfnYXimnokxH+aavC/YqubakOKm0vwrC5ZisL55WMmud6R6TmjBw==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -4213,10 +4245,6 @@ packages:
     resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
     engines: {node: '>= 8'}
 
-  methods@1.1.2:
-    resolution: {integrity: sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==}
-    engines: {node: '>= 0.6'}
-
   microdiff@1.6.0:
     resolution: {integrity: sha512-w7JWt8Bno6I8h0rEqlxr4lNG4UbT1FVtWo42wWosIiaJ+rP3pXh7shCYDnyqBrYx36LJ1CZ64p8A62aVp0sJpQ==}
 
@@ -4224,24 +4252,16 @@ packages:
     resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
     engines: {node: '>=8.6'}
 
-  mime-db@1.52.0:
-    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
-    engines: {node: '>= 0.6'}
-
   mime-db@1.54.0:
     resolution: {integrity: sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==}
     engines: {node: '>= 0.6'}
 
-  mime-types@2.1.35:
-    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
-    engines: {node: '>= 0.6'}
-
   mime-types@3.0.2:
     resolution: {integrity: sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==}
     engines: {node: '>=18'}
 
-  mime@4.1.0:
-    resolution: {integrity: sha512-X5ju04+cAzsojXKes0B/S4tcYtFAJ6tTMuSPBEn9CPGlrWr8Fiw7qYeLT0XyH80HSoAoqWCaz+MWKh22P7G1cw==}
+  mime@4.1.1:
+    resolution: {integrity: sha512-YAApRsTpM2+gnUFHhRNGfkX8NK0V5xj1nyQLufGlwEI+eX4xRsTcel2IXDuMEGSGjBvzykNW4VuoEACgwYe7BQ==}
     engines: {node: '>=16'}
     hasBin: true
 
@@ -4256,9 +4276,6 @@ packages:
     resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
     engines: {node: 18 || 20 || >=22}
 
-  minimatch@3.1.5:
-    resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
-
   minimatch@5.1.9:
     resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==}
     engines: {node: '>=10'}
@@ -4303,9 +4320,6 @@ packages:
       vite:
         optional: true
 
-  mz@2.7.0:
-    resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
-
   nanoid@3.3.18:
     resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
@@ -4317,12 +4331,8 @@ packages:
   natural-compare@1.4.0:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
 
-  negotiator@0.6.3:
-    resolution: {integrity: sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==}
-    engines: {node: '>= 0.6'}
-
-  nitropack@2.13.4:
-    resolution: {integrity: sha512-tX7bT6zxNeMwkc6hxHiZeUoTOjVrcjoh1Z3cmxOlodIqjl4HISgqfGOmkWSayky3Nv9Z5+KQH52F8nmXJY5AAA==}
+  nitropack@2.13.5:
+    resolution: {integrity: sha512-Aq7c7Bd35CZloj1xZm4b4SonDzIDA5FUinMVQu61U6GHq2z8oZXbNiFCJYSPGvLUkkCXNx6Fzc/mS2kjJPgKyA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -4366,6 +4376,9 @@ packages:
   node-mock-http@1.0.4:
     resolution: {integrity: sha512-8DY+kFsDkNXy1sJglUfuODx1/opAGJGyrTuFqEoN90oRc2Vk0ZbD4K2qmKXBBEhZQzdKHIVfEJpDU8Ak2NJEvQ==}
 
+  node-mock-http@1.0.5:
+    resolution: {integrity: sha512-KQyt/wLjG3TAc7DOUhpqWzgd4ERxR80JOlTK5VE5R1S12IaPVN5qkj4klBce9HPG1Njuup4Sb5bljaT34lIyjw==}
+
   node-releases@2.0.53:
     resolution: {integrity: sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ==}
     engines: {node: '>=18'}
@@ -4406,7 +4419,7 @@ packages:
     hasBin: true
     peerDependencies:
       '@parcel/watcher': ^2.1.0
-      '@types/node': ^24.13.3
+      '@types/node': ^26.6.5
       rolldown: ~1.2.1
     peerDependenciesMeta:
       '@parcel/watcher':
@@ -4414,13 +4427,10 @@ packages:
       '@types/node':
         optional: true
 
-  object-assign@4.1.1:
-    resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
-    engines: {node: '>=0.10.0'}
-
-  object-hash@3.0.0:
-    resolution: {integrity: sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==}
-    engines: {node: '>= 6'}
+  nypm@0.6.11:
+    resolution: {integrity: sha512-wrVBTLWDu7nTUKGWplQebWOXWnhaIwyKQhBxobH/CGxJHoVw27r9vG5ba7kdZnxG+f4rC6dZd6m2oHmpkOcO7g==}
+    engines: {node: '>=18'}
+    hasBin: true
 
   object-identity@0.2.3:
     resolution: {integrity: sha512-2J8Joz2Tf7aaylhqFvIUJHNgpuGR38Hh75Voq9GzTbStBxJUaOtN0K1aOd3cV5qp+ij1pMqRbPrGCGMOyX303w==}
@@ -4460,17 +4470,10 @@ packages:
     resolution: {integrity: sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==}
     engines: {node: '>=12'}
 
-  only@0.0.2:
-    resolution: {integrity: sha512-Fvw+Jemq5fjjyWz6CpKx6w9s7xxqo3+JCyM0WXWeCSOboZ8ABkyvP8ID4CZuChA/wxSx+XSJmdOm8rGVyJ1hdQ==}
-
   open@11.0.0:
     resolution: {integrity: sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw==}
     engines: {node: '>=20'}
 
-  open@7.4.2:
-    resolution: {integrity: sha512-MVHddDVweXZF3awtlAS+6pgKLlm/JgxZ90+/NBurBoQctVOOB/zDdVjcyPzQ+0laDGbsWgrRkflI65sQeOgT9Q==}
-    engines: {node: '>=8'}
-
   optionator@0.9.4:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
@@ -4531,9 +4534,6 @@ packages:
   package-json-from-dist@1.0.1:
     resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
 
-  package-manager-detector@1.6.0:
-    resolution: {integrity: sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==}
-
   package-manager-detector@1.9.0:
     resolution: {integrity: sha512-zAMfbta9nPA8AKkA4WdmNAT8R8s6Dk0/xwPsqNnRidMFcLo1YkLuPDTgs2f64XdzS8vbLNnoJ+uUIkgbz7oRHA==}
 
@@ -4556,10 +4556,6 @@ packages:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
 
-  path-is-absolute@1.0.1:
-    resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
-    engines: {node: '>=0.10.0'}
-
   path-key@3.1.1:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
@@ -4579,12 +4575,6 @@ packages:
     resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==}
     engines: {node: 18 || 20 || >=22}
 
-  path-to-regexp@6.3.0:
-    resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
-
-  pathe@1.1.2:
-    resolution: {integrity: sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==}
-
   pathe@2.0.3:
     resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
@@ -4598,25 +4588,14 @@ packages:
     resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
     engines: {node: '>=8.6'}
 
-  picomatch@4.0.5:
-    resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
-    engines: {node: '>=12'}
-
   picomatch@4.0.7:
     resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
     engines: {node: '>=12'}
 
-  piece-length@2.0.1:
-    resolution: {integrity: sha512-dBILiDmm43y0JPISWEmVGKBETQjwJe6mSU9GND+P9KW0SJGUwoU/odyH1nbalOP9i8WSYuqf1lQnaj92Bhw+Ug==}
-
-  pify@2.3.0:
-    resolution: {integrity: sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==}
-    engines: {node: '>=0.10.0'}
-
-  pinia@4.0.3:
-    resolution: {integrity: sha512-XMQqpvjgG7LMqVhhFUzKLT4KEbsYbfZZ0CZU9PgdFm1O2VKBmIkykL8+SfNhOaT7sR0wT6BEgKT0YNDYWgmVRA==}
+  pinia@4.1.0:
+    resolution: {integrity: sha512-+5/HMuVjYQfKlCD5xQ7zfXn1xUzYFEa7pd0DQK5SaMfZCaFRTHlaH/c02N1FoGOdlzSiwf5EOPgJx//1QDw6gw==}
     peerDependencies:
-      '@vue/devtools-api': ^8.1.5
+      '@vue/devtools-api': ^8.2.1
       typescript: '>=5.6.0'
       vue: ^3.5.11
     peerDependenciesMeta:
@@ -4626,21 +4605,17 @@ packages:
   pino-abstract-transport@3.0.0:
     resolution: {integrity: sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==}
 
-  pino-pretty@13.1.3:
-    resolution: {integrity: sha512-ttXRkkOz6WWC95KeY9+xxWL6AtImwbyMHrL1mSwqwW9u+vLp/WIElvHvCSDg0xO/Dzrggz1zv3rN5ovTRVowKg==}
+  pino-pretty@13.2.0:
+    resolution: {integrity: sha512-jjghD1ML+Di/WxjJDz6j6Y4FT7hIXOlb8h27AyJ+ohtAXJXH4PS/xkv7si+RCCIW59HMgZsMKTDgzdr0RhuRrg==}
     hasBin: true
 
   pino-std-serializers@7.1.0:
     resolution: {integrity: sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==}
 
-  pino@10.3.1:
-    resolution: {integrity: sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==}
+  pino@10.4.0:
+    resolution: {integrity: sha512-bk1ZMTwG/Vymx+zPoa28MhNzucFvXJWp3csrSuxuHPSMeUettaCoQ5Jvg07mtC4JGNpcfTwz41oVCnNgBK9+vA==}
     hasBin: true
 
-  pirates@4.0.7:
-    resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
-    engines: {node: '>= 6'}
-
   pkg-types@1.3.1:
     resolution: {integrity: sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==}
 
@@ -4654,66 +4629,12 @@ packages:
     resolution: {integrity: sha512-40QW5YalBNfQo5yRYmiw7Yz6TKKVr3h6970B2YE+3fQpsWcrbj1PzJgxeJ19DRQjhMbKPIuMY8rFaXc8moolVw==}
     engines: {node: '>=10.13.0'}
 
-  portfinder@1.0.38:
-    resolution: {integrity: sha512-rEwq/ZHlJIKw++XtLAO8PPuOQA/zaPJOZJ37BVuN97nLpMJeuDVLVGRwbFoBgLudgdTMP2hdRJP++H+8QOA3vg==}
-    engines: {node: '>= 10.12'}
-
   postcss-calc@11.2.3:
     resolution: {integrity: sha512-pFW3MR2a4W7uHcSGUiyQGGXZWHon83ljbNwnUJ1mRKublWQbv+3o9NiqhlV4TJfNby+U+zLY2OgiywzhA5eFqw==}
     engines: {node: ^22.22.3 || ^24.15 || >=26.0}
     peerDependencies:
       postcss: ^8.5.23
 
-  postcss-import@15.1.0:
-    resolution: {integrity: sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==}
-    engines: {node: '>=14.0.0'}
-    peerDependencies:
-      postcss: ^8.5.23
-
-  postcss-js@4.1.0:
-    resolution: {integrity: sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==}
-    engines: {node: ^12 || ^14 || >= 16}
-    peerDependencies:
-      postcss: ^8.5.23
-
-  postcss-load-config@6.0.1:
-    resolution: {integrity: sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==}
-    engines: {node: '>= 18'}
-    peerDependencies:
-      jiti: '>=1.21.0'
-      postcss: ^8.5.23
-      tsx: ^4.8.1
-      yaml: ^2.4.2
-    peerDependenciesMeta:
-      jiti:
-        optional: true
-      postcss:
-        optional: true
-      tsx:
-        optional: true
-      yaml:
-        optional: true
-
-  postcss-nested@6.2.0:
-    resolution: {integrity: sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==}
-    engines: {node: '>=12.0'}
-    peerDependencies:
-      postcss: ^8.5.23
-
-  postcss-nesting@13.0.2:
-    resolution: {integrity: sha512-1YCI290TX+VP0U/K/aFxzHzQWHWURL+CtHMSbex1lCdpXD1SoR2sYuxDu5aNI9lPoXpKTCggFZiDJbwylU0LEQ==}
-    engines: {node: '>=18'}
-    peerDependencies:
-      postcss: ^8.5.23
-
-  postcss-selector-parser@6.1.5:
-    resolution: {integrity: sha512-TEHFzb5KRDKaOgJ4TYE+0jyJtFbjLvkdVOu0fZ2b6MTWzoqZd4Le+61aEppWkvTlYePgOX4ATL1wsAIPMLTw6Q==}
-    engines: {node: '>=4'}
-
-  postcss-selector-parser@7.1.7:
-    resolution: {integrity: sha512-wWBro/7hJ40ye6TPiXkUQoXKCw23xSsjriUvqd7Uls9Sso3oLiON1flc18cCdnjgCRXw4fBVqUJJeOdDTh3P3g==}
-    engines: {node: '>=4'}
-
   postcss-value-parser@4.2.0:
     resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
 
@@ -4733,8 +4654,8 @@ packages:
     resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
     engines: {node: '>= 0.8.0'}
 
-  pretty-bytes@7.1.0:
-    resolution: {integrity: sha512-nODzvTiYVRGRqAOvE84Vk5JDPyyxsVk0/fbA/bq7RqlnhksGpset09XTxbpvLTIjoaF7K8Z8DG8yHtKGTPSYRw==}
+  pretty-bytes@7.2.0:
+    resolution: {integrity: sha512-T2kroepGB5DRVbkN/nOpW03+VRWqdtJhZNuCW3wYk3chdPjgi4GcTBOaxWfHq1MIM0ypidxsSWbQaAiRpxnXmg==}
     engines: {node: '>=20'}
 
   process-nextick-args@2.0.1:
@@ -4747,28 +4668,23 @@ packages:
     resolution: {integrity: sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==}
     engines: {node: '>= 0.6.0'}
 
-  prom-client@15.1.3:
-    resolution: {integrity: sha512-6ZiOBfCywsD4k1BN9IX0uZhF+tJkV8q8llP64G5Hajs4JOeVLPCwpPVcpXy3BwYiUGgyJzsJJQeOIv7+hDSq8g==}
-    engines: {node: ^16 || ^18 || >=20}
-    deprecated: prom-client has been replaced by @prometheus-io/client
-
   proper-lockfile@4.1.2:
     resolution: {integrity: sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==}
 
-  prosemirror-changeset@2.4.1:
-    resolution: {integrity: sha512-96WBLhOaYhJ+kPhLg3uW359Tz6I/MfcrQfL4EGv4SrcqKEMC1gmoGrXHecPE8eOwTVCJ4IwgfzM8fFad25wNfw==}
+  prosemirror-changeset@2.4.4:
+    resolution: {integrity: sha512-Gyuz9jYdrAeA9I7AholyOes9KUmv/lEwsC5O9s5xF5VB3EgTPsXMGUxz4+H1B+wKVPdZbvRcg1Cp3x8qX+8ofA==}
 
-  prosemirror-commands@1.7.1:
-    resolution: {integrity: sha512-rT7qZnQtx5c0/y/KlYaGvtG411S97UaL6gdp6RIZ23DLHanMYLyfGBV5DtSnZdthQql7W+lEVbpSfwtO8T+L2w==}
+  prosemirror-commands@1.7.2:
+    resolution: {integrity: sha512-q6Q6szxqdu9Xd6EcdKsqXghu5nQdZTpB4Q9yd04WRc7/jt763e/rT60Owh0L1GYY+T46o5rD+9lEN36dZS43tw==}
 
-  prosemirror-dropcursor@1.8.2:
-    resolution: {integrity: sha512-CCk6Gyx9+Tt2sbYk5NK0nB1ukHi2ryaRgadV/LvyNuO3ena1payM2z6Cg0vO1ebK8cxbzo41ku2DE5Axj1Zuiw==}
+  prosemirror-dropcursor@1.8.4:
+    resolution: {integrity: sha512-VmKxhcA6a+h5oPSYmfF1ZNeQqPbyYaIxqZsKqeYCyTlPtrjUgNaHL3P8vVaO19oqAV0zuaM/axkowZHrB1P3Tg==}
 
   prosemirror-gapcursor@1.4.1:
     resolution: {integrity: sha512-pMdYaEnjNMSwl11yjEGtgTmLkR08m/Vl+Jj443167p9eB3HVQKhYCc4gmHVDsLPODfZfjr/MmirsdyZziXbQKw==}
 
-  prosemirror-history@1.5.0:
-    resolution: {integrity: sha512-zlzTiH01eKA55UAf1MEjtssJeHnGxO0j4K4Dpx+gnmX9n+SHNlDqI2oO1Kv1iPN5B1dm5fsljCfqKF9nFL6HRg==}
+  prosemirror-history@1.5.1:
+    resolution: {integrity: sha512-onlwnqKvgtFg6srZOmDOAhlAy1FIHQpOExORybX0S+DvJepE5tPALrB9iGet/2sqqqrelSnB10OoiOJqAvu2DA==}
 
   prosemirror-inputrules@1.5.1:
     resolution: {integrity: sha512-7wj4uMjKaXWAQ1CDgxNzNtR9AlsuwzHfdFH1ygEHA2KHF2DOEaXl1CJfNPAKCg9qNEh4rum975QLaCiQPyY6Fw==}
@@ -4788,8 +4704,8 @@ packages:
   prosemirror-tables@1.8.5:
     resolution: {integrity: sha512-V/0cDCsHKHe/tfWkeCmthNUcEp1IVO3p6vwN8XtwE9PZQLAZJigbw3QoraAdfJPir4NKJtNvOB8oYGKRl+t0Dw==}
 
-  prosemirror-transform@1.12.0:
-    resolution: {integrity: sha512-GxboyN4AMIsoHNtz5uf2r2Ru551i5hWeCMD6E2Ib4Eogqoub0NflniaBPVQ4MrGE5yZ8JV9tUHg9qcZTTrcN4w==}
+  prosemirror-transform@1.12.4:
+    resolution: {integrity: sha512-2/WuPum3pn+O/Vi2vzpi8210ICUe2kIPXdLYjQ09Pv5DtT5bcKWMJhAKPBwvpPjpp5iOYUVwVEr0gOM1BY1Mgw==}
 
   prosemirror-view@1.42.7:
     resolution: {integrity: sha512-aTIAUN4zdD+VS7gsv9Po9Sty81B6yl6D3HggCosry9DLYTmVo4omjcqICDIOPnPJmskRUsqLInxBjaH7I+BQ4Q==}
@@ -4835,9 +4751,6 @@ packages:
   rc9@3.1.0:
     resolution: {integrity: sha512-ufjkNVzbRHKcCOmTahZkmVsyc3W+MSk3jY03m+a7tGHkIsdVMG9l10/3HvFbWkkKzY5VFp3pkRsIo/UYgmFL7Q==}
 
-  read-cache@1.0.0:
-    resolution: {integrity: sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==}
-
   readable-stream@2.3.8:
     resolution: {integrity: sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==}
 
@@ -4848,10 +4761,6 @@ packages:
   readdir-glob@1.1.3:
     resolution: {integrity: sha512-v05I2k7xN8zXvPD9N+z/uhXPaj0sUFCe2rcWZIpBsqxfP7xXFQ0tipAd/wjj1YxWyWtUS5IDJpOG82JKt2EAVA==}
 
-  readdirp@3.6.0:
-    resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
-    engines: {node: '>=8.10.0'}
-
   readdirp@5.0.0:
     resolution: {integrity: sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==}
     engines: {node: '>= 20.19.0'}
@@ -4860,6 +4769,9 @@ packages:
     resolution: {integrity: sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==}
     engines: {node: '>= 12.13.0'}
 
+  real-require@1.0.0:
+    resolution: {integrity: sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==}
+
   redis-errors@1.2.0:
     resolution: {integrity: sha512-1qny3OExCf0UvUV/5wpYKf2YwPcOqXzkwKKSmKHiE6ZMQs5heeE/c8eXK+PNllPvmjgAbfnsbpkGZWy8cBpn9w==}
     engines: {node: '>=4'}
@@ -4875,11 +4787,6 @@ packages:
     resolution: {integrity: sha512-iETxpjK6YoRWJG5o6hXLwvjYAoW+FEZn9os0PD/b6AP6xQwsa/Y7lCVgIixBbUPMfhu+i2LtdeAqVTgGlQarfA==}
     hasBin: true
 
-  replace-in-file@6.3.5:
-    resolution: {integrity: sha512-arB9d3ENdKva2fxRnSjwBEXfK1npgyci7ZZuwysgAp7ORjHSyxz6oqIjTEv8R0Ydl4Ll7uOAZXL4vbkhGIizCg==}
-    engines: {node: '>=10'}
-    hasBin: true
-
   require-directory@2.1.1:
     resolution: {integrity: sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==}
     engines: {node: '>=0.10.0'}
@@ -4895,10 +4802,6 @@ packages:
     resolution: {integrity: sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==}
     engines: {node: '>=8'}
 
-  resolve-path@1.4.0:
-    resolution: {integrity: sha512-i1xevIst/Qa+nA9olDxLWnLk8YZbi8R/7JPbCMcgyWaFR6bKWaexgJgEB5oc2PKMjYdrHynyz0NY+if+H98t1w==}
-    engines: {node: '>= 0.8'}
-
   resolve-pkg-maps@1.0.0:
     resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
 
@@ -4929,8 +4832,8 @@ packages:
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
 
-  rollup-plugin-visualizer@7.0.1:
-    resolution: {integrity: sha512-UJUT4+1Ho4OcWmPYU3sYXgUqI8B8Ayfe06MX7y0qCJ1K8aGoKtR/NDd/2nZqM7ADkrzny+I99Ul7GgyoiVNAgg==}
+  rollup-plugin-visualizer@7.1.1:
+    resolution: {integrity: sha512-ThaGiHTU8XW02OkK80TrTHATraJmM9OAduU4otal+7gyXLpYEtmGBLfx5kW+EHvvLwn03YGW2NnwKUIqsYlJAA==}
     engines: {node: '>=22'}
     hasBin: true
     peerDependencies:
@@ -4942,8 +4845,8 @@ packages:
       rollup:
         optional: true
 
-  rollup@4.60.3:
-    resolution: {integrity: sha512-pAQK9HalE84QSm4Po3EmWIZPd3FnjkShVkiMlz1iligWYkWQ7wHYd1PF/T7QZ5TVSD6uSTon5gBVMSM4JfBV+A==}
+  rollup@4.65.0:
+    resolution: {integrity: sha512-QVCvQUTGDN6JRwi3jVGCY3H4aTHvi9rX0LyoBMkGUvdh/Z6O51CzcLz85BWZaTCDGhl6ySGqYZs+xI1jmPqGcw==}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
@@ -4953,6 +4856,10 @@ packages:
   rou3@0.9.2:
     resolution: {integrity: sha512-3SOzvaAg8rkHrXtRjpCvCvbyO5to9oOO27Z/XqHEYXfMRVSw/qMIVdmaOk9W2lcRLtR6dlqTjo9hDeJk70QBYQ==}
 
+  rou3@1.0.0:
+    resolution: {integrity: sha512-ySeaQkSrua+ut9g+65I7FHqOFBaY8tV0FmccXItoq0q21se32Q3u4YiW7/RqXSosWgYJaaKwRHXy3BST9PeCNQ==}
+    engines: {node: '>=20.19.0'}
+
   run-applescript@7.1.0:
     resolution: {integrity: sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q==}
     engines: {node: '>=18'}
@@ -4966,10 +4873,6 @@ packages:
   safe-buffer@5.2.1:
     resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
 
-  safe-regex-test@1.1.0:
-    resolution: {integrity: sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==}
-    engines: {node: '>= 0.4'}
-
   safe-stable-stringify@2.5.0:
     resolution: {integrity: sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==}
     engines: {node: '>=10'}
@@ -4991,16 +4894,6 @@ packages:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
 
-  semver@7.7.4:
-    resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
-    engines: {node: '>=10'}
-    hasBin: true
-
-  semver@7.8.1:
-    resolution: {integrity: sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==}
-    engines: {node: '>=10'}
-    hasBin: true
-
   semver@7.8.5:
     resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
     engines: {node: '>=10'}
@@ -5028,9 +4921,6 @@ packages:
   set-blocking@2.0.0:
     resolution: {integrity: sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==}
 
-  setprototypeof@1.1.0:
-    resolution: {integrity: sha512-BvE/TwpZX4FXExxOxZyRGQQv651MSwmWKZGqvmPcRIjDqWub67kTKuIMx43cZZrS/cBBzwBcNDWoFxt2XEFIpQ==}
-
   setprototypeof@1.2.0:
     resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==}
 
@@ -5046,9 +4936,6 @@ packages:
     resolution: {integrity: sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==}
     engines: {node: '>= 0.4'}
 
-  siginfo@2.0.0:
-    resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
-
   signal-exit@3.0.7:
     resolution: {integrity: sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==}
 
@@ -5074,6 +4961,9 @@ packages:
   sonic-boom@4.2.1:
     resolution: {integrity: sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==}
 
+  sonic-boom@5.0.2:
+    resolution: {integrity: sha512-/JEruzo6yhNVhsLblTRchgTQHIt7SsdJP0YyrfWaNKjIOQDfrdZv9gwYraYCAsmKV39/LAdV31FLL5NCDpoL/A==}
+
   source-map-js@1.2.2:
     resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
     engines: {node: '>=0.10.0'}
@@ -5089,6 +4979,10 @@ packages:
     resolution: {integrity: sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==}
     engines: {node: '>= 12'}
 
+  source-map@0.8.0:
+    resolution: {integrity: sha512-d8EqvL+k/SOXCreS/SUzg2ciyHqBBLcN/yuRjFsbvVhHTE2pgei7oAhmPM7kWFbkX6OSMQfUq4KbkF3au9lhYQ==}
+    engines: {node: '>= 12'}
+
   split2@4.2.0:
     resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==}
     engines: {node: '>= 10.x'}
@@ -5103,23 +4997,13 @@ packages:
     engines: {node: '>=20.16.0'}
     hasBin: true
 
-  stackback@0.0.2:
-    resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
-
   standard-as-callback@2.1.0:
     resolution: {integrity: sha512-qoRRSyROncaz1z0mvYqIE4lCd9p2R90i6GxW3uZv5ucSu8tU7B5HXUP1gG8pVZsYNVaXjk8ClXHPttLyxAL48A==}
 
-  statuses@1.5.0:
-    resolution: {integrity: sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==}
-    engines: {node: '>= 0.6'}
-
   statuses@2.0.2:
     resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
     engines: {node: '>= 0.8'}
 
-  std-env@4.1.0:
-    resolution: {integrity: sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==}
-
   std-env@4.2.0:
     resolution: {integrity: sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==}
 
@@ -5141,6 +5025,10 @@ packages:
     resolution: {integrity: sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==}
     engines: {node: '>=18'}
 
+  string-width@8.3.0:
+    resolution: {integrity: sha512-ZbmZM0JCihQN91dWnxoipT2KOEyHqEyfRXUyjuRhW8b/xnqPDoq4gWEVApTVa9db2wN8mmoikgFBbjh71+cGeQ==}
+    engines: {node: '>=20'}
+
   string_decoder@1.1.1:
     resolution: {integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==}
 
@@ -5163,50 +5051,30 @@ packages:
     resolution: {integrity: sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==}
     engines: {node: '>=14.16'}
 
-  strip-literal@3.1.0:
-    resolution: {integrity: sha512-8r3mkIM/2+PpjHoOtiAW8Rg3jJLHaV7xPwG+YRGrv6FP0wwk/toTpATxWYOW0BKdWwl82VT2tFYi5DlROa0Mxg==}
-
   strip-literal@4.0.0:
     resolution: {integrity: sha512-PaqAvfUZKBwc/SLmNZtHmzK+v19Z4O4eS3cKPeGvbIv/U3pnyEq4Tuw3/4v/FwfM8VQaEawsyCcOQ0P+kpwWWw==}
 
   structured-clone-es@2.0.1:
     resolution: {integrity: sha512-10ZL5r77LhknxlP1FBiCW+VdnuWOEFLdSS2SKtjyEV+L4qP1hUEIMIZW94LC3jKxRmT/Dj7KkD1mqh/IY6lhKQ==}
 
-  sucrase@3.35.1:
-    resolution: {integrity: sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==}
-    engines: {node: '>=16 || 14 >=14.17'}
-    hasBin: true
-
   supports-color@10.2.2:
     resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==}
     engines: {node: '>=18'}
 
-  supports-color@7.2.0:
-    resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
-    engines: {node: '>=8'}
-
   supports-preserve-symlinks-flag@1.0.0:
     resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
     engines: {node: '>= 0.4'}
 
-  symbol-tree@3.2.4:
-    resolution: {integrity: sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==}
-
   tagged-tag@1.0.0:
     resolution: {integrity: sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng==}
     engines: {node: '>=20'}
 
-  tailwind-config-viewer@2.0.4:
-    resolution: {integrity: sha512-icvcmdMmt9dphvas8wL40qttrHwAnW3QEN4ExJ2zICjwRsPj7gowd1cOceaWG3IfTuM/cTNGQcx+bsjMtmV+cw==}
-    engines: {node: '>=13'}
-    hasBin: true
-    peerDependencies:
-      tailwindcss: 1 || 2 || 2.0.1-compat || 3
+  tailwindcss@4.3.3:
+    resolution: {integrity: sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==}
 
-  tailwindcss@3.4.19:
-    resolution: {integrity: sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==}
-    engines: {node: '>=14.0.0'}
-    hasBin: true
+  tapable@2.3.3:
+    resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==}
+    engines: {node: '>=6'}
 
   tar-stream@3.2.0:
     resolution: {integrity: sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==}
@@ -5229,13 +5097,6 @@ packages:
   text-decoder@1.2.7:
     resolution: {integrity: sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==}
 
-  thenify-all@1.6.0:
-    resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
-    engines: {node: '>=0.8'}
-
-  thenify@3.3.1:
-    resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
-
   thread-stream@4.0.0:
     resolution: {integrity: sha512-4iMVL6HAINXWf1ZKZjIPcz5wYaOdPhtO8ATvZ+Xqp3BTdaqtAwQkNmKORqcIo5YkQqGXq5cwfswDwMqqQNrpJA==}
     engines: {node: '>=20'}
@@ -5246,21 +5107,18 @@ packages:
   tiny-invariant@1.3.3:
     resolution: {integrity: sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==}
 
-  tinybench@2.9.0:
-    resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
+  tinybench@6.2.2:
+    resolution: {integrity: sha512-nIZ2N2dFpjBsg2hgitKu7mA+FvsIJuGJOwysRngmVRRmWgR/UyPjwJj8c/fT/dhm8EkHnF5EOogRf+0Z2qrimA==}
+    engines: {node: '>=20.0.0'}
 
-  tinyclip@0.1.12:
-    resolution: {integrity: sha512-Ae3OVUqifDw0wBriIBS7yVaW44Dp6eSHQcyq4Igc7eN2TJH/2YsicswaW+J/OuMvhpDPOKEgpAZCjkb4hpoyeA==}
+  tinyclip@0.1.15:
+    resolution: {integrity: sha512-uo33abH+Ays0xYaDysoBt494Hb3hsEczMpcC0MwFl773pazORx4fmvKhclhR1wonUbB6vvpRsvVMwnhfqeMc+A==}
     engines: {node: ^16.14.0 || >= 17.3.0}
 
   tinyclip@1.0.3:
     resolution: {integrity: sha512-nTv2raKFMzGG6JJp0lpNDsRPdfFE6UHlu2rVEjXo8vkx1ZS3LW2CVXqIaLu8xZlu+6tbFs9V58Qc/Jmk/Ii7wA==}
     engines: {node: ^16.14.0 || >= 17.3.0}
 
-  tinyexec@1.3.0:
-    resolution: {integrity: sha512-QKAl9m8gWWGHV8jZcPeym6j+XULi6tOf1mT83WYJ4Lk2ytW/uwAWkrP0uFsdoYMdueVJ0qs26wZ+23xeB4ibNQ==}
-    engines: {node: '>=18'}
-
   tinyexec@1.3.1:
     resolution: {integrity: sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==}
     engines: {node: '>=18'}
@@ -5269,10 +5127,6 @@ packages:
     resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
     engines: {node: '>=12.0.0'}
 
-  tinyrainbow@3.1.1:
-    resolution: {integrity: sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==}
-    engines: {node: '>=14.0.0'}
-
   tldts-core@7.0.30:
     resolution: {integrity: sha512-uiHN8PIB1VmWyS98eZYja4xzlYqeFZVjb4OuYlJQnZAuJhMw4PbKQOKgHKhBdJR3FE/t5mUQ1Kd80++B+qhD1Q==}
 
@@ -5303,9 +5157,9 @@ packages:
   tr46@0.0.3:
     resolution: {integrity: sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==}
 
-  tr46@6.0.0:
-    resolution: {integrity: sha512-bLVMLPtstlZ4iMQHpFHTR7GAGj2jxi8Dg0s2h2MafAE4uSWF98FC/3MomU51iQAMf8/qDUbKWf5GxuvvVcXEhw==}
-    engines: {node: '>=20'}
+  tr46@7.0.0:
+    resolution: {integrity: sha512-BcDSDW+SIGWVOns1Zm6Yg91q9AEj7eaID0QDY9oIqJD1A8dscNwMcl9Sms2DeuWCNov1X0/oXanHGYQBSLwZsg==}
+    engines: {node: ^22.14.0 || >=24.0.0}
 
   ts-api-utils@2.5.0:
     resolution: {integrity: sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==}
@@ -5313,26 +5167,14 @@ packages:
     peerDependencies:
       typescript: '>=4.8.4'
 
-  ts-interface-checker@0.1.13:
-    resolution: {integrity: sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==}
-
   tslib@1.14.1:
     resolution: {integrity: sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==}
 
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
-  tsscmp@1.0.6:
-    resolution: {integrity: sha512-LxhtAkPDTkVCMQjt2h6eBVY28KCjikZqZfMcC15YBeNjkgUpdCfBu5HoiOTDu86v6smE8yOjyEktJ8hlbANHQA==}
-    engines: {node: '>=0.6.x'}
-
-  tsx@4.23.12:
-    resolution: {integrity: sha512-FDf4L4sYzKtzWYhU/Xm0AQFdTjdIxNo9ElTf2mxXM6k8YMHXzYUe4yODVaXP4V9uMFbVg8c0qyBccK2OOxb45Q==}
-    engines: {node: '>=18.0.0'}
-    hasBin: true
-
-  tsx@4.23.13:
-    resolution: {integrity: sha512-BL5MGkRln6aDYhb0xbQlEAGw743BaZYWdbWtdJOBriYJboKgUUYCadFp2/FpBBZquBC/ezNBn7wMMPx7FDZUDw==}
+  tsx@4.23.15:
+    resolution: {integrity: sha512-Yiex1Ovn8z2xPpOWckIiysV1SSyRMY9BkLF++q0yKiDxCqRhosKfMg3janKkiLBwZ5c/YryloKwGZcrEmtwxKw==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -5352,15 +5194,11 @@ packages:
     resolution: {integrity: sha512-8ZiHFm91orbSAe2PSAiSVBVko18pbhbiB3U9GglSzF/zCGkR+rxpHx6sEMCUm4kxY4LjDIUGgCfUMtwfZfjfUA==}
     engines: {node: '>=20'}
 
-  type-is@1.6.18:
-    resolution: {integrity: sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==}
-    engines: {node: '>= 0.6'}
-
   type-level-regexp@0.1.17:
     resolution: {integrity: sha512-wTk4DH3cxwk196uGLK/E9pE45aLfeKJacKmcEgEOA/q5dnPGNxXt0cfYdFxb57L+sEpf1oJH4Dnx/pnRcku9jg==}
 
-  typescript@5.9.3:
-    resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
+  typescript@6.0.3:
+    resolution: {integrity: sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==}
     engines: {node: '>=14.17'}
     hasBin: true
 
@@ -5382,9 +5220,6 @@ packages:
     resolution: {integrity: sha512-8iAasVS4wUx0gPLjH8Xtz2PeDzTSiy8QiLGu2DT3X5GU+egFEQhpnbtkehbAwjvDcxIERmCYcysiODFmE3Ud0Q==}
     engines: {node: '>=18'}
 
-  ultrahtml@1.6.0:
-    resolution: {integrity: sha512-R9fBn90VTJrqqLDwyMph+HGne8eqY1iPfYhPzZrvKpIfwkWZbcYlfpsb8B9dTvBfpy1/hqAD7Wi8EKfP9e8zdw==}
-
   ultrahtml@1.7.0:
     resolution: {integrity: sha512-2xRd0VHoAQE4M+vF/DvFFB7pUV0ZxTW1TLi7lHQWnF/Sb5TPeEUV/l+hxcNnGO00ZXGnR0voCMmYRKQf+rvJ2g==}
 
@@ -5428,8 +5263,8 @@ packages:
       unplugin:
         optional: true
 
-  undici-types@7.18.2:
-    resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
+  undici-types@8.9.0:
+    resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==}
 
   undici@8.12.3:
     resolution: {integrity: sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==}
@@ -5454,17 +5289,20 @@ packages:
     resolution: {integrity: sha512-wH590V9VNgYH9g3lH9wWjTrUoKsjLF6sGLjhR4sH1LWpLmCOH0Zf7PukhDA8BiS7KHe4oPNkcTHqYkj7SOGUOw==}
     engines: {node: '>=20'}
 
-  unifont@0.7.5:
-    resolution: {integrity: sha512-ULe/Cs+ZIsq+dcFofNkhqielCrUJnb5mr+Yc4EBM2VlL+6OZR6+cjtI2mT1bJvRBrVncqHAbLURxmPLcCXzWMg==}
+  unifont@1.0.3:
+    resolution: {integrity: sha512-XGnEwj5sWdCbiBX01mWLSBncS0yMRjnLygau3IfdOlfjMacNIQvTGW4VH7pWBq+gGWArfSef/CensMLjMmIr/A==}
 
-  unimport@6.2.0:
-    resolution: {integrity: sha512-4NcqaphAHQff4eBWQ3pjVOCYNLlmVGGMoLDmboobh8+OQe9yP7UyeoMP043M1bG0YNc3CqtukD2VuINxOqm4rQ==}
+  unimport@6.5.0:
+    resolution: {integrity: sha512-t0KLJLRbebz3f7NrQe+vy2ObeugVeM1XqI2oeYnauddmHSglYj3U6bxOJ65IbXmOFkcAGFJK2OyGH7aqHPM6Ug==}
     engines: {node: '>=18.12.0'}
     peerDependencies:
       oxc-parser: '*'
+      rolldown: ^1.0.0
     peerDependenciesMeta:
       oxc-parser:
         optional: true
+      rolldown:
+        optional: true
 
   unimport@7.0.2:
     resolution: {integrity: sha512-5yrZs6kHyx5h1ZgeLxK0EgS/JL7Uhwv9HgzQImW8JccGmbYWyXx7Jc4YhU5+sd1Yk31PlfLQhfbZ1oigXipo3A==}
@@ -5481,14 +5319,6 @@ packages:
       rolldown:
         optional: true
 
-  universalify@2.0.1:
-    resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==}
-    engines: {node: '>= 10.0.0'}
-
-  unplugin-utils@0.3.1:
-    resolution: {integrity: sha512-5lWVjgi6vuHhJ526bI4nlCOmkCIF3nnfXkCMDeMJrtdvxTs6ZFCM8oNufGTsDbKv/tJ/xj8RpvXjRuPBZJuJog==}
-    engines: {node: '>=20.19.0'}
-
   unplugin-utils@0.3.2:
     resolution: {integrity: sha512-xVToRh2CTmLk2HnEG7ac4rl1MJTT3RFkpS8B++/SnB0kXvuaavD+n3m/vrzyWQOdJNSZQACnbz01pnppbwV5BA==}
     engines: {node: '>=20.19.0'}
@@ -5631,8 +5461,70 @@ packages:
       uploadthing:
         optional: true
 
-  untun@0.1.3:
-    resolution: {integrity: sha512-4luGP9LMYszMRZwsvyUd9MrxgEGZdZuZgpVQHEEX0lCYFESasVRvZd0EYpCkOIbJKHMuv0LskpXc/8Un+MJzEQ==}
+  unstorage@1.17.6:
+    resolution: {integrity: sha512-gjKtcmn/KwZuJZO9o2sc0esAQnhmTw0LviDHwevTXbJMYs0dRTp8ZEEWXHU0vTpzbN3cA0yxlTeyXssMp3zDqw==}
+    peerDependencies:
+      '@azure/app-configuration': ^1.8.0
+      '@azure/cosmos': ^4.2.0
+      '@azure/data-tables': ^13.3.0
+      '@azure/identity': ^4.6.0
+      '@azure/keyvault-secrets': ^4.9.0
+      '@azure/storage-blob': ^12.26.0
+      '@capacitor/preferences': ^6 || ^7 || ^8
+      '@deno/kv': '>=0.9.0'
+      '@netlify/blobs': ^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0 || ^11.0.0
+      '@planetscale/database': ^1.19.0
+      '@upstash/redis': ^1.34.3
+      '@vercel/blob': '>=0.27.1'
+      '@vercel/functions': ^2.2.12 || ^3.0.0
+      '@vercel/kv': ^1 || ^2 || ^3
+      aws4fetch: ^1.0.20
+      db0: '>=0.2.1'
+      idb-keyval: ^6.2.1
+      ioredis: ^5.4.2
+      uploadthing: ^7.4.4
+    peerDependenciesMeta:
+      '@azure/app-configuration':
+        optional: true
+      '@azure/cosmos':
+        optional: true
+      '@azure/data-tables':
+        optional: true
+      '@azure/identity':
+        optional: true
+      '@azure/keyvault-secrets':
+        optional: true
+      '@azure/storage-blob':
+        optional: true
+      '@capacitor/preferences':
+        optional: true
+      '@deno/kv':
+        optional: true
+      '@netlify/blobs':
+        optional: true
+      '@planetscale/database':
+        optional: true
+      '@upstash/redis':
+        optional: true
+      '@vercel/blob':
+        optional: true
+      '@vercel/functions':
+        optional: true
+      '@vercel/kv':
+        optional: true
+      aws4fetch:
+        optional: true
+      db0:
+        optional: true
+      idb-keyval:
+        optional: true
+      ioredis:
+        optional: true
+      uploadthing:
+        optional: true
+
+  untun@0.2.2:
+    resolution: {integrity: sha512-+NnOJcSiEtYsVgJmXUzQbJeRAFXJC4yPJYuh6kF9B0Rm6zunXcs/3GZOTllyocSbUDIxD6Bj7e/4ATw7sph1Sw==}
     hasBin: true
 
   untyped@2.0.0:
@@ -5661,14 +5553,10 @@ packages:
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
-  uuid@14.0.2:
-    resolution: {integrity: sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==}
+  uuid@14.0.3:
+    resolution: {integrity: sha512-Sc5u1VVln93y1Xnz4R+CunOZc7R9LUcTmhj7Rc7Eg3HVcf7rVn2FOoa812fe0W8p3jD7xeoGSYbfqCGGH2B6xw==}
     hasBin: true
 
-  vary@1.1.2:
-    resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
-    engines: {node: '>= 0.8'}
-
   verkit@0.3.2:
     resolution: {integrity: sha512-zj/ob3UsvJGN0whEAKFp53REA5X66hvffVqoCtVQAakJKnKlH+/PcOfMoFwIG/o4rElqLv/ycAFlx8ZlXUorCg==}
     engines: {node: '>=18.12.0'}
@@ -5744,7 +5632,7 @@ packages:
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
-      '@types/node': ^24.13.3
+      '@types/node': ^26.6.5
       '@vitejs/devtools': ^0.7.1 || ^0.8.0
       esbuild: ^0.28.2
       jiti: '>=1.21.0'
@@ -5782,20 +5670,20 @@ packages:
       yaml:
         optional: true
 
-  vitest@4.1.12:
-    resolution: {integrity: sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==}
-    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
+  vitest@5.0.5:
+    resolution: {integrity: sha512-cPODOMF8YnkiiYtDdHo6n4wWmBrOBBbOIYH2d33M4l3CdNn72h+qMmO6uXffUN6A5AZFXNND/d+krS9mgkXRfg==}
+    engines: {node: ^22.12.0 || ^24.0.0 || >=26.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@opentelemetry/api': ^1.9.0
-      '@types/node': ^24.13.3
-      '@vitest/browser-playwright': 4.1.12
-      '@vitest/browser-preview': 4.1.12
-      '@vitest/browser-webdriverio': ^4.1.11
-      '@vitest/coverage-istanbul': 4.1.12
-      '@vitest/coverage-v8': 4.1.12
-      '@vitest/ui': 4.1.12
+      '@types/node': ^26.6.5
+      '@vitest/browser-playwright': 5.0.5
+      '@vitest/browser-preview': 5.0.5
+      '@vitest/browser-webdriverio': ^5.0.0-beta.5 || >=5.0.0
+      '@vitest/coverage-istanbul': 5.0.5
+      '@vitest/coverage-v8': 5.0.5
+      '@vitest/ui': 5.0.5
       happy-dom: '*'
       jsdom: '*'
       vite: ^8.2.4
@@ -5865,8 +5753,8 @@ packages:
       vite:
         optional: true
 
-  vue-tsc@3.3.11:
-    resolution: {integrity: sha512-gOb0B9rtU2+f1dszwPqSH5kAieIF9ReeLhD3kSRNHv5WZZUQz/JdVXW0RTdqhNTMlQkqKzrTTviqKr/4FYZraQ==}
+  vue-tsc@3.3.13:
+    resolution: {integrity: sha512-jE4/bXdOMSHVxEGgQCqNllJy+9N3Gx6tfSAsg0yhFK/MAN6eXqISihupnDEKSCt12VVnjN2gI3AqLYcqoh5x/A==}
     hasBin: true
     peerDependencies:
       typescript: '>=5.0.0'
@@ -5882,9 +5770,9 @@ packages:
   w3c-keyname@2.2.8:
     resolution: {integrity: sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ==}
 
-  w3c-xmlserializer@5.0.0:
-    resolution: {integrity: sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==}
-    engines: {node: '>=18'}
+  w3c-xmlserializer@6.0.0:
+    resolution: {integrity: sha512-4Nsy8K5Tr6SPDH9jhKJOHf7ChDrc1zufZTVSF7x72hwuEXBqxqk9G6cK+K2NRUtB3iELRJqjXb4JPDMBjMTl2Q==}
+    engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}
 
   web-push@3.6.7:
     resolution: {integrity: sha512-OpiIUe8cuGjrj3mMBFWY+e4MMIkW3SVT+7vEIjvD9kejGUypv8GPDf84JdPWskK8zMRIJ6xYGm+Kxr8YkPyA0A==}
@@ -5909,12 +5797,8 @@ packages:
     resolution: {integrity: sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw==}
     engines: {node: '>=20'}
 
-  whatwg-url@16.0.1:
-    resolution: {integrity: sha512-1to4zXBxmXHV3IiSSEInrreIlu02vUOvrhxJJH5vcxYTBDAx51cqZiKdyTxlecdKNSjj8EcxGBxNf6Vg+945gw==}
-    engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
-
-  whatwg-url@17.1.0:
-    resolution: {integrity: sha512-3GeworPmc2ZfEEHP7lEbUfBX/L75wdEsi0rLNhXcXxnoN5jyq0SL5gCy06SGW2cyTIZdTvWIDQNQoza++vKeaw==}
+  whatwg-url@17.3.0:
+    resolution: {integrity: sha512-KwOAJrpf+GTgBvcBQJcP38sMF0DsQKdwtG+TxM2pW44P6E5k0hDbWrDmyuJDIF0Uef0aQq0ZoJs+5oI+k8ddhg==}
     engines: {node: ^22.14.0 || >=24.0.0}
 
   whatwg-url@5.0.0:
@@ -5933,9 +5817,9 @@ packages:
     engines: {node: ^20.17.0 || >=22.9.0}
     hasBin: true
 
-  why-is-node-running@2.3.0:
-    resolution: {integrity: sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==}
-    engines: {node: '>=8'}
+  why-is-node-running@3.2.1:
+    resolution: {integrity: sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==}
+    engines: {node: '>=20.11'}
     hasBin: true
 
   word-wrap@1.2.5:
@@ -6011,10 +5895,6 @@ packages:
     resolution: {integrity: sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==}
     engines: {node: '>=6'}
 
-  yargs-parser@21.1.1:
-    resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
-    engines: {node: '>=12'}
-
   yargs-parser@22.0.0:
     resolution: {integrity: sha512-rwu/ClNdSMpkSrUb+d6BRsSkLUq1fmfsY6TOpYzTwvwkg1/NRG85KBy3kq++A8LKQwX6lsu+aWad+2khvuXrqw==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=23}
@@ -6023,18 +5903,10 @@ packages:
     resolution: {integrity: sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==}
     engines: {node: '>=8'}
 
-  yargs@17.7.2:
-    resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
-    engines: {node: '>=12'}
-
-  yargs@18.0.0:
-    resolution: {integrity: sha512-4UEqdc2RYGHZc7Doyqkrqiln3p9X2DZVxaGbwhn2pi7MrRagKaOcIKe8L3OxYcbhXLgLFUS3zAYuQjKBQgmuNg==}
+  yargs@18.2.0:
+    resolution: {integrity: sha512-9OpKOLeaoNFecEp7P6iYbzze/5CqWoH7N3SMs/6y1XF4nMvFMspEGZzJ6uFi9MmQwXhyzqYoSEKO3tvA3Z/o2w==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=23}
 
-  ylru@1.4.0:
-    resolution: {integrity: sha512-2OQsPNEmBCvXuFlIni/a+Rn+R2pHW9INm0BxXJ4hVDA8TirqMj+J/Rp9ItLatT/5pZqWwefVrTQcHpixsxnVlA==}
-    engines: {node: '>= 4.0.0'}
-
   yocto-queue@0.1.0:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
@@ -6054,27 +5926,25 @@ packages:
 
 snapshots:
 
-  '@alloc/quick-lru@5.2.0': {}
-
-  '@antfu/install-pkg@1.1.0':
+  '@antfu/install-pkg@2.1.0':
     dependencies:
-      package-manager-detector: 1.6.0
-      tinyexec: 1.3.0
+      package-manager-detector: 1.9.0
+      tinyexec: 1.3.1
 
-  '@asamuzakjp/css-color@6.0.7':
+  '@asamuzakjp/css-color@7.1.7':
     dependencies:
-      '@csstools/css-calc': 3.3.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)
-      '@csstools/css-color-parser': 4.2.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)
-      '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.2)
+      '@csstools/css-calc': 3.4.3(@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)
+      '@csstools/css-color-parser': 4.2.6(@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)
+      '@csstools/css-parser-algorithms': 4.0.2(@csstools/css-tokenizer@4.0.2)
       '@csstools/css-tokenizer': 4.0.2
-      lru-cache: 11.5.2
+      lru-cache: 11.5.3
 
-  '@asamuzakjp/dom-selector@8.3.2':
+  '@asamuzakjp/dom-selector@10.0.5':
     dependencies:
-      bidi-js: 1.0.3
+      bidi-js: 1.1.0
       css-tree: 3.2.1
       is-potential-custom-element-name: 1.0.1
-      lru-cache: 11.5.2
+      lru-cache: 11.5.3
 
   '@babel/code-frame@7.29.7':
     dependencies:
@@ -6184,14 +6054,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-string-parser@7.27.1': {}
-
   '@babel/helper-string-parser@7.29.7': {}
 
   '@babel/helper-string-parser@8.0.6': {}
 
-  '@babel/helper-validator-identifier@7.28.5': {}
-
   '@babel/helper-validator-identifier@7.29.7': {}
 
   '@babel/helper-validator-identifier@8.0.6': {}
@@ -6203,10 +6069,6 @@ snapshots:
       '@babel/template': 7.29.7
       '@babel/types': 7.29.8
 
-  '@babel/parser@7.29.3':
-    dependencies:
-      '@babel/types': 7.29.0
-
   '@babel/parser@7.29.8':
     dependencies:
       '@babel/types': 7.29.8
@@ -6258,11 +6120,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/types@7.29.0':
-    dependencies:
-      '@babel/helper-string-parser': 7.27.1
-      '@babel/helper-validator-identifier': 7.28.5
-
   '@babel/types@7.29.8':
     dependencies:
       '@babel/helper-string-parser': 7.29.7
@@ -6297,51 +6154,43 @@ snapshots:
 
   '@colordx/core@7.3.0': {}
 
-  '@csstools/color-helpers@6.1.1': {}
+  '@csstools/color-helpers@6.1.2': {}
 
-  '@csstools/css-calc@3.3.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)':
+  '@csstools/css-calc@3.4.3(@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)':
     dependencies:
-      '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.2)
+      '@csstools/css-parser-algorithms': 4.0.2(@csstools/css-tokenizer@4.0.2)
       '@csstools/css-tokenizer': 4.0.2
 
-  '@csstools/css-color-parser@4.2.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)':
+  '@csstools/css-color-parser@4.2.6(@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)':
     dependencies:
-      '@csstools/color-helpers': 6.1.1
-      '@csstools/css-calc': 3.3.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)
-      '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.2)
+      '@csstools/color-helpers': 6.1.2
+      '@csstools/css-calc': 3.4.3(@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)
+      '@csstools/css-parser-algorithms': 4.0.2(@csstools/css-tokenizer@4.0.2)
       '@csstools/css-tokenizer': 4.0.2
 
-  '@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.2)':
+  '@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2)':
     dependencies:
       '@csstools/css-tokenizer': 4.0.2
 
-  '@csstools/css-syntax-patches-for-csstree@1.1.8(css-tree@3.2.1)':
+  '@csstools/css-syntax-patches-for-csstree@1.1.15(css-tree@3.2.1)':
     optionalDependencies:
       css-tree: 3.2.1
 
   '@csstools/css-tokenizer@4.0.2': {}
 
-  '@csstools/selector-resolve-nested@3.1.0(postcss-selector-parser@7.1.7)':
-    dependencies:
-      postcss-selector-parser: 7.1.7
-
-  '@csstools/selector-specificity@5.0.0(postcss-selector-parser@7.1.7)':
-    dependencies:
-      postcss-selector-parser: 7.1.7
-
   '@drizzle-team/brocli@0.10.2': {}
 
-  '@dxup/nuxt@0.5.10(esbuild@0.28.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))':
+  '@dxup/nuxt@0.5.10(esbuild@0.28.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))':
     dependencies:
       '@dxup/unimport': 0.1.2
-      '@nuxt/kit': 4.5.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      '@nuxt/kit': 4.5.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       '@vue/compiler-dom': 3.5.42
       chokidar: 5.0.0
       knitwork: 1.3.0
       magic-string: 1.4.3
       pathe: 2.0.3
       tinyglobby: 0.2.17
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@rspack/core'
@@ -6491,7 +6340,7 @@ snapshots:
       '@eslint/core': 1.2.1
       levn: 0.4.1
 
-  '@exodus/bytes@1.15.1(@noble/hashes@2.2.0)':
+  '@exodus/bytes@1.16.0(@noble/hashes@2.2.0)':
     optionalDependencies:
       '@noble/hashes': 2.2.0
 
@@ -6528,28 +6377,28 @@ snapshots:
     dependencies:
       '@iconify/types': 2.0.0
 
-  '@iconify-json/simple-icons@1.2.94':
+  '@iconify-json/simple-icons@1.2.100':
     dependencies:
       '@iconify/types': 2.0.0
 
-  '@iconify/collections@1.0.727':
+  '@iconify/collections@1.0.755':
     dependencies:
       '@iconify/types': 2.0.0
 
   '@iconify/types@2.0.0': {}
 
-  '@iconify/utils@3.1.4':
+  '@iconify/utils@3.1.7':
     dependencies:
-      '@antfu/install-pkg': 1.1.0
+      '@antfu/install-pkg': 2.1.0
       '@iconify/types': 2.0.0
       import-meta-resolve: 4.2.0
 
-  '@iconify/vue@5.0.1(vue@3.5.44(typescript@5.9.3))':
+  '@iconify/vue@5.0.4(vue@3.5.44(typescript@6.0.3))':
     dependencies:
       '@iconify/types': 2.0.0
-      vue: 3.5.44(typescript@5.9.3)
+      vue: 3.5.44(typescript@6.0.3)
 
-  '@intlify/bundle-utils@11.2.5(vue-i18n@11.4.8(vue@3.5.44(typescript@5.9.3)))':
+  '@intlify/bundle-utils@11.2.5(vue-i18n@11.4.8(vue@3.5.44(typescript@6.0.3)))':
     dependencies:
       '@intlify/message-compiler': 11.4.8
       '@intlify/shared': 11.4.8
@@ -6561,7 +6410,7 @@ snapshots:
       source-map-js: 1.2.2
       yaml-eslint-parser: 1.3.2
     optionalDependencies:
-      vue-i18n: 11.4.8(vue@3.5.44(typescript@5.9.3))
+      vue-i18n: 11.4.8(vue@3.5.44(typescript@6.0.3))
 
   '@intlify/core-base@11.4.8':
     dependencies:
@@ -6591,26 +6440,25 @@ snapshots:
 
   '@intlify/shared@11.4.8': {}
 
-  '@intlify/unplugin-vue-i18n@11.2.5(@vue/compiler-dom@3.5.41)(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(rollup@4.60.3)(supports-color@10.2.2)(typescript@5.9.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue-i18n@11.4.8(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))':
+  '@intlify/unplugin-vue-i18n@11.2.5(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(rollup@4.65.0)(supports-color@10.2.2)(typescript@6.0.3)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue-i18n@11.4.8(vue@3.5.44(typescript@6.0.3)))(vue@3.5.44(typescript@6.0.3))':
     dependencies:
       '@eslint-community/eslint-utils': 4.9.1(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))
-      '@intlify/bundle-utils': 11.2.5(vue-i18n@11.4.8(vue@3.5.44(typescript@5.9.3)))
+      '@intlify/bundle-utils': 11.2.5(vue-i18n@11.4.8(vue@3.5.44(typescript@6.0.3)))
       '@intlify/shared': 11.4.8
-      '@intlify/vue-i18n-extensions': 8.0.0(@intlify/shared@11.4.8)(@vue/compiler-dom@3.5.41)(vue-i18n@11.4.8(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
-      '@rollup/pluginutils': 5.3.0(rollup@4.60.3)
+      '@intlify/vue-i18n-extensions': 8.0.0(@intlify/shared@11.4.8)(vue-i18n@11.4.8(vue@3.5.44(typescript@6.0.3)))(vue@3.5.44(typescript@6.0.3))
+      '@rollup/pluginutils': 5.3.0(rollup@4.65.0)
       '@typescript-eslint/scope-manager': 8.59.2
-      '@typescript-eslint/typescript-estree': 8.59.2(supports-color@10.2.2)(typescript@5.9.3)
+      '@typescript-eslint/typescript-estree': 8.59.2(supports-color@10.2.2)(typescript@6.0.3)
       debug: 4.4.3(supports-color@10.2.2)
       fast-glob: 3.3.3
       pathe: 2.0.3
       picocolors: 1.1.1
       unplugin: 2.3.11
-      vue: 3.5.44(typescript@5.9.3)
+      vue: 3.5.44(typescript@6.0.3)
     optionalDependencies:
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-      vue-i18n: 11.4.8(vue@3.5.44(typescript@5.9.3))
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
+      vue-i18n: 11.4.8(vue@3.5.44(typescript@6.0.3))
     transitivePeerDependencies:
-      - '@vue/compiler-dom'
       - eslint
       - rollup
       - supports-color
@@ -6620,16 +6468,16 @@ snapshots:
 
   '@intlify/utils@0.14.1': {}
 
-  '@intlify/vue-i18n-extensions@8.0.0(@intlify/shared@11.4.8)(@vue/compiler-dom@3.5.41)(vue-i18n@11.4.8(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))':
+  '@intlify/vue-i18n-extensions@8.0.0(@intlify/shared@11.4.8)(vue-i18n@11.4.8(vue@3.5.44(typescript@6.0.3)))(vue@3.5.44(typescript@6.0.3))':
     dependencies:
       '@babel/parser': 7.29.8
+      '@vue/compiler-dom': 3.5.41
     optionalDependencies:
       '@intlify/shared': 11.4.8
-      '@vue/compiler-dom': 3.5.41
-      vue: 3.5.44(typescript@5.9.3)
-      vue-i18n: 11.4.8(vue@3.5.44(typescript@5.9.3))
+      vue: 3.5.44(typescript@6.0.3)
+      vue-i18n: 11.4.8(vue@3.5.44(typescript@6.0.3))
 
-  '@ioredis/commands@1.5.1': {}
+  '@ioredis/commands@1.10.0': {}
 
   '@ioredis/commands@2.0.0': {}
 
@@ -6672,16 +6520,6 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  '@koa/router@12.0.2(supports-color@10.2.2)':
-    dependencies:
-      debug: 4.4.3(supports-color@10.2.2)
-      http-errors: 2.0.1
-      koa-compose: 4.1.0
-      methods: 1.1.2
-      path-to-regexp: 6.3.0
-    transitivePeerDependencies:
-      - supports-color
-
   '@kurkle/color@0.3.4': {}
 
   '@levischuck/tiny-cbor@0.2.11': {}
@@ -6693,7 +6531,7 @@ snapshots:
       https-proxy-agent: 7.0.6(supports-color@10.2.2)
       node-fetch: 2.7.0
       nopt: 8.1.0
-      semver: 7.8.1
+      semver: 7.8.5
       tar: 7.5.22
     transitivePeerDependencies:
       - encoding
@@ -6701,11 +6539,14 @@ snapshots:
 
   '@mixmark-io/domino@2.2.0': {}
 
-  '@miyaneee/rollup-plugin-json5@1.2.0(rollup@4.60.3)':
+  '@miyaneee/rollup-plugin-json5@1.2.0(rollup@4.65.0)':
     dependencies:
-      '@rollup/pluginutils': 5.3.0(rollup@4.60.3)
+      '@rollup/pluginutils': 5.3.0(rollup@4.65.0)
       json5: 2.2.3
-      rollup: 4.60.3
+      rollup: 4.65.0
+
+  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
+    optional: true
 
   '@napi-rs/wasm-runtime@1.2.3(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)':
     dependencies:
@@ -6728,7 +6569,7 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
-  '@nuxt/cli@4.0.1(@nuxt/schema@4.6.2)(jiti@2.7.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))':
+  '@nuxt/cli@4.0.1(@nuxt/schema@4.6.2)(jiti@2.7.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))':
     dependencies:
       '@clack/prompts': 1.8.1
       args-tokenizer: 0.3.0
@@ -6739,7 +6580,7 @@ snapshots:
       exsolve: 1.1.3
       fuzzysort: 4.0.2
       get-port-please: 3.2.0
-      my-bad: 0.2.11(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      my-bad: 0.2.11(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       obug: 3.0.0
       package-manager-detector: 1.9.0
       pathe: 2.0.3
@@ -6763,35 +6604,28 @@ snapshots:
 
   '@nuxt/devalue@2.0.2': {}
 
-  '@nuxt/devtools-kit@3.4.1(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))':
-    dependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
-      execa: 8.0.1
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-    transitivePeerDependencies:
-      - magic-string
-      - magicast
-      - oxc-parser
-      - rolldown
-      - unplugin
-
-  '@nuxt/devtools-kit@3.4.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))':
+  '@nuxt/devtools-kit@3.4.4(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))':
     dependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       execa: 8.0.1
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
     transitivePeerDependencies:
+      - '@nuxt/schema'
+      - confbox
+      - dotenv
+      - giget
+      - jiti
       - magic-string
-      - magicast
+      - mlly
       - oxc-parser
       - rolldown
       - unplugin
 
-  '@nuxt/devtools-kit@3.4.4(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))':
+  '@nuxt/devtools-kit@3.4.4(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))':
     dependencies:
-      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       execa: 8.0.1
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
     transitivePeerDependencies:
       - '@nuxt/schema'
       - confbox
@@ -6815,12 +6649,12 @@ snapshots:
       pkg-types: 2.4.0
       semver: 7.8.5
 
-  '@nuxt/devtools@3.4.4(@nuxt/schema@4.6.2)(bufferutil@4.1.0)(confbox@0.3.1)(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(dotenv@17.4.2)(giget@3.3.1)(ioredis@5.10.1(supports-color@10.2.2))(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(utf-8-validate@6.0.6)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))':
+  '@nuxt/devtools@3.4.4(@nuxt/schema@4.6.2)(bufferutil@4.1.0)(confbox@0.3.1)(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(dotenv@17.4.2)(giget@3.2.0)(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(utf-8-validate@6.0.6)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))':
     dependencies:
-      '@nuxt/devtools-kit': 3.4.4(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      '@nuxt/devtools-kit': 3.4.4(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       '@nuxt/devtools-wizard': 3.4.4
-      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
-      '@vue/devtools-core': 8.2.1(vue@3.5.44(typescript@5.9.3))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
+      '@vue/devtools-core': 8.2.1(vue@3.5.44(typescript@6.0.3))
       '@vue/devtools-kit': 8.2.1
       birpc: 4.2.0
       consola: 3.4.2
@@ -6845,10 +6679,10 @@ snapshots:
       structured-clone-es: 2.0.1
       tinyexec: 1.3.1
       tinyglobby: 0.2.17
-      unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.10.1(supports-color@10.2.2))
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-      vite-plugin-inspect: 11.4.1(@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      vite-plugin-vue-tracer: 1.5.0(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
+      unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.11.1(supports-color@10.2.2))
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
+      vite-plugin-inspect: 11.4.1(@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      vite-plugin-vue-tracer: 1.5.0(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
       which: 6.0.1
       ws: 8.21.0(bufferutil@4.1.0)(utf-8-validate@6.0.6)
     transitivePeerDependencies:
@@ -6885,23 +6719,26 @@ snapshots:
       - utf-8-validate
       - vue
 
-  '@nuxt/fonts@0.14.0(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(esbuild@0.28.2)(ioredis@5.10.1(supports-color@10.2.2))(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))':
+  '@nuxt/fonts@1.1.0(@nuxt/schema@4.6.2)(cac@7.0.0)(confbox@0.3.1)(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(dotenv@17.4.2)(esbuild@0.28.2)(giget@3.2.0)(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(lightningcss@1.33.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(postcss@8.5.26)(rolldown@1.2.15)(rollup@4.65.0)(srvx@1.0.6)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))':
     dependencies:
-      '@nuxt/devtools-kit': 3.4.1(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      '@nuxt/kit': 4.5.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
-      consola: 3.4.2
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       defu: 6.1.7
-      fontless: 0.2.1(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.10.1(supports-color@10.2.2))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      devframe: 1.2.6(cac@7.0.0)(srvx@1.0.6)
+      exsolve: 1.1.3
+      fontless: 1.3.4(devframe@1.2.6(cac@7.0.0)(srvx@1.0.6))(esbuild@0.28.2)(jiti@2.7.0)(lightningcss@1.33.0)(postcss@8.5.26)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       h3: 1.15.11
-      magic-regexp: 0.10.0
+      magic-regexp: 0.11.2(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      nypm: 0.6.11
       ofetch: 1.5.1
       pathe: 2.0.3
-      sirv: 3.0.2
+      std-env: 4.3.0
       tinyglobby: 0.2.17
       ufo: 1.6.4
-      unifont: 0.7.5
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.10.1(supports-color@10.2.2))
+      unifont: 1.0.3
+      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      unstorage: 1.17.6(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.11.1(supports-color@10.2.2))
+    optionalDependencies:
+      lightningcss: 1.33.0
     transitivePeerDependencies:
       - '@azure/app-configuration'
       - '@azure/cosmos'
@@ -6911,9 +6748,12 @@ snapshots:
       - '@azure/storage-blob'
       - '@capacitor/preferences'
       - '@deno/kv'
+      - '@devframes/agentic'
       - '@farmfe/core'
       - '@netlify/blobs'
+      - '@nuxt/schema'
       - '@planetscale/database'
+      - '@rsbuild/core'
       - '@rspack/core'
       - '@upstash/redis'
       - '@vercel/blob'
@@ -6921,102 +6761,58 @@ snapshots:
       - '@vercel/kv'
       - aws4fetch
       - bun-types-no-globals
+      - cac
+      - confbox
       - db0
+      - dotenv
       - esbuild
+      - giget
       - idb-keyval
       - ioredis
+      - jiti
       - magic-string
-      - magicast
+      - mlly
+      - ocache
       - oxc-parser
+      - postcss
       - rolldown
       - rollup
+      - srvx
       - unloader
       - uploadthing
       - vite
       - webpack
 
-  '@nuxt/icon@2.5.1(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))':
+  '@nuxt/icon@2.6.0(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))':
     dependencies:
-      '@iconify/collections': 1.0.727
+      '@iconify/collections': 1.0.755
       '@iconify/types': 2.0.0
-      '@iconify/utils': 3.1.4
-      '@iconify/vue': 5.0.1(vue@3.5.44(typescript@5.9.3))
-      '@nuxt/devtools-kit': 3.4.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      '@nuxt/kit': 4.5.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      '@iconify/utils': 3.1.7
+      '@iconify/vue': 5.0.4(vue@3.5.44(typescript@6.0.3))
+      '@nuxt/devtools-kit': 3.4.4(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       consola: 3.4.2
       local-pkg: 1.2.1
       mlly: 1.8.2
       ohash: 2.0.12
-      picomatch: 4.0.5
-      std-env: 4.2.0
+      picomatch: 4.0.7
+      std-env: 4.3.0
       tinyglobby: 0.2.17
       ufo: 1.6.4
     transitivePeerDependencies:
+      - '@nuxt/schema'
+      - confbox
+      - dotenv
+      - giget
+      - jiti
       - magic-string
-      - magicast
       - oxc-parser
       - rolldown
       - unplugin
       - vite
       - vue
 
-  '@nuxt/kit@3.21.4(magicast@0.5.5)':
-    dependencies:
-      c12: 3.3.4(magicast@0.5.5)
-      consola: 3.4.2
-      defu: 6.1.7
-      destr: 2.0.5
-      errx: 0.1.2
-      exsolve: 1.1.1
-      ignore: 7.0.6
-      jiti: 2.7.0
-      klona: 2.0.6
-      knitwork: 1.3.0
-      mlly: 1.8.2
-      ohash: 2.0.12
-      pathe: 2.0.3
-      pkg-types: 2.3.1
-      rc9: 3.0.1
-      scule: 1.3.0
-      semver: 7.7.4
-      tinyglobby: 0.2.17
-      ufo: 1.6.4
-      unctx: 2.5.0
-      untyped: 2.0.0
-    transitivePeerDependencies:
-      - magicast
-
-  '@nuxt/kit@4.5.2(magic-string@0.30.21)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))':
-    dependencies:
-      c12: 3.3.4(magicast@0.5.5)
-      consola: 3.4.2
-      defu: 6.1.7
-      destr: 2.0.5
-      errx: 0.1.2
-      exsolve: 1.1.1
-      ignore: 7.0.6
-      jiti: 2.7.0
-      klona: 2.0.6
-      mlly: 1.8.2
-      nostics: 1.2.0
-      ohash: 2.0.11
-      pathe: 2.0.3
-      pkg-types: 2.3.1
-      rc9: 3.0.1
-      scule: 1.3.0
-      tinyglobby: 0.2.17
-      ufo: 1.6.4
-      unctx: 3.0.0(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
-      untyped: 2.0.0
-      verkit: 0.3.2
-    transitivePeerDependencies:
-      - magic-string
-      - magicast
-      - oxc-parser
-      - rolldown
-      - unplugin
-
-  '@nuxt/kit@4.5.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))':
+  '@nuxt/kit@4.5.2(magic-string@0.30.21)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))':
     dependencies:
       c12: 3.3.4(magicast@0.5.5)
       consola: 3.4.2
@@ -7036,7 +6832,7 @@ snapshots:
       scule: 1.3.0
       tinyglobby: 0.2.17
       ufo: 1.6.4
-      unctx: 3.0.0(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      unctx: 3.0.0(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       untyped: 2.0.0
       verkit: 0.3.2
     transitivePeerDependencies:
@@ -7046,7 +6842,7 @@ snapshots:
       - rolldown
       - unplugin
 
-  '@nuxt/kit@4.5.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))':
+  '@nuxt/kit@4.5.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))':
     dependencies:
       c12: 3.3.4(magicast@0.5.5)
       consola: 3.4.2
@@ -7066,7 +6862,7 @@ snapshots:
       scule: 1.3.0
       tinyglobby: 0.2.17
       ufo: 1.6.4
-      unctx: 3.0.0(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      unctx: 3.0.0(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       untyped: 2.0.0
       verkit: 0.3.2
     transitivePeerDependencies:
@@ -7076,7 +6872,7 @@ snapshots:
       - rolldown
       - unplugin
 
-  '@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))':
+  '@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))':
     dependencies:
       consola: 3.4.2
       defu: 6.1.7
@@ -7094,13 +6890,79 @@ snapshots:
       std-env: 4.3.0
       tinyexec: 1.3.1
       tinyglobby: 0.2.17
-      unctx: 3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      unctx: 3.0.1(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       verkit: 0.5.0
     optionalDependencies:
       '@nuxt/schema': 4.6.2
       confbox: 0.3.1
       dotenv: 17.4.2
-      giget: 3.3.1
+      giget: 3.2.0
+      jiti: 2.7.0
+      mlly: 1.8.2
+      oxc-parser: 0.141.0
+      rolldown: 1.2.15
+    transitivePeerDependencies:
+      - magic-string
+      - unplugin
+
+  '@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))':
+    dependencies:
+      consola: 3.4.2
+      defu: 6.1.7
+      destr: 2.0.5
+      errx: 0.2.2
+      exsolve: 1.1.3
+      ignore: 7.0.13
+      klona: 2.0.6
+      microdiff: 1.6.0
+      nostics: 1.3.0
+      package-manager-detector: 1.9.0
+      pathe: 2.0.3
+      rc9: 3.1.0
+      scule: 1.3.0
+      std-env: 4.3.0
+      tinyexec: 1.3.1
+      tinyglobby: 0.2.17
+      unctx: 3.0.1(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
+      verkit: 0.5.0
+    optionalDependencies:
+      '@nuxt/schema': 4.6.2
+      confbox: 0.3.1
+      dotenv: 17.4.2
+      giget: 3.2.0
+      jiti: 2.7.0
+      mlly: 1.8.2
+      oxc-parser: 0.141.0
+      rolldown: 1.2.15
+    transitivePeerDependencies:
+      - magic-string
+      - unplugin
+
+  '@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))':
+    dependencies:
+      consola: 3.4.2
+      defu: 6.1.7
+      destr: 2.0.5
+      errx: 0.2.2
+      exsolve: 1.1.3
+      ignore: 7.0.13
+      klona: 2.0.6
+      microdiff: 1.6.0
+      nostics: 1.3.0
+      package-manager-detector: 1.9.0
+      pathe: 2.0.3
+      rc9: 3.1.0
+      scule: 1.3.0
+      std-env: 4.3.0
+      tinyexec: 1.3.1
+      tinyglobby: 0.2.17
+      unctx: 3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
+      verkit: 0.5.0
+    optionalDependencies:
+      '@nuxt/schema': 4.6.2
+      confbox: 0.3.1
+      dotenv: 17.4.2
+      giget: 3.2.0
       jiti: 2.7.0
       mlly: 1.8.2
       oxc-parser: 0.141.0
@@ -7109,7 +6971,7 @@ snapshots:
       - magic-string
       - unplugin
 
-  '@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))':
+  '@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))':
     dependencies:
       consola: 3.4.2
       defu: 6.1.7
@@ -7127,13 +6989,13 @@ snapshots:
       std-env: 4.3.0
       tinyexec: 1.3.1
       tinyglobby: 0.2.17
-      unctx: 3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      unctx: 3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       verkit: 0.5.0
     optionalDependencies:
       '@nuxt/schema': 4.6.2
       confbox: 0.3.1
       dotenv: 17.4.2
-      giget: 3.3.1
+      giget: 3.2.0
       jiti: 2.7.0
       mlly: 1.8.2
       oxc-parser: 0.141.0
@@ -7142,10 +7004,10 @@ snapshots:
       - magic-string
       - unplugin
 
-  '@nuxt/nitro-server@4.6.2(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7(supports-color@10.2.2)))(@nuxt/schema@4.6.2)(@oxc-project/types@0.155.0)(confbox@0.3.1)(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(dotenv@17.4.2)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9))(esbuild@0.28.2)(giget@3.3.1)(ioredis@5.10.1(supports-color@10.2.2))(jiti@2.7.0)(lightningcss@1.33.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(770feae4848205a63c0a1ab5684c5cdb))(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(supports-color@10.2.2)(typescript@5.9.3)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))':
+  '@nuxt/nitro-server@4.6.2(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7(supports-color@10.2.2)))(@nuxt/schema@4.6.2)(@oxc-project/types@0.155.0)(@parcel/watcher@2.5.6)(confbox@0.3.1)(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(dotenv@17.4.2)(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9))(esbuild@0.28.2)(giget@3.2.0)(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(lightningcss@1.33.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(0aa2e1ff7ec74578bd134c9d216ec795))(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(srvx@1.0.6)(supports-color@10.2.2)(typescript@6.0.3)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))':
     dependencies:
-      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
-      '@unhead/vue': 3.4.3(@oxc-project/types@0.155.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
+      '@unhead/vue': 3.4.3(@oxc-project/types@0.155.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
       consola: 3.4.2
       defu: 6.1.7
       destr: 2.0.5
@@ -7155,23 +7017,23 @@ snapshots:
       exsolve: 1.1.3
       flru: 1.0.2
       h3: 1.15.11
-      impound: 1.2.1(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      impound: 1.2.1(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       klona: 2.0.6
       mocked-exports: 0.1.1
-      my-bad: 0.2.11(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      nitropack: 2.13.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9))(oxc-parser@0.141.0)(rolldown@1.2.15)(supports-color@10.2.2)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      my-bad: 0.2.11(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      nitropack: 2.13.5(@parcel/watcher@2.5.6)(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9))(oxc-parser@0.141.0)(rolldown@1.2.15)(srvx@1.0.6)(supports-color@10.2.2)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       nostics: 1.3.0
-      nuxt: 4.6.2(770feae4848205a63c0a1ab5684c5cdb)
+      nuxt: 4.6.2(0aa2e1ff7ec74578bd134c9d216ec795)
       ohash: 2.0.12
       pathe: 2.0.3
       radix3: 1.1.2
       rou3: 0.9.2
       std-env: 4.3.0
       ufo: 1.6.4
-      unctx: 3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      unctx: 3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       unrouting: 0.2.3
-      unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.10.1(supports-color@10.2.2))
-      vue: 3.5.44(typescript@5.9.3)
+      unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.11.1(supports-color@10.2.2))
+      vue: 3.5.44(typescript@6.0.3)
       vue-bundle-renderer: 2.4.0
       vue-devtools-stub: 0.1.0
     optionalDependencies:
@@ -7191,7 +7053,9 @@ snapshots:
       - '@netlify/blobs'
       - '@nuxt/schema'
       - '@oxc-project/types'
+      - '@parcel/watcher'
       - '@planetscale/database'
+      - '@rsbuild/core'
       - '@rspack/core'
       - '@unhead/cli'
       - '@upstash/redis'
@@ -7223,6 +7087,7 @@ snapshots:
       - rolldown
       - rollup
       - sqlite3
+      - srvx
       - supports-color
       - typescript
       - unloader
@@ -7241,19 +7106,19 @@ snapshots:
       pkg-types: 2.4.0
       std-env: 4.3.0
 
-  '@nuxt/telemetry@2.9.1(@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))))':
+  '@nuxt/telemetry@2.9.1(@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))))':
     dependencies:
-      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       citty: 0.2.2
       consola: 3.4.2
       rc9: 3.0.1
       std-env: 4.2.0
 
-  '@nuxt/vite-builder@4.6.2(@babel/plugin-syntax-jsx@7.28.6(@babel/core@7.29.7(supports-color@10.2.2)))(@nuxt/schema@4.6.2)(@types/node@24.13.3)(confbox@0.3.1)(dotenv@17.4.2)(esbuild@0.28.2)(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(770feae4848205a63c0a1ab5684c5cdb))(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup-plugin-visualizer@7.0.1(rolldown@1.2.15)(rollup@4.60.3))(rollup@4.60.3)(supports-color@10.2.2)(terser@5.46.2)(tsx@4.23.13)(typescript@5.9.3)(vue-tsc@3.3.11(typescript@5.9.3))(vue@3.5.44(typescript@5.9.3))(yaml@2.9.0)':
+  '@nuxt/vite-builder@4.6.2(@babel/plugin-syntax-jsx@7.28.6(@babel/core@7.29.7(supports-color@10.2.2)))(@nuxt/schema@4.6.2)(@types/node@26.6.5)(confbox@0.3.1)(dotenv@17.4.2)(esbuild@0.28.2)(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(0aa2e1ff7ec74578bd134c9d216ec795))(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup-plugin-visualizer@7.1.1(rolldown@1.2.15)(rollup@4.65.0))(rollup@4.65.0)(supports-color@10.2.2)(terser@5.46.2)(tsx@4.23.15)(typescript@6.0.3)(vue-tsc@3.3.13(typescript@6.0.3))(vue@3.5.44(typescript@6.0.3))(yaml@2.9.0)':
     dependencies:
-      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
-      '@vitejs/plugin-vue': 6.0.10(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
-      '@vitejs/plugin-vue-jsx': 5.1.6(supports-color@10.2.2)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
+      '@vitejs/plugin-vue': 6.0.10(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
+      '@vitejs/plugin-vue-jsx': 5.1.6(supports-color@10.2.2)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
       autoprefixer: 10.6.1(postcss@8.5.26)
       clickable-path: 0.1.1
       consola: 3.4.2
@@ -7266,8 +7131,8 @@ snapshots:
       js-tokens: 10.0.0
       knitwork: 1.3.0
       mocked-exports: 0.1.1
-      my-bad: 0.2.11(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      nuxt: 4.6.2(770feae4848205a63c0a1ab5684c5cdb)
+      my-bad: 0.2.11(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      nuxt: 4.6.2(0aa2e1ff7ec74578bd134c9d216ec795)
       pathe: 2.0.3
       pkg-types: 2.4.0
       postcss: 8.5.26
@@ -7276,16 +7141,16 @@ snapshots:
       std-env: 4.3.0
       ufo: 1.6.4
       unenv: 2.0.0-rc.24
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-      vite-node: 6.0.0(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-      vite-plugin-checker: 0.14.5(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(optionator@0.9.4)(typescript@5.9.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue-tsc@3.3.11(typescript@5.9.3))
-      vue: 3.5.44(typescript@5.9.3)
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
+      vite-node: 6.0.0(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
+      vite-plugin-checker: 0.14.5(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(optionator@0.9.4)(typescript@6.0.3)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue-tsc@3.3.13(typescript@6.0.3))
+      vue: 3.5.44(typescript@6.0.3)
       vue-bundle-renderer: 2.4.0
     optionalDependencies:
       '@babel/plugin-syntax-jsx': 7.28.6(@babel/core@7.29.7(supports-color@10.2.2))
       rolldown: 1.2.15
-      rollup-plugin-visualizer: 7.0.1(rolldown@1.2.15)(rollup@4.60.3)
+      rollup-plugin-visualizer: 7.1.1(rolldown@1.2.15)(rollup@4.65.0)
     transitivePeerDependencies:
       - '@biomejs/biome'
       - '@farmfe/core'
@@ -7322,21 +7187,21 @@ snapshots:
       - webpack
       - yaml
 
-  '@nuxt/vite-server@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(770feae4848205a63c0a1ab5684c5cdb))(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))':
+  '@nuxt/vite-server@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(0aa2e1ff7ec74578bd134c9d216ec795))(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))':
     dependencies:
-      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       clickable-path: 0.1.1
       defu: 6.1.7
       exsolve: 1.1.3
       mocked-exports: 0.1.1
-      my-bad: 0.2.11(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      nuxt: 4.6.2(770feae4848205a63c0a1ab5684c5cdb)
+      my-bad: 0.2.11(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      nuxt: 4.6.2(0aa2e1ff7ec74578bd134c9d216ec795)
       pathe: 2.0.3
       rou3: 0.9.2
       srvx: 1.0.5
       ufo: 1.6.4
       ultrahtml: 1.7.0
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
     transitivePeerDependencies:
       - '@nuxt/schema'
       - confbox
@@ -7349,17 +7214,17 @@ snapshots:
       - rolldown
       - unplugin
 
-  '@nuxtjs/i18n@10.6.0(@vue/compiler-dom@3.5.41)(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(esbuild@0.28.2)(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(ioredis@5.10.1(supports-color@10.2.2))(magicast@0.5.5)(pinia@4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3)))(rolldown@1.2.15)(rollup@4.60.3)(supports-color@10.2.2)(typescript@5.9.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))':
+  '@nuxtjs/i18n@10.6.0(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(esbuild@0.28.2)(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(ioredis@5.11.1(supports-color@10.2.2))(magicast@0.5.5)(pinia@4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3)))(rolldown@1.2.15)(rollup@4.65.0)(supports-color@10.2.2)(typescript@6.0.3)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))':
     dependencies:
       '@intlify/core': 11.4.8
       '@intlify/h3': 0.7.4
       '@intlify/message-compiler': 11.4.8
       '@intlify/shared': 11.4.8
-      '@intlify/unplugin-vue-i18n': 11.2.5(@vue/compiler-dom@3.5.41)(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(rollup@4.60.3)(supports-color@10.2.2)(typescript@5.9.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue-i18n@11.4.8(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
+      '@intlify/unplugin-vue-i18n': 11.2.5(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(rollup@4.65.0)(supports-color@10.2.2)(typescript@6.0.3)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue-i18n@11.4.8(vue@3.5.44(typescript@6.0.3)))(vue@3.5.44(typescript@6.0.3))
       '@intlify/utils': 0.14.1
-      '@miyaneee/rollup-plugin-json5': 1.2.0(rollup@4.60.3)
-      '@nuxt/kit': 4.5.2(magic-string@0.30.21)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
-      '@rollup/plugin-yaml': 4.1.2(rollup@4.60.3)
+      '@miyaneee/rollup-plugin-json5': 1.2.0(rollup@4.65.0)
+      '@nuxt/kit': 4.5.2(magic-string@0.30.21)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
+      '@rollup/plugin-yaml': 4.1.2(rollup@4.65.0)
       '@vue/compiler-sfc': 3.5.41
       confbox: 0.2.4
       defu: 6.1.7
@@ -7374,12 +7239,12 @@ snapshots:
       oxc-walker: 0.7.0(oxc-parser@0.141.0)
       pathe: 2.0.3
       ufo: 1.6.4
-      unhead: 3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unhead: 3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       unrouting: 0.2.3
-      unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.10.1(supports-color@10.2.2))
-      vue-i18n: 11.4.8(vue@3.5.44(typescript@5.9.3))
-      vue-router: 5.4.0(@vue/compiler-sfc@3.5.41)(esbuild@0.28.2)(pinia@4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3)))(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
+      unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.11.1(supports-color@10.2.2))
+      vue-i18n: 11.4.8(vue@3.5.44(typescript@6.0.3))
+      vue-router: 5.4.0(@vue/compiler-sfc@3.5.41)(esbuild@0.28.2)(pinia@4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3)))(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
     transitivePeerDependencies:
       - '@azure/app-configuration'
       - '@azure/cosmos'
@@ -7399,7 +7264,6 @@ snapshots:
       - '@vercel/blob'
       - '@vercel/functions'
       - '@vercel/kv'
-      - '@vue/compiler-dom'
       - aws4fetch
       - bun-types-no-globals
       - db0
@@ -7420,30 +7284,6 @@ snapshots:
       - vue
       - webpack
 
-  '@nuxtjs/tailwindcss@6.14.0(magicast@0.5.5)(supports-color@10.2.2)(tsx@4.23.13)(yaml@2.9.0)':
-    dependencies:
-      '@nuxt/kit': 3.21.4(magicast@0.5.5)
-      autoprefixer: 10.5.0(postcss@8.5.26)
-      c12: 3.3.4(magicast@0.5.5)
-      consola: 3.4.2
-      defu: 6.1.7
-      h3: 1.15.11
-      klona: 2.0.6
-      ohash: 2.0.11
-      pathe: 2.0.3
-      pkg-types: 2.3.1
-      postcss: 8.5.26
-      postcss-nesting: 13.0.2(postcss@8.5.26)
-      tailwind-config-viewer: 2.0.4(supports-color@10.2.2)(tailwindcss@3.4.19(tsx@4.23.13)(yaml@2.9.0))
-      tailwindcss: 3.4.19(tsx@4.23.13)(yaml@2.9.0)
-      ufo: 1.6.4
-      unctx: 2.5.0
-    transitivePeerDependencies:
-      - magicast
-      - supports-color
-      - tsx
-      - yaml
-
   '@opentelemetry/api@1.9.1': {}
 
   '@otplib/core@13.5.0': {}
@@ -7669,6 +7509,7 @@ snapshots:
       '@parcel/watcher-win32-arm64': 2.5.6
       '@parcel/watcher-win32-ia32': 2.5.6
       '@parcel/watcher-win32-x64': 2.5.6
+    optional: true
 
   '@peculiar/asn1-android@2.9.4':
     dependencies:
@@ -7676,6 +7517,14 @@ snapshots:
       asn1js: 3.0.10
       tslib: 2.8.1
 
+  '@peculiar/asn1-asym-key@2.11.0':
+    dependencies:
+      '@peculiar/asn1-pkcs8': 2.9.4
+      '@peculiar/asn1-schema': 2.9.4
+      '@peculiar/asn1-x509': 2.9.4
+      asn1js: 3.0.10
+      tslib: 2.8.1
+
   '@peculiar/asn1-cms@2.9.4':
     dependencies:
       '@peculiar/asn1-schema': 2.9.4
@@ -7745,6 +7594,14 @@ snapshots:
       asn1js: 3.0.10
       tslib: 2.8.1
 
+  '@peculiar/asn1-x509-post-quantum@2.11.0':
+    dependencies:
+      '@peculiar/asn1-asym-key': 2.11.0
+      '@peculiar/asn1-schema': 2.9.4
+      '@peculiar/asn1-x509': 2.9.4
+      asn1js: 3.0.10
+      tslib: 2.8.1
+
   '@peculiar/asn1-x509@2.9.4':
     dependencies:
       '@peculiar/asn1-schema': 2.9.4
@@ -7756,7 +7613,7 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@peculiar/x509@1.14.3':
+  '@peculiar/x509@2.2.0':
     dependencies:
       '@peculiar/asn1-cms': 2.9.4
       '@peculiar/asn1-csr': 2.9.4
@@ -7765,18 +7622,23 @@ snapshots:
       '@peculiar/asn1-rsa': 2.9.4
       '@peculiar/asn1-schema': 2.9.4
       '@peculiar/asn1-x509': 2.9.4
+      '@peculiar/asn1-x509-post-quantum': 2.11.0
       pvtsutils: 1.3.6
-      reflect-metadata: 0.2.2
       tslib: 2.8.1
       tsyringe: 4.10.0
 
-  '@pinia/nuxt@1.0.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(pinia@4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3)))(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))':
+  '@pinia/nuxt@1.0.3(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(pinia@4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3)))(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))':
     dependencies:
-      '@nuxt/kit': 4.5.2(magic-string@1.4.3)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
-      pinia: 4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
+      pinia: 4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3))
     transitivePeerDependencies:
+      - '@nuxt/schema'
+      - confbox
+      - dotenv
+      - giget
+      - jiti
       - magic-string
-      - magicast
+      - mlly
       - oxc-parser
       - rolldown
       - unplugin
@@ -7800,6 +7662,11 @@ snapshots:
 
   '@poppinss/exception@1.2.3': {}
 
+  '@prometheus-io/client@0.16.1':
+    dependencies:
+      '@opentelemetry/api': 1.9.1
+      tdigest: 0.1.2
+
   '@rolldown/binding-android-arm-eabi@1.2.15':
     optional: true
 
@@ -7847,13 +7714,13 @@ snapshots:
 
   '@rolldown/pluginutils@1.0.1': {}
 
-  '@rollup/plugin-alias@6.0.0(rollup@4.60.3)':
+  '@rollup/plugin-alias@6.0.0(rollup@4.65.0)':
     optionalDependencies:
-      rollup: 4.60.3
+      rollup: 4.65.0
 
-  '@rollup/plugin-commonjs@29.0.2(rollup@4.60.3)':
+  '@rollup/plugin-commonjs@29.0.3(rollup@4.65.0)':
     dependencies:
-      '@rollup/pluginutils': 5.3.0(rollup@4.60.3)
+      '@rollup/pluginutils': 5.3.0(rollup@4.65.0)
       commondir: 1.0.1
       estree-walker: 2.0.2
       fdir: 6.5.0(picomatch@4.0.7)
@@ -7861,143 +7728,143 @@ snapshots:
       magic-string: 0.30.21
       picomatch: 4.0.7
     optionalDependencies:
-      rollup: 4.60.3
+      rollup: 4.65.0
 
-  '@rollup/plugin-inject@5.0.5(rollup@4.60.3)':
+  '@rollup/plugin-inject@5.0.5(rollup@4.65.0)':
     dependencies:
-      '@rollup/pluginutils': 5.3.0(rollup@4.60.3)
+      '@rollup/pluginutils': 5.3.0(rollup@4.65.0)
       estree-walker: 2.0.2
       magic-string: 0.30.21
     optionalDependencies:
-      rollup: 4.60.3
+      rollup: 4.65.0
 
-  '@rollup/plugin-json@6.1.0(rollup@4.60.3)':
+  '@rollup/plugin-json@6.1.0(rollup@4.65.0)':
     dependencies:
-      '@rollup/pluginutils': 5.3.0(rollup@4.60.3)
+      '@rollup/pluginutils': 5.3.0(rollup@4.65.0)
     optionalDependencies:
-      rollup: 4.60.3
+      rollup: 4.65.0
 
-  '@rollup/plugin-node-resolve@16.0.3(rollup@4.60.3)':
+  '@rollup/plugin-node-resolve@16.0.3(rollup@4.65.0)':
     dependencies:
-      '@rollup/pluginutils': 5.3.0(rollup@4.60.3)
+      '@rollup/pluginutils': 5.3.0(rollup@4.65.0)
       '@types/resolve': 1.20.2
       deepmerge: 4.3.1
       is-module: 1.0.0
       resolve: 1.22.12
     optionalDependencies:
-      rollup: 4.60.3
+      rollup: 4.65.0
 
-  '@rollup/plugin-replace@6.0.3(rollup@4.60.3)':
+  '@rollup/plugin-replace@6.0.3(rollup@4.65.0)':
     dependencies:
-      '@rollup/pluginutils': 5.3.0(rollup@4.60.3)
+      '@rollup/pluginutils': 5.3.0(rollup@4.65.0)
       magic-string: 0.30.21
     optionalDependencies:
-      rollup: 4.60.3
+      rollup: 4.65.0
 
-  '@rollup/plugin-terser@1.0.0(rollup@4.60.3)':
+  '@rollup/plugin-terser@1.0.0(rollup@4.65.0)':
     dependencies:
       serialize-javascript: 7.1.3
       smob: 1.6.1
       terser: 5.46.2
     optionalDependencies:
-      rollup: 4.60.3
+      rollup: 4.65.0
 
-  '@rollup/plugin-yaml@4.1.2(rollup@4.60.3)':
+  '@rollup/plugin-yaml@4.1.2(rollup@4.65.0)':
     dependencies:
-      '@rollup/pluginutils': 5.3.0(rollup@4.60.3)
+      '@rollup/pluginutils': 5.3.0(rollup@4.65.0)
       js-yaml: 4.3.2
       tosource: 2.0.0-alpha.3
     optionalDependencies:
-      rollup: 4.60.3
+      rollup: 4.65.0
 
-  '@rollup/pluginutils@5.3.0(rollup@4.60.3)':
+  '@rollup/pluginutils@5.3.0(rollup@4.65.0)':
     dependencies:
       '@types/estree': 1.0.9
       estree-walker: 2.0.2
       picomatch: 4.0.7
     optionalDependencies:
-      rollup: 4.60.3
+      rollup: 4.65.0
 
-  '@rollup/rollup-android-arm-eabi@4.60.3':
+  '@rollup/rollup-android-arm-eabi@4.65.0':
     optional: true
 
-  '@rollup/rollup-android-arm64@4.60.3':
+  '@rollup/rollup-android-arm64@4.65.0':
     optional: true
 
-  '@rollup/rollup-darwin-arm64@4.60.3':
+  '@rollup/rollup-darwin-arm64@4.65.0':
     optional: true
 
-  '@rollup/rollup-darwin-x64@4.60.3':
+  '@rollup/rollup-darwin-x64@4.65.0':
     optional: true
 
-  '@rollup/rollup-freebsd-arm64@4.60.3':
+  '@rollup/rollup-freebsd-arm64@4.65.0':
     optional: true
 
-  '@rollup/rollup-freebsd-x64@4.60.3':
+  '@rollup/rollup-freebsd-x64@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.60.3':
+  '@rollup/rollup-linux-arm-gnueabihf@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.60.3':
+  '@rollup/rollup-linux-arm-musleabihf@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.60.3':
+  '@rollup/rollup-linux-arm64-gnu@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.60.3':
+  '@rollup/rollup-linux-arm64-musl@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-loong64-gnu@4.60.3':
+  '@rollup/rollup-linux-loong64-gnu@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-loong64-musl@4.60.3':
+  '@rollup/rollup-linux-loong64-musl@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-gnu@4.60.3':
+  '@rollup/rollup-linux-ppc64-gnu@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-musl@4.60.3':
+  '@rollup/rollup-linux-ppc64-musl@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.60.3':
+  '@rollup/rollup-linux-riscv64-gnu@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-musl@4.60.3':
+  '@rollup/rollup-linux-riscv64-musl@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.60.3':
+  '@rollup/rollup-linux-s390x-gnu@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-x64-gnu@4.60.3':
+  '@rollup/rollup-linux-x64-gnu@4.65.0':
     optional: true
 
-  '@rollup/rollup-linux-x64-musl@4.60.3':
+  '@rollup/rollup-linux-x64-musl@4.65.0':
     optional: true
 
-  '@rollup/rollup-openbsd-x64@4.60.3':
+  '@rollup/rollup-openbsd-x64@4.65.0':
     optional: true
 
-  '@rollup/rollup-openharmony-arm64@4.60.3':
+  '@rollup/rollup-openharmony-arm64@4.65.0':
     optional: true
 
-  '@rollup/rollup-win32-arm64-msvc@4.60.3':
+  '@rollup/rollup-win32-arm64-msvc@4.65.0':
     optional: true
 
-  '@rollup/rollup-win32-ia32-msvc@4.60.3':
+  '@rollup/rollup-win32-ia32-msvc@4.65.0':
     optional: true
 
-  '@rollup/rollup-win32-x64-gnu@4.60.3':
+  '@rollup/rollup-win32-x64-gnu@4.65.0':
     optional: true
 
-  '@rollup/rollup-win32-x64-msvc@4.60.3':
+  '@rollup/rollup-win32-x64-msvc@4.65.0':
     optional: true
 
   '@scure/base@2.2.0': {}
 
-  '@simplewebauthn/browser@13.3.0': {}
+  '@simplewebauthn/browser@14.0.0': {}
 
-  '@simplewebauthn/server@13.3.3':
+  '@simplewebauthn/server@14.0.3':
     dependencies:
       '@hexagon/base64': 1.1.28
       '@levischuck/tiny-cbor': 0.2.11
@@ -8006,7 +7873,9 @@ snapshots:
       '@peculiar/asn1-rsa': 2.9.4
       '@peculiar/asn1-schema': 2.9.4
       '@peculiar/asn1-x509': 2.9.4
-      '@peculiar/x509': 1.14.3
+      '@peculiar/asn1-x509-post-quantum': 2.11.0
+      '@peculiar/x509': 2.2.0
+      reflect-metadata: 0.2.2
 
   '@sindresorhus/is@7.2.0': {}
 
@@ -8014,197 +7883,263 @@ snapshots:
 
   '@speed-highlight/core@1.2.15': {}
 
-  '@standard-schema/spec@1.1.0': {}
+  '@tailwindcss/node@4.3.3':
+    dependencies:
+      '@jridgewell/remapping': 2.3.5
+      enhanced-resolve: 5.26.0
+      jiti: 2.7.0
+      lightningcss: 1.32.0
+      magic-string: 0.30.21
+      source-map-js: 1.2.2
+      tailwindcss: 4.3.3
+
+  '@tailwindcss/oxide-android-arm64@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-darwin-arm64@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-darwin-x64@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-freebsd-x64@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-linux-arm-gnueabihf@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-linux-arm64-gnu@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-linux-arm64-musl@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-linux-x64-gnu@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-linux-x64-musl@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-wasm32-wasi@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-win32-arm64-msvc@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide-win32-x64-msvc@4.3.3':
+    optional: true
+
+  '@tailwindcss/oxide@4.3.3':
+    optionalDependencies:
+      '@tailwindcss/oxide-android-arm64': 4.3.3
+      '@tailwindcss/oxide-darwin-arm64': 4.3.3
+      '@tailwindcss/oxide-darwin-x64': 4.3.3
+      '@tailwindcss/oxide-freebsd-x64': 4.3.3
+      '@tailwindcss/oxide-linux-arm-gnueabihf': 4.3.3
+      '@tailwindcss/oxide-linux-arm64-gnu': 4.3.3
+      '@tailwindcss/oxide-linux-arm64-musl': 4.3.3
+      '@tailwindcss/oxide-linux-x64-gnu': 4.3.3
+      '@tailwindcss/oxide-linux-x64-musl': 4.3.3
+      '@tailwindcss/oxide-wasm32-wasi': 4.3.3
+      '@tailwindcss/oxide-win32-arm64-msvc': 4.3.3
+      '@tailwindcss/oxide-win32-x64-msvc': 4.3.3
+
+  '@tailwindcss/vite@4.3.3(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))':
+    dependencies:
+      '@tailwindcss/node': 4.3.3
+      '@tailwindcss/oxide': 4.3.3
+      tailwindcss: 4.3.3
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
 
   '@thaunknown/thirty-two@1.0.6':
     dependencies:
       uint8-util: 2.3.2
 
-  '@tiptap/core@3.31.0(@tiptap/pm@3.31.0)':
+  '@tiptap/core@3.32.0(@tiptap/pm@3.32.0)':
     dependencies:
-      '@tiptap/pm': 3.31.0
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-blockquote@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)':
+  '@tiptap/extension-blockquote@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-bold@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-bold@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-bubble-menu@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)':
+  '@tiptap/extension-bubble-menu@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)':
     dependencies:
       '@floating-ui/dom': 1.7.6
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
+      '@tiptap/pm': 3.32.0
     optional: true
 
-  '@tiptap/extension-bullet-list@3.31.0(@tiptap/extension-list@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-bullet-list@3.32.0(@tiptap/extension-list@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/extension-list': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
+      '@tiptap/extension-list': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-code-block@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)':
+  '@tiptap/extension-code-block@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-code@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-code@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-color@3.31.0(@tiptap/extension-text-style@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0)))':
+  '@tiptap/extension-color@3.32.0(@tiptap/extension-text-style@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0)))':
     dependencies:
-      '@tiptap/extension-text-style': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
+      '@tiptap/extension-text-style': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
 
-  '@tiptap/extension-document@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-document@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-dropcursor@3.31.0(@tiptap/extensions@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-dropcursor@3.32.0(@tiptap/extensions@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/extensions': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
+      '@tiptap/extensions': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-floating-menu@3.31.0(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)':
+  '@tiptap/extension-floating-menu@3.32.0(@floating-ui/dom@1.7.6)(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)':
     dependencies:
       '@floating-ui/dom': 1.7.6
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
+      '@tiptap/pm': 3.32.0
     optional: true
 
-  '@tiptap/extension-gapcursor@3.31.0(@tiptap/extensions@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-gapcursor@3.32.0(@tiptap/extensions@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/extensions': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
+      '@tiptap/extensions': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-hard-break@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-hard-break@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-heading@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-heading@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-horizontal-rule@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)':
+  '@tiptap/extension-horizontal-rule@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-image@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-image@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-italic@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-italic@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-link@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)':
+  '@tiptap/extension-link@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
+      '@tiptap/pm': 3.32.0
       linkifyjs: 4.3.3
 
-  '@tiptap/extension-list-item@3.31.0(@tiptap/extension-list@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-list-item@3.32.0(@tiptap/extension-list@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/extension-list': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
+      '@tiptap/extension-list': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-list-keymap@3.31.0(@tiptap/extension-list@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-list-keymap@3.32.0(@tiptap/extension-list@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/extension-list': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
+      '@tiptap/extension-list': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-list@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)':
+  '@tiptap/extension-list@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/extension-ordered-list@3.31.0(@tiptap/extension-list@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-ordered-list@3.32.0(@tiptap/extension-list@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/extension-list': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
+      '@tiptap/extension-list': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-paragraph@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-paragraph@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-placeholder@3.31.0(@tiptap/extensions@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-placeholder@3.32.0(@tiptap/extensions@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/extensions': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
+      '@tiptap/extensions': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-strike@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-strike@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-text-align@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-text-align@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-text-style@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-text-style@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-text@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-text@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extension-underline@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))':
+  '@tiptap/extension-underline@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
 
-  '@tiptap/extensions@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)':
+  '@tiptap/extensions@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)':
     dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
-      '@tiptap/pm': 3.31.0
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
+      '@tiptap/pm': 3.32.0
 
-  '@tiptap/pm@3.31.0':
+  '@tiptap/pm@3.32.0':
     dependencies:
-      prosemirror-changeset: 2.4.1
-      prosemirror-commands: 1.7.1
-      prosemirror-dropcursor: 1.8.2
+      prosemirror-changeset: 2.4.4
+      prosemirror-commands: 1.7.2
+      prosemirror-dropcursor: 1.8.4
       prosemirror-gapcursor: 1.4.1
-      prosemirror-history: 1.5.0
+      prosemirror-history: 1.5.1
       prosemirror-inputrules: 1.5.1
       prosemirror-keymap: 1.2.3
       prosemirror-model: 1.25.12
       prosemirror-schema-list: 1.5.1
       prosemirror-state: 1.4.4
       prosemirror-tables: 1.8.5
-      prosemirror-transform: 1.12.0
+      prosemirror-transform: 1.12.4
       prosemirror-view: 1.42.7
 
-  '@tiptap/starter-kit@3.31.0':
-    dependencies:
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
-      '@tiptap/extension-blockquote': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
-      '@tiptap/extension-bold': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
-      '@tiptap/extension-bullet-list': 3.31.0(@tiptap/extension-list@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))
-      '@tiptap/extension-code': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
-      '@tiptap/extension-code-block': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
-      '@tiptap/extension-document': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
-      '@tiptap/extension-dropcursor': 3.31.0(@tiptap/extensions@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))
-      '@tiptap/extension-gapcursor': 3.31.0(@tiptap/extensions@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))
-      '@tiptap/extension-hard-break': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
-      '@tiptap/extension-heading': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
-      '@tiptap/extension-horizontal-rule': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
-      '@tiptap/extension-italic': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
-      '@tiptap/extension-link': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
-      '@tiptap/extension-list': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
-      '@tiptap/extension-list-item': 3.31.0(@tiptap/extension-list@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))
-      '@tiptap/extension-list-keymap': 3.31.0(@tiptap/extension-list@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))
-      '@tiptap/extension-ordered-list': 3.31.0(@tiptap/extension-list@3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0))
-      '@tiptap/extension-paragraph': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
-      '@tiptap/extension-strike': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
-      '@tiptap/extension-text': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
-      '@tiptap/extension-underline': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))
-      '@tiptap/extensions': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
-      '@tiptap/pm': 3.31.0
-
-  '@tiptap/vue-3@3.31.0(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)(vue@3.5.44(typescript@5.9.3))':
+  '@tiptap/starter-kit@3.32.0':
+    dependencies:
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
+      '@tiptap/extension-blockquote': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
+      '@tiptap/extension-bold': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
+      '@tiptap/extension-bullet-list': 3.32.0(@tiptap/extension-list@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))
+      '@tiptap/extension-code': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
+      '@tiptap/extension-code-block': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
+      '@tiptap/extension-document': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
+      '@tiptap/extension-dropcursor': 3.32.0(@tiptap/extensions@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))
+      '@tiptap/extension-gapcursor': 3.32.0(@tiptap/extensions@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))
+      '@tiptap/extension-hard-break': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
+      '@tiptap/extension-heading': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
+      '@tiptap/extension-horizontal-rule': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
+      '@tiptap/extension-italic': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
+      '@tiptap/extension-link': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
+      '@tiptap/extension-list': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
+      '@tiptap/extension-list-item': 3.32.0(@tiptap/extension-list@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))
+      '@tiptap/extension-list-keymap': 3.32.0(@tiptap/extension-list@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))
+      '@tiptap/extension-ordered-list': 3.32.0(@tiptap/extension-list@3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0))
+      '@tiptap/extension-paragraph': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
+      '@tiptap/extension-strike': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
+      '@tiptap/extension-text': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
+      '@tiptap/extension-underline': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))
+      '@tiptap/extensions': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
+      '@tiptap/pm': 3.32.0
+
+  '@tiptap/vue-3@3.32.0(@floating-ui/dom@1.7.6)(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)(vue@3.5.44(typescript@6.0.3))':
     dependencies:
       '@floating-ui/dom': 1.7.6
-      '@tiptap/core': 3.31.0(@tiptap/pm@3.31.0)
-      '@tiptap/pm': 3.31.0
-      vue: 3.5.44(typescript@5.9.3)
+      '@tiptap/core': 3.32.0(@tiptap/pm@3.32.0)
+      '@tiptap/pm': 3.32.0
+      vue: 3.5.44(typescript@6.0.3)
     optionalDependencies:
-      '@tiptap/extension-bubble-menu': 3.31.0(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
-      '@tiptap/extension-floating-menu': 3.31.0(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.0(@tiptap/pm@3.31.0))(@tiptap/pm@3.31.0)
+      '@tiptap/extension-bubble-menu': 3.32.0(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
+      '@tiptap/extension-floating-menu': 3.32.0(@floating-ui/dom@1.7.6)(@tiptap/core@3.32.0(@tiptap/pm@3.32.0))(@tiptap/pm@3.32.0)
 
   '@tybys/wasm-util@0.10.3':
     dependencies:
@@ -8218,18 +8153,12 @@ snapshots:
       '@types/deep-eql': 4.0.2
       assertion-error: 2.0.1
 
-  '@types/create-torrent@6.1.1':
-    dependencies:
-      '@types/node': 24.13.3
-
   '@types/css-tree@3.2.0': {}
 
   '@types/deep-eql@4.0.2': {}
 
   '@types/esrecurse@4.3.1': {}
 
-  '@types/estree@1.0.8': {}
-
   '@types/estree@1.0.9': {}
 
   '@types/hammerjs@2.0.46': {}
@@ -8238,20 +8167,20 @@ snapshots:
 
   '@types/magnet-uri@5.1.5':
     dependencies:
-      '@types/node': 24.13.3
+      '@types/node': 26.6.5
 
-  '@types/node@24.13.3':
+  '@types/node@26.6.5':
     dependencies:
-      undici-types: 7.18.2
+      undici-types: 8.9.0
 
   '@types/parse-torrent@11.0.1':
     dependencies:
       '@types/magnet-uri': 5.1.5
-      '@types/node': 24.13.3
+      '@types/node': 26.6.5
 
   '@types/qrcode@1.5.6':
     dependencies:
-      '@types/node': 24.13.3
+      '@types/node': 26.6.5
 
   '@types/resolve@1.20.2': {}
 
@@ -8264,14 +8193,14 @@ snapshots:
 
   '@types/web-push@3.6.4':
     dependencies:
-      '@types/node': 24.13.3
+      '@types/node': 26.6.5
 
-  '@typescript-eslint/project-service@8.59.2(supports-color@10.2.2)(typescript@5.9.3)':
+  '@typescript-eslint/project-service@8.59.2(supports-color@10.2.2)(typescript@6.0.3)':
     dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.59.2(typescript@5.9.3)
+      '@typescript-eslint/tsconfig-utils': 8.59.2(typescript@6.0.3)
       '@typescript-eslint/types': 8.59.2
       debug: 4.4.3(supports-color@10.2.2)
-      typescript: 5.9.3
+      typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
 
@@ -8280,24 +8209,24 @@ snapshots:
       '@typescript-eslint/types': 8.59.2
       '@typescript-eslint/visitor-keys': 8.59.2
 
-  '@typescript-eslint/tsconfig-utils@8.59.2(typescript@5.9.3)':
+  '@typescript-eslint/tsconfig-utils@8.59.2(typescript@6.0.3)':
     dependencies:
-      typescript: 5.9.3
+      typescript: 6.0.3
 
   '@typescript-eslint/types@8.59.2': {}
 
-  '@typescript-eslint/typescript-estree@8.59.2(supports-color@10.2.2)(typescript@5.9.3)':
+  '@typescript-eslint/typescript-estree@8.59.2(supports-color@10.2.2)(typescript@6.0.3)':
     dependencies:
-      '@typescript-eslint/project-service': 8.59.2(supports-color@10.2.2)(typescript@5.9.3)
-      '@typescript-eslint/tsconfig-utils': 8.59.2(typescript@5.9.3)
+      '@typescript-eslint/project-service': 8.59.2(supports-color@10.2.2)(typescript@6.0.3)
+      '@typescript-eslint/tsconfig-utils': 8.59.2(typescript@6.0.3)
       '@typescript-eslint/types': 8.59.2
       '@typescript-eslint/visitor-keys': 8.59.2
       debug: 4.4.3(supports-color@10.2.2)
       minimatch: 10.2.5
       semver: 7.8.5
       tinyglobby: 0.2.17
-      ts-api-utils: 2.5.0(typescript@5.9.3)
-      typescript: 5.9.3
+      ts-api-utils: 2.5.0(typescript@6.0.3)
+      typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
 
@@ -8366,18 +8295,18 @@ snapshots:
   '@typescript/typescript-win32-x64@7.0.2':
     optional: true
 
-  '@unhead/bundler@3.4.3(@oxc-project/types@0.155.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(unhead@3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))':
+  '@unhead/bundler@3.4.3(@oxc-project/types@0.155.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(unhead@3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))':
     dependencies:
       magic-string: 1.4.3
       oxc-walker: 1.1.1(@oxc-project/types@0.155.0)(oxc-parser@0.141.0)(rolldown@1.2.15)
-      unhead: 3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unhead: 3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
     optionalDependencies:
       esbuild: 0.28.2
       lightningcss: 1.33.0
       oxc-parser: 0.141.0
       rolldown: 1.2.15
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@oxc-project/types'
@@ -8386,15 +8315,15 @@ snapshots:
       - rollup
       - unloader
 
-  '@unhead/vue@3.4.3(@oxc-project/types@0.155.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))':
+  '@unhead/vue@3.4.3(@oxc-project/types@0.155.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))':
     dependencies:
-      '@unhead/bundler': 3.4.3(@oxc-project/types@0.155.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(unhead@3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      '@unhead/bundler': 3.4.3(@oxc-project/types@0.155.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(unhead@3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       hookable: 6.1.1
-      unhead: 3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      vue: 3.5.44(typescript@5.9.3)
+      unhead: 3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      vue: 3.5.44(typescript@6.0.3)
     optionalDependencies:
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@oxc-project/types'
@@ -8409,12 +8338,12 @@ snapshots:
       - rollup
       - unloader
 
-  '@vercel/nft@1.5.0(rollup@4.60.3)(supports-color@10.2.2)':
+  '@vercel/nft@1.11.0(rollup@4.65.0)(supports-color@10.2.2)':
     dependencies:
       '@mapbox/node-pre-gyp': 2.0.3(supports-color@10.2.2)
-      '@rollup/pluginutils': 5.3.0(rollup@4.60.3)
-      acorn: 8.16.0
-      acorn-import-attributes: 1.9.5(acorn@8.16.0)
+      '@rollup/pluginutils': 5.3.0(rollup@4.65.0)
+      acorn: 8.18.0
+      acorn-import-attributes: 1.9.5(acorn@8.18.0)
       async-sema: 3.1.1
       bindings: 1.5.0
       estree-walker: 2.0.2
@@ -8428,64 +8357,34 @@ snapshots:
       - rollup
       - supports-color
 
-  '@vitejs/plugin-vue-jsx@5.1.6(supports-color@10.2.2)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))':
+  '@vitejs/plugin-vue-jsx@5.1.6(supports-color@10.2.2)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))':
     dependencies:
       '@babel/core': 7.29.7(supports-color@10.2.2)
       '@babel/plugin-syntax-typescript': 7.29.7(@babel/core@7.29.7(supports-color@10.2.2))
       '@babel/plugin-transform-typescript': 7.29.7(@babel/core@7.29.7(supports-color@10.2.2))(supports-color@10.2.2)
       '@rolldown/pluginutils': 1.0.1
       '@vue/babel-plugin-jsx': 2.0.1(@babel/core@7.29.7(supports-color@10.2.2))(supports-color@10.2.2)
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-      vue: 3.5.44(typescript@5.9.3)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
+      vue: 3.5.44(typescript@6.0.3)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitejs/plugin-vue@6.0.10(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))':
+  '@vitejs/plugin-vue@6.0.10(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))':
     dependencies:
       '@rolldown/pluginutils': 1.0.1
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-      vue: 3.5.44(typescript@5.9.3)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
+      vue: 3.5.44(typescript@6.0.3)
 
-  '@vitest/expect@4.1.12':
+  '@vitest/mocker@5.0.5(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))':
     dependencies:
-      '@standard-schema/spec': 1.1.0
-      '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.12
-      '@vitest/utils': 4.1.12
-      chai: 6.2.2
-      tinyrainbow: 3.1.1
-
-  '@vitest/mocker@4.1.12(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))':
-    dependencies:
-      '@vitest/spy': 4.1.12
+      '@jridgewell/trace-mapping': 0.3.31
+      '@vitest/spy': 5.0.5
       estree-walker: 3.0.3
-      magic-string: 0.30.21
+      magic-string: 1.4.3
     optionalDependencies:
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-
-  '@vitest/pretty-format@4.1.12':
-    dependencies:
-      tinyrainbow: 3.1.1
-
-  '@vitest/runner@4.1.12':
-    dependencies:
-      '@vitest/utils': 4.1.12
-      pathe: 2.0.3
-
-  '@vitest/snapshot@4.1.12':
-    dependencies:
-      '@vitest/pretty-format': 4.1.12
-      '@vitest/utils': 4.1.12
-      magic-string: 0.30.21
-      pathe: 2.0.3
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
 
-  '@vitest/spy@4.1.12': {}
-
-  '@vitest/utils@4.1.12':
-    dependencies:
-      '@vitest/pretty-format': 4.1.12
-      convert-source-map: 2.0.0
-      tinyrainbow: 3.1.1
+  '@vitest/spy@5.0.5': {}
 
   '@volar/language-core@2.4.28':
     dependencies:
@@ -8493,15 +8392,15 @@ snapshots:
 
   '@volar/source-map@2.4.28': {}
 
-  '@volar/typescript@2.4.28(typescript@5.9.3)':
+  '@volar/typescript@2.4.28(typescript@6.0.3)':
     dependencies:
       '@volar/language-core': 2.4.28
       path-browserify: 1.0.1
       vscode-uri: 3.2.0
     optionalDependencies:
-      typescript: 5.9.3
+      typescript: 6.0.3
 
-  '@vue-macros/common@3.1.4(vue@3.5.44(typescript@5.9.3))':
+  '@vue-macros/common@3.1.4(vue@3.5.44(typescript@6.0.3))':
     dependencies:
       '@vue/compiler-sfc': 3.5.42
       ast-kit: 2.2.0
@@ -8509,7 +8408,7 @@ snapshots:
       magic-string-ast: 1.0.3
       unplugin-utils: 0.3.2
     optionalDependencies:
-      vue: 3.5.44(typescript@5.9.3)
+      vue: 3.5.44(typescript@6.0.3)
 
   '@vue/babel-helper-vue-transform-on@2.0.1': {}
 
@@ -8636,11 +8535,11 @@ snapshots:
     dependencies:
       '@vue/devtools-kit': 8.2.1
 
-  '@vue/devtools-core@8.2.1(vue@3.5.44(typescript@5.9.3))':
+  '@vue/devtools-core@8.2.1(vue@3.5.44(typescript@6.0.3))':
     dependencies:
       '@vue/devtools-kit': 8.2.1
       '@vue/devtools-shared': 8.2.1
-      vue: 3.5.44(typescript@5.9.3)
+      vue: 3.5.44(typescript@6.0.3)
 
   '@vue/devtools-kit@8.2.1':
     dependencies:
@@ -8651,11 +8550,11 @@ snapshots:
 
   '@vue/devtools-shared@8.2.1': {}
 
-  '@vue/language-core@3.3.11':
+  '@vue/language-core@3.3.13':
     dependencies:
       '@volar/language-core': 2.4.28
-      '@vue/compiler-dom': 3.5.41
-      '@vue/shared': 3.5.41
+      '@vue/compiler-dom': 3.5.44
+      '@vue/shared': 3.5.44
       alien-signals: 3.2.1
       muggle-string: 0.4.1
       path-browserify: 1.0.1
@@ -8689,18 +8588,18 @@ snapshots:
 
   '@vue/shared@3.5.44': {}
 
-  '@vueuse/core@14.4.0(vue@3.5.44(typescript@5.9.3))':
+  '@vueuse/core@15.0.0(vue@3.5.44(typescript@6.0.3))':
     dependencies:
       '@types/web-bluetooth': 0.0.21
-      '@vueuse/metadata': 14.4.0
-      '@vueuse/shared': 14.4.0(vue@3.5.44(typescript@5.9.3))
-      vue: 3.5.44(typescript@5.9.3)
+      '@vueuse/metadata': 15.0.0
+      '@vueuse/shared': 15.0.0(vue@3.5.44(typescript@6.0.3))
+      vue: 3.5.44(typescript@6.0.3)
 
-  '@vueuse/metadata@14.4.0': {}
+  '@vueuse/metadata@15.0.0': {}
 
-  '@vueuse/shared@14.4.0(vue@3.5.44(typescript@5.9.3))':
+  '@vueuse/shared@15.0.0(vue@3.5.44(typescript@6.0.3))':
     dependencies:
-      vue: 3.5.44(typescript@5.9.3)
+      vue: 3.5.44(typescript@6.0.3)
 
   abbrev@3.0.1: {}
 
@@ -8708,21 +8607,14 @@ snapshots:
     dependencies:
       event-target-shim: 5.0.1
 
-  accepts@1.3.8:
+  acorn-import-attributes@1.9.5(acorn@8.18.0):
     dependencies:
-      mime-types: 2.1.35
-      negotiator: 0.6.3
-
-  acorn-import-attributes@1.9.5(acorn@8.16.0):
-    dependencies:
-      acorn: 8.16.0
+      acorn: 8.18.0
 
   acorn-jsx@5.3.2(acorn@8.18.0):
     dependencies:
       acorn: 8.18.0
 
-  acorn@8.16.0: {}
-
   acorn@8.18.0: {}
 
   agent-base@7.1.4: {}
@@ -8748,8 +8640,6 @@ snapshots:
 
   ansis@4.3.1: {}
 
-  any-promise@1.3.0: {}
-
   anymatch@3.1.3:
     dependencies:
       normalize-path: 3.0.0
@@ -8779,8 +8669,6 @@ snapshots:
       - bare-buffer
       - react-native-b4a
 
-  arg@5.0.2: {}
-
   argparse@2.0.1: {}
 
   args-tokenizer@0.3.0: {}
@@ -8821,19 +8709,8 @@ snapshots:
 
   async@3.2.6: {}
 
-  at-least-node@1.0.0: {}
-
   atomic-sleep@1.0.0: {}
 
-  autoprefixer@10.5.0(postcss@8.5.26):
-    dependencies:
-      browserslist: 4.28.8
-      caniuse-lite: 1.0.30001792
-      fraction.js: 5.3.4
-      picocolors: 1.1.1
-      postcss: 8.5.26
-      postcss-value-parser: 4.2.0
-
   autoprefixer@10.6.1(postcss@8.5.26):
     dependencies:
       browserslist: 4.28.8
@@ -8893,12 +8770,10 @@ snapshots:
 
   bep53-range@2.0.0: {}
 
-  bidi-js@1.0.3:
+  bidi-js@1.1.0:
     dependencies:
       require-from-string: 2.0.2
 
-  binary-extensions@2.3.0: {}
-
   bindings@1.5.0:
     dependencies:
       file-uri-to-path: 1.0.0
@@ -8911,15 +8786,8 @@ snapshots:
 
   birpc@4.2.0: {}
 
-  block-iterator@1.1.2: {}
-
   bn.js@4.12.3: {}
 
-  brace-expansion@1.1.21:
-    dependencies:
-      balanced-match: 1.0.2
-      concat-map: 0.0.1
-
   brace-expansion@2.1.7:
     dependencies:
       balanced-match: 1.0.2
@@ -8960,59 +8828,25 @@ snapshots:
     dependencies:
       run-applescript: 7.1.0
 
-  c12@3.3.4(magicast@0.5.2):
-    dependencies:
-      chokidar: 5.0.0
-      confbox: 0.2.4
-      defu: 6.1.7
-      dotenv: 17.4.2
-      exsolve: 1.1.1
-      giget: 3.2.0
-      jiti: 2.7.0
-      ohash: 2.0.12
-      pathe: 2.0.3
-      perfect-debounce: 2.1.0
-      pkg-types: 2.3.1
-      rc9: 3.0.1
-    optionalDependencies:
-      magicast: 0.5.2
-
   c12@3.3.4(magicast@0.5.5):
     dependencies:
       chokidar: 5.0.0
       confbox: 0.2.4
       defu: 6.1.7
       dotenv: 17.4.2
-      exsolve: 1.1.1
+      exsolve: 1.1.3
       giget: 3.2.0
       jiti: 2.7.0
       ohash: 2.0.12
       pathe: 2.0.3
       perfect-debounce: 2.1.0
-      pkg-types: 2.3.1
-      rc9: 3.0.1
+      pkg-types: 2.4.0
+      rc9: 3.1.0
     optionalDependencies:
       magicast: 0.5.5
 
   cac@7.0.0: {}
 
-  cache-content-type@1.0.1:
-    dependencies:
-      mime-types: 2.1.35
-      ylru: 1.4.0
-
-  call-bind-apply-helpers@1.0.2:
-    dependencies:
-      es-errors: 1.3.0
-      function-bind: 1.1.2
-
-  call-bound@1.0.4:
-    dependencies:
-      call-bind-apply-helpers: 1.0.2
-      get-intrinsic: 1.3.0
-
-  camelcase-css@2.0.1: {}
-
   camelcase@5.3.1: {}
 
   caniuse-api@4.0.0:
@@ -9020,41 +8854,22 @@ snapshots:
       browserslist: 4.28.8
       caniuse-lite: 1.0.30001809
 
-  caniuse-lite@1.0.30001792: {}
-
   caniuse-lite@1.0.30001809: {}
 
   caniuse-lite@1.0.30001819: {}
 
-  chai@6.2.2: {}
+  chai@6.3.0: {}
 
-  chalk@4.1.2:
-    dependencies:
-      ansi-styles: 4.3.0
-      supports-color: 7.2.0
-
-  chart.js@4.5.1:
+  chart.js@4.6.1:
     dependencies:
       '@kurkle/color': 0.3.4
 
-  chartjs-plugin-zoom@2.2.0(chart.js@4.5.1):
+  chartjs-plugin-zoom@2.2.0(chart.js@4.6.1):
     dependencies:
       '@types/hammerjs': 2.0.46
-      chart.js: 4.5.1
+      chart.js: 4.6.1
       hammerjs: 2.0.8
 
-  chokidar@3.6.0:
-    dependencies:
-      anymatch: 3.1.3
-      braces: 3.0.3
-      glob-parent: 5.1.2
-      is-binary-path: 2.1.0
-      is-glob: 4.0.3
-      normalize-path: 3.0.0
-      readdirp: 3.6.0
-    optionalDependencies:
-      fsevents: 2.3.3
-
   chokidar@5.0.0:
     dependencies:
       readdirp: 5.0.0
@@ -9075,12 +8890,6 @@ snapshots:
       strip-ansi: 6.0.1
       wrap-ansi: 6.2.0
 
-  cliui@8.0.1:
-    dependencies:
-      string-width: 4.2.3
-      strip-ansi: 6.0.1
-      wrap-ansi: 7.0.0
-
   cliui@9.0.1:
     dependencies:
       string-width: 7.2.0
@@ -9089,10 +8898,6 @@ snapshots:
 
   cluster-key-slot@1.1.1: {}
 
-  cluster-key-slot@1.1.2: {}
-
-  co@4.6.0: {}
-
   color-convert@2.0.1:
     dependencies:
       color-name: 1.1.4
@@ -9103,10 +8908,6 @@ snapshots:
 
   commander@2.20.3: {}
 
-  commander@4.1.1: {}
-
-  commander@6.2.1: {}
-
   commondir@1.0.1: {}
 
   compatx@0.2.0: {}
@@ -9119,8 +8920,6 @@ snapshots:
       normalize-path: 3.0.0
       readable-stream: 4.7.0
 
-  concat-map@0.0.1: {}
-
   confbox@0.1.8: {}
 
   confbox@0.2.4: {}
@@ -9129,12 +8928,6 @@ snapshots:
 
   consola@3.4.2: {}
 
-  content-disposition@0.5.4:
-    dependencies:
-      safe-buffer: 5.2.1
-
-  content-type@1.0.5: {}
-
   convert-source-map@2.0.0: {}
 
   cookie-es@1.2.3: {}
@@ -9143,11 +8936,6 @@ snapshots:
 
   cookie-es@3.1.1: {}
 
-  cookies@0.9.1:
-    dependencies:
-      depd: 2.0.0
-      keygrip: 1.1.0
-
   core-util-is@1.0.3: {}
 
   crc-32@1.2.2: {}
@@ -9157,21 +8945,6 @@ snapshots:
       crc-32: 1.2.2
       readable-stream: 4.7.0
 
-  create-torrent@6.1.3:
-    dependencies:
-      bencode: 4.0.1
-      block-iterator: 1.1.2
-      fast-readable-async-iterator: 2.0.0
-      is-file: 1.0.0
-      join-async-iterator: 1.1.1
-      junk: 4.0.1
-      minimist: 1.2.8
-      once: 1.4.0
-      piece-length: 2.0.1
-      queue-microtask: 1.2.3
-      run-parallel: 1.2.0
-      uint8-util: 2.3.2
-
   croner@10.0.1: {}
 
   cross-fetch-ponyfill@1.0.3:
@@ -9189,13 +8962,15 @@ snapshots:
     dependencies:
       uncrypto: 0.1.3
 
+  crossws@0.4.16(srvx@1.0.6):
+    optionalDependencies:
+      srvx: 1.0.6
+
   css-tree@3.2.1:
     dependencies:
       mdn-data: 2.27.1
       source-map-js: 1.2.2
 
-  cssesc@3.0.0: {}
-
   cssnano@9.9.0(postcss@8.5.26):
     dependencies:
       '@colordx/core': 7.3.0
@@ -9209,24 +8984,18 @@ snapshots:
 
   data-uri-to-buffer@4.0.1: {}
 
-  data-urls@7.0.0(@noble/hashes@2.2.0):
+  data-urls@8.0.0(@noble/hashes@2.2.0):
     dependencies:
       whatwg-mimetype: 5.0.0
-      whatwg-url: 16.0.1(@noble/hashes@2.2.0)
+      whatwg-url: 17.3.0(@noble/hashes@2.2.0)
     transitivePeerDependencies:
       - '@noble/hashes'
 
   dateformat@4.6.3: {}
 
-  db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)):
+  db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)):
     optionalDependencies:
-      drizzle-orm: 0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)
-
-  debug@3.2.7(supports-color@10.2.2):
-    dependencies:
-      ms: 2.1.3
-    optionalDependencies:
-      supports-color: 10.2.2
+      drizzle-orm: 0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)
 
   debug@4.4.3(supports-color@10.2.2):
     dependencies:
@@ -9238,8 +9007,6 @@ snapshots:
 
   decimal.js@10.6.0: {}
 
-  deep-equal@1.0.1: {}
-
   deep-is@0.1.4: {}
 
   deepmerge@4.3.1: {}
@@ -9255,60 +9022,56 @@ snapshots:
 
   defu@6.1.7: {}
 
-  delegates@1.0.0: {}
-
   denque@2.1.0: {}
 
-  depd@1.1.2: {}
-
   depd@2.0.0: {}
 
   destr@2.0.5: {}
 
-  destroy@1.2.0: {}
-
   detect-libc@2.1.2: {}
 
   devalue@5.9.4: {}
 
   devalue@6.0.3: {}
 
-  didyoumean@1.2.2: {}
+  devframe@1.2.6(cac@7.0.0)(srvx@1.0.6):
+    dependencies:
+      crossws: 0.4.16(srvx@1.0.6)
+      h3: 2.0.8(crossws@0.4.16(srvx@1.0.6))
+      nostics: 1.3.0
+      pathe: 2.0.3
+    optionalDependencies:
+      cac: 7.0.0
+    transitivePeerDependencies:
+      - ocache
+      - srvx
 
   diff@9.0.0: {}
 
   dijkstrajs@1.0.3: {}
 
-  dlv@1.1.3: {}
-
   dompurify@3.4.17:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
-  dot-prop@10.1.0:
+  dot-prop@10.2.0:
     dependencies:
       type-fest: 5.6.0
 
   dotenv@17.4.2: {}
 
-  drizzle-kit@0.31.10:
+  drizzle-kit@0.31.11:
     dependencies:
       '@drizzle-team/brocli': 0.10.2
       '@esbuild-kit/esm-loader': 2.6.5
       esbuild: 0.28.2
-      tsx: 4.23.12
+      tsx: 4.23.15
 
-  drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9):
+  drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9):
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
       postgres: 3.4.9
 
-  dunder-proto@1.0.1:
-    dependencies:
-      call-bind-apply-helpers: 1.0.2
-      es-errors: 1.3.0
-      gopd: 1.2.0
-
   duplexer@0.1.2: {}
 
   eastasianwidth@0.2.0: {}
@@ -9327,14 +9090,17 @@ snapshots:
 
   emoji-regex@9.2.2: {}
 
-  encodeurl@1.0.2: {}
-
   encodeurl@2.0.0: {}
 
   end-of-stream@1.4.5:
     dependencies:
       once: 1.4.0
 
+  enhanced-resolve@5.26.0:
+    dependencies:
+      graceful-fs: 4.2.11
+      tapable: 2.3.3
+
   entities@7.0.1: {}
 
   entities@8.0.0: {}
@@ -9347,17 +9113,13 @@ snapshots:
 
   errx@0.2.2: {}
 
-  es-define-property@1.0.1: {}
-
   es-errors@1.3.0: {}
 
   es-module-lexer@2.1.0: {}
 
-  es-module-lexer@3.0.4: {}
+  es-module-lexer@2.3.2: {}
 
-  es-object-atoms@1.1.1:
-    dependencies:
-      es-errors: 1.3.0
+  es-module-lexer@3.0.4: {}
 
   esbuild@0.28.2:
     optionalDependencies:
@@ -9508,9 +9270,7 @@ snapshots:
       signal-exit: 4.1.0
       strip-final-newline: 3.0.0
 
-  expect-type@1.3.0: {}
-
-  exsolve@1.0.8: {}
+  expect-type@1.4.0: {}
 
   exsolve@1.1.1: {}
 
@@ -9538,8 +9298,6 @@ snapshots:
     dependencies:
       cac: 7.0.0
 
-  fast-readable-async-iterator@2.0.0: {}
-
   fast-safe-stringify@2.1.1: {}
 
   fast-string-truncated-width@3.0.3: {}
@@ -9598,57 +9356,54 @@ snapshots:
 
   fnv1a-64@0.1.2: {}
 
-  fontaine@0.8.0:
+  fontaine@1.0.3(esbuild@0.28.2)(postcss@8.5.26)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
       '@capsizecss/unpack': 4.0.1
       css-tree: 3.2.1
-      magic-regexp: 0.10.0
-      magic-string: 0.30.21
-      pathe: 2.0.3
-      ufo: 1.6.4
-      unplugin: 2.3.11
+      magic-string: 1.4.3
+      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+    optionalDependencies:
+      postcss: 8.5.26
+    transitivePeerDependencies:
+      - '@farmfe/core'
+      - '@rsbuild/core'
+      - '@rspack/core'
+      - bun-types-no-globals
+      - esbuild
+      - rolldown
+      - rollup
+      - unloader
+      - vite
+      - webpack
 
   fontkitten@1.0.3:
     dependencies:
       tiny-inflate: 1.0.3
 
-  fontless@0.2.1(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.10.1(supports-color@10.2.2))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  fontless@1.3.4(devframe@1.2.6(cac@7.0.0)(srvx@1.0.6))(esbuild@0.28.2)(jiti@2.7.0)(lightningcss@1.33.0)(postcss@8.5.26)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
-      consola: 3.4.2
       css-tree: 3.2.1
       defu: 6.1.7
-      esbuild: 0.28.2
-      fontaine: 0.8.0
+      exsolve: 1.1.3
+      fontaine: 1.0.3(esbuild@0.28.2)(postcss@8.5.26)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      magic-string: 1.4.3
+      unifont: 1.0.3
+    optionalDependencies:
+      devframe: 1.2.6(cac@7.0.0)(srvx@1.0.6)
       jiti: 2.7.0
       lightningcss: 1.33.0
-      magic-string: 0.30.21
-      ohash: 2.0.11
-      pathe: 2.0.3
-      ufo: 1.6.4
-      unifont: 0.7.5
-      unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.10.1(supports-color@10.2.2))
-    optionalDependencies:
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
     transitivePeerDependencies:
-      - '@azure/app-configuration'
-      - '@azure/cosmos'
-      - '@azure/data-tables'
-      - '@azure/identity'
-      - '@azure/keyvault-secrets'
-      - '@azure/storage-blob'
-      - '@capacitor/preferences'
-      - '@deno/kv'
-      - '@netlify/blobs'
-      - '@planetscale/database'
-      - '@upstash/redis'
-      - '@vercel/blob'
-      - '@vercel/functions'
-      - '@vercel/kv'
-      - aws4fetch
-      - db0
-      - idb-keyval
-      - ioredis
-      - uploadthing
+      - '@farmfe/core'
+      - '@rsbuild/core'
+      - '@rspack/core'
+      - bun-types-no-globals
+      - esbuild
+      - postcss
+      - rolldown
+      - rollup
+      - unloader
+      - webpack
 
   foreground-child@3.3.1:
     dependencies:
@@ -9661,19 +9416,8 @@ snapshots:
 
   fraction.js@5.3.4: {}
 
-  fresh@0.5.2: {}
-
   fresh@2.0.0: {}
 
-  fs-extra@9.1.0:
-    dependencies:
-      at-least-node: 1.0.0
-      graceful-fs: 4.2.11
-      jsonfile: 6.2.1
-      universalify: 2.0.1
-
-  fs.realpath@1.0.0: {}
-
   fsevents@2.3.3:
     optional: true
 
@@ -9681,8 +9425,6 @@ snapshots:
 
   fuzzysort@4.0.2: {}
 
-  generator-function@2.0.1: {}
-
   generic-names@4.0.0:
     dependencies:
       loader-utils: 3.3.1
@@ -9693,26 +9435,8 @@ snapshots:
 
   get-east-asian-width@1.5.0: {}
 
-  get-intrinsic@1.3.0:
-    dependencies:
-      call-bind-apply-helpers: 1.0.2
-      es-define-property: 1.0.1
-      es-errors: 1.3.0
-      es-object-atoms: 1.1.1
-      function-bind: 1.1.2
-      get-proto: 1.0.1
-      gopd: 1.2.0
-      has-symbols: 1.1.0
-      hasown: 2.0.3
-      math-intrinsics: 1.1.0
-
   get-port-please@3.2.0: {}
 
-  get-proto@1.0.1:
-    dependencies:
-      dunder-proto: 1.0.1
-      es-object-atoms: 1.1.1
-
   get-stdin@10.0.0: {}
 
   get-stream@8.0.1: {}
@@ -9723,9 +9447,6 @@ snapshots:
 
   giget@3.2.0: {}
 
-  giget@3.3.1:
-    optional: true
-
   glob-parent@5.1.2:
     dependencies:
       is-glob: 4.0.3
@@ -9749,30 +9470,20 @@ snapshots:
       minipass: 7.1.3
       path-scurry: 2.0.2
 
-  glob@7.2.3:
-    dependencies:
-      fs.realpath: 1.0.0
-      inflight: 1.0.6
-      inherits: 2.0.4
-      minimatch: 3.1.5
-      once: 1.4.0
-      path-is-absolute: 1.0.1
-
   global-directory@4.0.1:
     dependencies:
       ini: 4.1.1
 
-  globby@16.2.0:
+  globby@16.2.4:
     dependencies:
       '@sindresorhus/merge-streams': 4.0.0
       fast-glob: 3.3.3
-      ignore: 7.0.6
+      ignore: 7.0.13
       is-path-inside: 4.0.0
+      micromatch: 4.0.8
       slash: 5.1.0
       unicorn-magic: 0.4.0
 
-  gopd@1.2.0: {}
-
   graceful-fs@4.2.11: {}
 
   gzip-size@7.0.0:
@@ -9791,15 +9502,14 @@ snapshots:
       ufo: 1.6.4
       uncrypto: 0.1.3
 
-  hammerjs@2.0.8: {}
-
-  has-flag@4.0.0: {}
-
-  has-symbols@1.1.0: {}
-
-  has-tostringtag@1.0.2:
+  h3@2.0.8(crossws@0.4.16(srvx@1.0.6)):
     dependencies:
-      has-symbols: 1.1.0
+      rou3: 1.0.0
+      srvx: 1.0.6
+    optionalDependencies:
+      crossws: 0.4.16(srvx@1.0.6)
+
+  hammerjs@2.0.8: {}
 
   hasown@2.0.3:
     dependencies:
@@ -9813,32 +9523,12 @@ snapshots:
 
   hookable@6.1.2: {}
 
-  html-encoding-sniffer@6.0.0(@noble/hashes@2.2.0):
+  html-encoding-sniffer@7.0.0(@noble/hashes@2.2.0):
     dependencies:
-      '@exodus/bytes': 1.15.1(@noble/hashes@2.2.0)
+      '@exodus/bytes': 1.16.0(@noble/hashes@2.2.0)
     transitivePeerDependencies:
       - '@noble/hashes'
 
-  http-assert@1.5.0:
-    dependencies:
-      deep-equal: 1.0.1
-      http-errors: 1.8.1
-
-  http-errors@1.6.3:
-    dependencies:
-      depd: 1.1.2
-      inherits: 2.0.3
-      setprototypeof: 1.1.0
-      statuses: 1.5.0
-
-  http-errors@1.8.1:
-    dependencies:
-      depd: 1.1.2
-      inherits: 2.0.4
-      setprototypeof: 1.2.0
-      statuses: 1.5.0
-      toidentifier: 1.0.1
-
   http-errors@2.0.1:
     dependencies:
       depd: 2.0.0
@@ -9858,7 +9548,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  httpxy@0.5.1: {}
+  httpxy@0.5.6: {}
 
   human-signals@5.0.0: {}
 
@@ -9874,12 +9564,12 @@ snapshots:
 
   import-meta-resolve@4.2.0: {}
 
-  impound@1.2.1(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  impound@1.2.1(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       es-module-lexer: 3.0.4
       pathe: 2.0.3
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       unplugin-utils: 0.3.2
     transitivePeerDependencies:
       - '@farmfe/core'
@@ -9894,25 +9584,16 @@ snapshots:
 
   imurmurhash@0.1.4: {}
 
-  inflight@1.0.6:
-    dependencies:
-      once: 1.4.0
-      wrappy: 1.0.2
-
-  inherits@2.0.3: {}
-
   inherits@2.0.4: {}
 
   ini@4.1.1: {}
 
-  ioredis@5.10.1(supports-color@10.2.2):
+  ioredis@5.11.1(supports-color@10.2.2):
     dependencies:
-      '@ioredis/commands': 1.5.1
-      cluster-key-slot: 1.1.2
+      '@ioredis/commands': 1.10.0
+      cluster-key-slot: 1.1.1
       debug: 4.4.3(supports-color@10.2.2)
       denque: 2.1.0
-      lodash.defaults: 4.2.0
-      lodash.isarguments: 3.1.0
       redis-errors: 1.2.0
       redis-parser: 3.0.0
       standard-as-callback: 2.1.0
@@ -9936,32 +9617,16 @@ snapshots:
     dependencies:
       uint8array-extras: 1.6.0
 
-  is-binary-path@2.1.0:
-    dependencies:
-      binary-extensions: 2.3.0
-
   is-core-module@2.16.2:
     dependencies:
       hasown: 2.0.3
 
-  is-docker@2.2.1: {}
-
   is-docker@3.0.0: {}
 
   is-extglob@2.1.1: {}
 
-  is-file@1.0.0: {}
-
   is-fullwidth-code-point@3.0.0: {}
 
-  is-generator-function@1.1.2:
-    dependencies:
-      call-bound: 1.0.4
-      generator-function: 2.0.1
-      get-proto: 1.0.1
-      has-tostringtag: 1.0.2
-      safe-regex-test: 1.1.0
-
   is-glob@4.0.3:
     dependencies:
       is-extglob: 2.1.1
@@ -9989,21 +9654,10 @@ snapshots:
     dependencies:
       '@types/estree': 1.0.9
 
-  is-regex@1.2.1:
-    dependencies:
-      call-bound: 1.0.4
-      gopd: 1.2.0
-      has-tostringtag: 1.0.2
-      hasown: 2.0.3
-
   is-stream@2.0.1: {}
 
   is-stream@3.0.0: {}
 
-  is-wsl@2.2.0:
-    dependencies:
-      is-docker: 2.2.1
-
   is-wsl@3.1.1:
     dependencies:
       is-inside-container: 1.0.0
@@ -10014,10 +9668,10 @@ snapshots:
 
   isexe@4.0.0: {}
 
-  isomorphic-dompurify@4.1.0(@noble/hashes@2.2.0):
+  isomorphic-dompurify@4.6.0(@noble/hashes@2.2.0):
     dependencies:
       dompurify: 3.4.17
-      jsdom: 30.0.1(@noble/hashes@2.2.0)
+      jsdom: 30.1.3(@noble/hashes@2.2.0)
     transitivePeerDependencies:
       - '@noble/hashes'
       - canvas
@@ -10028,46 +9682,39 @@ snapshots:
     optionalDependencies:
       '@pkgjs/parseargs': 0.11.0
 
-  jiti@1.21.7: {}
-
   jiti@2.7.0: {}
 
-  join-async-iterator@1.1.1: {}
-
   joycon@3.1.1: {}
 
   js-tokens@10.0.0: {}
 
   js-tokens@4.0.0: {}
 
-  js-tokens@9.0.1: {}
-
   js-yaml@4.3.2:
     dependencies:
       argparse: 2.0.1
 
-  jsdom@30.0.1(@noble/hashes@2.2.0):
+  jsdom@30.1.3(@noble/hashes@2.2.0):
     dependencies:
-      '@asamuzakjp/css-color': 6.0.7
-      '@asamuzakjp/dom-selector': 8.3.2
+      '@asamuzakjp/css-color': 7.1.7
+      '@asamuzakjp/dom-selector': 10.0.5
       '@bramus/specificity': 2.4.2
-      '@csstools/css-syntax-patches-for-csstree': 1.1.8(css-tree@3.2.1)
-      '@exodus/bytes': 1.15.1(@noble/hashes@2.2.0)
+      '@csstools/css-syntax-patches-for-csstree': 1.1.15(css-tree@3.2.1)
+      '@exodus/bytes': 1.16.0(@noble/hashes@2.2.0)
       css-tree: 3.2.1
-      data-urls: 7.0.0(@noble/hashes@2.2.0)
+      data-urls: 8.0.0(@noble/hashes@2.2.0)
       decimal.js: 10.6.0
-      html-encoding-sniffer: 6.0.0(@noble/hashes@2.2.0)
+      html-encoding-sniffer: 7.0.0(@noble/hashes@2.2.0)
       is-potential-custom-element-name: 1.0.1
-      lru-cache: 11.5.2
+      lru-cache: 11.5.3
       parse5: 8.0.1
       saxes: 6.0.0
-      symbol-tree: 3.2.4
       tough-cookie: 6.0.2
       undici: 8.12.3
-      w3c-xmlserializer: 5.0.0
+      w3c-xmlserializer: 6.0.0
       webidl-conversions: 8.0.1
       whatwg-mimetype: 5.0.0
-      whatwg-url: 17.1.0(@noble/hashes@2.2.0)
+      whatwg-url: 17.3.0(@noble/hashes@2.2.0)
       xml-name-validator: 5.0.0
     transitivePeerDependencies:
       - '@noble/hashes'
@@ -10089,14 +9736,6 @@ snapshots:
       espree: 9.6.1
       semver: 7.8.5
 
-  jsonfile@6.2.1:
-    dependencies:
-      universalify: 2.0.1
-    optionalDependencies:
-      graceful-fs: 4.2.11
-
-  junk@4.0.1: {}
-
   jwa@2.0.1:
     dependencies:
       buffer-equal-constant-time: 1.0.1
@@ -10108,10 +9747,6 @@ snapshots:
       jwa: 2.0.1
       safe-buffer: 5.2.1
 
-  keygrip@1.1.0:
-    dependencies:
-      tsscmp: 1.0.6
-
   keyv@4.5.4:
     dependencies:
       json-buffer: 3.0.1
@@ -10122,56 +9757,6 @@ snapshots:
 
   knitwork@1.3.0: {}
 
-  koa-compose@4.1.0: {}
-
-  koa-convert@2.0.0:
-    dependencies:
-      co: 4.6.0
-      koa-compose: 4.1.0
-
-  koa-send@5.0.1(supports-color@10.2.2):
-    dependencies:
-      debug: 4.4.3(supports-color@10.2.2)
-      http-errors: 1.8.1
-      resolve-path: 1.4.0
-    transitivePeerDependencies:
-      - supports-color
-
-  koa-static@5.0.0(supports-color@10.2.2):
-    dependencies:
-      debug: 3.2.7(supports-color@10.2.2)
-      koa-send: 5.0.1(supports-color@10.2.2)
-    transitivePeerDependencies:
-      - supports-color
-
-  koa@2.16.4(supports-color@10.2.2):
-    dependencies:
-      accepts: 1.3.8
-      cache-content-type: 1.0.1
-      content-disposition: 0.5.4
-      content-type: 1.0.5
-      cookies: 0.9.1
-      debug: 4.4.3(supports-color@10.2.2)
-      delegates: 1.0.0
-      depd: 2.0.0
-      destroy: 1.2.0
-      encodeurl: 1.0.2
-      escape-html: 1.0.3
-      fresh: 0.5.2
-      http-assert: 1.5.0
-      http-errors: 1.8.1
-      is-generator-function: 1.1.2
-      koa-compose: 4.1.0
-      koa-convert: 2.0.0
-      on-finished: 2.4.1
-      only: 0.0.2
-      parseurl: 1.3.3
-      statuses: 1.5.0
-      type-is: 1.6.18
-      vary: 1.1.2
-    transitivePeerDependencies:
-      - supports-color
-
   launch-editor@2.14.2:
     dependencies:
       picocolors: 1.1.1
@@ -10186,39 +9771,88 @@ snapshots:
       prelude-ls: 1.2.1
       type-check: 0.4.0
 
+  lightningcss-android-arm64@1.32.0:
+    optional: true
+
   lightningcss-android-arm64@1.33.0:
     optional: true
 
+  lightningcss-darwin-arm64@1.32.0:
+    optional: true
+
   lightningcss-darwin-arm64@1.33.0:
     optional: true
 
+  lightningcss-darwin-x64@1.32.0:
+    optional: true
+
   lightningcss-darwin-x64@1.33.0:
     optional: true
 
+  lightningcss-freebsd-x64@1.32.0:
+    optional: true
+
   lightningcss-freebsd-x64@1.33.0:
     optional: true
 
+  lightningcss-linux-arm-gnueabihf@1.32.0:
+    optional: true
+
   lightningcss-linux-arm-gnueabihf@1.33.0:
     optional: true
 
+  lightningcss-linux-arm64-gnu@1.32.0:
+    optional: true
+
   lightningcss-linux-arm64-gnu@1.33.0:
     optional: true
 
+  lightningcss-linux-arm64-musl@1.32.0:
+    optional: true
+
   lightningcss-linux-arm64-musl@1.33.0:
     optional: true
 
+  lightningcss-linux-x64-gnu@1.32.0:
+    optional: true
+
   lightningcss-linux-x64-gnu@1.33.0:
     optional: true
 
+  lightningcss-linux-x64-musl@1.32.0:
+    optional: true
+
   lightningcss-linux-x64-musl@1.33.0:
     optional: true
 
+  lightningcss-win32-arm64-msvc@1.32.0:
+    optional: true
+
   lightningcss-win32-arm64-msvc@1.33.0:
     optional: true
 
+  lightningcss-win32-x64-msvc@1.32.0:
+    optional: true
+
   lightningcss-win32-x64-msvc@1.33.0:
     optional: true
 
+  lightningcss@1.32.0:
+    dependencies:
+      detect-libc: 2.1.2
+    optionalDependencies:
+      lightningcss-android-arm64: 1.32.0
+      lightningcss-darwin-arm64: 1.32.0
+      lightningcss-darwin-x64: 1.32.0
+      lightningcss-freebsd-x64: 1.32.0
+      lightningcss-linux-arm-gnueabihf: 1.32.0
+      lightningcss-linux-arm64-gnu: 1.32.0
+      lightningcss-linux-arm64-musl: 1.32.0
+      lightningcss-linux-x64-gnu: 1.32.0
+      lightningcss-linux-x64-musl: 1.32.0
+      lightningcss-win32-arm64-msvc: 1.32.0
+      lightningcss-win32-x64-msvc: 1.32.0
+
   lightningcss@1.33.0:
     dependencies:
       detect-libc: 2.1.2
@@ -10235,32 +9869,30 @@ snapshots:
       lightningcss-win32-arm64-msvc: 1.33.0
       lightningcss-win32-x64-msvc: 1.33.0
 
-  lilconfig@3.1.3: {}
-
-  lines-and-columns@1.2.4: {}
-
   linkifyjs@4.3.3: {}
 
-  listhen@1.10.0:
+  listhen@1.10.1(@parcel/watcher@2.5.6)(srvx@1.0.6):
     dependencies:
-      '@parcel/watcher': 2.5.6
       '@parcel/watcher-wasm': 2.5.6
       citty: 0.2.2
       consola: 3.4.2
-      crossws: 0.3.5
+      crossws: 0.4.16(srvx@1.0.6)
       defu: 6.1.7
       get-port-please: 3.2.0
       h3: 1.15.11
       http-shutdown: 1.2.2
       jiti: 2.7.0
-      mlly: 1.8.2
       node-forge: 1.4.0
       pathe: 2.0.3
-      std-env: 4.2.0
-      tinyclip: 0.1.12
+      std-env: 4.3.0
+      tinyclip: 0.1.15
       ufo: 1.6.4
-      untun: 0.1.3
+      untun: 0.2.2
       uqr: 0.1.3
+    optionalDependencies:
+      '@parcel/watcher': 2.5.6
+    transitivePeerDependencies:
+      - srvx
 
   loader-utils@3.3.1: {}
 
@@ -10278,16 +9910,14 @@ snapshots:
     dependencies:
       p-locate: 5.0.0
 
-  lodash.defaults@4.2.0: {}
-
-  lodash.isarguments@3.1.0: {}
-
   lodash@4.18.1: {}
 
   lru-cache@10.4.3: {}
 
   lru-cache@11.5.2: {}
 
+  lru-cache@11.5.3: {}
+
   lru-cache@5.1.1:
     dependencies:
       yallist: 3.1.1
@@ -10302,13 +9932,31 @@ snapshots:
       ufo: 1.6.4
       unplugin: 2.3.11
 
+  magic-regexp@0.11.2(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
+    dependencies:
+      magic-string: 1.4.3
+      regexp-tree: 0.1.27
+      type-level-regexp: 0.1.17
+      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+    transitivePeerDependencies:
+      - '@farmfe/core'
+      - '@rsbuild/core'
+      - '@rspack/core'
+      - bun-types-no-globals
+      - esbuild
+      - rolldown
+      - rollup
+      - unloader
+      - vite
+      - webpack
+
   magic-string-ast@1.0.3:
     dependencies:
       magic-string: 0.30.21
 
   magic-string@0.30.21:
     dependencies:
-      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/sourcemap-codec': 1.6.0
 
   magic-string@1.2.0:
     dependencies:
@@ -10318,12 +9966,6 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.6.0
 
-  magicast@0.5.2:
-    dependencies:
-      '@babel/parser': 7.29.3
-      '@babel/types': 7.29.0
-      source-map-js: 1.2.2
-
   magicast@0.5.5:
     dependencies:
       '@babel/parser': 7.29.9
@@ -10336,24 +9978,18 @@ snapshots:
       bep53-range: 2.0.0
       uint8-util: 2.3.2
 
-  marked@18.0.10: {}
-
-  math-intrinsics@1.1.0: {}
+  marked@18.1.1: {}
 
   mdn-data@2.27.1: {}
 
-  media-typer@0.3.0: {}
-
-  mediainfo.js@0.3.7:
+  mediainfo.js@0.3.8:
     dependencies:
-      yargs: 18.0.0
+      yargs: 18.2.0
 
   merge-stream@2.0.0: {}
 
   merge2@1.4.1: {}
 
-  methods@1.1.2: {}
-
   microdiff@1.6.0: {}
 
   micromatch@4.0.8:
@@ -10361,19 +9997,13 @@ snapshots:
       braces: 3.0.3
       picomatch: 2.3.2
 
-  mime-db@1.52.0: {}
-
   mime-db@1.54.0: {}
 
-  mime-types@2.1.35:
-    dependencies:
-      mime-db: 1.52.0
-
   mime-types@3.0.2:
     dependencies:
       mime-db: 1.54.0
 
-  mime@4.1.0: {}
+  mime@4.1.1: {}
 
   mimic-fn@4.0.0: {}
 
@@ -10383,10 +10013,6 @@ snapshots:
     dependencies:
       brace-expansion: 5.0.12
 
-  minimatch@3.1.5:
-    dependencies:
-      brace-expansion: 1.1.21
-
   minimatch@5.1.9:
     dependencies:
       brace-expansion: 2.1.7
@@ -10418,19 +10044,13 @@ snapshots:
 
   muggle-string@0.4.1: {}
 
-  my-bad@0.2.11(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  my-bad@0.2.11(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
       clickable-path: 0.1.1
       errx: 0.2.2
       fnv1a-64: 0.1.2
     optionalDependencies:
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-
-  mz@2.7.0:
-    dependencies:
-      any-promise: 1.3.0
-      object-assign: 4.1.1
-      thenify-all: 1.6.0
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
 
   nanoid@3.3.18: {}
 
@@ -10438,21 +10058,19 @@ snapshots:
 
   natural-compare@1.4.0: {}
 
-  negotiator@0.6.3: {}
-
-  nitropack@2.13.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9))(oxc-parser@0.141.0)(rolldown@1.2.15)(supports-color@10.2.2)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  nitropack@2.13.5(@parcel/watcher@2.5.6)(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9))(oxc-parser@0.141.0)(rolldown@1.2.15)(srvx@1.0.6)(supports-color@10.2.2)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
       '@cloudflare/kv-asset-handler': 0.4.2
-      '@rollup/plugin-alias': 6.0.0(rollup@4.60.3)
-      '@rollup/plugin-commonjs': 29.0.2(rollup@4.60.3)
-      '@rollup/plugin-inject': 5.0.5(rollup@4.60.3)
-      '@rollup/plugin-json': 6.1.0(rollup@4.60.3)
-      '@rollup/plugin-node-resolve': 16.0.3(rollup@4.60.3)
-      '@rollup/plugin-replace': 6.0.3(rollup@4.60.3)
-      '@rollup/plugin-terser': 1.0.0(rollup@4.60.3)
-      '@vercel/nft': 1.5.0(rollup@4.60.3)(supports-color@10.2.2)
+      '@rollup/plugin-alias': 6.0.0(rollup@4.65.0)
+      '@rollup/plugin-commonjs': 29.0.3(rollup@4.65.0)
+      '@rollup/plugin-inject': 5.0.5(rollup@4.65.0)
+      '@rollup/plugin-json': 6.1.0(rollup@4.65.0)
+      '@rollup/plugin-node-resolve': 16.0.3(rollup@4.65.0)
+      '@rollup/plugin-replace': 6.0.3(rollup@4.65.0)
+      '@rollup/plugin-terser': 1.0.0(rollup@4.65.0)
+      '@vercel/nft': 1.11.0(rollup@4.65.0)(supports-color@10.2.2)
       archiver: 7.0.1
-      c12: 3.3.4(magicast@0.5.2)
+      c12: 3.3.4(magicast@0.5.5)
       chokidar: 5.0.0
       citty: 0.2.2
       compatx: 0.2.0
@@ -10461,53 +10079,53 @@ snapshots:
       cookie-es: 2.0.1
       croner: 10.0.1
       crossws: 0.3.5
-      db0: 0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9))
+      db0: 0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9))
       defu: 6.1.7
       destr: 2.0.5
-      dot-prop: 10.1.0
+      dot-prop: 10.2.0
       esbuild: 0.28.2
       escape-string-regexp: 5.0.0
       etag: 1.8.1
-      exsolve: 1.0.8
-      globby: 16.2.0
+      exsolve: 1.1.3
+      globby: 16.2.4
       gzip-size: 7.0.0
       h3: 1.15.11
       hookable: 5.5.3
-      httpxy: 0.5.1
-      ioredis: 5.10.1(supports-color@10.2.2)
+      httpxy: 0.5.6
+      ioredis: 5.11.1(supports-color@10.2.2)
       jiti: 2.7.0
       klona: 2.0.6
       knitwork: 1.3.0
-      listhen: 1.10.0
+      listhen: 1.10.1(@parcel/watcher@2.5.6)(srvx@1.0.6)
       magic-string: 0.30.21
-      magicast: 0.5.2
-      mime: 4.1.0
+      magicast: 0.5.5
+      mime: 4.1.1
       mlly: 1.8.2
       node-fetch-native: 1.6.7
-      node-mock-http: 1.0.4
+      node-mock-http: 1.0.5
       ofetch: 1.5.1
-      ohash: 2.0.11
+      ohash: 2.0.12
       pathe: 2.0.3
       perfect-debounce: 2.1.0
-      pkg-types: 2.3.1
-      pretty-bytes: 7.1.0
+      pkg-types: 2.4.0
+      pretty-bytes: 7.2.0
       radix3: 1.1.2
-      rollup: 4.60.3
-      rollup-plugin-visualizer: 7.0.1(rolldown@1.2.15)(rollup@4.60.3)
+      rollup: 4.65.0
+      rollup-plugin-visualizer: 7.1.1(rolldown@1.2.15)(rollup@4.65.0)
       scule: 1.3.0
-      semver: 7.7.4
+      semver: 7.8.5
       serve-placeholder: 2.0.2
       serve-static: 2.2.1(supports-color@10.2.2)
       source-map: 0.7.6
-      std-env: 4.1.0
+      std-env: 4.3.0
       ufo: 1.6.4
-      ultrahtml: 1.6.0
+      ultrahtml: 1.7.0
       uncrypto: 0.1.3
       unctx: 2.5.0
       unenv: 2.0.0-rc.24
-      unimport: 6.2.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      unplugin-utils: 0.3.1
-      unstorage: 1.17.5(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.10.1(supports-color@10.2.2))
+      unimport: 6.5.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      unplugin-utils: 0.3.2
+      unstorage: 1.17.6(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.11.1(supports-color@10.2.2))
       untyped: 2.0.0
       unwasm: 0.5.3
       youch: 4.1.1
@@ -10525,7 +10143,9 @@ snapshots:
       - '@farmfe/core'
       - '@libsql/client'
       - '@netlify/blobs'
+      - '@parcel/watcher'
       - '@planetscale/database'
+      - '@rsbuild/core'
       - '@rspack/core'
       - '@upstash/redis'
       - '@vercel/blob'
@@ -10544,13 +10164,15 @@ snapshots:
       - react-native-b4a
       - rolldown
       - sqlite3
+      - srvx
       - supports-color
       - unloader
       - uploadthing
       - vite
       - webpack
 
-  node-addon-api@7.1.1: {}
+  node-addon-api@7.1.1:
+    optional: true
 
   node-domexception@1.0.0: {}
 
@@ -10572,6 +10194,8 @@ snapshots:
 
   node-mock-http@1.0.4: {}
 
+  node-mock-http@1.0.5: {}
+
   node-releases@2.0.53: {}
 
   nodemailer@10.2.1: {}
@@ -10597,20 +10221,20 @@ snapshots:
 
   nuxt-define@1.0.0: {}
 
-  nuxt@4.6.2(770feae4848205a63c0a1ab5684c5cdb):
+  nuxt@4.6.2(0aa2e1ff7ec74578bd134c9d216ec795):
     dependencies:
-      '@dxup/nuxt': 0.5.10(esbuild@0.28.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      '@dxup/nuxt': 0.5.10(esbuild@0.28.2)(magicast@0.5.5)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       '@jridgewell/trace-mapping': 0.3.31
-      '@nuxt/cli': 4.0.1(@nuxt/schema@4.6.2)(jiti@2.7.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      '@nuxt/cli': 4.0.1(@nuxt/schema@4.6.2)(jiti@2.7.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       '@nuxt/devalue': 2.0.2
-      '@nuxt/devtools': 3.4.4(@nuxt/schema@4.6.2)(bufferutil@4.1.0)(confbox@0.3.1)(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(dotenv@17.4.2)(giget@3.3.1)(ioredis@5.10.1(supports-color@10.2.2))(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(utf-8-validate@6.0.6)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
-      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
-      '@nuxt/nitro-server': 4.6.2(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7(supports-color@10.2.2)))(@nuxt/schema@4.6.2)(@oxc-project/types@0.155.0)(confbox@0.3.1)(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(dotenv@17.4.2)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9))(esbuild@0.28.2)(giget@3.3.1)(ioredis@5.10.1(supports-color@10.2.2))(jiti@2.7.0)(lightningcss@1.33.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(770feae4848205a63c0a1ab5684c5cdb))(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(supports-color@10.2.2)(typescript@5.9.3)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      '@nuxt/devtools': 3.4.4(@nuxt/schema@4.6.2)(bufferutil@4.1.0)(confbox@0.3.1)(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(dotenv@17.4.2)(giget@3.2.0)(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(utf-8-validate@6.0.6)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
+      '@nuxt/nitro-server': 4.6.2(@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.29.7(supports-color@10.2.2)))(@nuxt/schema@4.6.2)(@oxc-project/types@0.155.0)(@parcel/watcher@2.5.6)(confbox@0.3.1)(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(dotenv@17.4.2)(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9))(esbuild@0.28.2)(giget@3.2.0)(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(lightningcss@1.33.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(0aa2e1ff7ec74578bd134c9d216ec795))(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(srvx@1.0.6)(supports-color@10.2.2)(typescript@6.0.3)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       '@nuxt/schema': 4.6.2
-      '@nuxt/telemetry': 2.9.1(@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))))
-      '@nuxt/vite-builder': 4.6.2(@babel/plugin-syntax-jsx@7.28.6(@babel/core@7.29.7(supports-color@10.2.2)))(@nuxt/schema@4.6.2)(@types/node@24.13.3)(confbox@0.3.1)(dotenv@17.4.2)(esbuild@0.28.2)(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(770feae4848205a63c0a1ab5684c5cdb))(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup-plugin-visualizer@7.0.1(rolldown@1.2.15)(rollup@4.60.3))(rollup@4.60.3)(supports-color@10.2.2)(terser@5.46.2)(tsx@4.23.13)(typescript@5.9.3)(vue-tsc@3.3.11(typescript@5.9.3))(vue@3.5.44(typescript@5.9.3))(yaml@2.9.0)
-      '@nuxt/vite-server': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(770feae4848205a63c0a1ab5684c5cdb))(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      '@unhead/vue': 3.4.3(@oxc-project/types@0.155.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
+      '@nuxt/telemetry': 2.9.1(@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))))
+      '@nuxt/vite-builder': 4.6.2(@babel/plugin-syntax-jsx@7.28.6(@babel/core@7.29.7(supports-color@10.2.2)))(@nuxt/schema@4.6.2)(@types/node@26.6.5)(confbox@0.3.1)(dotenv@17.4.2)(esbuild@0.28.2)(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(0aa2e1ff7ec74578bd134c9d216ec795))(optionator@0.9.4)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup-plugin-visualizer@7.1.1(rolldown@1.2.15)(rollup@4.65.0))(rollup@4.65.0)(supports-color@10.2.2)(terser@5.46.2)(tsx@4.23.15)(typescript@6.0.3)(vue-tsc@3.3.13(typescript@6.0.3))(vue@3.5.44(typescript@6.0.3))(yaml@2.9.0)
+      '@nuxt/vite-server': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(0aa2e1ff7ec74578bd134c9d216ec795))(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      '@unhead/vue': 3.4.3(@oxc-project/types@0.155.0)(esbuild@0.28.2)(lightningcss@1.33.0)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
       '@vue/shared': 3.5.44
       chokidar: 5.0.0
       clickable-path: 0.1.1
@@ -10627,13 +10251,13 @@ snapshots:
       fnv1a-64: 0.1.2
       hookable: 6.1.2
       ignore: 7.0.13
-      impound: 1.2.1(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      impound: 1.2.1(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       iron-webcrypto: 2.0.0
       jiti: 2.7.0
       klona: 2.0.6
       knitwork: 1.3.0
       magic-string: 1.4.3
-      my-bad: 0.2.11(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      my-bad: 0.2.11(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       nanotar: 0.3.0
       nostics: 1.3.0
       object-identity: 0.2.3
@@ -10654,21 +10278,21 @@ snapshots:
       ufo: 1.6.4
       ultrahtml: 1.7.0
       uncrypto: 0.1.3
-      unctx: 3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      unctx: 3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
       undici: 8.12.3
-      unhead: 3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      unimport: 7.0.2(acorn@8.18.0)(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unhead: 3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      unimport: 7.0.2(acorn@8.18.0)(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       unrouting: 0.2.3
       untyped: 2.0.0
       verkit: 0.5.0
-      vue: 3.5.44(typescript@5.9.3)
+      vue: 3.5.44(typescript@6.0.3)
       vue-bundle-renderer: 2.4.0
       vue-component-type-helpers: 3.3.13
-      vue-router: 5.4.0(@vue/compiler-sfc@3.5.41)(esbuild@0.28.2)(pinia@4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3)))(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3))
+      vue-router: 5.4.0(@vue/compiler-sfc@3.5.41)(esbuild@0.28.2)(pinia@4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3)))(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3))
     optionalDependencies:
       '@parcel/watcher': 2.5.6
-      '@types/node': 24.13.3
+      '@types/node': 26.6.5
     transitivePeerDependencies:
       - '@azure/app-configuration'
       - '@azure/cosmos'
@@ -10735,6 +10359,7 @@ snapshots:
       - sass-embedded
       - serve
       - sqlite3
+      - srvx
       - stylelint
       - stylus
       - sugarss
@@ -10751,9 +10376,11 @@ snapshots:
       - xml2js
       - yaml
 
-  object-assign@4.1.1: {}
-
-  object-hash@3.0.0: {}
+  nypm@0.6.11:
+    dependencies:
+      citty: 0.2.2
+      pathe: 2.0.3
+      tinyexec: 1.3.1
 
   object-identity@0.2.3: {}
 
@@ -10787,8 +10414,6 @@ snapshots:
     dependencies:
       mimic-fn: 4.0.0
 
-  only@0.0.2: {}
-
   open@11.0.0:
     dependencies:
       default-browser: 5.5.0
@@ -10798,11 +10423,6 @@ snapshots:
       powershell-utils: 0.1.0
       wsl-utils: 0.3.1
 
-  open@7.4.2:
-    dependencies:
-      is-docker: 2.2.1
-      is-wsl: 2.2.0
-
   optionator@0.9.4:
     dependencies:
       deep-is: 0.1.4
@@ -10902,8 +10522,6 @@ snapshots:
 
   package-json-from-dist@1.0.1: {}
 
-  package-manager-detector@1.6.0: {}
-
   package-manager-detector@1.9.0: {}
 
   parse-torrent@11.0.24:
@@ -10925,8 +10543,6 @@ snapshots:
 
   path-exists@4.0.0: {}
 
-  path-is-absolute@1.0.1: {}
-
   path-key@3.1.1: {}
 
   path-key@4.0.0: {}
@@ -10943,10 +10559,6 @@ snapshots:
       lru-cache: 11.5.2
       minipass: 7.1.3
 
-  path-to-regexp@6.3.0: {}
-
-  pathe@1.1.2: {}
-
   pathe@2.0.3: {}
 
   perfect-debounce@2.1.0: {}
@@ -10955,27 +10567,21 @@ snapshots:
 
   picomatch@2.3.2: {}
 
-  picomatch@4.0.5: {}
-
   picomatch@4.0.7: {}
 
-  piece-length@2.0.1: {}
-
-  pify@2.3.0: {}
-
-  pinia@4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3)):
+  pinia@4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3)):
     dependencies:
       '@vue/devtools-api': 8.2.1
-      nostics: 1.2.0
-      vue: 3.5.44(typescript@5.9.3)
+      nostics: 1.3.0
+      vue: 3.5.44(typescript@6.0.3)
     optionalDependencies:
-      typescript: 5.9.3
+      typescript: 6.0.3
 
   pino-abstract-transport@3.0.0:
     dependencies:
       split2: 4.2.0
 
-  pino-pretty@13.1.3:
+  pino-pretty@13.2.0:
     dependencies:
       colorette: 2.0.20
       dateformat: 4.6.3
@@ -10988,12 +10594,12 @@ snapshots:
       pino-abstract-transport: 3.0.0
       pump: 3.0.4
       secure-json-parse: 4.1.0
-      sonic-boom: 4.2.1
+      sonic-boom: 5.0.2
       strip-json-comments: 5.0.3
 
   pino-std-serializers@7.1.0: {}
 
-  pino@10.3.1:
+  pino@10.4.0:
     dependencies:
       '@pinojs/redact': 0.4.0
       atomic-sleep: 1.0.0
@@ -11002,13 +10608,11 @@ snapshots:
       pino-std-serializers: 7.1.0
       process-warning: 5.0.0
       quick-format-unescaped: 4.0.4
-      real-require: 0.2.0
+      real-require: 1.0.0
       safe-stable-stringify: 2.5.0
       sonic-boom: 4.2.1
       thread-stream: 4.0.0
 
-  pirates@4.0.7: {}
-
   pkg-types@1.3.1:
     dependencies:
       confbox: 0.1.8
@@ -11029,61 +10633,11 @@ snapshots:
 
   pngjs@5.0.0: {}
 
-  portfinder@1.0.38(supports-color@10.2.2):
-    dependencies:
-      async: 3.2.6
-      debug: 4.4.3(supports-color@10.2.2)
-    transitivePeerDependencies:
-      - supports-color
-
   postcss-calc@11.2.3(postcss@8.5.26):
     dependencies:
       '@csstools/css-tokenizer': 4.0.2
       postcss: 8.5.26
 
-  postcss-import@15.1.0(postcss@8.5.26):
-    dependencies:
-      postcss: 8.5.26
-      postcss-value-parser: 4.2.0
-      read-cache: 1.0.0
-      resolve: 1.22.12
-
-  postcss-js@4.1.0(postcss@8.5.26):
-    dependencies:
-      camelcase-css: 2.0.1
-      postcss: 8.5.26
-
-  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.26)(tsx@4.23.13)(yaml@2.9.0):
-    dependencies:
-      lilconfig: 3.1.3
-    optionalDependencies:
-      jiti: 1.21.7
-      postcss: 8.5.26
-      tsx: 4.23.13
-      yaml: 2.9.0
-
-  postcss-nested@6.2.0(postcss@8.5.26):
-    dependencies:
-      postcss: 8.5.26
-      postcss-selector-parser: 6.1.5
-
-  postcss-nesting@13.0.2(postcss@8.5.26):
-    dependencies:
-      '@csstools/selector-resolve-nested': 3.1.0(postcss-selector-parser@7.1.7)
-      '@csstools/selector-specificity': 5.0.0(postcss-selector-parser@7.1.7)
-      postcss: 8.5.26
-      postcss-selector-parser: 7.1.7
-
-  postcss-selector-parser@6.1.5:
-    dependencies:
-      cssesc: 3.0.0
-      util-deprecate: 1.0.2
-
-  postcss-selector-parser@7.1.7:
-    dependencies:
-      cssesc: 3.0.0
-      util-deprecate: 1.0.2
-
   postcss-value-parser@4.2.0: {}
 
   postcss@8.5.26:
@@ -11098,7 +10652,7 @@ snapshots:
 
   prelude-ls@1.2.1: {}
 
-  pretty-bytes@7.1.0: {}
+  pretty-bytes@7.2.0: {}
 
   process-nextick-args@2.0.1: {}
 
@@ -11106,31 +10660,26 @@ snapshots:
 
   process@0.11.10: {}
 
-  prom-client@15.1.3:
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      tdigest: 0.1.2
-
   proper-lockfile@4.1.2:
     dependencies:
       graceful-fs: 4.2.11
       retry: 0.12.0
       signal-exit: 3.0.7
 
-  prosemirror-changeset@2.4.1:
+  prosemirror-changeset@2.4.4:
     dependencies:
-      prosemirror-transform: 1.12.0
+      prosemirror-transform: 1.12.4
 
-  prosemirror-commands@1.7.1:
+  prosemirror-commands@1.7.2:
     dependencies:
       prosemirror-model: 1.25.12
       prosemirror-state: 1.4.4
-      prosemirror-transform: 1.12.0
+      prosemirror-transform: 1.12.4
 
-  prosemirror-dropcursor@1.8.2:
+  prosemirror-dropcursor@1.8.4:
     dependencies:
       prosemirror-state: 1.4.4
-      prosemirror-transform: 1.12.0
+      prosemirror-transform: 1.12.4
       prosemirror-view: 1.42.7
 
   prosemirror-gapcursor@1.4.1:
@@ -11140,17 +10689,17 @@ snapshots:
       prosemirror-state: 1.4.4
       prosemirror-view: 1.42.7
 
-  prosemirror-history@1.5.0:
+  prosemirror-history@1.5.1:
     dependencies:
       prosemirror-state: 1.4.4
-      prosemirror-transform: 1.12.0
+      prosemirror-transform: 1.12.4
       prosemirror-view: 1.42.7
       rope-sequence: 1.3.4
 
   prosemirror-inputrules@1.5.1:
     dependencies:
       prosemirror-state: 1.4.4
-      prosemirror-transform: 1.12.0
+      prosemirror-transform: 1.12.4
 
   prosemirror-keymap@1.2.3:
     dependencies:
@@ -11165,12 +10714,12 @@ snapshots:
     dependencies:
       prosemirror-model: 1.25.12
       prosemirror-state: 1.4.4
-      prosemirror-transform: 1.12.0
+      prosemirror-transform: 1.12.4
 
   prosemirror-state@1.4.4:
     dependencies:
       prosemirror-model: 1.25.12
-      prosemirror-transform: 1.12.0
+      prosemirror-transform: 1.12.4
       prosemirror-view: 1.42.7
 
   prosemirror-tables@1.8.5:
@@ -11178,10 +10727,10 @@ snapshots:
       prosemirror-keymap: 1.2.3
       prosemirror-model: 1.25.12
       prosemirror-state: 1.4.4
-      prosemirror-transform: 1.12.0
+      prosemirror-transform: 1.12.4
       prosemirror-view: 1.42.7
 
-  prosemirror-transform@1.12.0:
+  prosemirror-transform@1.12.4:
     dependencies:
       prosemirror-model: 1.25.12
 
@@ -11189,7 +10738,7 @@ snapshots:
     dependencies:
       prosemirror-model: 1.25.12
       prosemirror-state: 1.4.4
-      prosemirror-transform: 1.12.0
+      prosemirror-transform: 1.12.4
 
   pump@3.0.4:
     dependencies:
@@ -11230,10 +10779,6 @@ snapshots:
       defu: 6.1.7
       destr: 2.0.5
 
-  read-cache@1.0.0:
-    dependencies:
-      pify: 2.3.0
-
   readable-stream@2.3.8:
     dependencies:
       core-util-is: 1.0.3
@@ -11256,14 +10801,12 @@ snapshots:
     dependencies:
       minimatch: 5.1.9
 
-  readdirp@3.6.0:
-    dependencies:
-      picomatch: 2.3.2
-
   readdirp@5.0.0: {}
 
   real-require@0.2.0: {}
 
+  real-require@1.0.0: {}
+
   redis-errors@1.2.0: {}
 
   redis-parser@3.0.0:
@@ -11274,12 +10817,6 @@ snapshots:
 
   regexp-tree@0.1.27: {}
 
-  replace-in-file@6.3.5:
-    dependencies:
-      chalk: 4.1.2
-      glob: 7.2.3
-      yargs: 17.7.2
-
   require-directory@2.1.1: {}
 
   require-from-string@2.0.2: {}
@@ -11288,11 +10825,6 @@ snapshots:
 
   resolve-from@5.0.0: {}
 
-  resolve-path@1.4.0:
-    dependencies:
-      http-errors: 1.6.3
-      path-is-absolute: 1.0.1
-
   resolve-pkg-maps@1.0.0: {}
 
   resolve@1.22.12:
@@ -11333,51 +10865,54 @@ snapshots:
       '@rolldown/binding-win32-arm64-msvc': 1.2.15
       '@rolldown/binding-win32-x64-msvc': 1.2.15
 
-  rollup-plugin-visualizer@7.0.1(rolldown@1.2.15)(rollup@4.60.3):
+  rollup-plugin-visualizer@7.1.1(rolldown@1.2.15)(rollup@4.65.0):
     dependencies:
       open: 11.0.0
       picomatch: 4.0.7
-      source-map: 0.7.6
-      yargs: 18.0.0
+      source-map: 0.8.0
+      yargs: 18.2.0
     optionalDependencies:
       rolldown: 1.2.15
-      rollup: 4.60.3
+      rollup: 4.65.0
 
-  rollup@4.60.3:
+  rollup@4.65.0:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
     optionalDependencies:
-      '@rollup/rollup-android-arm-eabi': 4.60.3
-      '@rollup/rollup-android-arm64': 4.60.3
-      '@rollup/rollup-darwin-arm64': 4.60.3
-      '@rollup/rollup-darwin-x64': 4.60.3
-      '@rollup/rollup-freebsd-arm64': 4.60.3
-      '@rollup/rollup-freebsd-x64': 4.60.3
-      '@rollup/rollup-linux-arm-gnueabihf': 4.60.3
-      '@rollup/rollup-linux-arm-musleabihf': 4.60.3
-      '@rollup/rollup-linux-arm64-gnu': 4.60.3
-      '@rollup/rollup-linux-arm64-musl': 4.60.3
-      '@rollup/rollup-linux-loong64-gnu': 4.60.3
-      '@rollup/rollup-linux-loong64-musl': 4.60.3
-      '@rollup/rollup-linux-ppc64-gnu': 4.60.3
-      '@rollup/rollup-linux-ppc64-musl': 4.60.3
-      '@rollup/rollup-linux-riscv64-gnu': 4.60.3
-      '@rollup/rollup-linux-riscv64-musl': 4.60.3
-      '@rollup/rollup-linux-s390x-gnu': 4.60.3
-      '@rollup/rollup-linux-x64-gnu': 4.60.3
-      '@rollup/rollup-linux-x64-musl': 4.60.3
-      '@rollup/rollup-openbsd-x64': 4.60.3
-      '@rollup/rollup-openharmony-arm64': 4.60.3
-      '@rollup/rollup-win32-arm64-msvc': 4.60.3
-      '@rollup/rollup-win32-ia32-msvc': 4.60.3
-      '@rollup/rollup-win32-x64-gnu': 4.60.3
-      '@rollup/rollup-win32-x64-msvc': 4.60.3
+      '@napi-rs/lzma-linux-x64-gnu': 1.5.1
+      '@rollup/rollup-android-arm-eabi': 4.65.0
+      '@rollup/rollup-android-arm64': 4.65.0
+      '@rollup/rollup-darwin-arm64': 4.65.0
+      '@rollup/rollup-darwin-x64': 4.65.0
+      '@rollup/rollup-freebsd-arm64': 4.65.0
+      '@rollup/rollup-freebsd-x64': 4.65.0
+      '@rollup/rollup-linux-arm-gnueabihf': 4.65.0
+      '@rollup/rollup-linux-arm-musleabihf': 4.65.0
+      '@rollup/rollup-linux-arm64-gnu': 4.65.0
+      '@rollup/rollup-linux-arm64-musl': 4.65.0
+      '@rollup/rollup-linux-loong64-gnu': 4.65.0
+      '@rollup/rollup-linux-loong64-musl': 4.65.0
+      '@rollup/rollup-linux-ppc64-gnu': 4.65.0
+      '@rollup/rollup-linux-ppc64-musl': 4.65.0
+      '@rollup/rollup-linux-riscv64-gnu': 4.65.0
+      '@rollup/rollup-linux-riscv64-musl': 4.65.0
+      '@rollup/rollup-linux-s390x-gnu': 4.65.0
+      '@rollup/rollup-linux-x64-gnu': 4.65.0
+      '@rollup/rollup-linux-x64-musl': 4.65.0
+      '@rollup/rollup-openbsd-x64': 4.65.0
+      '@rollup/rollup-openharmony-arm64': 4.65.0
+      '@rollup/rollup-win32-arm64-msvc': 4.65.0
+      '@rollup/rollup-win32-ia32-msvc': 4.65.0
+      '@rollup/rollup-win32-x64-gnu': 4.65.0
+      '@rollup/rollup-win32-x64-msvc': 4.65.0
       fsevents: 2.3.3
 
   rope-sequence@1.3.4: {}
 
   rou3@0.9.2: {}
 
+  rou3@1.0.0: {}
+
   run-applescript@7.1.0: {}
 
   run-parallel@1.2.0:
@@ -11388,12 +10923,6 @@ snapshots:
 
   safe-buffer@5.2.1: {}
 
-  safe-regex-test@1.1.0:
-    dependencies:
-      call-bound: 1.0.4
-      es-errors: 1.3.0
-      is-regex: 1.2.1
-
   safe-stable-stringify@2.5.0: {}
 
   safer-buffer@2.1.2: {}
@@ -11408,10 +10937,6 @@ snapshots:
 
   semver@6.3.1: {}
 
-  semver@7.7.4: {}
-
-  semver@7.8.1: {}
-
   semver@7.8.5: {}
 
   send@1.2.1(supports-color@10.2.2):
@@ -11449,8 +10974,6 @@ snapshots:
 
   set-blocking@2.0.0: {}
 
-  setprototypeof@1.1.0: {}
-
   setprototypeof@1.2.0: {}
 
   shebang-command@2.0.0:
@@ -11461,8 +10984,6 @@ snapshots:
 
   shell-quote@1.12.0: {}
 
-  siginfo@2.0.0: {}
-
   signal-exit@3.0.7: {}
 
   signal-exit@4.1.0: {}
@@ -11483,6 +11004,10 @@ snapshots:
     dependencies:
       atomic-sleep: 1.0.0
 
+  sonic-boom@5.0.2:
+    dependencies:
+      atomic-sleep: 1.0.0
+
   source-map-js@1.2.2: {}
 
   source-map-support@0.5.21:
@@ -11494,22 +11019,18 @@ snapshots:
 
   source-map@0.7.6: {}
 
+  source-map@0.8.0: {}
+
   split2@4.2.0: {}
 
   srvx@1.0.5: {}
 
   srvx@1.0.6: {}
 
-  stackback@0.0.2: {}
-
   standard-as-callback@2.1.0: {}
 
-  statuses@1.5.0: {}
-
   statuses@2.0.2: {}
 
-  std-env@4.1.0: {}
-
   std-env@4.2.0: {}
 
   std-env@4.3.0: {}
@@ -11541,6 +11062,11 @@ snapshots:
       get-east-asian-width: 1.5.0
       strip-ansi: 7.2.0
 
+  string-width@8.3.0:
+    dependencies:
+      get-east-asian-width: 1.5.0
+      strip-ansi: 7.2.0
+
   string_decoder@1.1.1:
     dependencies:
       safe-buffer: 5.1.2
@@ -11561,79 +11087,21 @@ snapshots:
 
   strip-json-comments@5.0.3: {}
 
-  strip-literal@3.1.0:
-    dependencies:
-      js-tokens: 9.0.1
-
   strip-literal@4.0.0:
     dependencies:
       js-tokens: 10.0.0
 
   structured-clone-es@2.0.1: {}
 
-  sucrase@3.35.1:
-    dependencies:
-      '@jridgewell/gen-mapping': 0.3.13
-      commander: 4.1.1
-      lines-and-columns: 1.2.4
-      mz: 2.7.0
-      pirates: 4.0.7
-      tinyglobby: 0.2.17
-      ts-interface-checker: 0.1.13
-
   supports-color@10.2.2: {}
 
-  supports-color@7.2.0:
-    dependencies:
-      has-flag: 4.0.0
-
   supports-preserve-symlinks-flag@1.0.0: {}
 
-  symbol-tree@3.2.4: {}
-
   tagged-tag@1.0.0: {}
 
-  tailwind-config-viewer@2.0.4(supports-color@10.2.2)(tailwindcss@3.4.19(tsx@4.23.13)(yaml@2.9.0)):
-    dependencies:
-      '@koa/router': 12.0.2(supports-color@10.2.2)
-      commander: 6.2.1
-      fs-extra: 9.1.0
-      koa: 2.16.4(supports-color@10.2.2)
-      koa-static: 5.0.0(supports-color@10.2.2)
-      open: 7.4.2
-      portfinder: 1.0.38(supports-color@10.2.2)
-      replace-in-file: 6.3.5
-      tailwindcss: 3.4.19(tsx@4.23.13)(yaml@2.9.0)
-    transitivePeerDependencies:
-      - supports-color
+  tailwindcss@4.3.3: {}
 
-  tailwindcss@3.4.19(tsx@4.23.13)(yaml@2.9.0):
-    dependencies:
-      '@alloc/quick-lru': 5.2.0
-      arg: 5.0.2
-      chokidar: 3.6.0
-      didyoumean: 1.2.2
-      dlv: 1.1.3
-      fast-glob: 3.3.3
-      glob-parent: 6.0.2
-      is-glob: 4.0.3
-      jiti: 1.21.7
-      lilconfig: 3.1.3
-      micromatch: 4.0.8
-      normalize-path: 3.0.0
-      object-hash: 3.0.0
-      picocolors: 1.1.1
-      postcss: 8.5.26
-      postcss-import: 15.1.0(postcss@8.5.26)
-      postcss-js: 4.1.0(postcss@8.5.26)
-      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.26)(tsx@4.23.13)(yaml@2.9.0)
-      postcss-nested: 6.2.0(postcss@8.5.26)
-      postcss-selector-parser: 6.1.5
-      resolve: 1.22.12
-      sucrase: 3.35.1
-    transitivePeerDependencies:
-      - tsx
-      - yaml
+  tapable@2.3.3: {}
 
   tar-stream@3.2.0:
     dependencies:
@@ -11678,14 +11146,6 @@ snapshots:
     transitivePeerDependencies:
       - react-native-b4a
 
-  thenify-all@1.6.0:
-    dependencies:
-      thenify: 3.3.1
-
-  thenify@3.3.1:
-    dependencies:
-      any-promise: 1.3.0
-
   thread-stream@4.0.0:
     dependencies:
       real-require: 0.2.0
@@ -11694,14 +11154,12 @@ snapshots:
 
   tiny-invariant@1.3.3: {}
 
-  tinybench@2.9.0: {}
+  tinybench@6.2.2: {}
 
-  tinyclip@0.1.12: {}
+  tinyclip@0.1.15: {}
 
   tinyclip@1.0.3: {}
 
-  tinyexec@1.3.0: {}
-
   tinyexec@1.3.1: {}
 
   tinyglobby@0.2.17:
@@ -11709,8 +11167,6 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.7)
       picomatch: 4.0.7
 
-  tinyrainbow@3.1.1: {}
-
   tldts-core@7.0.30: {}
 
   tldts@7.0.30:
@@ -11733,29 +11189,19 @@ snapshots:
 
   tr46@0.0.3: {}
 
-  tr46@6.0.0:
+  tr46@7.0.0:
     dependencies:
       punycode: 2.3.1
 
-  ts-api-utils@2.5.0(typescript@5.9.3):
+  ts-api-utils@2.5.0(typescript@6.0.3):
     dependencies:
-      typescript: 5.9.3
-
-  ts-interface-checker@0.1.13: {}
+      typescript: 6.0.3
 
   tslib@1.14.1: {}
 
   tslib@2.8.1: {}
 
-  tsscmp@1.0.6: {}
-
-  tsx@4.23.12:
-    dependencies:
-      esbuild: 0.28.2
-    optionalDependencies:
-      fsevents: 2.3.3
-
-  tsx@4.23.13:
+  tsx@4.23.15:
     dependencies:
       esbuild: 0.28.2
     optionalDependencies:
@@ -11777,14 +11223,9 @@ snapshots:
     dependencies:
       tagged-tag: 1.0.0
 
-  type-is@1.6.18:
-    dependencies:
-      media-typer: 0.3.0
-      mime-types: 2.1.35
-
   type-level-regexp@0.1.17: {}
 
-  typescript@5.9.3: {}
+  typescript@6.0.3: {}
 
   typescript@7.0.2:
     optionalDependencies:
@@ -11819,55 +11260,60 @@ snapshots:
 
   uint8array-extras@1.6.0: {}
 
-  ultrahtml@1.6.0: {}
-
   ultrahtml@1.7.0: {}
 
   uncrypto@0.1.3: {}
 
   unctx@2.5.0:
     dependencies:
-      acorn: 8.16.0
+      acorn: 8.18.0
       estree-walker: 3.0.3
       magic-string: 0.30.21
       unplugin: 2.3.11
 
-  unctx@3.0.0(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))):
+  unctx@3.0.0(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))):
     optionalDependencies:
       magic-string: 0.30.21
       oxc-parser: 0.141.0
       rolldown: 1.2.15
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
 
-  unctx@3.0.0(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))):
+  unctx@3.0.0(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))):
     optionalDependencies:
       magic-string: 1.4.3
       oxc-parser: 0.141.0
       rolldown: 1.2.15
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
 
-  unctx@3.0.0(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))):
+  unctx@3.0.1(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))):
     optionalDependencies:
-      magic-string: 1.4.3
+      magic-string: 0.30.21
       oxc-parser: 0.141.0
       rolldown: 1.2.15
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
 
-  unctx@3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))):
+  unctx@3.0.1(magic-string@0.30.21)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))):
+    optionalDependencies:
+      magic-string: 0.30.21
+      oxc-parser: 0.141.0
+      rolldown: 1.2.15
+      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+
+  unctx@3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))):
     optionalDependencies:
       magic-string: 1.4.3
       oxc-parser: 0.141.0
       rolldown: 1.2.15
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
 
-  unctx@3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))):
+  unctx@3.0.1(magic-string@1.4.3)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))):
     optionalDependencies:
       magic-string: 1.4.3
       oxc-parser: 0.141.0
       rolldown: 1.2.15
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
 
-  undici-types@7.18.2: {}
+  undici-types@8.9.0: {}
 
   undici@8.12.3: {}
 
@@ -11875,12 +11321,12 @@ snapshots:
     dependencies:
       pathe: 2.0.3
 
-  unhead@3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  unhead@3.4.3(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
       hookable: 6.1.1
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
     optionalDependencies:
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@rspack/core'
@@ -11895,42 +11341,44 @@ snapshots:
 
   unicorn-magic@0.4.0: {}
 
-  unifont@0.7.5:
+  unifont@1.0.3:
     dependencies:
       css-tree: 3.2.1
-      ohash: 2.0.11
+      fnv1a-64: 0.1.2
+      std-env: 4.3.0
       undici: 8.12.3
 
-  unimport@6.2.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  unimport@6.5.0(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
-      acorn: 8.16.0
+      acorn: 8.18.0
       escape-string-regexp: 5.0.0
       estree-walker: 3.0.3
       local-pkg: 1.2.1
-      magic-string: 0.30.21
+      magic-string: 1.4.3
       mlly: 1.8.2
       pathe: 2.0.3
       picomatch: 4.0.7
-      pkg-types: 2.3.1
+      pkg-types: 2.4.0
       scule: 1.3.0
-      strip-literal: 3.1.0
+      strip-literal: 4.0.0
       tinyglobby: 0.2.17
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       unplugin-utils: 0.3.2
     optionalDependencies:
       oxc-parser: 0.141.0
+      rolldown: 1.2.15
     transitivePeerDependencies:
       - '@farmfe/core'
+      - '@rsbuild/core'
       - '@rspack/core'
       - bun-types-no-globals
       - esbuild
-      - rolldown
       - rollup
       - unloader
       - vite
       - webpack
 
-  unimport@7.0.2(acorn@8.18.0)(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  unimport@7.0.2(acorn@8.18.0)(esbuild@0.28.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
       escape-string-regexp: 5.0.0
       estree-walker: 3.0.3
@@ -11943,7 +11391,7 @@ snapshots:
       scule: 1.3.0
       strip-literal: 4.0.0
       tinyglobby: 0.2.17
-      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       unplugin-utils: 0.3.2
     optionalDependencies:
       acorn: 8.18.0
@@ -11959,13 +11407,6 @@ snapshots:
       - vite
       - webpack
 
-  universalify@2.0.1: {}
-
-  unplugin-utils@0.3.1:
-    dependencies:
-      pathe: 2.0.3
-      picomatch: 4.0.7
-
   unplugin-utils@0.3.2:
     dependencies:
       pathe: 2.0.3
@@ -11978,7 +11419,7 @@ snapshots:
       picomatch: 4.0.7
       webpack-virtual-modules: 0.6.2
 
-  unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  unplugin@3.3.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
       '@jridgewell/remapping': 2.3.5
       picomatch: 4.0.7
@@ -11986,10 +11427,10 @@ snapshots:
     optionalDependencies:
       esbuild: 0.28.2
       rolldown: 1.2.15
-      rollup: 4.60.3
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      rollup: 4.65.0
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
 
-  unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
       '@jridgewell/remapping': 2.3.5
       picomatch: 4.0.7
@@ -11997,15 +11438,15 @@ snapshots:
     optionalDependencies:
       esbuild: 0.28.2
       rolldown: 1.2.15
-      rollup: 4.60.3
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      rollup: 4.65.0
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
 
   unrouting@0.2.3:
     dependencies:
       escape-string-regexp: 5.0.0
       ufo: 1.6.4
 
-  unstorage@1.17.5(db0@0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.10.1(supports-color@10.2.2)):
+  unstorage@1.17.5(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.11.1(supports-color@10.2.2)):
     dependencies:
       anymatch: 3.1.3
       chokidar: 5.0.0
@@ -12016,14 +11457,24 @@ snapshots:
       ofetch: 1.5.1
       ufo: 1.6.4
     optionalDependencies:
-      db0: 0.3.4(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(postgres@3.4.9))
-      ioredis: 5.10.1(supports-color@10.2.2)
+      db0: 0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9))
+      ioredis: 5.11.1(supports-color@10.2.2)
 
-  untun@0.1.3:
+  unstorage@1.17.6(db0@0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9)))(ioredis@5.11.1(supports-color@10.2.2)):
     dependencies:
-      citty: 0.1.6
-      consola: 3.4.2
-      pathe: 1.1.2
+      anymatch: 3.1.3
+      chokidar: 5.0.0
+      destr: 2.0.5
+      h3: 1.15.11
+      lru-cache: 11.5.3
+      node-fetch-native: 1.6.7
+      ofetch: 1.5.1
+      ufo: 1.6.4
+    optionalDependencies:
+      db0: 0.3.4(drizzle-orm@0.45.4(@opentelemetry/api@1.9.1)(postgres@3.4.9))
+      ioredis: 5.11.1(supports-color@10.2.2)
+
+  untun@0.2.2: {}
 
   untyped@2.0.0:
     dependencies:
@@ -12035,12 +11486,12 @@ snapshots:
 
   unwasm@0.5.3:
     dependencies:
-      exsolve: 1.1.1
+      exsolve: 1.1.3
       knitwork: 1.3.0
       magic-string: 0.30.21
       mlly: 1.8.2
       pathe: 2.0.3
-      pkg-types: 2.3.1
+      pkg-types: 2.4.0
 
   update-browserslist-db@1.3.1(browserslist@4.28.8):
     dependencies:
@@ -12061,31 +11512,29 @@ snapshots:
 
   util-deprecate@1.0.2: {}
 
-  uuid@14.0.2: {}
-
-  vary@1.1.2: {}
+  uuid@14.0.3: {}
 
   verkit@0.3.2: {}
 
   verkit@0.5.0: {}
 
-  vite-dev-rpc@2.0.0(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  vite-dev-rpc@2.0.0(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
       birpc: 4.0.0
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-      vite-hot-client: 2.2.0(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
+      vite-hot-client: 2.2.0(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
 
-  vite-hot-client@2.2.0(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  vite-hot-client@2.2.0(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
 
-  vite-node@6.0.0(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0):
+  vite-node@6.0.0(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0):
     dependencies:
       cac: 7.0.0
       es-module-lexer: 2.1.0
       obug: 2.1.1
       pathe: 2.0.3
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
     transitivePeerDependencies:
       - '@types/node'
       - '@vitejs/devtools'
@@ -12100,7 +11549,7 @@ snapshots:
       - tsx
       - yaml
 
-  vite-plugin-checker@0.14.5(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(optionator@0.9.4)(typescript@5.9.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue-tsc@3.3.11(typescript@5.9.3)):
+  vite-plugin-checker@0.14.5(eslint@10.3.0(jiti@2.7.0)(supports-color@10.2.2))(optionator@0.9.4)(typescript@6.0.3)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue-tsc@3.3.13(typescript@6.0.3)):
     dependencies:
       '@babel/code-frame': 7.29.7
       chokidar: 5.0.0
@@ -12109,14 +11558,14 @@ snapshots:
       picomatch: 4.0.7
       proper-lockfile: 4.1.2
       tiny-invariant: 1.3.3
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
     optionalDependencies:
       eslint: 10.3.0(jiti@2.7.0)(supports-color@10.2.2)
       optionator: 0.9.4
-      typescript: 5.9.3
-      vue-tsc: 3.3.11(typescript@5.9.3)
+      typescript: 6.0.3
+      vue-tsc: 3.3.13(typescript@6.0.3)
 
-  vite-plugin-inspect@11.4.1(@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  vite-plugin-inspect@11.4.1(@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
       ansis: 4.3.1
       error-stack-parser-es: 1.0.5
@@ -12126,22 +11575,22 @@ snapshots:
       perfect-debounce: 2.1.0
       sirv: 3.0.2
       unplugin-utils: 0.3.2
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-      vite-dev-rpc: 2.0.0(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
+      vite-dev-rpc: 2.0.0(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
     optionalDependencies:
-      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)))
+      '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.141.0)(rolldown@1.2.15)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)))
 
-  vite-plugin-vue-tracer@1.5.0(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3)):
+  vite-plugin-vue-tracer@1.5.0(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3)):
     dependencies:
       estree-walker: 3.0.3
       exsolve: 1.1.1
       magic-string: 1.2.0
       pathe: 2.0.3
       source-map-js: 1.2.2
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-      vue: 3.5.44(typescript@5.9.3)
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
+      vue: 3.5.44(typescript@6.0.3)
 
-  vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0):
+  vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0):
     dependencies:
       lightningcss: 1.33.0
       picomatch: 4.0.7
@@ -12149,40 +11598,34 @@ snapshots:
       rolldown: 1.2.15
       tinyglobby: 0.2.17
     optionalDependencies:
-      '@types/node': 24.13.3
+      '@types/node': 26.6.5
       esbuild: 0.28.2
       fsevents: 2.3.3
       jiti: 2.7.0
       terser: 5.46.2
-      tsx: 4.23.13
+      tsx: 4.23.15
       yaml: 2.9.0
 
-  vitest@4.1.12(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.2.0))(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)):
+  vitest@5.0.5(@opentelemetry/api@1.9.1)(@types/node@26.6.5)(jsdom@30.1.3(@noble/hashes@2.2.0))(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)):
     dependencies:
-      '@vitest/expect': 4.1.12
-      '@vitest/mocker': 4.1.12(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
-      '@vitest/pretty-format': 4.1.12
-      '@vitest/runner': 4.1.12
-      '@vitest/snapshot': 4.1.12
-      '@vitest/spy': 4.1.12
-      '@vitest/utils': 4.1.12
-      es-module-lexer: 2.1.0
-      expect-type: 1.3.0
-      magic-string: 0.30.21
-      obug: 2.1.1
-      pathe: 2.0.3
+      '@types/chai': 5.2.3
+      '@vitest/mocker': 5.0.5(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
+      chai: 6.3.0
+      es-module-lexer: 2.3.2
+      expect-type: 1.4.0
+      magic-string: 1.4.3
+      obug: 3.0.0
       picomatch: 4.0.7
-      std-env: 4.2.0
-      tinybench: 2.9.0
-      tinyexec: 1.3.0
+      std-env: 4.3.0
+      tinybench: 6.2.2
+      tinyexec: 1.3.1
       tinyglobby: 0.2.17
-      tinyrainbow: 3.1.1
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
-      why-is-node-running: 2.3.0
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
+      why-is-node-running: 3.2.1
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
-      '@types/node': 24.13.3
-      jsdom: 30.0.1(@noble/hashes@2.2.0)
+      '@types/node': 26.6.5
+      jsdom: 30.1.3(@noble/hashes@2.2.0)
     transitivePeerDependencies:
       - msw
 
@@ -12192,26 +11635,26 @@ snapshots:
     dependencies:
       ufo: 1.6.4
 
-  vue-chartjs@5.3.4(chart.js@4.5.1)(vue@3.5.44(typescript@5.9.3)):
+  vue-chartjs@5.3.4(chart.js@4.6.1)(vue@3.5.44(typescript@6.0.3)):
     dependencies:
-      chart.js: 4.5.1
-      vue: 3.5.44(typescript@5.9.3)
+      chart.js: 4.6.1
+      vue: 3.5.44(typescript@6.0.3)
 
   vue-component-type-helpers@3.3.13: {}
 
   vue-devtools-stub@0.1.0: {}
 
-  vue-i18n@11.4.8(vue@3.5.44(typescript@5.9.3)):
+  vue-i18n@11.4.8(vue@3.5.44(typescript@6.0.3)):
     dependencies:
       '@intlify/core-base': 11.4.8
       '@intlify/devtools-types': 11.4.8
       '@intlify/shared': 11.4.8
       '@vue/devtools-api': 6.6.4
-      vue: 3.5.44(typescript@5.9.3)
+      vue: 3.5.44(typescript@6.0.3)
 
-  vue-router@5.4.0(@vue/compiler-sfc@3.5.41)(esbuild@0.28.2)(pinia@4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3)))(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))(vue@3.5.44(typescript@5.9.3)):
+  vue-router@5.4.0(@vue/compiler-sfc@3.5.41)(esbuild@0.28.2)(pinia@4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3)))(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))(vue@3.5.44(typescript@6.0.3)):
     dependencies:
-      '@vue-macros/common': 3.1.4(vue@3.5.44(typescript@5.9.3))
+      '@vue-macros/common': 3.1.4(vue@3.5.44(typescript@6.0.3))
       '@vue/devtools-api': 8.2.1
       ast-walker-scope: 0.10.0
       chokidar: 5.0.0
@@ -12225,13 +11668,13 @@ snapshots:
       picomatch: 4.0.7
       scule: 1.3.0
       tinyglobby: 0.2.17
-      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.60.3)(vite@8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0))
+      unplugin: 3.4.0(esbuild@0.28.2)(rolldown@1.2.15)(rollup@4.65.0)(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0))
       unplugin-utils: 0.3.2
-      vue: 3.5.44(typescript@5.9.3)
+      vue: 3.5.44(typescript@6.0.3)
     optionalDependencies:
       '@vue/compiler-sfc': 3.5.41
-      pinia: 4.0.3(@vue/devtools-api@8.2.1)(typescript@5.9.3)(vue@3.5.44(typescript@5.9.3))
-      vite: 8.3.5(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.13)(yaml@2.9.0)
+      pinia: 4.1.0(@vue/devtools-api@8.2.1)(typescript@6.0.3)(vue@3.5.44(typescript@6.0.3))
+      vite: 8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.46.2)(tsx@4.23.15)(yaml@2.9.0)
     transitivePeerDependencies:
       - '@farmfe/core'
       - '@rsbuild/core'
@@ -12243,13 +11686,13 @@ snapshots:
       - unloader
       - webpack
 
-  vue-tsc@3.3.11(typescript@5.9.3):
+  vue-tsc@3.3.13(typescript@6.0.3):
     dependencies:
-      '@volar/typescript': 2.4.28(typescript@5.9.3)
-      '@vue/language-core': 3.3.11
-      typescript: 5.9.3
+      '@volar/typescript': 2.4.28(typescript@6.0.3)
+      '@vue/language-core': 3.3.13
+      typescript: 6.0.3
 
-  vue@3.5.44(typescript@5.9.3):
+  vue@3.5.44(typescript@6.0.3):
     dependencies:
       '@vue/compiler-dom': 3.5.44
       '@vue/compiler-sfc': 3.5.44
@@ -12257,11 +11700,11 @@ snapshots:
       '@vue/server-renderer': 3.5.44
       '@vue/shared': 3.5.44
     optionalDependencies:
-      typescript: 5.9.3
+      typescript: 6.0.3
 
   w3c-keyname@2.2.8: {}
 
-  w3c-xmlserializer@5.0.0:
+  w3c-xmlserializer@6.0.0:
     dependencies:
       xml-name-validator: 5.0.0
 
@@ -12285,18 +11728,10 @@ snapshots:
 
   whatwg-mimetype@5.0.0: {}
 
-  whatwg-url@16.0.1(@noble/hashes@2.2.0):
+  whatwg-url@17.3.0(@noble/hashes@2.2.0):
     dependencies:
-      '@exodus/bytes': 1.15.1(@noble/hashes@2.2.0)
-      tr46: 6.0.0
-      webidl-conversions: 8.0.1
-    transitivePeerDependencies:
-      - '@noble/hashes'
-
-  whatwg-url@17.1.0(@noble/hashes@2.2.0):
-    dependencies:
-      '@exodus/bytes': 1.15.1(@noble/hashes@2.2.0)
-      tr46: 6.0.0
+      '@exodus/bytes': 1.16.0(@noble/hashes@2.2.0)
+      tr46: 7.0.0
       webidl-conversions: 8.0.1
     transitivePeerDependencies:
       - '@noble/hashes'
@@ -12316,10 +11751,7 @@ snapshots:
     dependencies:
       isexe: 4.0.0
 
-  why-is-node-running@2.3.0:
-    dependencies:
-      siginfo: 2.0.0
-      stackback: 0.0.2
+  why-is-node-running@3.2.1: {}
 
   word-wrap@1.2.5: {}
 
@@ -12383,8 +11815,6 @@ snapshots:
       camelcase: 5.3.1
       decamelize: 1.2.0
 
-  yargs-parser@21.1.1: {}
-
   yargs-parser@22.0.0: {}
 
   yargs@15.4.1:
@@ -12401,27 +11831,15 @@ snapshots:
       y18n: 4.0.3
       yargs-parser: 18.1.3
 
-  yargs@17.7.2:
-    dependencies:
-      cliui: 8.0.1
-      escalade: 3.2.0
-      get-caller-file: 2.0.5
-      require-directory: 2.1.1
-      string-width: 4.2.3
-      y18n: 5.0.8
-      yargs-parser: 21.1.1
-
-  yargs@18.0.0:
+  yargs@18.2.0:
     dependencies:
       cliui: 9.0.1
       escalade: 3.2.0
       get-caller-file: 2.0.5
-      string-width: 7.2.0
+      string-width: 8.3.0
       y18n: 5.0.8
       yargs-parser: 22.0.0
 
-  ylru@1.4.0: {}
-
   yocto-queue@0.1.0: {}
 
   youch-core@0.3.3:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 316254e2..ef3bf1db 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -8,27 +8,35 @@ shamefullyHoist: false
 # DEUX versions de TypeScript, volontairement. Ne pas « harmoniser ».
 #
 #   racine     : ^7.0.2  — vérifie l'API (`tsc -p apps/api/.nitro/…`)
-#   apps/web   : ~5.9.3  — vérifie le front (`nuxt typecheck`, donc vue-tsc)
+#   apps/web   : ~6.0.3  — vérifie le front (`nuxt typecheck`, donc vue-tsc)
 #
 # TypeScript 7 est le portage natif en Go. Son export principal ne contient
 # plus le compilateur : `exports["."]` pointe sur `lib/version.cjs`, et
 # `require('typescript').createProgram` vaut `undefined` (mesuré sur 7.0.2).
 # Seules des entrées `./unstable/*` exposent une API, encore instable.
 #
-# vue-tsc 3.3.11 déclare pourtant `peerDependencies: { typescript: ">=5.0.0" }`.
+# vue-tsc 3.3.13 déclare pourtant `peerDependencies: { typescript: ">=5.0.0" }`.
 # Cette plage est fausse pour 7.x : rien n'empêche donc quelqu'un de retirer le
 # pin de `apps/web`, de laisser pnpm résoudre le TypeScript de la racine, et de
 # casser `nuxt typecheck` sans qu'aucun avertissement de pair ne le signale.
 # Le pin EST le garde-fou. Il tombera quand volar saura parler à l'API
-# `unstable` — pas avant.
+# `unstable` — pas avant : @vue/language-core 4.0.0-alpha.0 réclame
+# `typescript >=7.1.0-beta`, rien de stable. Ce que vue-tsc 3.3.13 sait faire
+# (lu dans son `index.js`), c'est suivre un `typescript` aliasé vers
+# `@typescript/typescript6` jusqu'au tsc 6 qu'il embarque — l'API JavaScript de
+# 6.0, toujours pas celle de 7.
+#
+# 6.0 est donc la dernière marche possible, et elle a été franchie le
+# 2026-10-24 : `nuxt typecheck` vert sur 6.0.3, et une erreur volontaire
+# glissée dans un `.vue` y est bien rapportée (TS2322) — pas un faux vert.
 
-# pnpm 11 asks before removing node_modules when the lockfile has moved enough
-# to invalidate it, and refuses when there is no TTY:
-#   ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY
-# GitHub Actions sets CI=true so it is unaffected, but `docker build` does not,
-# so the image builds would fail on it. Declared here rather than exported as
-# CI=true in each Dockerfile: one place, and it cannot be forgotten in a new one.
-confirmModulesPurge: false
+# No `confirmModulesPurge` any more, and do not add it back. pnpm 11 asked
+# before removing node_modules and refused without a TTY
+# (ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY), which broke `docker build`.
+# pnpm 12 has no such prompt — it rebuilt node_modules after a hoisting change
+# with stdin closed, measured on 12.15.0 — and it REJECTS the key as "a pnpm v11
+# setting" (ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS), because this repo pins
+# the pnpm that reads this file.
 
 # ── Supply-chain hardening ───────────────────────────────────────────────────
 # The npm registry has repeatedly been the delivery vehicle for compromised
@@ -45,7 +53,7 @@ confirmModulesPurge: false
 #                      never a git URL or a tarball a compromised manifest
 #                      points at. The default since pnpm 11; kept explicit so
 #                      the intent survives a future default change.
-minimumReleaseAge: 1440
+minimumReleaseAge: 1440  # nosemgrep: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age
 trustPolicy: no-downgrade
 blockExoticSubdeps: true
 
@@ -112,7 +120,7 @@ overrides:
   # minifie NOS propres SVG au build.
   "svgo@4": "^4.1.0"
   "@babel/core@7": "^7.29.6"
-  "@types/node": "^24.13.3"
+  "@types/node": "^26.6.5"
   "@peculiar/asn1-android": "^2.9.4"
   "@peculiar/asn1-cms": "^2.9.4"
   "@peculiar/asn1-csr": "^2.9.4"
@@ -140,6 +148,10 @@ overrides:
   # est pourtant le rétroportage exact (mêmes trois passes réécrites en Set,
   # vérifié par diff des tarballs). Dependabot continuera de la signaler tant que
   # l'avis n'aura pas été amendé.
+  # Depuis le passage du front à Tailwind 4 (2026-10-24), aucune des deux branches
+  # n'est plus dans l'arbre : @nuxtjs/tailwindcss emportait tailwindcss 3,
+  # postcss-nested et postcss-nesting, et cssnano 9 n'en dépend plus. Les deux
+  # planchers restent, en garde-fous pour le jour où quelque chose les ramènerait.
   "browserslist": "^4.28.8"
   "postcss-selector-parser@6": "^6.1.5"
   "postcss-selector-parser@7": "^7.1.6"
@@ -160,18 +172,13 @@ overrides:
   # qui n'arrive que par @nuxt/devtools) ne corrige donc pas vite ; 8.2.4 est la
   # première version qui porte le correctif.
   "vite": "^8.2.4"
-  # GHSA-c8x8-7fp4-3x9w (<1.42.3) : coller du HTML fourni par un attaquant dans un
-  # éditeur ProseMirror peut exécuter son JavaScript dans la page qui l'héberge.
-  # Celui-ci tourne chez nous, dans le navigateur : WysiwygEditor (tiptap) sert à
-  # la description des torrents, au dépôt comme à l'édition, et à deux écrans
-  # d'administration. @tiptap/pm 3.31 accepte `^1.41.9`, d'où le plancher.
-  "prosemirror-view": "^1.42.3"
-  # Ce plancher en impose un second : prosemirror-view 1.42.7 exige
-  # prosemirror-model ^1.25.12, quand le reste de la pile tiptap gardait 1.25.11.
-  # Deux copies du modèle, c'est deux classes `Node` : les nœuds de l'une ne sont
-  # pas des instances de l'autre, et l'éditeur casse.
-  "prosemirror-model": "^1.25.12"
-  # Un seul exemplaire, même raison. nuxt 4.6.2 exige vue-router ^5.4.0 et unhead
+  # Plus d'override prosemirror-view ni prosemirror-model. Ils posaient le
+  # correctif de GHSA-c8x8-7fp4-3x9w (XSS au collage dans l'éditeur, <1.42.3) et
+  # le modèle unique qui va avec, parce que @tiptap/pm 3.31 acceptait encore
+  # `^1.41.9`. @tiptap/pm 3.32 exige lui-même `^1.42.6` et `^1.25.12` : retirés
+  # le 2026-10-24, la résolution est restée identique, une version de chacun.
+
+  # Un seul exemplaire de chacun. nuxt 4.6.2 exige vue-router ^5.4.0 et unhead
   # ^3.4.3 ; @nuxtjs/i18n 10.6.0 les déclare en dépendances ordinaires (^5.2.0,
   # ^3.2.3) et pnpm lui laissait les 5.3.0 et 3.3.2 déjà verrouillées. Deux
   # vue-router, c'est deux clés d'injection : le `useRouter()` d'i18n ne
diff --git a/tests/e2e/docker-compose.yml b/tests/e2e/docker-compose.yml
index 742940a4..3a8741c2 100644
--- a/tests/e2e/docker-compose.yml
+++ b/tests/e2e/docker-compose.yml
@@ -27,7 +27,7 @@ services:
       retries: 30
 
   redis:
-    image: redis:8.10.1-alpine
+    image: redis:8.10.2-alpine
     command: ["redis-server", "--requirepass", "e2e-redis-password"]
     # Published so a scenario can clear the rate-limit counters between phases —
     # see the note in lib.mjs. Sessions live in here too, which is why the
diff --git a/tests/e2e/knownDevice.mjs b/tests/e2e/knownDevice.mjs
new file mode 100644
index 00000000..33385792
--- /dev/null
+++ b/tests/e2e/knownDevice.mjs
@@ -0,0 +1,137 @@
+/**
+ * The per-account sign-in lockout, and the member's own browsers.
+ *
+ * Ten failed sign-ins in fifteen minutes hold a username out of password
+ * sign-in from every address — the right password included, so anyone who
+ * knows a username could keep its owner out. A browser that has completed a
+ * sign-in carries a known-device cookie and answers to its own counter instead:
+ * failing on purpose from elsewhere now shuts the account to new devices only.
+ * See `apps/api/utils/knownDevices.ts`.
+ *
+ * Runs just before `freshauth`, because it signs `donator` and `plainuser` out
+ * everywhere and only `freshauth` (founder alone) comes after it.
+ */
+import { API, check, report, resetAddressLimits, resetRateLimits } from './lib.mjs';
+import { generateLoginProof } from './crypto.mjs';
+
+const PASSWORDS = { donator: 'E2e-Passw0rd!donator', plainuser: 'E2e-Passw0rd!plain' };
+const KD = 'trackarr_kd';
+
+// A browser: a cookie jar of its own. The scenario's whole point is which
+// cookies each one holds, so it does not reuse the session file.
+const browser = () => new Map();
+
+async function call(jar, path, { method = 'GET', body } = {}) {
+  const res = await fetch(API + path, {
+    method,
+    headers: {
+      ...(body ? { 'content-type': 'application/json' } : {}),
+      ...(jar.size ? { cookie: [...jar].map(([k, v]) => `${k}=${v}`).join('; ') } : {}),
+    },
+    body: body ? JSON.stringify(body) : undefined,
+    redirect: 'manual',
+  });
+  const setCookies = res.headers.getSetCookie?.() ?? [];
+  for (const line of setCookies) {
+    const [pair] = line.split(';');
+    const i = pair.indexOf('=');
+    if (i > 0) jar.set(pair.slice(0, i).trim(), pair.slice(i + 1).trim());
+  }
+  const text = await res.text();
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    json = text;
+  }
+  return { status: res.status, body: json, setCookies };
+}
+
+/** The real protocol: challenge, then a proof — the right one, or 64 hex of noise. */
+async function signIn(jar, username, { wrong = false } = {}) {
+  const chal = await call(jar, `/api/auth/challenge?username=${encodeURIComponent(username)}`);
+  if (chal.status !== 200) return chal;
+  const proof = wrong
+    ? 'f'.repeat(64)
+    : await generateLoginProof(PASSWORDS[username], chal.body.salt, chal.body.challenge);
+  return call(jar, '/api/auth/login', {
+    method: 'POST',
+    body: { username, challenge: chal.body.challenge, proof },
+  });
+}
+
+/** Ten wrong proofs from `jar`, between two clears of the per-address buckets. */
+async function failTenTimes(jar, username) {
+  await resetAddressLimits();
+  const statuses = [];
+  for (let i = 0; i < 10; i++) statuses.push((await signIn(jar, username, { wrong: true })).status);
+  await resetAddressLimits();
+  return statuses;
+}
+
+const d = (r) => `status ${r.status} ${JSON.stringify(r.body).slice(0, 160)}`;
+const kdLine = (r) => r.setCookies.find((l) => l.startsWith(`${KD}=`));
+
+await resetRateLimits();
+
+console.log('\n1. a completed sign-in makes the browser known');
+const mine = browser();
+{
+  const r = await signIn(mine, 'donator');
+  check('donator signs in', r.status === 200, d(r));
+  const line = kdLine(r);
+  check('and gets a known-device cookie', !!line, r.setCookies.join(' | ').slice(0, 200));
+  check(
+    'httpOnly, SameSite=Lax, kept six months',
+    /HttpOnly/i.test(line ?? '') && /SameSite=Lax/i.test(line ?? '') && /Max-Age=15552000/.test(line ?? ''),
+    line,
+  );
+}
+
+console.log('\n2. ten failures from elsewhere shut the account to new browsers');
+const stranger = browser();
+{
+  const st = await failTenTimes(stranger, 'donator');
+  check('ten refusals', st.every((s) => s === 401), st.join(','));
+  const r = await signIn(stranger, 'donator');
+  check('then the right password is refused there', r.status === 429, d(r));
+  check('saying the account is locked, not the address',
+    r.body?.data?.reason === 'account-locked', d(r));
+  const fresh = await signIn(browser(), 'donator');
+  check('and in any other new browser', fresh.status === 429, d(fresh));
+}
+
+console.log("\n3. the member's own browser is not shut out");
+{
+  await resetAddressLimits();
+  const r = await signIn(mine, 'donator');
+  check('the known browser signs in', r.status === 200, d(r));
+  check('and its cookie is renewed', !!kdLine(r), r.setCookies.join(' | ').slice(0, 200));
+  const again = await signIn(stranger, 'donator');
+  check('which does not lift the lockout for the stranger', again.status === 429, d(again));
+}
+
+console.log('\n4. a known browser that fails ten times is known no more');
+{
+  const st = await failTenTimes(mine, 'donator');
+  check('ten refusals from the known browser', st.every((s) => s === 401), st.join(','));
+  const r = await signIn(mine, 'donator');
+  check("then it answers to the account's lockout like any other", r.status === 429, d(r));
+}
+
+console.log('\n5. signing out everywhere forgets every known browser');
+{
+  await resetAddressLimits();
+  const pc = browser();
+  const first = await signIn(pc, 'plainuser');
+  check('plainuser signs in', first.status === 200, d(first));
+  const out = await call(pc, '/api/me/sessions/revoke-all', { method: 'POST' });
+  check('and signs out everywhere', out.status === 200, d(out));
+  await failTenTimes(browser(), 'plainuser');
+  const r = await signIn(pc, 'plainuser');
+  check('after which its old cookie exempts nothing', r.status === 429, d(r));
+}
+
+// The counters this scenario filled must not leak into the next one.
+await resetRateLimits();
+report();
diff --git a/tests/e2e/lib.mjs b/tests/e2e/lib.mjs
index ef1f8f55..c3050cec 100644
--- a/tests/e2e/lib.mjs
+++ b/tests/e2e/lib.mjs
@@ -82,6 +82,16 @@ export function resetRateLimits() {
   );
 }
 
+/**
+ * Only the per-address sign-in and challenge buckets. A scenario that signs in
+ * more than ten times from this one host clears them between rounds, while the
+ * per-account and per-device failure counts it is checking stay as they are:
+ * `ratelimit:signin-fail…` does not match `ratelimit:signin:*`.
+ */
+export function resetAddressLimits() {
+  return sweepKeys(['ot:ratelimit:signin:*', 'ot:ratelimit:challenge:*']);
+}
+
 /** One EVAL to delete by pattern, plus optional exact keys. */
 function sweepKeys(patterns, exact = []) {
   const sweep =
diff --git a/tests/e2e/run.sh b/tests/e2e/run.sh
index fc02349e..4573cfe7 100755
--- a/tests/e2e/run.sh
+++ b/tests/e2e/run.sh
@@ -115,7 +115,7 @@ say "bundling the browser's crypto module for Node"
 # Desktop's virtiofs lags, and worse, the host caches the negative lookup, so
 # polling for the file can keep failing after it exists. A pipe has no such
 # problem.
-docker run --rm -v "$ROOT":/repo -w /repo node:24-alpine \
+docker run --rm -v "$ROOT":/repo -w /repo node:26-alpine \
   node_modules/.pnpm/node_modules/.bin/esbuild --bundle --platform=node \
   --format=esm --target=node24 apps/web/app/utils/crypto.ts > "$HERE/crypto.mjs"
 [ -s "$HERE/crypto.mjs" ] || { echo "crypto bundle is empty" >&2; exit 1; }
@@ -131,8 +131,10 @@ node "$HERE/seed.mjs" > "$HERE/session.json"
 # An explicit order rather than a glob, because the order matters: `freshauth`
 # clears the fresh-auth stamps to reach the refusal path, which makes every
 # session in the run stale, so it has to be last. A glob sorted alphabetically
-# would have put it in the middle and broken everything after it.
-SCENARIOS=(appearance fonts themes torrentVisibility messaging room tickets notifications interactions staffTools badges erasure freshauth)
+# would have put it in the middle and broken everything after it. `knownDevice`
+# signs donator and plainuser out everywhere, so it follows every scenario that
+# uses their sessions.
+SCENARIOS=(appearance fonts themes torrentVisibility messaging room tickets notifications interactions staffTools badges erasure knownDevice freshauth)
 
 status=0
 for name in "${SCENARIOS[@]}"; do
diff --git a/trivy.yaml b/trivy.yaml
new file mode 100644
index 00000000..a9d163b4
--- /dev/null
+++ b/trivy.yaml
@@ -0,0 +1,4 @@
+# Read by trivy from the directory it runs in, so `trivy fs .` at the
+# repository root. Its one job: load the YAML ignore file, whose entries can be
+# scoped to a path and carry their reason; a plain .trivyignore can do neither.
+ignorefile: .trivyignore.yaml