Merge pull request #1266 from PicPeak/fix/testplan-2026-09-01

fix: resolve the 2026-09-01 QA run findings (#1-#21) and repo-health debt

backend/__tests__/adminSettings.logo.test.js

@@ -110,6 +110,11 @@ describe('Admin settings logo upload flow', () => {
       }
     }));
 
+    jest.doMock('../src/middleware/permissions', () => ({
+      requirePermission: () => (req, res, next) => next(),
+      userHasAnyPermission: jest.fn().mockResolvedValue(true)
+    }));
+
     jest.doMock('../src/services/publicSiteService', () => ({
       clearPublicSiteCache: jest.fn(),
       getDefaultPublicSitePayload: jest.fn(),

backend/__tests__/integration/adminPhotos.reference.test.js

@@ -40,6 +40,15 @@ describe('Admin photos in reference mode', () => {
       }
     }));
 
+    // The routes gained requirePermission() after this fixture was written.
+    // It resolves the caller's role through admin_users/roles, which this
+    // minimal schema does not create, so every request died in the RBAC
+    // lookup before reaching the handler. RBAC is not what this suite is
+    // about — stub it out the same way adminAuth already is.
+    jest.doMock('../../src/middleware/permissions', () => ({
+      requirePermission: () => (_req, _res, next) => next()
+    }));
+
     jest.doMock('../../src/services/imageProcessor', () => ({
       generateThumbnail: jest.fn().mockResolvedValue('thumbnails/mock-thumb.jpg'),
       ensureThumbnail: jest.fn()
@@ -98,8 +107,21 @@ describe('Admin photos in reference mode', () => {
       table.string('type').notNullable();
       table.integer('size_bytes');
       table.integer('category_id');
-      table.string('source_origin');
+      // Mirrors migration 041: the upload route never writes this column, it
+      // relies on the NOT NULL DEFAULT 'managed' to mark managed originals.
+      table.string('source_origin').notNullable().defaultTo('managed');
       table.string('external_relpath');
+      // Columns the upload insert writes (migrations 048, 062, 071, 085, 193)
+      // and the PATCH handler writes (migration 178). Without them the insert
+      // and the update both fail on "no such column".
+      table.string('original_filename', 512);
+      table.string('source_filename', 255);
+      table.datetime('captured_at').nullable();
+      table.string('media_type').defaultTo('image');
+      table.string('mime_type');
+      table.string('processing_status', 16).notNullable().defaultTo('complete');
+      table.string('upload_id', 64).nullable();
+      table.boolean('auto_categorized');
       table.datetime('uploaded_at').defaultTo(db.fn.now());
       table.float('average_rating').defaultTo(0);
       table.integer('like_count').defaultTo(0);
@@ -153,7 +175,10 @@ describe('Admin photos in reference mode', () => {
       .field('category_id', String(categoryId))
       .attach('photos', Buffer.from('fake image data'), 'photo.jpg');
 
-    expect(uploadResponse.status).toBe(200);
+    // 202 Accepted since the upload route went async (851744c3): the files are
+    // stored and a pending row is inserted, thumbnails/EXIF follow in the
+    // background worker. This assertion still said 200 from before that.
+    expect(uploadResponse.status).toBe(202);
     expect(uploadResponse.body).toHaveProperty('photos');
     expect(Array.isArray(uploadResponse.body.photos)).toBe(true);
 
@@ -203,5 +228,24 @@ describe('Admin photos in reference mode', () => {
 
     const updated = await db('photos').where({ id: photo.id }).first();
     expect(updated.category_id).toBeNull();
+
+    // A real id still round-trips — the '0' guard must not swallow it.
+    await request(app)
+      .patch(`/api/admin/events/1/photos/${photo.id}`)
+      .send({ category_id: String(categoryId) })
+      .expect(200);
+    expect((await db('photos').where({ id: photo.id }).first()).category_id).toBe(categoryId);
+
+    // Numeric 0 and unparseable input clear the category too, rather than
+    // writing a category id that can never exist.
+    for (const value of [0, 'not-a-category']) {
+      await request(app)
+        .patch(`/api/admin/events/1/photos/${photo.id}`)
+        .send({ category_id: value })
+        .expect(200);
+      expect((await db('photos').where({ id: photo.id }).first()).category_id).toBeNull();
+
+      await db('photos').where({ id: photo.id }).update({ category_id: categoryId });
+    }
   });
 });

backend/__tests__/integration/crmMintPaths.test.js

@@ -148,10 +148,15 @@ async function seedCustomerSignedContract() {
 beforeAll(async () => {
   ({ db, cleanup, tmpDir } = await bootCrmDb());
   // Business-doc PDFs (quotes/invoices/contracts) persist under
-  // `process.cwd()/storage/business-docs/...` — chdir into the temp dir
-  // so every test artifact lands isolated and gets cleaned up.
+  // `getStoragePath()/business-docs/...`, and safePath also allows a
+  // `process.cwd()/storage/business-docs/...` root — chdir into the temp
+  // dir so every test artifact lands isolated and gets cleaned up.
   process.chdir(tmpDir);
-  storageRoot = path.join(fs.realpathSync(tmpDir), 'storage', 'business-docs');
+  // Mirror what the services store: the raw STORAGE_PATH bootCrmDb
+  // exported, NOT a symlink-resolved variant. On macOS os.tmpdir() is
+  // /var/... while realpath is /private/var/..., so canonicalizing here
+  // would make every stored path fail the prefix check.
+  storageRoot = path.join(process.env.STORAGE_PATH, 'business-docs');
 
   // Fail-fast on the pre-existing logActivity-inside-transaction
   // deadlock: createContract and createStorno call logActivity() from

backend/__tests__/integration/webhookDelivery.test.js

@@ -146,8 +146,8 @@ describe('webhook delivery worker (#327)', () => {
         payload: JSON.stringify({ id: 'd1', type: 'event.published', data: {} }),
         attempt_count: 4,
         status: 'pending',
-        next_retry_at: new Date(),
-        created_at: new Date(),
+        next_retry_at: new Date().toISOString(),
+        created_at: new Date().toISOString(),
       });
       await __test.tick();
 
@@ -190,8 +190,8 @@ describe('webhook delivery worker (#327)', () => {
         payload: JSON.stringify({ id: 'd1', type: 'event.published', data: {} }),
         attempt_count: 0,
         status: 'pending',
-        next_retry_at: new Date(),
-        created_at: new Date(),
+        next_retry_at: new Date().toISOString(),
+        created_at: new Date().toISOString(),
       });
       await __test.tick();
 
@@ -214,8 +214,8 @@ describe('webhook delivery worker (#327)', () => {
         payload: JSON.stringify({ id: 'd1', type: 'event.published', data: {} }),
         attempt_count: 0,
         status: 'pending',
-        next_retry_at: new Date(),
-        created_at: new Date(),
+        next_retry_at: new Date().toISOString(),
+        created_at: new Date().toISOString(),
       });
       await __test.tick();
 

backend/__tests__/migrations/194_german_gallery_created_translation.test.js

@@ -0,0 +1,234 @@
+/**
+ * The `gallery_created` German translation shipped as the English text
+ * verbatim on every fresh install (QA J.04), because 059 seeds `_de` from
+ * `_en` and 075 turns those columns into the `de` translation row.
+ *
+ * What is pinned here is as much about restraint as repair: the migration may
+ * only overwrite a German row that is still the English one, so a legacy
+ * install (whose German came from legacy migration 026) and any template an
+ * admin has edited themselves survive untouched.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+const migration = require('../../migrations/core/194_german_gallery_created_translation');
+
+// The English copy seeded by migration 001, verbatim.
+const EN_SUBJECT = 'Your Photo Gallery is Ready!';
+const EN_HTML = `<h2>Gallery Created Successfully</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been created successfully!</p>
+<p><strong>Gallery Details:</strong></p>
+<ul>
+  <li>Event Date: {{event_date}}</li>
+  <li>Gallery Link: {{gallery_link}}</li>
+  <li>Password: {{gallery_password}}</li>
+  <li>Expires: {{expiry_date}}</li>
+</ul>
+<p>Share this link and password with your guests to allow them to view and download photos.</p>`;
+const EN_TEXT = 'Gallery Created Successfully\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has been created successfully!';
+
+const placeholdersOf = (...parts) => {
+  const found = new Set();
+  for (const part of parts) {
+    for (const match of String(part || '').matchAll(/\{\{\s*([#/]?[\w.]+)\s*\}\}/g)) {
+      found.add(match[1]);
+    }
+  }
+  return [...found].sort();
+};
+
+describe('migration 194 — German gallery_created translation (QA J.04)', () => {
+  let knex; let tmpDir;
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-mig194-'));
+    knex = require('knex')({
+      client: 'sqlite3',
+      connection: { filename: path.join(tmpDir, 'db.sqlite') },
+      useNullAsDefault: true,
+    });
+  });
+
+  afterAll(async () => {
+    if (knex) await knex.destroy();
+    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+  });
+
+  const createTables = async () => {
+    await knex.schema.createTable('email_templates', (t) => {
+      t.increments('id').primary();
+      t.string('template_key').unique().notNullable();
+      t.string('subject_en');
+      t.string('subject_de');
+      t.text('body_html_en');
+      t.text('body_html_de');
+      t.text('body_text_en');
+      t.text('body_text_de');
+      t.json('variables');
+      t.string('updated_at');
+    });
+    await knex.schema.createTable('email_template_translations', (t) => {
+      t.increments('id').primary();
+      t.integer('template_id');
+      t.string('language', 10);
+      t.text('subject');
+      t.text('body_html');
+      t.text('body_text');
+      t.string('created_at');
+      t.string('updated_at');
+    });
+  };
+
+  const dropTables = async () => {
+    if (await knex.schema.hasTable('email_template_translations')) {
+      await knex.schema.dropTable('email_template_translations');
+    }
+    if (await knex.schema.hasTable('email_templates')) {
+      await knex.schema.dropTable('email_templates');
+    }
+  };
+
+  /** The state a fresh install lands in: 059 copied EN into the DE columns. */
+  const seedFreshInstall = async ({ deHtml = EN_HTML, deSubject = EN_SUBJECT, deText = EN_TEXT } = {}) => {
+    const [id] = await knex('email_templates').insert({
+      template_key: 'gallery_created',
+      subject_en: EN_SUBJECT,
+      subject_de: deSubject,
+      body_html_en: EN_HTML,
+      body_html_de: deHtml,
+      body_text_en: EN_TEXT,
+      body_text_de: deText,
+      variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date']),
+    });
+    await knex('email_template_translations').insert([
+      { template_id: id, language: 'en', subject: EN_SUBJECT, body_html: EN_HTML, body_text: EN_TEXT },
+      { template_id: id, language: 'de', subject: deSubject, body_html: deHtml, body_text: deText },
+    ]);
+    return id;
+  };
+
+  const rowFor = async (templateId, language) =>
+    knex('email_template_translations').where({ template_id: templateId, language }).first();
+
+  beforeEach(async () => {
+    await dropTables();
+    await createTables();
+  });
+
+  it('replaces the English-as-German row with actual German', async () => {
+    const id = await seedFreshInstall();
+
+    await migration.up(knex);
+
+    const de = await rowFor(id, 'de');
+    expect(de.subject).not.toBe(EN_SUBJECT);
+    expect(de.body_html).not.toBe(EN_HTML);
+    expect(de.body_text).not.toBe(EN_TEXT);
+    expect(de.subject).toContain('Fotogalerie');
+    expect(de.body_html).toContain('Galerie erfolgreich erstellt');
+    expect(de.body_text).toContain('Passwort');
+    // The English row is not collateral damage.
+    const en = await rowFor(id, 'en');
+    expect(en.body_html).toBe(EN_HTML);
+  });
+
+  it('uses exactly the placeholder set of the English original', async () => {
+    const id = await seedFreshInstall();
+
+    await migration.up(knex);
+
+    const en = await rowFor(id, 'en');
+    const de = await rowFor(id, 'de');
+    const expected = placeholdersOf(en.subject, en.body_html, en.body_text);
+    expect(expected).toEqual(['event_date', 'event_name', 'expiry_date', 'gallery_link', 'gallery_password', 'host_name']);
+    expect(placeholdersOf(de.subject, de.body_html, de.body_text)).toEqual(expected);
+  });
+
+  it('repairs the legacy _de columns too', async () => {
+    const id = await seedFreshInstall();
+
+    await migration.up(knex);
+
+    const master = await knex('email_templates').where({ id }).first();
+    expect(master.body_html_de).not.toBe(EN_HTML);
+    expect(master.body_html_de).toContain('Galerie erfolgreich erstellt');
+    expect(master.subject_de).not.toBe(EN_SUBJECT);
+    expect(master.body_html_en).toBe(EN_HTML);
+  });
+
+  it('leaves an already-translated German row (and columns) alone', async () => {
+    // What a legacy install carries after legacy migration 026.
+    const legacyDe = '<h2>Galerie erfolgreich erstellt</h2><p>Liebe(r) {{host_name}},</p>';
+    const id = await seedFreshInstall({
+      deSubject: 'Ihre Fotogalerie ist bereit!',
+      deHtml: legacyDe,
+      deText: 'Galerie erfolgreich erstellt',
+    });
+
+    await migration.up(knex);
+
+    expect((await rowFor(id, 'de')).body_html).toBe(legacyDe);
+    expect((await knex('email_templates').where({ id }).first()).body_html_de).toBe(legacyDe);
+  });
+
+  it('fills in a missing German row', async () => {
+    const id = await seedFreshInstall();
+    await knex('email_template_translations').where({ template_id: id, language: 'de' }).del();
+
+    await migration.up(knex);
+
+    expect((await rowFor(id, 'de')).body_html).toContain('Galerie erfolgreich erstellt');
+  });
+
+  it('keeps a subject the admin translated while repairing the still-English body', async () => {
+    // Each field is judged on its own. Gating on body_html alone would have
+    // thrown this subject away — and down() is a no-op, so for good.
+    const adminSubject = 'Ihre Galerie steht bereit';
+    const id = await seedFreshInstall({ deSubject: adminSubject });
+
+    await migration.up(knex);
+
+    const de = await rowFor(id, 'de');
+    expect(de.subject).toBe(adminSubject);
+    expect(de.body_html).toContain('Galerie erfolgreich erstellt');
+    expect(de.body_text).toContain('Passwort');
+    const master = await knex('email_templates').where({ id }).first();
+    expect(master.subject_de).toBe(adminSubject);
+    expect(master.body_html_de).toContain('Galerie erfolgreich erstellt');
+  });
+
+  it('keeps an admin-translated body while repairing a still-English subject', async () => {
+    const adminHtml = '<p>Hallo {{host_name}}, „{{event_name}}“ ist online: {{gallery_link}} / {{gallery_password}} bis {{expiry_date}} ({{event_date}})</p>';
+    const id = await seedFreshInstall({ deHtml: adminHtml });
+
+    await migration.up(knex);
+
+    const de = await rowFor(id, 'de');
+    expect(de.body_html).toBe(adminHtml);
+    expect(de.subject).toBe('Ihre Fotogalerie ist bereit!');
+    expect((await knex('email_templates').where({ id }).first()).body_html_de).toBe(adminHtml);
+  });
+
+  it('is idempotent', async () => {
+    const id = await seedFreshInstall();
+
+    await migration.up(knex);
+    const once = await rowFor(id, 'de');
+    await migration.up(knex);
+    const twice = await rowFor(id, 'de');
+
+    expect(twice.body_html).toBe(once.body_html);
+    expect(await knex('email_template_translations').where({ template_id: id, language: 'de' }).count())
+      .toEqual([{ 'count(*)': 1 }]);
+  });
+
+  it('no-ops when the template or the tables are absent', async () => {
+    await expect(migration.up(knex)).resolves.toBeUndefined();
+    await dropTables();
+    await expect(migration.up(knex)).resolves.toBeUndefined();
+    await createTables();
+  });
+});

backend/__tests__/routes/adminArchivesQuery.test.js

@@ -0,0 +1,209 @@
+/**
+ * The archives list must resolve search / type filter / sort in SQL.
+ *
+ * Before this, GET /admin/archives ignored every query param except page and
+ * limit: the UI fetched one 20-row page and filtered it in JavaScript while
+ * the pagination footer kept reporting the unfiltered server-side total. An
+ * archive that matched the search but lived on another page came back as a
+ * false "0 results". These tests pin the params the route now honours, and
+ * — the part that actually made the bug visible — that `pagination.total`
+ * describes the *filtered* set.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-archquery-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'archquery-test-secret';
+
+const request = require('supertest');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal, buildRouteApp } = require('../integration/helpers/crmDb');
+
+describe('GET /admin/archives query params (#I.01)', () => {
+  let db; let cleanup; let app; let token;
+
+  // name, type, archived_at, photo sizes
+  const fixtures = [
+    ['Alpha Wedding', 'wedding', '2026-01-05T10:00:00.000Z', [300]],
+    ['Bravo Birthday', 'birthday', '2026-02-05T10:00:00.000Z', [100]],
+    ['Charlie Wedding', 'wedding', '2026-03-05T10:00:00.000Z', [500, 400]],
+    ['Delta Corporate', 'corporate', '2026-04-05T10:00:00.000Z', [200]],
+    ['Echo WEDDING Gala', 'wedding', '2026-05-05T10:00:00.000Z', [50]],
+  ];
+
+  const list = async (query) => {
+    const res = await request(app)
+      .get('/admin/archives')
+      .query(query)
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(200);
+    return res.body;
+  };
+
+  const names = (body) => body.archives.map((a) => a.eventName);
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+
+    const role = await db('roles').where({ name: 'super_admin' }).first();
+    const inserted = await db('admin_users').insert({
+      username: 'arch-admin',
+      email: 'arch-admin@example.com',
+      password_hash: await bcrypt.hash('Passw0rd!', 4),
+      role_id: role.id,
+      is_active: 1,
+      created_at: new Date().toISOString(),
+      updated_at: new Date().toISOString(),
+    }).returning('id');
+    const adminId = inserted[0]?.id ?? inserted[0];
+    token = jwt.sign(
+      { id: adminId, username: 'arch-admin', type: 'admin', role: 'super_admin', loginTime: Date.now() },
+      process.env.JWT_SECRET,
+      { expiresIn: '1h', issuer: 'picpeak-auth' },
+    );
+
+    let i = 0;
+    for (const [eventName, eventType, archivedAt, sizes] of fixtures) {
+      const slug = `arch-${i++}`;
+      const ev = await db('events').insert({
+        slug,
+        event_type: eventType,
+        event_name: eventName,
+        event_date: '2026-08-01',
+        host_email: 'h@example.com',
+        admin_email: 'a@example.com',
+        password_hash: 'x',
+        share_token: `tok-${slug}`,
+        share_link: `/gallery/${slug}/tok-${slug}`,
+        expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
+        is_active: 0,
+        is_archived: 1,
+        is_draft: 0,
+        archived_at: archivedAt,
+        created_at: new Date().toISOString(),
+      }).returning('id');
+      const eventId = ev[0]?.id ?? ev[0];
+
+      let p = 0;
+      for (const size of sizes) {
+        await db('photos').insert({
+          event_id: eventId,
+          filename: `${slug}-${p++}.jpg`,
+          path: `events/archived/${slug}.jpg`,
+          type: 'individual',
+          size_bytes: size,
+          uploaded_at: new Date().toISOString(),
+        });
+      }
+    }
+
+    // A live event that must never surface in the archives list.
+    await db('events').insert({
+      slug: 'not-archived',
+      event_type: 'wedding',
+      event_name: 'Alpha Live Wedding',
+      event_date: '2026-08-01',
+      host_email: 'h@example.com',
+      admin_email: 'a@example.com',
+      password_hash: 'x',
+      share_token: 'tok-not-archived',
+      share_link: '/gallery/not-archived/tok-not-archived',
+      expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
+      is_active: 1,
+      is_archived: 0,
+      is_draft: 0,
+      created_at: new Date().toISOString(),
+    });
+
+    app = buildRouteApp('/admin/archives', require('../../src/routes/adminArchives'));
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  test('no params: every archive, newest first, unfiltered total', async () => {
+    const body = await list({});
+    expect(names(body)).toEqual([
+      'Echo WEDDING Gala', 'Delta Corporate', 'Charlie Wedding', 'Bravo Birthday', 'Alpha Wedding',
+    ]);
+    expect(body.pagination.total).toBe(5);
+  });
+
+  test('search filters in SQL and the total describes the filtered set', async () => {
+    const body = await list({ search: 'wedding' });
+    // Case-insensitive, matches "Echo WEDDING Gala" too, and never the
+    // non-archived "Alpha Live Wedding".
+    expect(names(body).sort()).toEqual(['Alpha Wedding', 'Charlie Wedding', 'Echo WEDDING Gala']);
+    expect(body.pagination.total).toBe(3);
+    expect(body.pagination.totalPages).toBe(1);
+  });
+
+  test('search reaches rows that are not on page 1 — the actual bug', async () => {
+    // limit=2 puts "Alpha Wedding" (oldest) on page 3 of the unfiltered list.
+    // Client-side filtering of page 1 returned nothing for this query.
+    const body = await list({ search: 'alpha', limit: 2, page: 1 });
+    expect(names(body)).toEqual(['Alpha Wedding']);
+    expect(body.pagination.total).toBe(1);
+  });
+
+  test('search with no match returns an empty page and a zero total', async () => {
+    const body = await list({ search: 'zzz-nothing' });
+    expect(body.archives).toEqual([]);
+    expect(body.pagination.total).toBe(0);
+    expect(body.pagination.totalPages).toBe(0);
+  });
+
+  test('type filter narrows the rows and the total; "all" is a no-op', async () => {
+    const filtered = await list({ type: 'wedding' });
+    expect(names(filtered).sort()).toEqual(['Alpha Wedding', 'Charlie Wedding', 'Echo WEDDING Gala']);
+    expect(filtered.pagination.total).toBe(3);
+
+    const all = await list({ type: 'all' });
+    expect(all.pagination.total).toBe(5);
+  });
+
+  test('search and type filter combine', async () => {
+    const body = await list({ search: 'wedding', type: 'birthday' });
+    expect(body.archives).toEqual([]);
+    expect(body.pagination.total).toBe(0);
+  });
+
+  test('sortBy=name orders across the whole set, not just the page', async () => {
+    const page1 = await list({ sortBy: 'name', limit: 2, page: 1 });
+    expect(names(page1)).toEqual(['Alpha Wedding', 'Bravo Birthday']);
+
+    const page3 = await list({ sortBy: 'name', limit: 2, page: 3 });
+    expect(names(page3)).toEqual(['Echo WEDDING Gala']);
+  });
+
+  test('sortBy=size orders by archived content size, largest first', async () => {
+    const body = await list({ sortBy: 'size' });
+    expect(names(body)).toEqual([
+      'Charlie Wedding',  // 900
+      'Alpha Wedding',    // 300
+      'Delta Corporate',  // 200
+      'Bravo Birthday',   // 100
+      'Echo WEDDING Gala' // 50
+    ]);
+  });
+
+  test('an unknown sortBy falls back to the date ordering', async () => {
+    const body = await list({ sortBy: 'events.id; drop table events' });
+    expect(names(body)[0]).toBe('Echo WEDDING Gala');
+    expect(body.pagination.total).toBe(5);
+  });
+
+  test('quotes in the search are bound as a value, not injected as SQL', async () => {
+    const body = await list({ search: '\'; DROP TABLE events; --' });
+    expect(body.archives).toEqual([]);
+    // The table is still there.
+    expect((await list({})).pagination.total).toBe(5);
+  });
+});

backend/__tests__/routes/adminCategoriesNameLength.test.js

@@ -0,0 +1,76 @@
+/**
+ * photo_categories.name is varchar(100). Without a length check the insert
+ * hit Postgres' "value too long" and the route's catch turned it into a raw
+ * 500 with no message the form could surface — a >100-char name must come
+ * back as a normal 400 validation error instead.
+ */
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-catlen-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'catlen-test-secret';
+process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-catlen-storage-'));
+
+const request = require('supertest');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const { bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken } = require('../integration/helpers/crmDb');
+
+const TOO_LONG = 'z'.repeat(101);
+
+describe('category name length validation', () => {
+  let db; let cleanup; let app; let superTok;
+
+  const auth = (req) => req.set('Authorization', `Bearer ${superTok}`);
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    const { adminId: superId } = await seedMinimal(db);
+    await assignAdminRole(db, superId, 'super_admin');
+    superTok = mintAdminToken(superId);
+
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/admin/categories', require('../../src/routes/adminCategories'));
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  it('rejects a >100-char name on create with a 400, not a 500', async () => {
+    const res = await auth(request(app).post('/api/admin/categories'))
+      .send({ name: TOO_LONG, is_global: true });
+
+    expect(res.status).toBe(400);
+    expect(res.body.errors.some((e) => e.path === 'name')).toBe(true);
+    const rows = await db('photo_categories').where('name', TOO_LONG);
+    expect(rows).toHaveLength(0);
+  });
+
+  it('rejects a >100-char name on update with a 400, not a 500', async () => {
+    const created = await auth(request(app).post('/api/admin/categories'))
+      .send({ name: 'zzcatlen-ok', is_global: true });
+    expect(created.status).toBe(200);
+
+    const res = await auth(request(app).put(`/api/admin/categories/${created.body.id}`))
+      .send({ name: TOO_LONG });
+
+    expect(res.status).toBe(400);
+    expect(res.body.errors.some((e) => e.path === 'name')).toBe(true);
+    const row = await db('photo_categories').where('id', created.body.id).first();
+    expect(row.name).toBe('zzcatlen-ok');
+  });
+
+  it('still accepts a name at exactly the 100-char limit', async () => {
+    const name = 'y'.repeat(100);
+    const res = await auth(request(app).post('/api/admin/categories'))
+      .send({ name, is_global: true });
+
+    expect(res.status).toBe(200);
+    expect(res.body.name).toBe(name);
+  });
+});

backend/__tests__/routes/adminFeedbackWordFilterSeverity.test.js

@@ -0,0 +1,72 @@
+/**
+ * Word-filter severity vocabulary. The Settings → Moderation UI offers
+ * low / moderate / high / block, but the validator only accepted the
+ * unrelated mild / moderate / severe set, so 3 of the 4 levels — including
+ * "block", the strongest tier — 400'd on every add.
+ */
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-wfsev-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'wfsev-test-secret';
+process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-wfsev-storage-'));
+
+const request = require('supertest');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const { bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken } = require('../integration/helpers/crmDb');
+
+describe('word filter severity levels', () => {
+  let db; let cleanup; let app; let superTok;
+
+  const auth = (req) => req.set('Authorization', `Bearer ${superTok}`);
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    const { adminId: superId } = await seedMinimal(db);
+    await assignAdminRole(db, superId, 'super_admin');
+    superTok = mintAdminToken(superId);
+
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/admin/feedback', require('../../src/routes/adminFeedback'));
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  it.each(['low', 'moderate', 'high', 'block'])('accepts severity "%s"', async (severity) => {
+    const word = `zzsev${severity}`;
+    const res = await auth(request(app).post('/api/admin/feedback/word-filters'))
+      .send({ word, severity });
+
+    expect(res.status).toBe(200);
+    const row = await db('feedback_word_filters').where({ word }).first();
+    expect(row.severity).toBe(severity);
+  });
+
+  it('still rejects a severity outside the vocabulary', async () => {
+    const res = await auth(request(app).post('/api/admin/feedback/word-filters'))
+      .send({ word: 'zzsevbogus', severity: 'catastrophic' });
+
+    expect(res.status).toBe(400);
+    expect(res.body.errors.some((e) => e.path === 'severity')).toBe(true);
+  });
+
+  it('blocks a comment matching a "block" filter and only flags a "low" one', async () => {
+    const moderation = require('../../src/services/feedbackModeration');
+    moderation.clearCache();
+
+    const blocked = await moderation.moderateText('this is zzsevblock speech');
+    expect(blocked.approved).toBe(false);
+    expect(blocked.violations.map((v) => v.word)).toEqual(['zzsevblock']);
+
+    const flagged = await moderation.moderateText('this is zzsevlow speech');
+    expect(flagged.approved).toBe(true);
+    expect(flagged.flagged).toBe(true);
+  });
+});

backend/__tests__/routes/adminPhotoUploadSizeLimit.test.js

@@ -0,0 +1,164 @@
+/**
+ * Per-file upload size limit on the admin photo routes.
+ *
+ * `general_max_file_size_mb` (Settings → General, default 50MB) is what the
+ * dropzone advertises ("max. 50MB per file"), but the admin upload route
+ * hardcoded multer's cap at 10GB and the chunked-upload init route at 10GB
+ * too — so the advertised limit was never enforced anywhere server-side and a
+ * 50.74MB JPEG uploaded cleanly.
+ *
+ * Pins:
+ *  - a file over the configured cap is rejected with a 400 naming the limit
+ *  - the chunked-upload init route honours the same cap (it would otherwise
+ *    be a trivial bypass of the multipart route's cap)
+ *  - the chunk route enforces the cap on the bytes actually received, so a
+ *    client can't declare `fileSize: 1` at init and stream past the limit
+ *  - a file under the cap still gets past the size gate
+ *  - the limit is read per request, so an admin raising it takes effect
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-upload-size-')), 'db.sqlite',
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'upload-size-test-secret';
+process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-upload-size-storage-'));
+
+const request = require('supertest');
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
+
+const SLUG = 'upload-size-test-event';
+
+describe('admin upload per-file size limit (general_max_file_size_mb)', () => {
+  let db;
+  let cleanup;
+  let app;
+  let eventId;
+  let adminToken;
+  let uploadSettings;
+
+  const setLimitMb = async (mb) => {
+    await db('app_settings')
+      .insert({
+        setting_key: 'general_max_file_size_mb',
+        setting_value: JSON.stringify(mb),
+        setting_type: 'general',
+        updated_at: new Date().toISOString(),
+      })
+      .onConflict('setting_key')
+      .merge({ setting_value: JSON.stringify(mb) });
+    uploadSettings.clearMaxFileSizeCache();
+  };
+
+  const postUpload = (bytes, filename = 'shot.jpg') => request(app)
+    .post(`/api/admin/photos/${eventId}/upload`)
+    .set('Authorization', `Bearer ${adminToken}`)
+    .attach('photos', Buffer.alloc(bytes, 0x41), { filename, contentType: 'image/jpeg' });
+
+  const postChunkedInit = (fileSize) => request(app)
+    .post(`/api/admin/photos/${eventId}/chunked-upload/init`)
+    .set('Authorization', `Bearer ${adminToken}`)
+    .send({ filename: 'clip.mp4', fileSize, mimeType: 'video/mp4', totalChunks: 1 });
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+
+    const inserted = await db('events').insert({
+      slug: SLUG,
+      event_type: 'wedding',
+      event_name: 'Upload Size Test',
+      event_date: '2026-09-01',
+      host_email: 'host@example.com',
+      admin_email: 'admin@example.com',
+      password_hash: 'x',
+      share_link: `/gallery/${SLUG}/share`,
+      share_token: 'upload-size-share',
+      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+      is_active: 1,
+      is_archived: 0,
+      is_draft: 0,
+      created_at: new Date().toISOString(),
+    }).returning('id');
+    eventId = inserted[0]?.id ?? inserted[0];
+
+    const superRole = await db('roles').where({ name: 'super_admin' }).first();
+    const [rootId] = await db('admin_users').insert({
+      username: 'upload-size-admin',
+      email: 'upload-size-admin@example.com',
+      password_hash: await bcrypt.hash('UploadSize123', 4),
+      role_id: superRole.id,
+      is_active: 1,
+      created_at: new Date().toISOString(),
+      updated_at: new Date().toISOString(),
+    }).returning('id').then((r) => [r[0]?.id || r[0]]);
+    adminToken = jwt.sign(
+      { id: rootId, username: 'upload-size-admin', type: 'admin', role: 'super_admin', loginTime: Date.now() },
+      process.env.JWT_SECRET,
+      { expiresIn: '1h', issuer: 'picpeak-auth' }
+    );
+
+    uploadSettings = require('../../src/services/uploadSettings');
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/photos', require('../../src/routes/adminPhotos'));
+  }, 120000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  it('rejects a file over the configured limit with a 400 naming the limit', async () => {
+    await setLimitMb(1);
+    const res = await postUpload(2 * 1024 * 1024);
+    expect(res.status).toBe(400);
+    expect(res.body.error).toBe('File too large. Maximum size is 1 MB per file.');
+  });
+
+  it('rejects an over-limit chunked upload at init instead of allowing 10GB', async () => {
+    await setLimitMb(1);
+    const res = await postChunkedInit(200 * 1024 * 1024);
+    expect(res.status).toBe(400);
+    expect(res.body.error).toBe('File too large. Maximum size is 1 MB per file.');
+  });
+
+  it('rejects chunk bytes over the limit regardless of the declared fileSize', async () => {
+    await setLimitMb(1);
+    const initRes = await postChunkedInit(1);
+    expect(initRes.status).toBe(200);
+
+    const res = await request(app)
+      .post(`/api/admin/photos/${eventId}/chunked-upload/${initRes.body.uploadId}/chunk/0`)
+      .set('Authorization', `Bearer ${adminToken}`)
+      .set('Content-Type', 'application/octet-stream')
+      .send(Buffer.alloc(2 * 1024 * 1024, 0x41));
+    expect(res.status).toBe(413);
+    expect(res.body.error).toBe('File too large. Maximum size is 1 MB per file.');
+  });
+
+  it('lets a file under the limit past the size gate', async () => {
+    await setLimitMb(1);
+    // Junk bytes, so it still fails downstream on the content check — that is
+    // the point: the failure is no longer about size.
+    const res = await postUpload(64 * 1024);
+    expect(res.status).toBe(400);
+    expect(res.body.error).toBe('File content does not match declared type: shot.jpg');
+  });
+
+  it('reads the limit per request, so raising it takes effect immediately', async () => {
+    await setLimitMb(1);
+    expect((await postUpload(2 * 1024 * 1024)).status).toBe(400);
+
+    await setLimitMb(10);
+    const res = await postUpload(2 * 1024 * 1024);
+    expect(res.status).toBe(400);
+    expect(res.body.error).toBe('File content does not match declared type: shot.jpg');
+  });
+});

backend/__tests__/routes/feedbackBlockSeverity.test.js

@@ -0,0 +1,119 @@
+/**
+ * Word-filter severity tiers, at the submission route.
+ *
+ * The Settings → Moderation UI advertises `block` as "comment is rejected
+ * immediately", but the submit route saved every non-approved comment with
+ * is_approved = false — identical handling to `moderate`/`high`. So the
+ * strongest tier stored the prohibited text anyway and only hid it from the
+ * public list.
+ *
+ * These three cases pin the tiers apart:
+ *   block           → 4xx, nothing written
+ *   moderate / high → 201, stored held-for-moderation (is_approved = false)
+ *   low             → 201, stored approved (flag-only)
+ */
+
+const request = require('supertest');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const jwt = require('jsonwebtoken');
+
+const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
+
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'block-severity-secret';
+
+const SLUG = 'block-severity';
+
+describe('word-filter severity tiers at submission (#B11)', () => {
+  let db; let cleanup; let app;
+  let eventId; let photoId;
+
+  const galleryToken = () => jwt.sign(
+    { eventId, eventSlug: SLUG, type: 'gallery' },
+    process.env.JWT_SECRET,
+    { expiresIn: '1h', issuer: 'picpeak-auth' }
+  );
+
+  const comment = (text) => request(app)
+    .post(`/api/gallery/${SLUG}/photos/${photoId}/feedback`)
+    .set('Authorization', `Bearer ${galleryToken()}`)
+    .send({ feedback_type: 'comment', comment_text: text });
+
+  beforeAll(async () => {
+    ({ db, cleanup } = await bootCrmDb());
+    await seedMinimal(db);
+
+    const [ev] = await db('events').insert({
+      slug: SLUG,
+      event_type: 'wedding',
+      event_name: 'Block Severity',
+      event_date: '2026-08-01',
+      host_email: 'h@example.com',
+      admin_email: 'a@example.com',
+      password_hash: 'x',
+      share_link: `/gallery/${SLUG}/share`,
+      share_token: 'block-severity-share',
+      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+      is_active: 1, is_archived: 0, is_draft: 0,
+      created_at: new Date().toISOString(),
+    }).returning('id');
+    eventId = typeof ev === 'object' ? ev.id : ev;
+
+    const [p] = await db('photos').insert({
+      event_id: eventId, filename: 'shot.jpg', path: `events/${SLUG}/shot.jpg`,
+      type: 'individual', uploaded_at: new Date().toISOString(),
+    }).returning('id');
+    photoId = typeof p === 'object' ? p.id : p;
+
+    await db('event_feedback_settings').insert({
+      event_id: eventId, feedback_enabled: true, allow_comments: true,
+      moderate_comments: false, require_name_email: false,
+      show_feedback_to_guests: true,
+    });
+
+    await db('feedback_word_filters').insert([
+      { word: 'zzblocked', severity: 'block', is_active: true, created_at: new Date().toISOString() },
+      { word: 'zzmoderated', severity: 'moderate', is_active: true, created_at: new Date().toISOString() },
+      { word: 'zzmild', severity: 'low', is_active: true, created_at: new Date().toISOString() },
+    ]);
+    require('../../src/services/feedbackModeration').clearCache();
+
+    app = express();
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use('/api/gallery', require('../../src/routes/galleryFeedback'));
+  }, 180000);
+
+  afterAll(async () => { if (cleanup) await cleanup(); });
+
+  beforeEach(async () => {
+    await db('photo_feedback').where({ photo_id: photoId }).del();
+  });
+
+  it('rejects a "block" match outright and stores nothing', async () => {
+    const res = await comment('this is zzblocked content');
+
+    expect(res.status).toBe(400);
+    expect(res.body.code).toBe('COMMENT_BLOCKED');
+    expect(await db('photo_feedback').where({ photo_id: photoId })).toHaveLength(0);
+  });
+
+  it('still holds a "moderate" match for moderation', async () => {
+    const res = await comment('this is zzmoderated content');
+
+    expect(res.status).toBeLessThan(400);
+    const rows = await db('photo_feedback').where({ photo_id: photoId });
+    expect(rows).toHaveLength(1);
+    expect([false, 0]).toContain(rows[0].is_approved);
+    expect(rows[0].comment_text).toContain('zzmoderated');
+  });
+
+  it('lets a "low" match through approved (flag only)', async () => {
+    const res = await comment('this is zzmild content');
+
+    expect(res.status).toBeLessThan(400);
+    const rows = await db('photo_feedback').where({ photo_id: photoId });
+    expect(rows).toHaveLength(1);
+    expect([true, 1]).toContain(rows[0].is_approved);
+  });
+});

backend/__tests__/services/backupService.enhanced.test.js

@@ -11,8 +11,27 @@ jest.mock('../../src/services/emailProcessor');
 jest.mock('node-cron');
 jest.mock('../../src/services/backupManifest');
 jest.mock('../../src/services/storage/s3Storage');
+// runBackup lazily requires this from inside the run — resolve+register it
+// here so the require doesn't hit the (mock-fs'd) filesystem mid-backup.
+jest.mock('../../src/services/databaseBackup', () => ({
+  databaseBackupService: {
+    backup: jest.fn()
+  }
+}));
+// Same deal for the rsync path's lazy requires.
+jest.mock('../../src/utils/safeExec', () => ({
+  spawnAsync: jest.fn(),
+  spawnToFile: jest.fn(),
+  spawnFromFile: jest.fn()
+}));
+jest.mock('../../src/utils/networkValidation', () => ({
+  isHostAllowed: jest.fn().mockResolvedValue(true)
+}));
 
 const backupService = require('../../src/services/backupService');
+const { databaseBackupService } = require('../../src/services/databaseBackup');
+const { spawnAsync } = require('../../src/utils/safeExec');
+const { isHostAllowed } = require('../../src/utils/networkValidation');
 const { db } = require('../../src/database/db');
 const logger = require('../../src/utils/logger');
 const { queueEmail } = require('../../src/services/emailProcessor');
@@ -20,6 +39,20 @@ const cron = require('node-cron');
 const backupManifest = require('../../src/services/backupManifest');
 const S3StorageAdapter = require('../../src/services/storage/s3Storage');
 
+// `runBackup` opens the run row with `db('backup_runs').insert(...).returning('id')`,
+// so the insert mock has to be awaitable AND carry a `.returning()`.
+const insertResult = (value) => {
+  const thenable = Promise.resolve(value);
+  thenable.returning = jest.fn().mockResolvedValue(value);
+  return thenable;
+};
+
+// Every runBackup goes through ensureDatabaseDumpForBackup, which stats the
+// DB dump on disk and refuses to continue without it — seed it into every
+// mock-fs tree.
+const DB_DUMP_PATH = '/backup/db-dump.sql';
+const mockStorage = (tree) => mockFs({ [DB_DUMP_PATH]: Buffer.from('database dump'), ...tree });
+
 describe('Enhanced Backup Service Tests', () => {
   let mockDb;
   let mockS3Client;
@@ -36,7 +69,7 @@ describe('Enhanced Backup Service Tests', () => {
       orderBy: jest.fn().mockReturnThis(),
       limit: jest.fn().mockReturnThis(),
       first: jest.fn(),
-      insert: jest.fn(),
+      insert: jest.fn(() => insertResult([1])),
       update: jest.fn(),
       delete: jest.fn()
     };
@@ -75,6 +108,19 @@ describe('Enhanced Backup Service Tests', () => {
     logger.error = jest.fn();
     logger.warn = jest.fn();
     logger.debug = jest.fn();
+
+    // The inline DB dump and its on-disk verification run on every backup and
+    // throw when no dump is available — give both a passing default so each
+    // test can focus on the destination path it actually covers.
+    databaseBackupService.backup.mockResolvedValue({ path: DB_DUMP_PATH, size: 13 });
+    isHostAllowed.mockResolvedValue(true);
+    jest.spyOn(backupService, 'getDatabaseBackupInfo').mockResolvedValue({
+      type: 'sqlite',
+      backupFile: DB_DUMP_PATH,
+      size: 13,
+      checksum: 'abc123',
+      hasChanged: false
+    });
   });
 
   afterEach(() => {
@@ -132,7 +178,7 @@ describe('Enhanced Backup Service Tests', () => {
   describe('S3 Backup Functionality', () => {
     beforeEach(() => {
       // Mock file system
-      mockFs({
+      mockStorage({
         '/storage/events/active/event1': {
           'photo1.jpg': Buffer.from('photo1 content'),
           'photo2.jpg': Buffer.from('photo2 content')
@@ -165,12 +211,12 @@ describe('Enhanced Backup Service Tests', () => {
       mockDb.select.mockResolvedValue([]);
       mockDb.where.mockReturnThis();
       mockDb.first.mockResolvedValue(null);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
       jest.spyOn(backupService, 'getDatabaseBackupInfo').mockResolvedValue({
         type: 'sqlite',
-        backupFile: null,
+        backupFile: DB_DUMP_PATH,
         hasChanged: true
       });
       
@@ -202,7 +248,7 @@ describe('Enhanced Backup Service Tests', () => {
       };
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       mockDb.first.mockResolvedValue(null);
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
@@ -240,7 +286,7 @@ describe('Enhanced Backup Service Tests', () => {
       });
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
       
@@ -265,7 +311,7 @@ describe('Enhanced Backup Service Tests', () => {
       };
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
       jest.spyOn(backupService, 'getDatabaseBackupInfo').mockResolvedValue({
@@ -277,7 +323,7 @@ describe('Enhanced Backup Service Tests', () => {
       });
       
       // Mock database backup file
-      mockFs({
+      mockStorage({
         '/storage/events/active': {},
         '/backup/db-backup.sql': Buffer.from('database backup content')
       });
@@ -301,7 +347,7 @@ describe('Enhanced Backup Service Tests', () => {
       };
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
       
@@ -326,12 +372,12 @@ describe('Enhanced Backup Service Tests', () => {
       };
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       mockDb.first.mockResolvedValue(null);
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
       
-      mockFs({
+      mockStorage({
         '/storage/events/active/event1': {
           'photo1.jpg': Buffer.from('photo1 content')
         },
@@ -365,7 +411,7 @@ describe('Enhanced Backup Service Tests', () => {
       };
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([2]);
+      mockDb.insert.mockReturnValue(insertResult([2]));
       mockDb.first.mockImplementation(() => Promise.resolve(lastBackup));
       mockDb.orderBy.mockReturnThis();
       mockDb.where.mockReturnThis();
@@ -373,7 +419,7 @@ describe('Enhanced Backup Service Tests', () => {
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
       
-      mockFs({
+      mockStorage({
         '/storage/events/active': {},
         '/backup': {}
       });
@@ -395,7 +441,7 @@ describe('Enhanced Backup Service Tests', () => {
       };
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       mockDb.first.mockResolvedValue(null);
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
@@ -406,7 +452,7 @@ describe('Enhanced Backup Service Tests', () => {
       };
       backupManifest.generateManifest.mockResolvedValue(manifest);
       
-      mockFs({
+      mockStorage({
         '/storage/events/active': {},
         '/storage/temp': {}
       });
@@ -431,12 +477,12 @@ describe('Enhanced Backup Service Tests', () => {
       };
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       mockDb.first.mockResolvedValue(null);
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
       
-      mockFs({
+      mockStorage({
         '/storage/events/active/event1': {
           'photo1.jpg': Buffer.from('photo1 content')
         },
@@ -461,28 +507,27 @@ describe('Enhanced Backup Service Tests', () => {
       };
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       mockDb.first.mockResolvedValue(null);
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
-      
-      // Mock exec for rsync
-      const { exec } = require('child_process');
-      const mockExec = jest.fn((cmd, callback) => {
-        callback(null, { stdout: 'Number of files transferred: 1\nTotal file size: 1024 bytes' });
+
+      // rsync is spawned argv-style (no shell) — assert that shape, not the
+      // legacy `exec('rsync ...')` string.
+      spawnAsync.mockResolvedValue({
+        stdout: 'Number of files transferred: 1\nTotal file size: 1024 bytes'
       });
-      exec.mockImplementation(mockExec);
-      
-      mockFs({
+
+      mockStorage({
         '/storage/events/active': {}
       });
-      
+
       await backupService.runBackup();
-      
-      expect(mockExec).toHaveBeenCalledWith(
-        expect.stringContaining('rsync'),
-        expect.any(Function)
-      );
+
+      expect(spawnAsync).toHaveBeenCalledWith('rsync', expect.any(Array));
+      const [, rsyncArgs] = spawnAsync.mock.calls[0];
+      expect(rsyncArgs).toContain('-avz');
+      expect(rsyncArgs[rsyncArgs.length - 1]).toBe('backup@backup.example.com:/remote/backup');
     });
   });
 
@@ -497,7 +542,7 @@ describe('Enhanced Backup Service Tests', () => {
       };
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       mockDb.first.mockResolvedValue(null);
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
@@ -514,7 +559,7 @@ describe('Enhanced Backup Service Tests', () => {
         return originalCreateReadStream(path);
       });
       
-      mockFs({
+      mockStorage({
         '/storage/events/active': {
           'error.jpg': Buffer.from('content'),
           'good.jpg': Buffer.from('content')
@@ -546,7 +591,7 @@ describe('Enhanced Backup Service Tests', () => {
       ];
       
       mockDb.select.mockResolvedValue([]);
-      mockDb.insert.mockResolvedValue([1]);
+      mockDb.insert.mockReturnValue(insertResult([1]));
       mockDb.where.mockReturnThis();
       
       jest.spyOn(backupService, 'getBackupConfig')
@@ -555,7 +600,13 @@ describe('Enhanced Backup Service Tests', () => {
       
       // Force an error
       jest.spyOn(backupService, 'getFilesToBackup').mockRejectedValue(new Error('Storage error'));
-      
+
+      // The DB-dump verification runs first and would throw its own error —
+      // give it a tree so 'Storage error' is what actually surfaces.
+      mockStorage({
+        '/storage/events/active': {}
+      });
+
       // Mock admin users query
       db.mockImplementation((table) => {
         if (table === 'admin_users') {
@@ -588,7 +639,7 @@ describe('Enhanced Backup Service Tests', () => {
       
       jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
       
-      mockFs({
+      mockStorage({
         '/storage/events/active': {},
         '/backup': {}
       });
@@ -675,20 +726,32 @@ describe('Enhanced Backup Service Tests', () => {
       ];
       
       mockDb.limit.mockResolvedValue(recentRuns);
-      
+      // getBackupStatus also reads the backup config to compute the next run;
+      // an unscheduled/disabled backup legitimately yields null (#871).
+      mockDb.select.mockResolvedValue([
+        { setting_key: 'backup_enabled', setting_value: 'true' },
+        { setting_key: 'backup_schedule', setting_value: '"daily"' }
+      ]);
+
       backupManifest.validateManifest.mockImplementation(() => true);
-      
+
       const status = await backupService.getBackupStatus();
-      
+
+      // Runs are returned with a `created_at` alias for the frontend.
+      const run = { ...recentRuns[0], created_at: recentRuns[0].started_at };
+
       expect(status).toEqual({
         isRunning: false,
         isHealthy: true,
-        lastRun: expect.objectContaining({
-          ...recentRuns[0],
-          manifestValid: true
-        }),
-        recentRuns: recentRuns,
-        nextScheduledRun: expect.any(String)
+        lastRun: { ...run, manifestValid: true },
+        lastBackup: { ...run, manifestValid: true },
+        lastSuccessfulBackup: run,
+        zombieRuns: [],
+        recentRuns: [run],
+        recentBackups: [run],
+        totalBackups: 1,
+        nextScheduledRun: expect.any(String),
+        nextBackup: expect.any(String)
       });
     });
 

backend/__tests__/services/chunkedUploadSizeCap.test.js

@@ -0,0 +1,80 @@
+/**
+ * The chunked-upload per-file cap has to hold on the bytes actually received,
+ * not on the client-declared `fileSize` the init route validates. Declaring
+ * `fileSize: 1` and then streaming 10 GB through the chunk route was a
+ * complete bypass of general_max_file_size_mb; the merge step only logged a
+ * size mismatch and processed the file anyway.
+ */
+const path = require('path');
+const os = require('os');
+const fs = require('fs').promises;
+
+process.env.STORAGE_PATH = path.join(os.tmpdir(), `picpeak-chunk-cap-test-${process.pid}`);
+
+const chunkedUpload = require('../../src/services/chunkedUploadService');
+
+const MB = 1024 * 1024;
+
+const init = (overrides = {}) => chunkedUpload.initializeUpload({
+  filename: 'clip.mp4',
+  fileSize: 1,
+  mimeType: 'video/mp4',
+  eventId: 1,
+  totalChunks: 2,
+  maxFileSizeBytes: 1 * MB,
+  ...overrides,
+});
+
+describe('chunkedUploadService per-file size cap', () => {
+  afterAll(async () => {
+    await fs.rm(process.env.STORAGE_PATH, { recursive: true, force: true }).catch(() => {});
+  });
+
+  it('rejects a single chunk over the cap even when the declared fileSize is tiny', async () => {
+    const { uploadId } = await init();
+    await expect(chunkedUpload.uploadChunk(uploadId, 0, Buffer.alloc(2 * MB)))
+      .rejects.toMatchObject({ code: 'FILE_TOO_LARGE', statusCode: 413 });
+    // Aborted, not merely rejected: the upload can no longer be completed.
+    expect(chunkedUpload.getUploadStatus(uploadId)).toBeNull();
+  });
+
+  it('rejects when the running total across chunks crosses the cap', async () => {
+    const { uploadId } = await init();
+    await chunkedUpload.uploadChunk(uploadId, 0, Buffer.alloc(0.75 * MB));
+    await expect(chunkedUpload.uploadChunk(uploadId, 1, Buffer.alloc(0.5 * MB)))
+      .rejects.toMatchObject({ code: 'FILE_TOO_LARGE' });
+  });
+
+  it('counts a re-sent chunk once, not twice', async () => {
+    const { uploadId } = await init();
+    await chunkedUpload.uploadChunk(uploadId, 0, Buffer.alloc(0.6 * MB));
+    // Same index again — replaces the earlier bytes, so the total stays 0.6 MB.
+    await expect(chunkedUpload.uploadChunk(uploadId, 0, Buffer.alloc(0.6 * MB))).resolves.toBeTruthy();
+    await expect(chunkedUpload.uploadChunk(uploadId, 1, Buffer.alloc(0.3 * MB))).resolves.toBeTruthy();
+  });
+
+  it('rejects chunk indices outside the announced range', async () => {
+    const { uploadId } = await init();
+    await expect(chunkedUpload.uploadChunk(uploadId, 2, Buffer.alloc(10)))
+      .rejects.toMatchObject({ code: 'INVALID_CHUNK', statusCode: 400 });
+    await expect(chunkedUpload.uploadChunk(uploadId, -1, Buffer.alloc(10)))
+      .rejects.toMatchObject({ code: 'INVALID_CHUNK' });
+    await expect(chunkedUpload.uploadChunk(uploadId, NaN, Buffer.alloc(10)))
+      .rejects.toMatchObject({ code: 'INVALID_CHUNK' });
+  });
+
+  it('merges an upload under the cap and reports the real size', async () => {
+    const { uploadId } = await init();
+    await chunkedUpload.uploadChunk(uploadId, 0, Buffer.alloc(400 * 1024, 0x41));
+    await chunkedUpload.uploadChunk(uploadId, 1, Buffer.alloc(400 * 1024, 0x42));
+    const merged = await chunkedUpload.completeUpload(uploadId);
+    expect(merged.size).toBe(800 * 1024);
+    await fs.rm(merged.tempDir, { recursive: true, force: true });
+  });
+
+  it('applies no cap when none is given', async () => {
+    const { uploadId } = await init({ maxFileSizeBytes: undefined, totalChunks: 1 });
+    await expect(chunkedUpload.uploadChunk(uploadId, 0, Buffer.alloc(3 * MB))).resolves.toBeTruthy();
+    await chunkedUpload.abortUpload(uploadId);
+  });
+});

backend/migrations/core/194_german_gallery_created_translation.js

@@ -0,0 +1,126 @@
+/**
+ * Migration 194: give `gallery_created` a real German translation.
+ *
+ * On a fresh install the German copy of this template is the ENGLISH copy,
+ * verbatim. Migration 059 introduces the multilingual columns by seeding
+ * `subject_de`/`body_html_de`/`body_text_de` from their `_en` counterparts
+ * ("Copy to German as default"), and migration 075 then materialises exactly
+ * those columns as the `de` row in `email_template_translations`. The proper
+ * German lived only in the LEGACY migrations (009/026), which never run on a
+ * fresh install — so every install created since then mails English to
+ * German-locale recipients, while nl/pt/ru/fr/es/sl are all localised.
+ *
+ * This is the most customer-visible transactional mail we send (one per
+ * published gallery), so it is repaired as a content UPDATE: a code-only fix
+ * would leave every existing install on the English-as-German row forever,
+ * because Knex will not re-run 059/075.
+ *
+ * Idempotent, and deliberately conservative about WHICH rows it touches: the
+ * German row is rewritten only while it is still byte-identical to the English
+ * one (or empty), which is precisely the broken state. A legacy install whose
+ * German came from migration 026, or any install where an admin has edited the
+ * template themselves, is left alone.
+ *
+ * The placeholder set matches the English original exactly — host_name,
+ * event_name, event_date, gallery_link, gallery_password, expiry_date — which
+ * is also the template's declared `variables` array.
+ */
+
+const SUBJECT_DE = 'Ihre Fotogalerie ist bereit!';
+
+const HTML_DE = `<h2>Galerie erfolgreich erstellt</h2>
+<p>Guten Tag {{host_name}},</p>
+<p>Ihre Fotogalerie „{{event_name}}“ wurde erfolgreich erstellt!</p>
+<p><strong>Details zur Galerie:</strong></p>
+<ul>
+  <li>Veranstaltungsdatum: {{event_date}}</li>
+  <li>Link zur Galerie: <a href="{{gallery_link}}">{{gallery_link}}</a></li>
+  <li>Passwort: {{gallery_password}}</li>
+  <li>Verfügbar bis: {{expiry_date}}</li>
+</ul>
+<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit diese die Fotos ansehen und herunterladen können.</p>`;
+
+const TEXT_DE = 'Galerie erfolgreich erstellt\n\nGuten Tag {{host_name}},\n\nIhre Fotogalerie „{{event_name}}“ wurde erfolgreich erstellt!\n\nVeranstaltungsdatum: {{event_date}}\nLink zur Galerie: {{gallery_link}}\nPasswort: {{gallery_password}}\nVerfügbar bis: {{expiry_date}}\n\nTeilen Sie diesen Link und das Passwort mit Ihren Gästen, damit diese die Fotos ansehen und herunterladen können.';
+
+// "Not translated yet" = empty, or still the English text.
+const isUntranslated = (german, english) => {
+  const de = (german || '').trim();
+  if (!de) return true;
+  return de === (english || '').trim();
+};
+
+exports.up = async function(knex) {
+  if (!(await knex.schema.hasTable('email_templates'))) return;
+
+  const master = await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .first();
+  if (!master) return; // Template not seeded on this install — nothing to fix.
+
+  const now = new Date().toISOString();
+
+  if (await knex.schema.hasTable('email_template_translations')) {
+    const enRow = await knex('email_template_translations')
+      .where({ template_id: master.id, language: 'en' })
+      .first();
+    const deRow = await knex('email_template_translations')
+      .where({ template_id: master.id, language: 'de' })
+      .first();
+
+    const englishHtml = (enRow && enRow.body_html) || master.body_html_en || master.body_html || '';
+
+    if (!deRow) {
+      await knex('email_template_translations').insert({
+        template_id: master.id,
+        language: 'de',
+        subject: SUBJECT_DE,
+        body_html: HTML_DE,
+        body_text: TEXT_DE,
+        created_at: now,
+        updated_at: now,
+      });
+    } else {
+      // Each field is judged on its own. Gating all three on body_html would
+      // overwrite a subject the admin had already translated whenever the HTML
+      // still matched English — and down() is a deliberate no-op, so that loss
+      // would be unrecoverable.
+      const englishSubject = (enRow && enRow.subject) || master.subject_en || master.subject || '';
+      const englishText = (enRow && enRow.body_text) || master.body_text_en || master.body_text || '';
+      const patch = {};
+      if (isUntranslated(deRow.subject, englishSubject)) patch.subject = SUBJECT_DE;
+      if (isUntranslated(deRow.body_html, englishHtml)) patch.body_html = HTML_DE;
+      if (isUntranslated(deRow.body_text, englishText)) patch.body_text = TEXT_DE;
+
+      if (Object.keys(patch).length > 0) {
+        patch.updated_at = now;
+        await knex('email_template_translations').where({ id: deRow.id }).update(patch);
+      }
+    }
+  }
+
+  // Legacy per-language columns on the master row — still the fallback path in
+  // emailProcessor.processTemplate when the translations table is unavailable.
+  const cols = await knex('email_templates').columnInfo();
+  if (cols.body_html_de) {
+    // Same per-field rule as the translations table above.
+    const legacyPatch = {};
+    if (cols.subject_de && isUntranslated(master.subject_de, master.subject_en)) {
+      legacyPatch.subject_de = SUBJECT_DE;
+    }
+    if (isUntranslated(master.body_html_de, master.body_html_en)) {
+      legacyPatch.body_html_de = HTML_DE;
+    }
+    if (cols.body_text_de && isUntranslated(master.body_text_de, master.body_text_en)) {
+      legacyPatch.body_text_de = TEXT_DE;
+    }
+    if (Object.keys(legacyPatch).length > 0) {
+      legacyPatch.updated_at = now;
+      await knex('email_templates').where({ id: master.id }).update(legacyPatch);
+    }
+  }
+};
+
+exports.down = async function() {
+  // No-op: reverting would restore English-as-German. Admins who want
+  // different copy can edit it under Settings → Email → Templates.
+};

backend/src/__tests__/customerAuth.middleware.test.js

@@ -65,7 +65,7 @@ function makeRes() {
   res.json = jest.fn().mockReturnValue(res);
   return res;
 }
-function makeReq({ token = 'tkn', cookies = {}, headers = {}, originalUrl = '/api/customer/foo', ip = '1.2.3.4' } = {}) {
+function makeReq({ cookies = {}, headers = {}, originalUrl = '/api/customer/foo', ip = '1.2.3.4' } = {}) {
   return { headers: { authorization: undefined, ...headers }, cookies, originalUrl, ip, connection: { remoteAddress: ip } };
 }
 

backend/src/__tests__/publicSiteService.test.js

@@ -19,7 +19,7 @@ const { sanitizeCss } = require('../utils/cssSanitizer');
 const buildPublicSiteRows = (overrides = {}) => ([
   { setting_key: 'general_public_site_enabled', setting_value: JSON.stringify(overrides.enabled ?? true) },
   { setting_key: 'general_public_site_html', setting_value: JSON.stringify(overrides.html ?? '<h1>{{company_name}}</h1>') },
-  { setting_key: 'general_public_site_custom_css', setting_value: JSON.stringify(overrides.css ?? "body { color: red; }") }
+  { setting_key: 'general_public_site_custom_css', setting_value: JSON.stringify(overrides.css ?? 'body { color: red; }') }
 ]);
 
 const buildBrandingRows = (overrides = {}) => ([
@@ -64,7 +64,7 @@ describe('publicSiteService', () => {
 
   it('sanitizes custom CSS and removes dangerous patterns', async () => {
     const publicSiteRows = buildPublicSiteRows({
-      css: "body { color: blue; } @import url('https://malicious.example/style.css'); div { background: url(\"javascript:alert(1)\"); }"
+      css: 'body { color: blue; } @import url(\'https://malicious.example/style.css\'); div { background: url("javascript:alert(1)"); }'
     });
     const brandingRows = buildBrandingRows();
 

backend/src/database/db.js

@@ -21,7 +21,7 @@ try {
   }
 } catch (e) {
   // Non-fatal: log and continue; SQLite will fail later if still missing
-  try { logger.warn('SQLite directory ensure failed', { error: e.message }); } catch (_) {}
+  try { logger.warn('SQLite directory ensure failed', { error: e.message }); } catch (_) { /* non-fatal */ }
 }
 
 // Create database connection with built-in retry logic.
@@ -205,28 +205,28 @@ async function initializeDatabase() {
           )
         `);
         
-        const pragmaRows = await db.raw("PRAGMA table_info('events')");
+        const pragmaRows = await db.raw('PRAGMA table_info(\'events\')');
         const existingColumns = pragmaRows.map(row => row.name);
         const selectColumns = existingColumns.map((col) => {
           switch (col) {
-            case 'allow_user_uploads':
-              return "COALESCE(allow_user_uploads, 0) as allow_user_uploads";
-            case 'upload_category_id':
-              return "upload_category_id";
-            case 'allow_downloads':
-              return "COALESCE(allow_downloads, 1) as allow_downloads";
-            case 'disable_right_click':
-              return "COALESCE(disable_right_click, 0) as disable_right_click";
-            case 'watermark_downloads':
-              return "COALESCE(watermark_downloads, 0) as watermark_downloads";
-            case 'watermark_text':
-              return 'watermark_text';
-            case 'hero_photo_id':
-              return 'hero_photo_id';
-            case 'require_password':
-              return 'COALESCE(require_password, 1) as require_password';
-            default:
-              return col;
+          case 'allow_user_uploads':
+            return 'COALESCE(allow_user_uploads, 0) as allow_user_uploads';
+          case 'upload_category_id':
+            return 'upload_category_id';
+          case 'allow_downloads':
+            return 'COALESCE(allow_downloads, 1) as allow_downloads';
+          case 'disable_right_click':
+            return 'COALESCE(disable_right_click, 0) as disable_right_click';
+          case 'watermark_downloads':
+            return 'COALESCE(watermark_downloads, 0) as watermark_downloads';
+          case 'watermark_text':
+            return 'watermark_text';
+          case 'hero_photo_id':
+            return 'hero_photo_id';
+          case 'require_password':
+            return 'COALESCE(require_password, 1) as require_password';
+          default:
+            return col;
           }
         });
 

backend/src/middleware/feedbackRateLimit.js

@@ -176,7 +176,7 @@ function feedbackRateLimit(actionType) {
         
         return res.status(429).json({
           error: 'Too many requests',
-          message: `Rate limit exceeded. Please try again later.`,
+          message: 'Rate limit exceeded. Please try again later.',
           retryAfter: rateLimitStatus.window
         });
       }

backend/src/middleware/ownership.js

@@ -27,7 +27,7 @@ function requireEventOwnership(req, res, next) {
       }
       next();
     })
-    .catch((err) => {
+    .catch((_err) => {
       res.status(500).json({ error: 'Failed to verify ownership' });
     });
 }

backend/src/middleware/photoAuth.js

@@ -120,9 +120,9 @@ async function photoAuth(req, res, next) {
           }
           return next();
         }
-    } catch (err) {
+      } catch (err) {
       // Token invalid, fall through to password check
-      logger.warn('JWT verification failed in photoAuth', { error: err.message });
+        logger.warn('JWT verification failed in photoAuth', { error: err.message });
       }
     }
     

backend/src/middleware/secureImageMiddleware.js

@@ -1,7 +1,6 @@
 const { db } = require('../database/db');
 const secureImageService = require('../services/secureImageService');
 const logger = require('../utils/logger');
-const { formatBoolean } = require('../utils/dbCompat');
 
 /**
  * Enhanced secure image middleware with comprehensive protection
@@ -69,7 +68,7 @@ class SecureImageMiddleware {
   /**
    * Perform comprehensive security checks
    */
-  async performSecurityChecks(req, res) {
+  async performSecurityChecks(req, _res) {
     const { clientInfo } = req;
     const { photoId } = req.params;
 
@@ -132,7 +131,6 @@ class SecureImageMiddleware {
    */
   async checkRateLimit(req) {
     const { clientInfo } = req;
-    const now = Date.now();
 
     // Get rate limit settings from database
     const settings = await this.getRateLimitSettings();

backend/src/middleware/secureStatic.js

@@ -24,7 +24,8 @@ function secureStatic(basePath, options = {}) {
     
     try {
       // Validate the full path is within the base directory
-      const fullPath = safePathJoin(normalizedBase, requestedPath);
+      // Validates the path stays inside the base dir; throws on traversal.
+      safePathJoin(normalizedBase, requestedPath);
       
       // If validation passes, use express.static
       const staticMiddleware = express.static(normalizedBase, {

backend/src/middleware/sessionTimeout.js

@@ -135,7 +135,7 @@ async function sessionTimeoutMiddleware(req, res, next) {
     // Clean up old token if user has a new one
     // This prevents memory leaks from token renewals
     const userId = decoded.id;
-    for (const [oldToken, _] of sessions.entries()) {
+    for (const oldToken of sessions.keys()) {
       if (oldToken !== token) {
         try {
           const oldDecoded = jwt.verify(oldToken, process.env.JWT_SECRET, { algorithms: ['HS256'] });
@@ -198,7 +198,7 @@ function getActiveSessions() {
   const now = Date.now();
   let active = 0;
   
-  for (const [_, lastActivity] of sessions.entries()) {
+  for (const lastActivity of sessions.values()) {
     if (now - lastActivity <= DEFAULT_SESSION_TIMEOUT) {
       active++;
     }

backend/src/middleware/uploadValidation.js

@@ -46,8 +46,8 @@ async function validateUploadedFile(filePath) {
           failOn: 'none',
           limitInputPixels: 268402689
         })
-        .resize(10, 10) // Try to resize to very small size
-        .toBuffer();
+          .resize(10, 10) // Try to resize to very small size
+          .toBuffer();
       } catch (decodeError) {
         throw new Error(`Image decode failed - file may be corrupted: ${decodeError.message}`);
       }

backend/src/routes/__tests__/adminAuth.test.js

@@ -36,11 +36,13 @@ jest.mock('../../middleware/auth', () => ({
 
 const { db, logActivity } = require('../../database/db');
 const adminAuthRouter = require('../adminAuth');
+const { errorHandler } = require('../../middleware/errorHandler');
 
 describe('adminAuth profile updates', () => {
   const app = express();
   app.use(express.json());
   app.use('/auth/admin', adminAuthRouter);
+  app.use(errorHandler);
 
   beforeEach(() => {
     jest.clearAllMocks();
@@ -55,8 +57,8 @@ describe('adminAuth profile updates', () => {
     };
 
     db.__setImplementations(
-      buildChain({ firstResult: null }),          // email check
       buildChain({ firstResult: null }),          // username check
+      buildChain({ firstResult: null }),          // email check
       buildChain({ updateResult: 1 }),            // update
       buildChain({ firstResult: updatedUser }),   // fetch updated user
     );
@@ -66,18 +68,22 @@ describe('adminAuth profile updates', () => {
       .send({ username: updatedUser.username, email: updatedUser.email })
       .expect(200);
 
-    expect(response.body).toEqual({ user: updatedUser });
+    expect(response.body).toEqual({
+      message: 'Admin profile updated successfully',
+      user: updatedUser
+    });
     expect(logActivity).toHaveBeenCalledWith(
       'admin_profile_updated',
-      { admin_id: 1, updated_fields: ['username', 'email'] },
+      { username: updatedUser.username, email: updatedUser.email },
       null,
-      { type: 'admin', id: 1, name: updatedUser.username }
+      { type: 'admin', id: 1, name: 'admin' }
     );
   });
 
   it('rejects email conflicts', async () => {
     db.__setImplementations(
-      buildChain({ firstResult: { id: 2 } })
+      buildChain({ firstResult: null }),          // username check
+      buildChain({ firstResult: { id: 2 } }),     // email check
     );
 
     const response = await request(app)
@@ -85,7 +91,11 @@ describe('adminAuth profile updates', () => {
       .send({ username: 'newadmin', email: 'taken@example.com' })
       .expect(409);
 
-    expect(response.body).toEqual({ error: 'Email is already in use by another admin' });
+    expect(response.body).toEqual({
+      error: 'Email address is already in use',
+      code: 'CONFLICT',
+      field: 'email'
+    });
   });
 
   it('validates input', async () => {
@@ -94,6 +104,6 @@ describe('adminAuth profile updates', () => {
       .send({ username: '', email: 'not-an-email' })
       .expect(400);
 
-    expect(response.body.errors).toBeDefined();
+    expect(response.body.details).toBeDefined();
   });
 });

backend/src/routes/adminArchives.js

@@ -6,7 +6,6 @@ const { formatBoolean } = require('../utils/dbCompat');
 const { slugify } = require('../utils/slug');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
-const archiver = require('archiver');
 const StreamZip = require('node-stream-zip');
 const { requireEventOwnership } = require('../middleware/ownership');
 const { assertZipEntriesWithin } = require('../utils/safePath');
@@ -19,26 +18,63 @@ const router = express.Router();
 router.get('/', adminAuth, requirePermission('archives.view'), async (req, res) => {
   try {
     const { page, limit, offset } = getPagination(req);
+    const search = typeof req.query.search === 'string' ? req.query.search.trim() : '';
+    const type = typeof req.query.type === 'string' ? req.query.type.trim() : '';
+    const sortBy = ['date', 'name', 'size'].includes(req.query.sortBy) ? req.query.sortBy : 'date';
 
-    // Get total count
-    const totalCount = await db('events')
-      .where('is_archived', formatBoolean(true))
-      .count('id as count')
+    // Search and type filtering run in SQL so both the returned rows and
+    // the total count cover the whole archive table, not just the page the
+    // client happens to be on. Values are bound, never interpolated.
+    // % and _ are wildcards to LIKE but literal characters to the client-side
+    // `includes()` this replaced, so searching for "100%" would otherwise match
+    // every archive and report a nonsense total. The ESCAPE clause is
+    // load-bearing rather than decorative: SQLite has no default LIKE escape
+    // character, so without it the escaped pattern matches literal backslashes
+    // there while working on Postgres.
+    const escapeLike = (value) => value.replace(/[\\%_]/g, '\\$&');
+    const applyFilters = (query) => {
+      if (search) {
+        query.whereRaw(
+          'LOWER(events.event_name) LIKE ? ESCAPE \'\\\'',
+          [`%${escapeLike(search.toLowerCase())}%`]
+        );
+      }
+      if (type && type !== 'all') {
+        query.where('events.event_type', type);
+      }
+      return query;
+    };
+
+    // Get total count (of the filtered set, so pagination stays truthful)
+    const totalCount = await applyFilters(
+      db('events').where('events.is_archived', formatBoolean(true))
+    )
+      .count('events.id as count')
       .first();
 
     // Get archived events
-    const archives = await db('events')
-      .select(
-        'events.*',
-        db.raw('COUNT(DISTINCT photos.id) as photo_count'),
-        db.raw('SUM(photos.size_bytes) as total_size')
-      )
-      .leftJoin('photos', 'events.id', 'photos.event_id')
-      .where('events.is_archived', formatBoolean(true))
-      .groupBy('events.id')
-      .orderBy('events.archived_at', 'desc')
-      .limit(limit)
-      .offset(offset);
+    const archivesQuery = applyFilters(
+      db('events')
+        .select(
+          'events.*',
+          db.raw('COUNT(DISTINCT photos.id) as photo_count'),
+          db.raw('SUM(photos.size_bytes) as total_size')
+        )
+        .leftJoin('photos', 'events.id', 'photos.event_id')
+        .where('events.is_archived', formatBoolean(true))
+    ).groupBy('events.id');
+
+    if (sortBy === 'name') {
+      archivesQuery.orderBy('events.event_name', 'asc');
+    } else if (sortBy === 'size') {
+      // The zip's on-disk size is only known after the per-row fs.stat below,
+      // so a global size sort has to use the archived content size instead.
+      archivesQuery.orderByRaw('COALESCE(SUM(photos.size_bytes), 0) desc');
+    } else {
+      archivesQuery.orderBy('events.archived_at', 'desc');
+    }
+
+    const archives = await archivesQuery.limit(limit).offset(offset);
 
     // Check if archive files exist and get their sizes
     const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');

backend/src/routes/adminBackup.js

@@ -346,7 +346,7 @@ router.post('/test-connection', adminAuth, requirePermission('backup.create'), a
     const { destination_type, ...config } = req.body;
     
     switch (destination_type) {
-    case 'local':
+    case 'local': {
       // Test local path access
       const fs = require('fs').promises;
       try {
@@ -360,8 +360,9 @@ router.post('/test-connection', adminAuth, requirePermission('backup.create'), a
         res.json({ success: false, message: 'Cannot write to local path. Check server logs for details.' });
       }
       break;
-        
-    case 'rsync':
+    }
+
+    case 'rsync': {
       // Test rsync connection using spawn with argument arrays to prevent command injection
       const { spawn } = require('child_process');
 
@@ -425,7 +426,7 @@ router.post('/test-connection', adminAuth, requirePermission('backup.create'), a
       sshArgs.push('echo', 'Connection successful');
 
       try {
-        const result = await new Promise((resolve, reject) => {
+        await new Promise((resolve, reject) => {
           const sshProcess = spawn('ssh', sshArgs, {
             timeout: 15000,
             stdio: ['ignore', 'pipe', 'pipe']
@@ -459,7 +460,8 @@ router.post('/test-connection', adminAuth, requirePermission('backup.create'), a
         res.json({ success: false, message: 'Rsync connection failed. Check server logs for details.' });
       }
       break;
-        
+    }
+
     case 's3':
       // Test S3 connection (would need AWS SDK)
       res.json({ success: false, message: 'S3 testing not implemented yet' });
@@ -829,7 +831,7 @@ router.get('/download/:backupId', adminAuth, requirePermission('backup.view'), a
     
     // Handle different backup types
     switch (config.backup_destination_type) {
-    case 'local':
+    case 'local': {
       // Stream local backup as zip
       const backupPath = path.join(config.backup_destination_path, `backup-${backupRun.id}`);
       const archive = archiver('zip', { zlib: { level: 9 } });
@@ -847,8 +849,9 @@ router.get('/download/:backupId', adminAuth, requirePermission('backup.view'), a
         
       await archive.finalize();
       break;
-        
-    case 's3':
+    }
+
+    case 's3': {
       // For S3, provide pre-signed URLs or stream files
       const s3Adapter = new S3StorageAdapter({
         endpoint: config.backup_s3_endpoint,
@@ -882,7 +885,8 @@ router.get('/download/:backupId', adminAuth, requirePermission('backup.view'), a
         message: 'Use the provided URLs to download individual files'
       });
       break;
-        
+    }
+
     case 'rsync':
       return res.status(400).json({ error: 'Direct download not available for rsync backups' });
         
@@ -909,7 +913,7 @@ router.get('/checksums', adminAuth, requirePermission('backup.view'), async (req
     }
     
     // Calculate checksums for files
-    async function calculateDirChecksums(dirPath, relative = '') {
+    const calculateDirChecksums = async (dirPath, relative = '') => {
       try {
         const entries = await fs.readdir(dirPath, { withFileTypes: true });
         
@@ -940,7 +944,7 @@ router.get('/checksums', adminAuth, requirePermission('backup.view'), async (req
       } catch (error) {
         logger.error(`Failed to calculate checksums for ${dirPath}:`, error);
       }
-    }
+    };
     
     await calculateDirChecksums(basePath);
     
@@ -978,7 +982,7 @@ router.post('/estimate', adminAuth, requirePermission('backup.view'), async (req
     const breakdown = {};
     
     // Estimate size for each directory
-    async function estimateDir(dirPath, category) {
+    const estimateDir = async (dirPath, category) => {
       let dirSize = 0;
       let dirCount = 0;
       
@@ -1005,7 +1009,7 @@ router.post('/estimate', adminAuth, requirePermission('backup.view'), async (req
       }
       
       return { size: dirSize, count: dirCount };
-    }
+    };
     
     // Estimate each category
     const categories = [

backend/src/routes/adminCategories.js

@@ -40,7 +40,11 @@ router.get('/event/:eventId', adminAuth, requirePermission('settings.view'), req
 
 // Create a new category
 router.post('/', adminAuth, requirePermission('settings.edit'), [
-  body('name').notEmpty().withMessage('Category name is required'),
+  // photo_categories.name is varchar(100) — without the length check Postgres
+  // raises "value too long" and the catch below turns it into a raw 500 with
+  // no usable message for the form.
+  body('name').notEmpty().withMessage('Category name is required')
+    .isLength({ max: 100 }).withMessage('Category name must be at most 100 characters'),
   body('slug').optional(),
   body('is_global').optional().isBoolean(),
   body('event_id').optional().isInt(),
@@ -127,7 +131,8 @@ router.post('/', adminAuth, requirePermission('settings.edit'), [
 
 // Update a category
 router.put('/:id', adminAuth, requirePermission('settings.edit'), [
-  body('name').notEmpty().withMessage('Category name is required'),
+  body('name').notEmpty().withMessage('Category name is required')
+    .isLength({ max: 100 }).withMessage('Category name must be at most 100 characters'),
   body('hero_photo_id').optional({ nullable: true }).custom((value) => {
     if (value === null || value === undefined) return true;
     return Number.isInteger(Number(value));

backend/src/routes/adminContracts.js

@@ -155,22 +155,22 @@ function transformContract(c, inclusions) {
     updatedAt: c.updated_at,
     inclusions: Array.isArray(inclusions)
       ? inclusions.map((inc) => ({
-          id: inc.id,
-          blockId: inc.block_id,
-          section: inc.section,
-          position: inc.position,
-          included: inc.included === true || inc.included === 1 || inc.included === '1',
-          block: {
-            slug: inc.block_slug,
-            name: inc.block_name,
-            description: inc.block_description,
-            bodyText: inc.block_body_text,
-            bodyTextDe: inc.block_body_text_de,
-            isSystem: inc.block_is_system === true || inc.block_is_system === 1 || inc.block_is_system === '1',
-          },
-          bodyTextSnapshot: inc.body_text_snapshot,
-          bodyTextDeSnapshot: inc.body_text_de_snapshot,
-        }))
+        id: inc.id,
+        blockId: inc.block_id,
+        section: inc.section,
+        position: inc.position,
+        included: inc.included === true || inc.included === 1 || inc.included === '1',
+        block: {
+          slug: inc.block_slug,
+          name: inc.block_name,
+          description: inc.block_description,
+          bodyText: inc.block_body_text,
+          bodyTextDe: inc.block_body_text_de,
+          isSystem: inc.block_is_system === true || inc.block_is_system === 1 || inc.block_is_system === '1',
+        },
+        bodyTextSnapshot: inc.body_text_snapshot,
+        bodyTextDeSnapshot: inc.body_text_de_snapshot,
+      }))
       : undefined,
   };
 }

backend/src/routes/adminDashboard.js

@@ -2,7 +2,7 @@ const express = require('express');
 const { db } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
-const { sanitizeDays, addDateRangeCondition } = require('../utils/sqlSecurity');
+const { sanitizeDays } = require('../utils/sqlSecurity');
 const { formatBoolean } = require('../utils/dbCompat');
 const { resolveAdapter } = require('../services/trackers');
 const logger = require('../utils/logger');

backend/src/routes/adminEvents/crud.js

@@ -318,8 +318,6 @@ module.exports = (router) => {
         css_template_id = null,
         // Hero logo settings
         hero_logo_visible = true,
-        hero_logo_size = 'medium',
-        hero_logo_position = 'top',
         // Header style settings
         header_style = 'standard',
         hero_divider_style = 'wave',

backend/src/routes/adminEvents/helpers.js

@@ -176,8 +176,9 @@ const mapEventForApi = (event) => {
     customer_name,
     customer_email,
     customer_phone,
-    password_hash: _ph,
-    client_password_hash: _cph,
+    // Bound only to exclude the secrets from `...rest` — never read.
+    // eslint-disable-next-line no-unused-vars -- rest-sibling omission
+    password_hash: _ph, client_password_hash: _cph,
     ...rest
   } = event;
 

backend/src/routes/adminExpenses.js

@@ -130,7 +130,7 @@ router.get('/inbound/:id/file', requireIncoming, requirePermission('accounting.v
     res.setHeader('Content-Type', row.mime_type || 'application/octet-stream');
     res.setHeader('Content-Disposition', isPdf ? 'attachment' : 'inline');
     res.setHeader('X-Content-Type-Options', 'nosniff');
-    if (!isPdf) res.setHeader('Content-Security-Policy', "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'");
+    if (!isPdf) res.setHeader('Content-Security-Policy', 'default-src \'none\'; img-src \'self\' data:; style-src \'unsafe-inline\'');
     createReadStream(safe).pipe(res);
   }));
 
@@ -149,7 +149,7 @@ router.get('/inbound/:id/page/:n', requireIncoming, requirePermission('accountin
     res.setHeader('Content-Type', 'image/png');
     res.setHeader('Content-Disposition', 'inline');
     res.setHeader('X-Content-Type-Options', 'nosniff');
-    res.setHeader('Content-Security-Policy', "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'");
+    res.setHeader('Content-Security-Policy', 'default-src \'none\'; img-src \'self\' data:; style-src \'unsafe-inline\'');
     createReadStream(safePng).pipe(res);
   }));
 
@@ -217,7 +217,7 @@ router.get('/:id/proof', requireExpenses, requirePermission('accounting.view'),
     res.setHeader('Content-Type', isPdf ? 'application/pdf' : 'application/octet-stream');
     res.setHeader('Content-Disposition', isPdf ? 'attachment' : 'inline');
     res.setHeader('X-Content-Type-Options', 'nosniff');
-    if (!isPdf) res.setHeader('Content-Security-Policy', "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'");
+    if (!isPdf) res.setHeader('Content-Security-Policy', 'default-src \'none\'; img-src \'self\' data:; style-src \'unsafe-inline\'');
     createReadStream(safe).pipe(res);
   }));
 

backend/src/routes/adminExternalMedia.js

@@ -4,7 +4,7 @@ const fs = require('fs').promises;
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
 const { requireEventOwnership } = require('../middleware/ownership');
-const { list, resolveExternalPath, getExternalMediaRoot } = require('../services/externalMediaService');
+const { list, resolveExternalPath } = require('../services/externalMediaService');
 const { db, logActivity } = require('../database/db');
 const sharp = require('sharp');
 const logger = require('../utils/logger');

backend/src/routes/adminFeedback.js

@@ -107,7 +107,7 @@ router.get('/events/:eventId/feedback',
       
       if (status === 'pending') {
         query = query.where('photo_feedback.is_approved', false)
-                     .where('photo_feedback.is_hidden', false);
+          .where('photo_feedback.is_hidden', false);
       } else if (status === 'approved') {
         query = query.where('photo_feedback.is_approved', true);
       } else if (status === 'hidden') {
@@ -131,7 +131,7 @@ router.get('/events/:eventId/feedback',
       
       if (status === 'pending') {
         countQuery = countQuery.where('photo_feedback.is_approved', false)
-                               .where('photo_feedback.is_hidden', false);
+          .where('photo_feedback.is_hidden', false);
       } else if (status === 'approved') {
         countQuery = countQuery.where('photo_feedback.is_approved', true);
       } else if (status === 'hidden') {

backend/src/routes/adminImageSecurity.js

@@ -104,17 +104,17 @@ router.get('/dashboard', adminAuth, requirePermission(['settings.view', 'image_s
     
     let timeFilter;
     switch (timeframe) {
-      case '1h':
-        timeFilter = new Date(Date.now() - 3600000);
-        break;
-      case '24h':
-        timeFilter = new Date(Date.now() - 86400000);
-        break;
-      case '7d':
-        timeFilter = new Date(Date.now() - 604800000);
-        break;
-      default:
-        timeFilter = new Date(Date.now() - 86400000);
+    case '1h':
+      timeFilter = new Date(Date.now() - 3600000);
+      break;
+    case '24h':
+      timeFilter = new Date(Date.now() - 86400000);
+      break;
+    case '7d':
+      timeFilter = new Date(Date.now() - 604800000);
+      break;
+    default:
+      timeFilter = new Date(Date.now() - 86400000);
     }
 
     // Get image access statistics
@@ -214,17 +214,17 @@ router.get('/logs', adminAuth, requirePermission(['settings.view', 'image_securi
 
     let timeFilter;
     switch (timeframe) {
-      case '1h':
-        timeFilter = new Date(Date.now() - 3600000);
-        break;
-      case '24h':
-        timeFilter = new Date(Date.now() - 86400000);
-        break;
-      case '7d':
-        timeFilter = new Date(Date.now() - 604800000);
-        break;
-      default:
-        timeFilter = new Date(Date.now() - 86400000);
+    case '1h':
+      timeFilter = new Date(Date.now() - 3600000);
+      break;
+    case '24h':
+      timeFilter = new Date(Date.now() - 86400000);
+      break;
+    case '7d':
+      timeFilter = new Date(Date.now() - 604800000);
+      break;
+    default:
+      timeFilter = new Date(Date.now() - 86400000);
     }
 
     let query = db('security_logs')
@@ -374,17 +374,17 @@ router.delete('/logs/cleanup', adminAuth, requirePermission('image_security.mana
     
     let cutoffDate;
     switch (olderThan) {
-      case '7d':
-        cutoffDate = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
-        break;
-      case '30d':
-        cutoffDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
-        break;
-      case '90d':
-        cutoffDate = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
-        break;
-      default:
-        cutoffDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+    case '7d':
+      cutoffDate = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
+      break;
+    case '30d':
+      cutoffDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+      break;
+    case '90d':
+      cutoffDate = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
+      break;
+    default:
+      cutoffDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
     }
 
     // Delete old security logs
@@ -431,17 +431,17 @@ router.get('/export', adminAuth, requirePermission(['settings.view', 'image_secu
     
     let timeFilter;
     switch (timeframe) {
-      case '24h':
-        timeFilter = new Date(Date.now() - 86400000);
-        break;
-      case '7d':
-        timeFilter = new Date(Date.now() - 604800000);
-        break;
-      case '30d':
-        timeFilter = new Date(Date.now() - 2592000000);
-        break;
-      default:
-        timeFilter = new Date(Date.now() - 604800000);
+    case '24h':
+      timeFilter = new Date(Date.now() - 86400000);
+      break;
+    case '7d':
+      timeFilter = new Date(Date.now() - 604800000);
+      break;
+    case '30d':
+      timeFilter = new Date(Date.now() - 2592000000);
+      break;
+    default:
+      timeFilter = new Date(Date.now() - 604800000);
     }
 
     // Get security logs

backend/src/routes/adminLedger.js

@@ -15,7 +15,6 @@ const { body, param, query } = require('express-validator');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
 const { handleAsync, validateRequest, successResponse } = require('../utils/routeHelpers');
-const { db } = require('../database/db');
 const ledgerService = require('../services/ledgerService');
 
 const router = express.Router();

backend/src/routes/adminNotifications.js

@@ -1,5 +1,5 @@
 const express = require('express');
-const { db, logActivity } = require('../database/db');
+const { db } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
 const logger = require('../utils/logger');

backend/src/routes/adminPhotos.js

@@ -17,7 +17,7 @@ const { COLOR_LABELS, dominantColorLabel, SHARED_COLOR_LABEL_IDENTITY } = requir
 const feedbackService = require('../services/feedbackService');
 const photoAdminMarksService = require('../services/photoAdminMarksService');
 const { validateUploadedFiles } = require('../middleware/uploadValidation');
-const { getMaxFilesPerUpload, getAllowedMimeTypes } = require('../services/uploadSettings');
+const { getMaxFilesPerUpload, getAllowedMimeTypes, getMaxFileSizeBytes, DEFAULT_MAX_FILE_SIZE_MB } = require('../services/uploadSettings');
 const { processUploadedPhotos } = require('../services/photoProcessor');
 const chunkedUpload = require('../services/chunkedUploadService');
 const watermarkGeneratorService = require('../services/watermarkGeneratorService');
@@ -37,7 +37,6 @@ const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '.
 const storage = multer.diskStorage({
   destination: (req, file, cb) => {
     logger.info('Multer destination called for file:', file.originalname);
-    const { eventId } = req.params;
     
     // We'll validate the event exists in the route handler
     // For now, just create a temp destination
@@ -67,10 +66,16 @@ const { validateFileType, createFileUploadValidator } = require('../utils/fileSe
 // The allowed types are fetched from the database once per request (before multer
 // processes files) and attached to req.allowedMimeTypes so that the fileFilter
 // callback can read them synchronously.
-const upload = multer({
+//
+// The per-file size cap is resolved per request too (general_max_file_size_mb),
+// so the uploader has to be built per request like the transfer routes do. It
+// was hardcoded to 10GB here, which meant the advertised "max. 50MB per file"
+// in the dropzone was never enforced anywhere server-side. getMaxFileSizeBytes()
+// clamps to MAX_ALLOWED_FILE_SIZE_MB (10GB), so that hard ceiling still applies.
+const createUpload = (maxFileSizeBytes) => multer({
   storage: storage,
   limits: {
-    fileSize: 10 * 1024 * 1024 * 1024, // 10GB limit per file to support large videos
+    fileSize: maxFileSizeBytes,
     files: 2000, // Hard safety ceiling; actual limit enforced dynamically
     fieldSize: 10 * 1024 * 1024, // 10MB for non-file fields
     parts: 10000,
@@ -105,7 +110,9 @@ const validateUploadContent = async (req, res, next) => {
   const allowedTypes = req.allowedMimeTypes || ['image/jpeg', 'image/png', 'image/webp'];
   const validator = createFileUploadValidator({
     allowedTypes,
-    maxFileSize: 10 * 1024 * 1024 * 1024, // 10GB to support large videos
+    // Same per-request cap multer streamed against, so the two layers can't
+    // disagree; this one names the offending file in the 400.
+    maxFileSize: req.maxFileSizeBytes || DEFAULT_MAX_FILE_SIZE_MB * 1024 * 1024,
     validateContent: true
   });
   return validator(req, res, next);
@@ -132,21 +139,25 @@ const uploadTimeout = (timeout = 300000) => { // 5 minutes default
 };
 
 // Upload photos for an event
-// Max file count is configurable via general settings
+// Max file count and max file size are configurable via general settings
 router.post('/:eventId/upload', adminAuth, requirePermission('photos.upload'), requireEventOwnership, uploadTimeout(600000), resolveAllowedTypes, async (req, res, next) => { // 10 minute timeout
   let maxFilesPerUpload;
+  let maxFileSizeBytes;
   try {
     maxFilesPerUpload = await getMaxFilesPerUpload();
+    maxFileSizeBytes = await getMaxFileSizeBytes();
   } catch (error) {
     return errorResponse(res, error, 500, 'Unable to determine upload limits');
   }
+  req.maxFileSizeBytes = maxFileSizeBytes;
+  const maxFileSizeMb = Math.floor(maxFileSizeBytes / (1024 * 1024));
 
-  upload.array('photos', maxFilesPerUpload)(req, res, (err) => {
+  createUpload(maxFileSizeBytes).array('photos', maxFilesPerUpload)(req, res, (err) => {
     if (err) {
       logger.error('Multer error:', err);
       if (err instanceof multer.MulterError) {
         if (err.code === 'LIMIT_FILE_SIZE') {
-          return res.status(400).json({ error: 'File too large. Maximum size is 10GB per file.' });
+          return res.status(400).json({ error: `File too large. Maximum size is ${maxFileSizeMb} MB per file.` });
         }
         if (err.code === 'LIMIT_FILE_COUNT' || err.code === 'LIMIT_UNEXPECTED_FILE') {
           return res.status(400).json({ error: `Too many files. Maximum ${maxFilesPerUpload} files per upload.` });
@@ -231,8 +242,11 @@ router.post('/:eventId/upload', adminAuth, requirePermission('photos.upload'), r
     }
     
     // Parse category_id to number if provided (handle string values like 'individual', 'collage')
+    // Same 0-is-not-a-category rule as the PATCH route below: '0' is truthy, so
+    // it parsed to 0 and the scope-validation guard (`if (parsedCategoryId && ...)`)
+    // then skipped on the falsy 0 and let it into the insert unvalidated.
     const rawParsed = category_id ? parseInt(category_id, 10) : NaN;
-    const parsedCategoryId = !isNaN(rawParsed) ? rawParsed : null;
+    const parsedCategoryId = rawParsed > 0 ? rawParsed : null;
 
     // Determine photo type and category name
     let photoType = 'individual'; // default
@@ -834,9 +848,16 @@ router.patch('/:eventId/photos/:photoId', adminAuth, requirePermission('photos.e
       // Explicitly clear category
       updateData.category_id = null;
     } else {
-      // Handle numeric category IDs from photo_categories table
+      // Handle numeric category IDs from photo_categories table.
+      // 0 and negatives mean "no category", not category zero: photo_categories.id
+      // is an increments() column so it starts at 1, and a <select> whose "none"
+      // option carries value="0" is exactly how '0' reaches this route. Storing 0
+      // left the photo in a black hole — the grid's category filters never match
+      // it, and the "uncategorized" filter is whereNull() so it misses it too,
+      // while the list mapper renders it as uncategorized because 0 is falsy.
+      // NaN (unparseable input) already fell through to null and still does.
       const numericCategoryId = parseInt(category_id, 10);
-      if (!isNaN(numericCategoryId)) {
+      if (numericCategoryId > 0) {
         updateData.category_id = numericCategoryId;
       } else {
         updateData.category_id = null;
@@ -1019,8 +1040,9 @@ router.post('/:eventId/photos/bulk-update', adminAuth, requirePermission('photos
         updateData.category_id = null;
       } else {
         // Handle numeric category IDs from photo_categories table
+        // (0/negative mean "no category" — see the PATCH route above)
         const numericCategoryId = parseInt(updates.category_id, 10);
-        if (!isNaN(numericCategoryId)) {
+        if (numericCategoryId > 0) {
           updateData.category_id = numericCategoryId;
         } else {
           updateData.category_id = null;
@@ -1582,10 +1604,18 @@ router.post('/:eventId/chunked-upload/init', adminAuth, requirePermission('photo
       return res.status(400).json({ error: 'Missing required fields: filename, fileSize, mimeType' });
     }
 
-    // Validate file size (max 10GB)
-    const maxSize = 10 * 1024 * 1024 * 1024;
+    // Validate file size against the configured per-file cap. Hardcoding 10GB
+    // here let the chunked path sidestep general_max_file_size_mb entirely.
+    let maxSize;
+    try {
+      maxSize = await getMaxFileSizeBytes();
+    } catch {
+      maxSize = DEFAULT_MAX_FILE_SIZE_MB * 1024 * 1024;
+    }
     if (fileSize > maxSize) {
-      return res.status(400).json({ error: 'File too large. Maximum size is 10GB.' });
+      return res.status(400).json({
+        error: `File too large. Maximum size is ${Math.floor(maxSize / (1024 * 1024))} MB per file.`
+      });
     }
 
     const result = await chunkedUpload.initializeUpload({
@@ -1593,7 +1623,10 @@ router.post('/:eventId/chunked-upload/init', adminAuth, requirePermission('photo
       fileSize,
       mimeType,
       eventId: parseInt(eventId),
-      totalChunks
+      totalChunks,
+      // The declared fileSize check above is client-controlled; the service
+      // enforces this cap on the bytes it actually receives and merges.
+      maxFileSizeBytes: maxSize
     });
 
     res.json(result);
@@ -1618,6 +1651,9 @@ router.post('/:eventId/chunked-upload/:uploadId/chunk/:chunkIndex', adminAuth, r
 
     res.json(result);
   } catch (error) {
+    if (error.statusCode === 413 || error.statusCode === 400) {
+      return res.status(error.statusCode).json({ error: error.message });
+    }
     logger.error('Error uploading chunk:', error);
     res.status(500).json({ error: error.message || 'Failed to upload chunk' });
   }
@@ -1660,6 +1696,9 @@ router.post('/:eventId/chunked-upload/:uploadId/complete', adminAuth, requirePer
       photos: uploadedPhotos
     });
   } catch (error) {
+    if (error.statusCode === 413) {
+      return res.status(413).json({ error: error.message });
+    }
     logger.error('Error completing chunked upload:', error);
     res.status(500).json({ error: error.message || 'Failed to complete upload' });
   }

backend/src/routes/adminRestore.js

@@ -3,7 +3,7 @@ const router = express.Router();
 const { restoreService } = require('../services/restoreService');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
-const { body, query, validationResult } = require('express-validator');
+const { body, validationResult } = require('express-validator');
 const logger = require('../utils/logger');
 const { getPagination } = require('../utils/routeHelpers');
 const { db } = require('../database/db');

backend/src/routes/adminSystem.js

@@ -1,5 +1,5 @@
 const express = require('express');
-const { db, withRetry } = require('../database/db');
+const { db } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
 const fs = require('fs').promises;

backend/src/routes/customer.js

@@ -16,7 +16,6 @@ const bcrypt = require('bcrypt');
 const jwt = require('jsonwebtoken');
 const { body, param, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
-const { formatBoolean } = require('../utils/dbCompat');
 const { getBcryptRounds } = require('../utils/passwordValidation');
 const logger = require('../utils/logger');
 const { errorResponse } = require('../utils/routeHelpers');

backend/src/routes/customerAuth.js

@@ -17,7 +17,6 @@ const bcrypt = require('bcrypt');
 const jwt = require('jsonwebtoken');
 const { body, param, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
-const { formatBoolean } = require('../utils/dbCompat');
 const { verifyRecaptcha } = require('../services/recaptcha');
 const {
   trackFailedAttempt,

backend/src/routes/galleryFeedback.js

@@ -14,7 +14,6 @@ const {
   checkValidation,
   validateGuestRequirements
 } = require('../utils/feedbackValidation');
-const { escapeLikePattern } = require('../utils/sqlSecurity');
 
 // Get feedback settings for a gallery
 router.get('/:slug/feedback-settings',
@@ -296,6 +295,21 @@ router.post('/:slug/photos/:photoId/feedback',
         // Moderate the comment
         const moderationResult = await feedbackModeration.moderateText(req.body.comment_text);
         
+        if (moderationResult.blocked) {
+          // `block` severity means rejected outright — never stored, not even
+          // as a pending row for a moderator to see. Anything else that isn't
+          // approved falls through to the held-for-moderation branch below.
+          logger.warn('Comment rejected by word filter:', {
+            eventId: event.id,
+            reason: moderationResult.reason,
+            violations: moderationResult.violations
+          });
+          return res.status(400).json({
+            error: 'Your comment contains words that are not allowed here.',
+            code: 'COMMENT_BLOCKED'
+          });
+        }
+
         if (!moderationResult.approved) {
           // Still save but mark as not approved
           feedbackData.is_approved = false;

backend/src/routes/galleryGuests.js

@@ -35,6 +35,7 @@ function sanitizeName(value) {
   // Strip HTML/control chars, collapse whitespace.
   const cleaned = value
     .replace(/[<>&"']/g, '')
+    // eslint-disable-next-line no-control-regex -- intentional: strips control chars from guest input
     .replace(/[\u0000-\u001F\u007F]/g, '')
     .replace(/\s+/g, ' ')
     .trim();

backend/src/routes/protectedImages.js

@@ -70,7 +70,7 @@ function verifyImageToken(token) {
 router.get('/:slug/photo/:photoId/view', verifyGalleryAccess, blockHiddenGallery, async (req, res) => {
   try {
     const { photoId } = req.params;
-    const { protectionLevel = 'standard', token } = req.query;
+    const { protectionLevel = 'standard' } = req.query;
     
     // Create client fingerprint
     const clientFingerprint = secureImageService.createClientFingerprint(req);

backend/src/routes/publicQuotes.js

@@ -74,6 +74,13 @@ function publicQuoteView(quote, lineItems, customer, profile, tosRequired, tosTe
       unitPriceMinor: li.unit_price_minor,
       discountPercent: li.discount_percent == null ? 0 : Number(li.discount_percent),
       lineTotalMinor: li.line_total_minor,
+      // Hierarchy + details (migration 119), same shape adminQuotes.js
+      // projects. Omitting them here meant the customer-facing page could
+      // never thread sub-items or show details text, even though the data
+      // is on the rows getQuoteById already returns.
+      parentLineItemId: li.parent_line_item_id || null,
+      parentPosition: li.parent_position == null ? null : Number(li.parent_position),
+      detailsText: li.details_text || null,
     })),
     recipient: customer ? {
       displayName: customer.display_name || [customer.first_name, customer.last_name].filter(Boolean).join(' '),

backend/src/routes/publicWorkflowApprovals.js

@@ -16,32 +16,32 @@ const router = express.Router();
 const { actByToken, peekApproval } = require('../services/workflows');
 
 function page(title, body) {
-  return `<!doctype html><html><head><meta charset="utf-8">`
-    + `<meta name="viewport" content="width=device-width, initial-scale=1">`
+  return '<!doctype html><html><head><meta charset="utf-8">'
+    + '<meta name="viewport" content="width=device-width, initial-scale=1">'
     + `<title>${title}</title></head>`
-    + `<body style="font-family:system-ui,sans-serif;max-width:480px;margin:64px auto;padding:0 20px;text-align:center;color:#1f2937">`
+    + '<body style="font-family:system-ui,sans-serif;max-width:480px;margin:64px auto;padding:0 20px;text-align:center;color:#1f2937">'
     + `<h2 style="font-weight:600">${title}</h2><p style="color:#4b5563;line-height:1.6">${body}</p></body></html>`;
 }
 
 // Escape any prompt text we echo into the interstitial HTML.
 function esc(s) {
   return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
-    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
+    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', '\'': '&#39;' }[c]
   ));
 }
 
 function decisionPage(token, emphasis, prompt) {
   const btn = (href, label, primary) => `<form method="POST" action="${href}" style="display:inline">`
-    + `<button type="submit" style="cursor:pointer;margin:6px;padding:12px 20px;border-radius:8px;border:1px solid #d1d5db;`
+    + '<button type="submit" style="cursor:pointer;margin:6px;padding:12px 20px;border-radius:8px;border:1px solid #d1d5db;'
     + `font-size:15px;font-weight:600;${primary
       ? 'background:#1d9e75;color:#fff;border-color:#1d9e75'
       : 'background:#fff;color:#374151'}">${label}</button></form>`;
   const body = (prompt ? `<span style="display:block;margin-bottom:16px">${esc(prompt)}</span>` : '')
-    + `<div>`
-    + btn(`confirm`, 'Confirm payment received', emphasis === 'confirm')
-    + btn(`deny`, 'No payment received', emphasis === 'deny')
-    + `</div>`
-    + `<p style="color:#9ca3af;font-size:13px;margin-top:20px">Choosing is a single, final action.</p>`;
+    + '<div>'
+    + btn('confirm', 'Confirm payment received', emphasis === 'confirm')
+    + btn('deny', 'No payment received', emphasis === 'deny')
+    + '</div>'
+    + '<p style="color:#9ca3af;font-size:13px;margin-top:20px">Choosing is a single, final action.</p>';
   return page('Confirm your response', body);
 }
 

backend/src/routes/v1/__tests__/events.category.test.js

@@ -93,6 +93,14 @@ jest.mock('multer', () => {
   return factory;
 });
 
+// The upload middleware resolves the per-file size cap from app_settings on
+// every request (general_max_file_size_mb). That read would consume one of
+// this suite's sequenced db chains and shift every later assertion, so stub it.
+jest.mock('../../../services/uploadSettings', () => ({
+  getMaxFileSizeBytes: jest.fn().mockResolvedValue(50 * 1024 * 1024),
+  DEFAULT_MAX_FILE_SIZE_MB: 50,
+}));
+
 // Stub sharp so the happy-path test doesn't actually decode an image
 // (the temp file is a 0-byte placeholder — see the beforeAll below).
 jest.mock('sharp', () => jest.fn(() => ({

backend/src/routes/v1/events.js

@@ -38,6 +38,7 @@ const { formatBoolean } = require('../../utils/dbCompat');
 const { parseBooleanInput } = require('../../utils/parsers');
 const { isValidEventType } = require('../../services/eventTypeService');
 const { replacePhoto } = require('../../services/photoReplacementService');
+const { getMaxFileSizeBytes, DEFAULT_MAX_FILE_SIZE_MB } = require('../../services/uploadSettings');
 const downloadZipService = require('../../services/downloadZipService');
 const { PhotoFilterBuilder } = require('../../utils/photoFilterBuilder');
 const { PhotoExportService } = require('../../services/photoExportService');
@@ -65,14 +66,34 @@ const photoStorage = multer.diskStorage({
     cb(null, `v1_${Date.now()}_${crypto.randomBytes(4).toString('hex')}${ext}`);
   }
 });
-const photoUpload = multer({
+const buildPhotoUpload = (maxFileSizeBytes) => multer({
   storage: photoStorage,
-  limits: { fileSize: 100 * 1024 * 1024 }, // 100MB per file for v1
+  limits: { fileSize: maxFileSizeBytes },
   fileFilter: (_req, file, cb) => {
     if (/^image\//.test(file.mimetype)) cb(null, true);
     else cb(new Error('Only image uploads are accepted on this endpoint'));
   }
-});
+}).single('photo');
+
+// The per-file cap was hardcoded to 100MB here, so general_max_file_size_mb
+// (Settings → General) didn't apply to the v1 upload either. Resolve it per
+// request — the admin can change it at runtime — and turn multer's generic
+// "File too large" into a 400 that names the configured limit.
+const photoUpload = async (req, res, next) => {
+  let maxFileSizeBytes;
+  try {
+    maxFileSizeBytes = await getMaxFileSizeBytes();
+  } catch {
+    maxFileSizeBytes = DEFAULT_MAX_FILE_SIZE_MB * 1024 * 1024;
+  }
+  buildPhotoUpload(maxFileSizeBytes)(req, res, (err) => {
+    if (err && err.code === 'LIMIT_FILE_SIZE') {
+      const limitMb = Math.floor(maxFileSizeBytes / (1024 * 1024));
+      return res.status(400).json({ error: `File too large. Maximum size is ${limitMb} MB per file.` });
+    }
+    next(err);
+  });
+};
 
 // slugify now imported from ../../utils/slug — shared with adminEvents
 // and events.js so the diacritic fix from #502 lands here too (#525).
@@ -616,7 +637,7 @@ router.post(
   requireApiScope('write'),
   requirePermission('photos.upload'),
   requireEventOwnership,
-  photoUpload.single('photo'),
+  photoUpload,
   async (req, res) => {
     let tempPath = null;
     try {

backend/src/services/__tests__/databaseBackup.test.js

@@ -1,7 +1,6 @@
 const { DatabaseBackupService } = require('../databaseBackup');
 const { db } = require('../../database/db');
 const fs = require('fs').promises;
-const path = require('path');
 const crypto = require('crypto');
 
 // Mock dependencies
@@ -12,11 +11,9 @@ jest.mock('child_process');
 
 describe('DatabaseBackupService', () => {
   let service;
-  let mockExecAsync;
 
   beforeEach(() => {
     service = new DatabaseBackupService();
-    mockExecAsync = jest.fn();
     
     // Reset mocks
     jest.clearAllMocks();

backend/src/services/_installFromBackupBoot.js

@@ -167,6 +167,7 @@ async function tryInstallFromBackup(db, logger) {
   // console.log as well so the docker-logs surface tells the story
   // without needing to exec into the container.
   const announce = (msg) => {
+    // eslint-disable-next-line no-console -- deliberate: mirrors boot progress to docker logs
     try { console.log(`[install-from-backup] ${msg}`); } catch (_) { /* defensive */ }
   };
 

backend/src/services/_workflowSeedBoot.js

@@ -335,6 +335,10 @@ const BUILTINS = [
   },
 ];
 
+// NOTE: written at the end of seedBuiltinWorkflowsAtBoot but never read — the
+// intended "seed only once per process" guard is missing its `if (booted) return;`
+// check. Left in place so the gap stays visible rather than being silently dropped.
+// eslint-disable-next-line no-unused-vars -- write-only boot guard, see note above
 let booted = false;
 
 function parseSeedConfig(raw) {

backend/src/services/backupService.js

@@ -4,7 +4,6 @@ const fsSync = require('fs');
 const crypto = require('crypto');
 const childProcess = require('child_process');
 const os = require('os');
-const { promisify } = require('util');
 
 const cron = require('node-cron');
 const cronParser = require('cron-parser');
@@ -69,7 +68,6 @@ function ensureMockableExec() {
 
 ensureMockableExec();
 
-const getExecAsync = () => promisify(childProcess.exec);
 
 async function resolveConfigWithFallback() {
   let config;
@@ -763,7 +761,7 @@ async function performLocalBackup(config, files) {
 
 function validateRsyncParam(value, label) {
   if (!value || typeof value !== 'string') return null;
-  if (!/^[a-zA-Z0-9._\/@:-]+$/.test(value)) {
+  if (!/^[a-zA-Z0-9._/@:-]+$/.test(value)) {
     throw new Error(`Invalid ${label}: contains disallowed characters`);
   }
   if (value.length > 1024) {
@@ -1532,7 +1530,7 @@ async function loadManifestFromAnywhere(manifestPath, config) {
     throw new Error('S3 credentials not configured for manifest retrieval');
   }
 
-  const match = manifestPath.match(/^s3:\/\/([^\/]+)\/(.+)$/);
+  const match = manifestPath.match(/^s3:\/\/([^/]+)\/(.+)$/);
   if (!match) {
     throw new Error('Invalid S3 manifest path');
   }
@@ -1601,7 +1599,7 @@ async function getBackupManifest(backupRunId) {
     throw new Error('S3 credentials not configured for manifest retrieval');
   }
 
-  const match = run.manifest_path.match(/^s3:\/\/([^\/]+)\/(.+)$/);
+  const match = run.manifest_path.match(/^s3:\/\/([^/]+)\/(.+)$/);
   if (!match) {
     throw new Error('Invalid S3 manifest path');
   }
@@ -1640,7 +1638,7 @@ async function validateBackupManifest(manifestPath) {
     let manifest;
 
     if (manifestPath.startsWith('s3://')) {
-      const match = manifestPath.match(/^s3:\/\/([^\/]+)\/(.+)$/);
+      const match = manifestPath.match(/^s3:\/\/([^/]+)\/(.+)$/);
       if (!match) {
         throw new Error('Invalid S3 manifest path');
       }

backend/src/services/chunkedUploadService.js

@@ -16,6 +16,27 @@ const CHUNK_SIZE = 10 * 1024 * 1024;
 // Upload expiration: 24 hours
 const UPLOAD_EXPIRATION_MS = 24 * 60 * 60 * 1000;
 
+function totalReceivedBytes(uploadMeta) {
+  let total = 0;
+  for (const size of uploadMeta.chunkSizes.values()) total += size;
+  return total;
+}
+
+// Tagged errors so the routes can answer 413/400 instead of a blanket 500.
+function fileTooLargeError(maxFileSizeBytes) {
+  const err = new Error(`File too large. Maximum size is ${Math.floor(maxFileSizeBytes / (1024 * 1024))} MB per file.`);
+  err.code = 'FILE_TOO_LARGE';
+  err.statusCode = 413;
+  return err;
+}
+
+function invalidChunkError(message) {
+  const err = new Error(message);
+  err.code = 'INVALID_CHUNK';
+  err.statusCode = 400;
+  return err;
+}
+
 /**
  * Initialize a new chunked upload
  * @param {Object} options - Upload options
@@ -27,7 +48,8 @@ async function initializeUpload(options) {
     fileSize,
     mimeType,
     eventId,
-    totalChunks
+    totalChunks,
+    maxFileSizeBytes
   } = options;
 
   // Strip any directory components from the client-supplied filename. It is
@@ -50,6 +72,13 @@ async function initializeUpload(options) {
   // Calculate expected chunks
   const expectedChunks = totalChunks || Math.ceil(fileSize / CHUNK_SIZE);
 
+  // The per-file cap is enforced on the BYTES ACTUALLY RECEIVED, not on the
+  // client-declared fileSize the init route checks: a client can declare
+  // `fileSize: 1` and then stream whatever it likes through the chunk route.
+  // Missing/invalid cap means "no cap" (callers outside the admin routes).
+  const cap = Number(maxFileSizeBytes);
+  const sizeCap = Number.isFinite(cap) && cap > 0 ? cap : Infinity;
+
   // Store upload metadata
   const uploadMeta = {
     uploadId,
@@ -59,6 +88,9 @@ async function initializeUpload(options) {
     eventId,
     expectedChunks,
     receivedChunks: new Set(),
+    // Bytes per chunk index, so a re-sent chunk replaces rather than adds.
+    chunkSizes: new Map(),
+    maxFileSizeBytes: sizeCap,
     uploadDir,
     createdAt: Date.now(),
     expiresAt: Date.now() + UPLOAD_EXPIRATION_MS,
@@ -107,12 +139,28 @@ async function uploadChunk(uploadId, chunkIndex, chunkData) {
     throw new Error('Upload expired');
   }
 
+  // Only the announced chunk indices are valid — anything else would merge
+  // into nothing (a gap) or let more chunks in than the declared file has.
+  if (!Number.isInteger(chunkIndex) || chunkIndex < 0 || chunkIndex >= uploadMeta.expectedChunks) {
+    throw invalidChunkError(`Invalid chunk index ${chunkIndex}: expected 0-${uploadMeta.expectedChunks - 1}`);
+  }
+
+  // Enforce the per-file cap on the running byte total. The upload is
+  // aborted, not just rejected: the chunks on disk are already over the
+  // limit and the client can't complete the file any more.
+  const receivedBytes = totalReceivedBytes(uploadMeta) - (uploadMeta.chunkSizes.get(chunkIndex) || 0) + chunkData.length;
+  if (receivedBytes > uploadMeta.maxFileSizeBytes) {
+    await abortUpload(uploadId);
+    throw fileTooLargeError(uploadMeta.maxFileSizeBytes);
+  }
+
   // Write chunk to disk
   const chunkPath = path.join(uploadMeta.uploadDir, `chunk_${String(chunkIndex).padStart(6, '0')}`);
   await fs.writeFile(chunkPath, chunkData);
 
   // Mark chunk as received
   uploadMeta.receivedChunks.add(chunkIndex);
+  uploadMeta.chunkSizes.set(chunkIndex, chunkData.length);
 
   const progress = (uploadMeta.receivedChunks.size / uploadMeta.expectedChunks) * 100;
 
@@ -184,6 +232,15 @@ async function completeUpload(uploadId) {
       });
     }
 
+    // Backstop for the per-chunk running total above: the merged file is
+    // the number that matters, so it is the number that is checked last.
+    if (stats.size > uploadMeta.maxFileSizeBytes) {
+      await fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
+      await fs.rm(uploadMeta.uploadDir, { recursive: true, force: true }).catch(() => {});
+      activeUploads.delete(uploadId);
+      throw fileTooLargeError(uploadMeta.maxFileSizeBytes);
+    }
+
     // Clean up chunks
     await fs.rm(uploadMeta.uploadDir, { recursive: true, force: true });
 

backend/src/services/contractEmailTemplates.js

@@ -30,7 +30,7 @@ const CONTRACT_EMAIL_TEMPLATES = {
 <p>Or open the full contract:<br>
 <span style="word-break: break-all; font-size: 13px;">{{response_url}}</span></p>
 {{#if valid_until}}<p style="font-size: 13px; color: #666;">Please sign by {{valid_until}}.</p>{{/if}}`,
-      body_text: `Contract {{contract_number}}\n\nDear {{customer_name}},\n\nPlease review and sign the contract {{contract_number}}.\n\nOpen: {{response_url}}\n\n{{#if valid_until}}Please sign by {{valid_until}}.{{/if}}`,
+      body_text: 'Contract {{contract_number}}\n\nDear {{customer_name}},\n\nPlease review and sign the contract {{contract_number}}.\n\nOpen: {{response_url}}\n\n{{#if valid_until}}Please sign by {{valid_until}}.{{/if}}',
     },
     de: {
       subject: 'Vertrag {{contract_number}} zur Unterzeichnung bereit',
@@ -44,7 +44,7 @@ const CONTRACT_EMAIL_TEMPLATES = {
 <p>Oder öffnen Sie den vollständigen Vertrag im Browser:<br>
 <span style="word-break: break-all; font-size: 13px;">{{response_url}}</span></p>
 {{#if valid_until}}<p style="font-size: 13px; color: #666;">Bitte unterzeichnen Sie bis {{valid_until}}.</p>{{/if}}`,
-      body_text: `Vertrag {{contract_number}}\n\nSehr geehrte/r {{customer_name}},\n\nbitte prüfen und unterzeichnen Sie den Vertrag {{contract_number}}.\n\nÖffnen: {{response_url}}\n\n{{#if valid_until}}Bitte unterzeichnen bis {{valid_until}}.{{/if}}`,
+      body_text: 'Vertrag {{contract_number}}\n\nSehr geehrte/r {{customer_name}},\n\nbitte prüfen und unterzeichnen Sie den Vertrag {{contract_number}}.\n\nÖffnen: {{response_url}}\n\n{{#if valid_until}}Bitte unterzeichnen bis {{valid_until}}.{{/if}}',
     },
   },
   contract_fully_signed: {
@@ -56,7 +56,7 @@ const CONTRACT_EMAIL_TEMPLATES = {
 <p>Dear {{customer_name}},</p>
 <p>Both parties have now signed contract {{contract_number}}{{#if title}} — "{{title}}"{{/if}}. Please find the fully signed PDF attached for your records.</p>
 <p style="font-size: 13px; color: #666;">This is the authoritative signed copy. Keep it alongside the related quote and invoices.</p>`,
-      body_text: `Contract {{contract_number}} is now fully signed by both parties. The signed PDF is attached for your records.`,
+      body_text: 'Contract {{contract_number}} is now fully signed by both parties. The signed PDF is attached for your records.',
     },
     de: {
       subject: 'Vertrag {{contract_number}} vollständig unterzeichnet',
@@ -64,7 +64,7 @@ const CONTRACT_EMAIL_TEMPLATES = {
 <p>Sehr geehrte/r {{customer_name}},</p>
 <p>der Vertrag {{contract_number}}{{#if title}} – „{{title}}"{{/if}} wurde nun von beiden Parteien unterzeichnet. Im Anhang finden Sie das beidseitig unterzeichnete PDF für Ihre Unterlagen.</p>
 <p style="font-size: 13px; color: #666;">Dies ist die massgebliche unterzeichnete Fassung. Bewahren Sie sie zusammen mit dem zugehörigen Angebot und den Rechnungen auf.</p>`,
-      body_text: `Vertrag {{contract_number}} ist nun beidseitig unterzeichnet. Das unterzeichnete PDF finden Sie im Anhang.`,
+      body_text: 'Vertrag {{contract_number}} ist nun beidseitig unterzeichnet. Das unterzeichnete PDF finden Sie im Anhang.',
     },
   },
   contract_signed_admin_notification: {
@@ -75,14 +75,14 @@ const CONTRACT_EMAIL_TEMPLATES = {
       body_html: `<h2>Contract signed</h2><p>{{signed_customer_name}} ({{customer_email}}) has just signed contract <strong>{{contract_number}}</strong>.</p>
 <p style="text-align: center; margin: 30px 0;"><a href="{{admin_dashboard_url}}" class="button">Open in admin</a></p>
 <p style="font-size: 13px; color: #666;">The signed PDF and signature evidence (typed name, IP, timestamp, signature image if drawn) are available on the contract detail page. To make this fully binding, counter-sign the contract or upload a wet-signed copy.</p>`,
-      body_text: `Contract {{contract_number}} signed by {{signed_customer_name}} ({{customer_email}}). Open: {{admin_dashboard_url}}`,
+      body_text: 'Contract {{contract_number}} signed by {{signed_customer_name}} ({{customer_email}}). Open: {{admin_dashboard_url}}',
     },
     de: {
       subject: 'Vertrag {{contract_number}} von {{customer_email}} unterzeichnet',
       body_html: `<h2>Vertrag unterzeichnet</h2><p>{{signed_customer_name}} ({{customer_email}}) hat soeben den Vertrag <strong>{{contract_number}}</strong> unterzeichnet.</p>
 <p style="text-align: center; margin: 30px 0;"><a href="{{admin_dashboard_url}}" class="button">Im Admin-Bereich öffnen</a></p>
 <p style="font-size: 13px; color: #666;">Das unterzeichnete PDF und die Signatur-Belege (Name, IP, Zeitstempel, Signaturbild falls gezeichnet) sind auf der Vertragsdetailseite einsehbar. Für vollständige Verbindlichkeit unterzeichnen Sie den Vertrag gegen oder laden Sie eine handunterschriebene Kopie hoch.</p>`,
-      body_text: `Vertrag {{contract_number}} von {{signed_customer_name}} ({{customer_email}}) unterzeichnet. Öffnen: {{admin_dashboard_url}}`,
+      body_text: 'Vertrag {{contract_number}} von {{signed_customer_name}} ({{customer_email}}) unterzeichnet. Öffnen: {{admin_dashboard_url}}',
     },
   },
 };

backend/src/services/crmEmailTemplates.js

@@ -22,10 +22,10 @@
  */
 
 const CRM_EMAIL_TEMPLATES = {
-quote_sent: {
+  quote_sent: {
     category: 'quotes', feature_flag: 'quotes',
     variables: ['quote_number', 'customer_name', 'response_url', 'accept_url', 'decline_url',
-                'valid_until', 'event_name', 'total_amount'],
+      'valid_until', 'event_name', 'total_amount'],
     en: {
       subject: 'Your quote {{quote_number}} is ready',
       body_html: `<h2>Quote {{quote_number}}</h2>
@@ -40,7 +40,7 @@ quote_sent: {
 <p>Or open the full quote in your browser:<br>
 <span style="word-break: break-all; font-size: 13px;">{{response_url}}</span></p>
 {{#if valid_until}}<p style="font-size: 13px; color: #666;">This quote is valid until {{valid_until}}.</p>{{/if}}`,
-      body_text: `Quote {{quote_number}}\n\nDear {{customer_name}},\n\nPlease find the attached quote {{quote_number}}. Total: {{total_amount}}.\n\nRespond: {{response_url}}\nAccept: {{accept_url}}\nDecline: {{decline_url}}\n\n{{#if valid_until}}Valid until {{valid_until}}.{{/if}}`,
+      body_text: 'Quote {{quote_number}}\n\nDear {{customer_name}},\n\nPlease find the attached quote {{quote_number}}. Total: {{total_amount}}.\n\nRespond: {{response_url}}\nAccept: {{accept_url}}\nDecline: {{decline_url}}\n\n{{#if valid_until}}Valid until {{valid_until}}.{{/if}}',
     },
     de: {
       subject: 'Ihr Angebot {{quote_number}} ist bereit',
@@ -56,7 +56,7 @@ quote_sent: {
 <p>Oder öffnen Sie das vollständige Angebot im Browser:<br>
 <span style="word-break: break-all; font-size: 13px;">{{response_url}}</span></p>
 {{#if valid_until}}<p style="font-size: 13px; color: #666;">Dieses Angebot ist gültig bis {{valid_until}}.</p>{{/if}}`,
-      body_text: `Angebot {{quote_number}}\n\nSehr geehrte/r {{customer_name}},\n\nim Anhang finden Sie das Angebot {{quote_number}}. Gesamtbetrag: {{total_amount}}.\n\nAnsehen: {{response_url}}\nAnnehmen: {{accept_url}}\nAblehnen: {{decline_url}}\n\n{{#if valid_until}}Gültig bis {{valid_until}}.{{/if}}`,
+      body_text: 'Angebot {{quote_number}}\n\nSehr geehrte/r {{customer_name}},\n\nim Anhang finden Sie das Angebot {{quote_number}}. Gesamtbetrag: {{total_amount}}.\n\nAnsehen: {{response_url}}\nAnnehmen: {{accept_url}}\nAblehnen: {{decline_url}}\n\n{{#if valid_until}}Gültig bis {{valid_until}}.{{/if}}',
     },
   },
   quote_accepted_admin: {
@@ -66,13 +66,13 @@ quote_sent: {
       subject: 'Quote {{quote_number}} accepted by {{customer_email}}',
       body_html: `<h2>Quote accepted</h2><p>{{customer_email}} just accepted quote <strong>{{quote_number}}</strong>{{#if event_name}} for "{{event_name}}"{{/if}}. Total: {{total_amount}}.</p>
 <p style="text-align: center; margin: 30px 0;"><a href="{{admin_dashboard_url}}" class="button">Open in admin</a></p>`,
-      body_text: `Quote {{quote_number}} accepted by {{customer_email}}. Open: {{admin_dashboard_url}}`,
+      body_text: 'Quote {{quote_number}} accepted by {{customer_email}}. Open: {{admin_dashboard_url}}',
     },
     de: {
       subject: 'Angebot {{quote_number}} von {{customer_email}} angenommen',
       body_html: `<h2>Angebot angenommen</h2><p>{{customer_email}} hat soeben das Angebot <strong>{{quote_number}}</strong>{{#if event_name}} für "{{event_name}}"{{/if}} angenommen. Gesamtbetrag: {{total_amount}}.</p>
 <p style="text-align: center; margin: 30px 0;"><a href="{{admin_dashboard_url}}" class="button">Im Admin-Bereich öffnen</a></p>`,
-      body_text: `Angebot {{quote_number}} von {{customer_email}} angenommen. Öffnen: {{admin_dashboard_url}}`,
+      body_text: 'Angebot {{quote_number}} von {{customer_email}} angenommen. Öffnen: {{admin_dashboard_url}}',
     },
   },
   quote_declined_admin: {
@@ -82,26 +82,26 @@ quote_sent: {
       subject: 'Quote {{quote_number}} declined by {{customer_email}}',
       body_html: `<p>{{customer_email}} declined quote <strong>{{quote_number}}</strong>{{#if event_name}} for "{{event_name}}"{{/if}}.</p>
 <p><a href="{{admin_dashboard_url}}">Open quote in admin</a></p>`,
-      body_text: `Quote {{quote_number}} declined by {{customer_email}}. Open: {{admin_dashboard_url}}`,
+      body_text: 'Quote {{quote_number}} declined by {{customer_email}}. Open: {{admin_dashboard_url}}',
     },
     de: {
       subject: 'Angebot {{quote_number}} von {{customer_email}} abgelehnt',
       body_html: `<p>{{customer_email}} hat das Angebot <strong>{{quote_number}}</strong>{{#if event_name}} für "{{event_name}}"{{/if}} abgelehnt.</p>
 <p><a href="{{admin_dashboard_url}}">Angebot im Admin-Bereich öffnen</a></p>`,
-      body_text: `Angebot {{quote_number}} von {{customer_email}} abgelehnt. Öffnen: {{admin_dashboard_url}}`,
+      body_text: 'Angebot {{quote_number}} von {{customer_email}} abgelehnt. Öffnen: {{admin_dashboard_url}}',
     },
   },
   invoice_sent: {
     category: 'billing', feature_flag: 'bills',
     variables: ['invoice_number', 'customer_name', 'event_name', 'total_amount', 'due_date',
-                'installment_label', 'installment_index', 'installment_total'],
+      'installment_label', 'installment_index', 'installment_total'],
     en: {
       subject: 'Invoice {{invoice_number}} — {{total_amount}}',
       body_html: `<h2>Invoice {{invoice_number}}</h2><p>Dear {{customer_name}},</p>
 <p>Please find the attached invoice {{invoice_number}}{{#if event_name}} for "{{event_name}}"{{/if}}.</p>
 <p><strong>Amount:</strong> {{total_amount}}<br><strong>Due:</strong> {{due_date}}{{#if installment_label}}<br><strong>Installment:</strong> {{installment_label}} ({{installment_index}}/{{installment_total}}){{/if}}</p>
 <p>The payment details and IBAN are on the attached PDF.</p>`,
-      body_text: `Invoice {{invoice_number}}: {{total_amount}}, due {{due_date}}.`,
+      body_text: 'Invoice {{invoice_number}}: {{total_amount}}, due {{due_date}}.',
     },
     de: {
       subject: 'Rechnung {{invoice_number}} — {{total_amount}}',
@@ -109,7 +109,7 @@ quote_sent: {
 <p>im Anhang finden Sie die Rechnung {{invoice_number}}{{#if event_name}} für "{{event_name}}"{{/if}}.</p>
 <p><strong>Betrag:</strong> {{total_amount}}<br><strong>Fällig:</strong> {{due_date}}{{#if installment_label}}<br><strong>Teilzahlung:</strong> {{installment_label}} ({{installment_index}}/{{installment_total}}){{/if}}</p>
 <p>Die Zahlungsdetails und IBAN finden Sie auf dem beigefügten PDF.</p>`,
-      body_text: `Rechnung {{invoice_number}}: {{total_amount}}, fällig {{due_date}}.`,
+      body_text: 'Rechnung {{invoice_number}}: {{total_amount}}, fällig {{due_date}}.',
     },
   },
   invoice_reminder_first: {
@@ -120,33 +120,33 @@ quote_sent: {
       body_html: `<h2>Payment reminder</h2><p>Dear {{customer_name}},</p>
 <p>Our records show that invoice <strong>{{invoice_number}}</strong> (originally due {{due_date}}) is now {{days_overdue}} days overdue. The outstanding amount is <strong>{{total_amount}}</strong>.</p>
 <p>If you have already paid, please ignore this reminder. Otherwise, please find a fresh copy attached.</p>`,
-      body_text: `Invoice {{invoice_number}} is {{days_overdue}} days overdue. Outstanding: {{total_amount}}.`,
+      body_text: 'Invoice {{invoice_number}} is {{days_overdue}} days overdue. Outstanding: {{total_amount}}.',
     },
     de: {
       subject: 'Zahlungserinnerung: Rechnung {{invoice_number}}',
       body_html: `<h2>Zahlungserinnerung</h2><p>Sehr geehrte/r {{customer_name}},</p>
 <p>laut unseren Unterlagen ist die Rechnung <strong>{{invoice_number}}</strong> (ursprünglich fällig am {{due_date}}) seit {{days_overdue}} Tagen überfällig. Der offene Betrag beträgt <strong>{{total_amount}}</strong>.</p>
 <p>Sollten Sie die Zahlung bereits veranlasst haben, betrachten Sie diese Erinnerung als gegenstandslos. Im Anhang finden Sie eine aktuelle Kopie der Rechnung.</p>`,
-      body_text: `Rechnung {{invoice_number}} ist seit {{days_overdue}} Tagen überfällig. Offen: {{total_amount}}.`,
+      body_text: 'Rechnung {{invoice_number}} ist seit {{days_overdue}} Tagen überfällig. Offen: {{total_amount}}.',
     },
   },
   invoice_reminder_second: {
     category: 'billing', feature_flag: 'bills',
     variables: ['invoice_number', 'customer_name', 'total_amount', 'due_date', 'days_overdue',
-                'late_fee_amount', 'new_total_amount'],
+      'late_fee_amount', 'new_total_amount'],
     en: {
       subject: 'Second reminder: invoice {{invoice_number}}',
       body_html: `<h2>Second payment reminder</h2><p>Dear {{customer_name}},</p>
 <p>Invoice <strong>{{invoice_number}}</strong> is now {{days_overdue}} days overdue. As advised in our payment terms, a late fee of <strong>{{late_fee_amount}}</strong> has been added. The new total is <strong>{{new_total_amount}}</strong>.</p>
 <p>Please settle the outstanding amount as soon as possible. A revised invoice is attached.</p>`,
-      body_text: `Second reminder for {{invoice_number}}. Late fee {{late_fee_amount}} added. New total: {{new_total_amount}}.`,
+      body_text: 'Second reminder for {{invoice_number}}. Late fee {{late_fee_amount}} added. New total: {{new_total_amount}}.',
     },
     de: {
       subject: 'Zweite Mahnung: Rechnung {{invoice_number}}',
       body_html: `<h2>Zweite Zahlungserinnerung</h2><p>Sehr geehrte/r {{customer_name}},</p>
 <p>die Rechnung <strong>{{invoice_number}}</strong> ist nun seit {{days_overdue}} Tagen überfällig. Gemäss unseren Zahlungsbedingungen wurde eine Mahngebühr von <strong>{{late_fee_amount}}</strong> hinzugefügt. Der neue Gesamtbetrag beträgt <strong>{{new_total_amount}}</strong>.</p>
 <p>Wir bitten Sie, den offenen Betrag umgehend zu begleichen. Eine aktualisierte Rechnung finden Sie im Anhang.</p>`,
-      body_text: `Zweite Mahnung für {{invoice_number}}. Mahngebühr {{late_fee_amount}} hinzugefügt. Neuer Gesamtbetrag: {{new_total_amount}}.`,
+      body_text: 'Zweite Mahnung für {{invoice_number}}. Mahngebühr {{late_fee_amount}} hinzugefügt. Neuer Gesamtbetrag: {{new_total_amount}}.',
     },
   },
   invoice_paid_receipt: {
@@ -156,13 +156,13 @@ quote_sent: {
       subject: 'Receipt for invoice {{invoice_number}}',
       body_html: `<h2>Payment received</h2><p>Dear {{customer_name}},</p>
 <p>We received your payment of <strong>{{paid_amount}}</strong> for invoice {{invoice_number}} on {{paid_at}}. Thank you!</p>`,
-      body_text: `Receipt: {{paid_amount}} received for {{invoice_number}} on {{paid_at}}.`,
+      body_text: 'Receipt: {{paid_amount}} received for {{invoice_number}} on {{paid_at}}.',
     },
     de: {
       subject: 'Zahlungsbestätigung für Rechnung {{invoice_number}}',
       body_html: `<h2>Zahlung erhalten</h2><p>Sehr geehrte/r {{customer_name}},</p>
 <p>vielen Dank für Ihre Zahlung in Höhe von <strong>{{paid_amount}}</strong> für die Rechnung {{invoice_number}} am {{paid_at}}.</p>`,
-      body_text: `Zahlungsbestätigung: {{paid_amount}} erhalten für {{invoice_number}} am {{paid_at}}.`,
+      body_text: 'Zahlungsbestätigung: {{paid_amount}} erhalten für {{invoice_number}} am {{paid_at}}.',
     },
   },
   invoice_cancelled: {
@@ -170,56 +170,56 @@ quote_sent: {
     variables: ['invoice_number', 'customer_name'],
     en: {
       subject: 'Invoice {{invoice_number}} cancelled',
-      body_html: `<p>Dear {{customer_name}},</p><p>Invoice {{invoice_number}} has been cancelled. Please disregard any previous reminders for this invoice.</p>`,
-      body_text: `Invoice {{invoice_number}} has been cancelled.`,
+      body_html: '<p>Dear {{customer_name}},</p><p>Invoice {{invoice_number}} has been cancelled. Please disregard any previous reminders for this invoice.</p>',
+      body_text: 'Invoice {{invoice_number}} has been cancelled.',
     },
     de: {
       subject: 'Rechnung {{invoice_number}} storniert',
-      body_html: `<p>Sehr geehrte/r {{customer_name}},</p><p>die Rechnung {{invoice_number}} wurde storniert. Bitte ignorieren Sie eventuelle frühere Erinnerungen zu dieser Rechnung.</p>`,
-      body_text: `Rechnung {{invoice_number}} wurde storniert.`,
+      body_html: '<p>Sehr geehrte/r {{customer_name}},</p><p>die Rechnung {{invoice_number}} wurde storniert. Bitte ignorieren Sie eventuelle frühere Erinnerungen zu dieser Rechnung.</p>',
+      body_text: 'Rechnung {{invoice_number}} wurde storniert.',
     },
   },
   quote_accepted_customer: {
-  category: 'quotes',
-  feature_flag: 'quotes',
-  variables: ['customer_name', 'quote_number', 'event_name', 'total_amount', 'accepted_on_behalf'],
-  en: {
-    subject: 'Quote {{quote_number}} accepted — thank you',
-    body_html: `<h2>Thank you</h2>
+    category: 'quotes',
+    feature_flag: 'quotes',
+    variables: ['customer_name', 'quote_number', 'event_name', 'total_amount', 'accepted_on_behalf'],
+    en: {
+      subject: 'Quote {{quote_number}} accepted — thank you',
+      body_html: `<h2>Thank you</h2>
 <p>Dear {{customer_name}},</p>
 <p>This confirms that quote <strong>{{quote_number}}</strong>{{#if event_name}} for "{{event_name}}"{{/if}} has been accepted. Total: <strong>{{total_amount}}</strong>.</p>
 {{#if accepted_on_behalf}}<p style="font-size: 13px; color: #666;">This acceptance was recorded on your behalf by your photographer.</p>{{/if}}
 <p>We'll be in touch with next steps shortly.</p>`,
-    body_text: `Dear {{customer_name}},
+      body_text: `Dear {{customer_name}},
 
 This confirms that quote {{quote_number}}{{#if event_name}} for "{{event_name}}"{{/if}} has been accepted. Total: {{total_amount}}.
 {{#if accepted_on_behalf}}
 This acceptance was recorded on your behalf by your photographer.
 {{/if}}
 We'll be in touch with next steps shortly.`,
-  },
-  de: {
-    subject: 'Angebot {{quote_number}} angenommen — vielen Dank',
-    body_html: `<h2>Vielen Dank</h2>
+    },
+    de: {
+      subject: 'Angebot {{quote_number}} angenommen — vielen Dank',
+      body_html: `<h2>Vielen Dank</h2>
 <p>Sehr geehrte/r {{customer_name}},</p>
 <p>hiermit bestätigen wir, dass das Angebot <strong>{{quote_number}}</strong>{{#if event_name}} für „{{event_name}}"{{/if}} angenommen wurde. Gesamtbetrag: <strong>{{total_amount}}</strong>.</p>
 {{#if accepted_on_behalf}}<p style="font-size: 13px; color: #666;">Diese Bestätigung wurde stellvertretend durch Ihren Fotografen erfasst.</p>{{/if}}
 <p>Wir melden uns in Kürze mit den nächsten Schritten.</p>`,
-    body_text: `Sehr geehrte/r {{customer_name}},
+      body_text: `Sehr geehrte/r {{customer_name}},
 
 hiermit bestätigen wir, dass das Angebot {{quote_number}}{{#if event_name}} für "{{event_name}}"{{/if}} angenommen wurde. Gesamtbetrag: {{total_amount}}.
 {{#if accepted_on_behalf}}
 Diese Bestätigung wurde stellvertretend durch Ihren Fotografen erfasst.
 {{/if}}
 Wir melden uns in Kürze mit den nächsten Schritten.`,
+    },
   },
-},
   invoice_payment_check: {
     category: 'billing', feature_flag: 'bills',
     variables: ['invoice_number', 'customer_name', 'event_name', 'due_date', 'total_amount', 'paid_url', 'partial_url', 'unpaid_url', 'skonto_url', 'has_skonto', 'skonto_amount', 'late_fee_due', 'late_fee_amount'],
     en: {
-  subject: 'Check payment for invoice {{invoice_number}}',
-  body_html: `<h2>Time to check on a payment</h2>
+      subject: 'Check payment for invoice {{invoice_number}}',
+      body_html: `<h2>Time to check on a payment</h2>
 <p>Invoice <strong>{{invoice_number}}</strong> for <strong>{{customer_name}}</strong>{{#if event_name}} ({{event_name}}){{/if}} was due on <strong>{{due_date}}</strong>. Total: <strong>{{total_amount}}</strong>.</p>
 <p>Please check your bank to confirm what (if anything) has been received, then click the matching button below — no login required.</p>
 <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin: 24px auto; border-collapse: collapse;">
@@ -239,7 +239,7 @@ Wir melden uns in Kürze mit den nächsten Schritten.`,
   </tr>
 </table>
 <p style="font-size: 13px; color: #666;">If you select "Not paid yet" or "Partially paid", the system will queue the next reminder to the customer{{#if late_fee_due}} including a late fee of {{late_fee_amount}}{{/if}}.</p>`,
-  body_text: `Time to check on a payment
+      body_text: `Time to check on a payment
 
 Invoice {{invoice_number}} for {{customer_name}}{{#if event_name}} ({{event_name}}){{/if}} was due on {{due_date}}. Total: {{total_amount}}.
 
@@ -250,10 +250,10 @@ Confirm what was received:
   Not paid yet:           {{unpaid_url}}
 
 Selecting "Not paid yet" or "Partially paid" will queue the customer reminder{{#if late_fee_due}} including a late fee of {{late_fee_amount}}{{/if}}.`,
-},
+    },
     de: {
-  subject: 'Zahlung prüfen für Rechnung {{invoice_number}}',
-  body_html: `<h2>Zahlung prüfen</h2>
+      subject: 'Zahlung prüfen für Rechnung {{invoice_number}}',
+      body_html: `<h2>Zahlung prüfen</h2>
 <p>Rechnung <strong>{{invoice_number}}</strong> für <strong>{{customer_name}}</strong>{{#if event_name}} ({{event_name}}){{/if}} war am <strong>{{due_date}}</strong> fällig. Gesamtbetrag: <strong>{{total_amount}}</strong>.</p>
 <p>Bitte prüfen Sie auf Ihrem Konto, was eingegangen ist, und klicken Sie unten den passenden Button — kein Login nötig.</p>
 <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin: 24px auto; border-collapse: collapse;">
@@ -273,7 +273,7 @@ Selecting "Not paid yet" or "Partially paid" will queue the customer reminder{{#
   </tr>
 </table>
 <p style="font-size: 13px; color: #666;">Bei „Nicht bezahlt" oder „Teilweise bezahlt" wird automatisch die Zahlungserinnerung an den Kunden gesendet{{#if late_fee_due}} inklusive Mahngebühr von {{late_fee_amount}}{{/if}}.</p>`,
-  body_text: `Zahlung prüfen
+      body_text: `Zahlung prüfen
 
 Rechnung {{invoice_number}} für {{customer_name}}{{#if event_name}} ({{event_name}}){{/if}} war am {{due_date}} fällig. Gesamtbetrag: {{total_amount}}.
 
@@ -284,32 +284,32 @@ Bitte bestätigen:
   Nicht bezahlt:                  {{unpaid_url}}
 
 Bei „Nicht bezahlt" oder „Teilweise bezahlt" wird automatisch die Zahlungserinnerung gesendet{{#if late_fee_due}} inklusive Mahngebühr von {{late_fee_amount}}{{/if}}.`,
-},
+    },
   },
   storno_issued: {
     category: 'billing', feature_flag: 'bills',
     variables: ['storno_number', 'original_invoice_number', 'original_issue_date', 'customer_name', 'total_amount'],
     en: {
-  subject: 'Cancellation invoice {{storno_number}} for invoice {{original_invoice_number}}',
-  body_html: `<p>Dear {{customer_name}},</p>
+      subject: 'Cancellation invoice {{storno_number}} for invoice {{original_invoice_number}}',
+      body_html: `<p>Dear {{customer_name}},</p>
 <p>Please find attached cancellation invoice <strong>{{storno_number}}</strong>, which formally reverses invoice <strong>{{original_invoice_number}}</strong> dated {{original_issue_date}} for {{total_amount}}.</p>
 <p>The original invoice is no longer payable. Please retain the attached PDF for your records and disregard any prior reminders.</p>`,
-  body_text: `Cancellation invoice {{storno_number}} formally reverses invoice {{original_invoice_number}} dated {{original_issue_date}} for {{total_amount}}. The original invoice is no longer payable. PDF attached.`,
-},
+      body_text: 'Cancellation invoice {{storno_number}} formally reverses invoice {{original_invoice_number}} dated {{original_issue_date}} for {{total_amount}}. The original invoice is no longer payable. PDF attached.',
+    },
     de: {
-  subject: 'Stornorechnung {{storno_number}} zu Rechnung {{original_invoice_number}}',
-  body_html: `<p>Sehr geehrte/r {{customer_name}},</p>
+      subject: 'Stornorechnung {{storno_number}} zu Rechnung {{original_invoice_number}}',
+      body_html: `<p>Sehr geehrte/r {{customer_name}},</p>
 <p>anbei erhalten Sie die Stornorechnung <strong>{{storno_number}}</strong>, mit der die Rechnung <strong>{{original_invoice_number}}</strong> vom {{original_issue_date}} über {{total_amount}} förmlich aufgehoben wird.</p>
 <p>Die ursprüngliche Rechnung ist damit nicht mehr zu begleichen. Bitte bewahren Sie die beigefügte PDF für Ihre Unterlagen auf — etwaige vorherige Mahnungen sind hinfällig.</p>`,
-  body_text: `Stornorechnung {{storno_number}} hebt Rechnung {{original_invoice_number}} vom {{original_issue_date}} über {{total_amount}} förmlich auf. Die ursprüngliche Rechnung ist nicht mehr zu begleichen. PDF im Anhang.`,
-},
+      body_text: 'Stornorechnung {{storno_number}} hebt Rechnung {{original_invoice_number}} vom {{original_issue_date}} über {{total_amount}} förmlich auf. Die ursprüngliche Rechnung ist nicht mehr zu begleichen. PDF im Anhang.',
+    },
   },
   invoice_paid_admin_notification: {
     category: 'billing', feature_flag: 'bills',
     variables: ['invoice_number', 'customer_name', 'event_name', 'total_amount', 'paid_amount', 'paid_at', 'payment_method', 'payment_reference', 'skonto_applied', 'skonto_percent', 'skonto_discount_amount'],
     en: {
-  subject: 'Payment received: invoice {{invoice_number}}',
-  body_html: `<h2>Payment recorded</h2>
+      subject: 'Payment received: invoice {{invoice_number}}',
+      body_html: `<h2>Payment recorded</h2>
 <p>Invoice <strong>{{invoice_number}}</strong> for <strong>{{customer_name}}</strong>{{#if event_name}} ({{event_name}}){{/if}} has been marked as fully paid.</p>
 <table role="presentation" cellpadding="6" cellspacing="0" border="0" style="border-collapse: collapse; margin: 16px 0;">
   <tr><td style="color: #666;">Total invoice amount</td><td><strong>{{total_amount}}</strong></td></tr>
@@ -320,7 +320,7 @@ Bei „Nicht bezahlt" oder „Teilweise bezahlt" wird automatisch die Zahlungser
   <tr><td style="color: #666;">Recorded at</td><td>{{paid_at}}</td></tr>
 </table>
 <p style="font-size: 13px; color: #666;">This is an automatic notification — no action required.</p>`,
-  body_text: `Payment recorded
+      body_text: `Payment recorded
 
 Invoice {{invoice_number}} for {{customer_name}}{{#if event_name}} ({{event_name}}){{/if}} has been marked as fully paid.
 
@@ -332,10 +332,10 @@ Invoice {{invoice_number}} for {{customer_name}}{{#if event_name}} ({{event_name
   Recorded at:             {{paid_at}}
 
 This is an automatic notification — no action required.`,
-},
+    },
     de: {
-  subject: 'Zahlung erhalten: Rechnung {{invoice_number}}',
-  body_html: `<h2>Zahlung erfasst</h2>
+      subject: 'Zahlung erhalten: Rechnung {{invoice_number}}',
+      body_html: `<h2>Zahlung erfasst</h2>
 <p>Rechnung <strong>{{invoice_number}}</strong> für <strong>{{customer_name}}</strong>{{#if event_name}} ({{event_name}}){{/if}} wurde als vollständig bezahlt markiert.</p>
 <table role="presentation" cellpadding="6" cellspacing="0" border="0" style="border-collapse: collapse; margin: 16px 0;">
   <tr><td style="color: #666;">Rechnungsbetrag</td><td><strong>{{total_amount}}</strong></td></tr>
@@ -346,7 +346,7 @@ This is an automatic notification — no action required.`,
   <tr><td style="color: #666;">Erfasst am</td><td>{{paid_at}}</td></tr>
 </table>
 <p style="font-size: 13px; color: #666;">Automatische Benachrichtigung — keine Aktion erforderlich.</p>`,
-  body_text: `Zahlung erfasst
+      body_text: `Zahlung erfasst
 
 Rechnung {{invoice_number}} für {{customer_name}}{{#if event_name}} ({{event_name}}){{/if}} wurde als vollständig bezahlt markiert.
 
@@ -358,14 +358,14 @@ Rechnung {{invoice_number}} für {{customer_name}}{{#if event_name}} ({{event_na
   Erfasst am:              {{paid_at}}
 
 Automatische Benachrichtigung — keine Aktion erforderlich.`,
-},
+    },
   },
   invoice_collections_handoff: {
     category: 'billing', feature_flag: 'bills',
     variables: ['invoice_number', 'customer_name', 'customer_email', 'customer_address', 'event_name', 'original_amount', 'late_fee_amount', 'paid_amount', 'outstanding_amount', 'due_date', 'reminder_level'],
     en: {
-  subject: 'Collections handoff: invoice {{invoice_number}} still unpaid after dunning',
-  body_html: `<h2>Ready to hand to collections</h2>
+      subject: 'Collections handoff: invoice {{invoice_number}} still unpaid after dunning',
+      body_html: `<h2>Ready to hand to collections</h2>
 <p>Invoice <strong>{{invoice_number}}</strong>{{#if event_name}} ({{event_name}}){{/if}} is still unpaid after {{reminder_level}} reminders. The invoice PDF is attached for forwarding.</p>
 <table role="presentation" cellpadding="6" cellspacing="0" border="0" style="border-collapse: collapse; margin: 16px 0;">
   <tr><td style="color:#666;">Customer</td><td><strong>{{customer_name}}</strong></td></tr>
@@ -378,7 +378,7 @@ Automatische Benachrichtigung — keine Aktion erforderlich.`,
   <tr><td style="color:#666;"><strong>Outstanding</strong></td><td><strong>{{outstanding_amount}}</strong></td></tr>
 </table>
 <p style="font-size:13px;color:#666;">Forward to your collections agency / for Betreibung. Automatic notification.</p>`,
-  body_text: `Ready to hand to collections
+      body_text: `Ready to hand to collections
 
 Invoice {{invoice_number}}{{#if event_name}} ({{event_name}}){{/if}} is still unpaid after {{reminder_level}} reminders. The invoice PDF is attached.
 
@@ -392,10 +392,10 @@ Invoice {{invoice_number}}{{#if event_name}} ({{event_name}}){{/if}} is still un
   Outstanding:     {{outstanding_amount}}
 
 Forward to your collections agency / for Betreibung.`,
-},
+    },
     de: {
-  subject: 'Inkasso-Übergabe: Rechnung {{invoice_number}} trotz Mahnungen offen',
-  body_html: `<h2>Bereit zur Inkasso-Übergabe</h2>
+      subject: 'Inkasso-Übergabe: Rechnung {{invoice_number}} trotz Mahnungen offen',
+      body_html: `<h2>Bereit zur Inkasso-Übergabe</h2>
 <p>Rechnung <strong>{{invoice_number}}</strong>{{#if event_name}} ({{event_name}}){{/if}} ist nach {{reminder_level}} Mahnungen weiterhin offen. Das Rechnungs-PDF ist zur Weiterleitung angehängt.</p>
 <table role="presentation" cellpadding="6" cellspacing="0" border="0" style="border-collapse: collapse; margin: 16px 0;">
   <tr><td style="color:#666;">Kunde</td><td><strong>{{customer_name}}</strong></td></tr>
@@ -408,7 +408,7 @@ Forward to your collections agency / for Betreibung.`,
   <tr><td style="color:#666;"><strong>Offen</strong></td><td><strong>{{outstanding_amount}}</strong></td></tr>
 </table>
 <p style="font-size:13px;color:#666;">Zur Weiterleitung an das Inkasso / für die Betreibung. Automatische Benachrichtigung.</p>`,
-  body_text: `Bereit zur Inkasso-Übergabe
+      body_text: `Bereit zur Inkasso-Übergabe
 
 Rechnung {{invoice_number}}{{#if event_name}} ({{event_name}}){{/if}} ist nach {{reminder_level}} Mahnungen weiterhin offen. Das Rechnungs-PDF ist angehängt.
 
@@ -422,7 +422,7 @@ Rechnung {{invoice_number}}{{#if event_name}} ({{event_name}}){{/if}} ist nach {
   Offen:           {{outstanding_amount}}
 
 Zur Weiterleitung an das Inkasso / für die Betreibung.`,
-},
+    },
   },
 };
 

backend/src/services/customerHoursService.js

@@ -23,10 +23,8 @@
  * — same legal-record discipline as line items today.
  */
 const { db, logActivity } = require('../database/db');
-const { formatBoolean } = require('../utils/dbCompat');
 const { AppError } = require('../utils/errors');
 const { hasColumnCached } = require('../utils/schemaCache');
-const logger = require('../utils/logger');
 const invoiceService = require('./invoiceService');
 
 // ---------------------------------------------------------------------
@@ -287,7 +285,7 @@ async function createEntry(customerId, payload, adminId) {
     logInfo = { type: 'hour_entry_logged', meta: { entryId, customerId: customer.id } };
     return { id: entryId, status: 'unbilled' };
   });
-  if (logInfo) { try { await logActivity(logInfo.type, logInfo.meta, null, `admin:${adminId}`); } catch (_) {} }
+  if (logInfo) { try { await logActivity(logInfo.type, logInfo.meta, null, `admin:${adminId}`); } catch (_) { /* non-fatal */ } }
   return result;
 }
 
@@ -385,7 +383,7 @@ async function updateEntry(entryId, payload, adminId) {
     logInfo = { type: 'hour_entry_updated', meta: { entryId, customerId: entry.customer_account_id } };
     return { id: entryId };
   });
-  if (logInfo) { try { await logActivity(logInfo.type, logInfo.meta, null, `admin:${adminId}`); } catch (_) {} }
+  if (logInfo) { try { await logActivity(logInfo.type, logInfo.meta, null, `admin:${adminId}`); } catch (_) { /* non-fatal */ } }
   return result;
 }
 
@@ -436,7 +434,7 @@ async function deleteEntry(entryId, adminId) {
     logInfo = { type: 'hour_entry_deleted', meta: { entryId, customerId: entry.customer_account_id, hadInvoice: !!entry.invoice_id } };
     return { deleted: true };
   });
-  if (logInfo) { try { await logActivity(logInfo.type, logInfo.meta, null, `admin:${adminId}`); } catch (_) {} }
+  if (logInfo) { try { await logActivity(logInfo.type, logInfo.meta, null, `admin:${adminId}`); } catch (_) { /* non-fatal */ } }
   return result;
 }
 
@@ -521,7 +519,7 @@ async function billUnbilledEntries(customerId, adminId) {
     logInfo = { type: 'hour_entries_billed', meta: { customerId: customer.id, invoiceId, entryCount: unbilled.length } };
     return { invoiceId, entriesBilled: unbilled.length };
   });
-  if (logInfo) { try { await logActivity(logInfo.type, logInfo.meta, null, `admin:${adminId}`); } catch (_) {} }
+  if (logInfo) { try { await logActivity(logInfo.type, logInfo.meta, null, `admin:${adminId}`); } catch (_) { /* non-fatal */ } }
   return result;
 }
 

backend/src/services/databaseBackup.js

@@ -13,8 +13,6 @@ const { formatBoolean } = require('../utils/dbCompat');
 const packageJson = require('../../package.json');
 
 // Constants
-const CHUNK_SIZE = 1024 * 1024; // 1MB chunks for streaming
-const PROGRESS_INTERVAL = 100; // Report progress every 100 rows
 
 // Face recognition tables (#1074). Their SCHEMA is backed up, their CONTENTS
 // are not: embeddings are biometric data (GDPR Art. 9) and fully derived from
@@ -183,7 +181,7 @@ class DatabaseBackupService {
   /**
    * Create SQLite backup
    */
-  async createSQLiteBackup(outputPath, options = {}) {
+  async createSQLiteBackup(outputPath, _options = {}) {
     const dbPath = knexConfig.connection.filename;
     const tempPath = `${outputPath}.tmp`;
     
@@ -214,7 +212,7 @@ class DatabaseBackupService {
       // works out that a manual re-scan is needed. Requeue instead.
       await spawnAsync('sqlite3', [
         tempPath,
-        "UPDATE photos SET face_status = CASE WHEN face_status IS NULL THEN NULL ELSE 'pending' END, "
+        'UPDATE photos SET face_status = CASE WHEN face_status IS NULL THEN NULL ELSE \'pending\' END, '
         + 'face_count = NULL, face_started_at = NULL, face_error = NULL;',
       ]).catch(() => {});
       // FATAL, not a warning. Deleting rows leaves their pages in the file
@@ -337,7 +335,7 @@ class DatabaseBackupService {
   /**
    * Validate backup integrity
    */
-  async validateBackup(backupPath, originalChecksums) {
+  async validateBackup(backupPath, _originalChecksums) {
     const tempDbPath = `${backupPath}.validate`;
     
     try {
@@ -747,7 +745,7 @@ class DatabaseBackupService {
   /**
    * Restore from backup (with version checking)
    */
-  async restore(backupPath, options = {}) {
+  async restore(backupPath, _options = {}) {
     // This is a dangerous operation and should be used with extreme caution
     throw new Error('Restore functionality not implemented for safety. Please use restore service or restore manually.');
   }

backend/src/services/emailProcessor.js

@@ -183,7 +183,7 @@ async function getRecipientLanguage(email, eventId = null) {
       .first();
     if (langSetting && langSetting.setting_value) {
       let lang = langSetting.setting_value;
-      try { lang = JSON.parse(lang); } catch (_) {}
+      try { lang = JSON.parse(lang); } catch (_) { /* non-fatal */ }
       if (typeof lang === 'string' && lang.trim()) return lang.trim();
     }
   } catch (error) {
@@ -789,13 +789,13 @@ async function sendTemplateEmail(to, templateKey, variables) {
         : undefined;
     const attachments = Array.isArray(variables.attachments)
       ? variables.attachments
-          .filter((a) => a && (a.contentPath || a.path || a.content))
-          .map((a) => ({
-            filename: a.filename,
-            path: a.contentPath || a.path,
-            content: a.content,
-            contentType: a.contentType,
-          }))
+        .filter((a) => a && (a.contentPath || a.path || a.content))
+        .map((a) => ({
+          filename: a.filename,
+          path: a.contentPath || a.path,
+          content: a.content,
+          contentType: a.contentType,
+        }))
       : undefined;
 
     // Send email
@@ -872,7 +872,7 @@ async function sendRawEmail({ to, cc, subject, html, text, attachments, accountK
   const ccList = Array.isArray(cc) ? cc.filter(Boolean) : (cc ? [cc] : undefined);
   const atts = Array.isArray(attachments)
     ? attachments.filter((a) => a && (a.contentPath || a.path || a.content))
-        .map((a) => ({ filename: a.filename, path: a.contentPath || a.path, content: a.content, contentType: a.contentType }))
+      .map((a) => ({ filename: a.filename, path: a.contentPath || a.path, content: a.content, contentType: a.contentType }))
     : undefined;
   const mail = {
     from: `${fromName || 'picpeak'} <${fromEmail}>`,

backend/src/services/eventReminderService.js

@@ -63,8 +63,6 @@ const { ensureEventReminderTemplatesSeeded } = require('./eventReminderTemplates
 
 const DEFAULT_DAYS_BEFORE = 2;
 const DEFAULT_TEMPLATE_GROUP = 'event_reminder';
-const TEMPLATE_KEY_DEFAULT = 'event_reminder_default';
-const TEMPLATE_KEY_PREFIX = 'event_reminder_';
 
 // One-shot guard: the "schema not migrated" warn would otherwise fire
 // once per cron tick (≈ hourly) on installs that haven't applied

backend/src/services/eventReminderTemplates.js

@@ -37,8 +37,8 @@ const VARIABLES = [
 
 // Tiny HTML signature line shared across templates so the maintainer
 // only has to brand once. Variables substitute at render time.
-const SIGNATURE_EN = `<p style="margin-top: 24px;">See you soon,<br>{{business_name}}</p>`;
-const SIGNATURE_DE = `<p style="margin-top: 24px;">Bis bald,<br>{{business_name}}</p>`;
+const SIGNATURE_EN = '<p style="margin-top: 24px;">See you soon,<br>{{business_name}}</p>';
+const SIGNATURE_DE = '<p style="margin-top: 24px;">Bis bald,<br>{{business_name}}</p>';
 
 const EVENT_REMINDER_TEMPLATES = {
   event_reminder_default: {
@@ -54,7 +54,7 @@ const EVENT_REMINDER_TEMPLATES = {
 </ul>
 <p>If anything has changed since we last spoke, just hit reply.</p>
 ${SIGNATURE_EN}`,
-      body_text: `Hi {{customer_name}},\n\nJust a quick reminder that {{event_name}} is coming up on {{event_date}} — about {{days_before}} day(s) from now.\n\nA few things that help us hit the ground running on the day:\n- Confirm the exact start time and address.\n- Let us know if there is anything we should keep an eye on (VIPs, surprise moments, restricted areas).\n- Indoor venues: a small corner for equipment setup is a huge help.\n\nIf anything has changed since we last spoke, just hit reply.\n\nSee you soon,\n{{business_name}}`,
+      body_text: 'Hi {{customer_name}},\n\nJust a quick reminder that {{event_name}} is coming up on {{event_date}} — about {{days_before}} day(s) from now.\n\nA few things that help us hit the ground running on the day:\n- Confirm the exact start time and address.\n- Let us know if there is anything we should keep an eye on (VIPs, surprise moments, restricted areas).\n- Indoor venues: a small corner for equipment setup is a huge help.\n\nIf anything has changed since we last spoke, just hit reply.\n\nSee you soon,\n{{business_name}}',
     },
     de: {
       subject: 'Erinnerung: {{event_name}} in {{days_before}} Tag(en)',
@@ -68,7 +68,7 @@ ${SIGNATURE_EN}`,
 </ul>
 <p>Hat sich seit unserem letzten Austausch etwas geändert? Einfach kurz auf diese Mail antworten.</p>
 ${SIGNATURE_DE}`,
-      body_text: `Hallo {{customer_name}},\n\nkurze Erinnerung: {{event_name}} findet am {{event_date}} statt — in etwa {{days_before}} Tag(en).\n\nDamit wir am Tag selbst sofort loslegen können, helfen uns folgende Punkte sehr:\n- Genaue Startzeit und Adresse bestätigen.\n- Kurz Bescheid geben, falls etwas besonders zu beachten ist (VIPs, Überraschungsmomente, abgesperrte Bereiche).\n- Bei Innen-Locations: eine kleine Ecke für den Equipment-Aufbau ist Gold wert.\n\nHat sich seit unserem letzten Austausch etwas geändert? Einfach kurz auf diese Mail antworten.\n\nBis bald,\n{{business_name}}`,
+      body_text: 'Hallo {{customer_name}},\n\nkurze Erinnerung: {{event_name}} findet am {{event_date}} statt — in etwa {{days_before}} Tag(en).\n\nDamit wir am Tag selbst sofort loslegen können, helfen uns folgende Punkte sehr:\n- Genaue Startzeit und Adresse bestätigen.\n- Kurz Bescheid geben, falls etwas besonders zu beachten ist (VIPs, Überraschungsmomente, abgesperrte Bereiche).\n- Bei Innen-Locations: eine kleine Ecke für den Equipment-Aufbau ist Gold wert.\n\nHat sich seit unserem letzten Austausch etwas geändert? Einfach kurz auf diese Mail antworten.\n\nBis bald,\n{{business_name}}',
     },
   },
 
@@ -87,7 +87,7 @@ ${SIGNATURE_DE}`,
 </ul>
 <p>If anything has shifted since we last spoke — even small things — just hit reply.</p>
 ${SIGNATURE_EN}`,
-      body_text: `Dear {{customer_name}},\n\nYour wedding day is almost here — {{event_date}}, in about {{days_before}} day(s). We are very much looking forward to it.\n\nA short pre-day checklist so the photo coverage flows smoothly:\n- Timeline: a rough hour-by-hour run-of-day helps us anticipate every moment.\n- Family shots: a short list of must-have group photos (with names) keeps the formals quick.\n- Getting-ready space: a room with natural light makes a real difference.\n- Surprises: let us know so we are in the right place — and won't spoil them.\n- Logistics: ceremony start time, venue address, parking notes, coordinator contact.\n\nIf anything has shifted since we last spoke, just hit reply.\n\nSee you soon,\n{{business_name}}`,
+      body_text: 'Dear {{customer_name}},\n\nYour wedding day is almost here — {{event_date}}, in about {{days_before}} day(s). We are very much looking forward to it.\n\nA short pre-day checklist so the photo coverage flows smoothly:\n- Timeline: a rough hour-by-hour run-of-day helps us anticipate every moment.\n- Family shots: a short list of must-have group photos (with names) keeps the formals quick.\n- Getting-ready space: a room with natural light makes a real difference.\n- Surprises: let us know so we are in the right place — and won\'t spoil them.\n- Logistics: ceremony start time, venue address, parking notes, coordinator contact.\n\nIf anything has shifted since we last spoke, just hit reply.\n\nSee you soon,\n{{business_name}}',
     },
     de: {
       subject: 'Eure Hochzeit am {{event_date}} — letzte Details',
@@ -103,7 +103,7 @@ ${SIGNATURE_EN}`,
 </ul>
 <p>Hat sich seit unserem letzten Gespräch etwas verschoben — auch Kleinigkeiten? Einfach kurz antworten.</p>
 ${SIGNATURE_DE}`,
-      body_text: `Liebe/r {{customer_name}},\n\neuer grosser Tag steht fast vor der Tür — {{event_date}}, in etwa {{days_before}} Tag(en). Wir freuen uns sehr darauf.\n\nEine kurze Checkliste vor dem Tag:\n- Ablauf: ein grober Stunden-Ablauf hilft uns enorm.\n- Familienbilder: kurze Liste der Wunsch-Gruppenbilder (mit Namen).\n- Getting-Ready-Raum: ein Zimmer mit Tageslicht macht einen riesigen Unterschied.\n- Überraschungen: kurz Bescheid geben, damit wir zur richtigen Zeit am richtigen Ort sind.\n- Logistik: Beginn der Trauung, Adresse, Parkhinweise, Telefonnummer der Tages-Koordination.\n\nHat sich etwas verschoben? Einfach kurz antworten.\n\nBis bald,\n{{business_name}}`,
+      body_text: 'Liebe/r {{customer_name}},\n\neuer grosser Tag steht fast vor der Tür — {{event_date}}, in etwa {{days_before}} Tag(en). Wir freuen uns sehr darauf.\n\nEine kurze Checkliste vor dem Tag:\n- Ablauf: ein grober Stunden-Ablauf hilft uns enorm.\n- Familienbilder: kurze Liste der Wunsch-Gruppenbilder (mit Namen).\n- Getting-Ready-Raum: ein Zimmer mit Tageslicht macht einen riesigen Unterschied.\n- Überraschungen: kurz Bescheid geben, damit wir zur richtigen Zeit am richtigen Ort sind.\n- Logistik: Beginn der Trauung, Adresse, Parkhinweise, Telefonnummer der Tages-Koordination.\n\nHat sich etwas verschoben? Einfach kurz antworten.\n\nBis bald,\n{{business_name}}',
     },
   },
 
@@ -120,7 +120,7 @@ ${SIGNATURE_DE}`,
 </ul>
 <p>Looking forward to celebrating — let us know if anything has changed.</p>
 ${SIGNATURE_EN}`,
-      body_text: `Hi {{customer_name}},\n\n{{event_name}} is coming up on {{event_date}} — about {{days_before}} day(s) away. Quick check-in:\n- Headcount: roughly how many guests?\n- Schedule: when is the cake/song moment?\n- Theme or dress code, if any.\n- Surprises we should keep quiet about?\n\nLooking forward to celebrating — let us know if anything has changed.\n\nSee you soon,\n{{business_name}}`,
+      body_text: 'Hi {{customer_name}},\n\n{{event_name}} is coming up on {{event_date}} — about {{days_before}} day(s) away. Quick check-in:\n- Headcount: roughly how many guests?\n- Schedule: when is the cake/song moment?\n- Theme or dress code, if any.\n- Surprises we should keep quiet about?\n\nLooking forward to celebrating — let us know if anything has changed.\n\nSee you soon,\n{{business_name}}',
     },
     de: {
       subject: '{{event_name}} am {{event_date}} — kurze Rückfrage',
@@ -134,7 +134,7 @@ ${SIGNATURE_EN}`,
 </ul>
 <p>Wir freuen uns auf das Fest — kurz Bescheid geben, falls sich etwas geändert hat.</p>
 ${SIGNATURE_DE}`,
-      body_text: `Hallo {{customer_name}},\n\n{{event_name}} steht am {{event_date}} an — in etwa {{days_before}} Tag(en). Kurze Rückfrage:\n- Personenzahl: wie viele Gäste werden in etwa kommen?\n- Ablauf: wann ist der Torten-/Ständchen-Moment?\n- Motto oder Dresscode, falls vorhanden.\n- Überraschungen, über die wir nicht reden sollten?\n\nKurz Bescheid geben, falls sich etwas geändert hat.\n\nBis bald,\n{{business_name}}`,
+      body_text: 'Hallo {{customer_name}},\n\n{{event_name}} steht am {{event_date}} an — in etwa {{days_before}} Tag(en). Kurze Rückfrage:\n- Personenzahl: wie viele Gäste werden in etwa kommen?\n- Ablauf: wann ist der Torten-/Ständchen-Moment?\n- Motto oder Dresscode, falls vorhanden.\n- Überraschungen, über die wir nicht reden sollten?\n\nKurz Bescheid geben, falls sich etwas geändert hat.\n\nBis bald,\n{{business_name}}',
     },
   },
 
@@ -153,7 +153,7 @@ ${SIGNATURE_DE}`,
 </ul>
 <p>Happy to jump on a 10-min call beforehand if it is easier than email.</p>
 ${SIGNATURE_EN}`,
-      body_text: `Dear {{customer_name}},\n\n{{event_name}} is on {{event_date}} — about {{days_before}} day(s) away. To make sure the coverage matches your goals, a few items to confirm:\n- Shot brief: internal comms, press kit, social, website?\n- Agenda / run-of-show: speakers, awards, panels, Q&A.\n- VIPs & brand: names to prioritise, plus logo/colour direction.\n- Access: entrance, loading dock, on-site contact. Photo ID needed?\n- Confidentiality: any no-photo sessions?\n- Delivery: rough turnaround (24h press selects, full gallery later)?\n\nHappy to jump on a 10-min call beforehand if it is easier than email.\n\nSee you soon,\n{{business_name}}`,
+      body_text: 'Dear {{customer_name}},\n\n{{event_name}} is on {{event_date}} — about {{days_before}} day(s) away. To make sure the coverage matches your goals, a few items to confirm:\n- Shot brief: internal comms, press kit, social, website?\n- Agenda / run-of-show: speakers, awards, panels, Q&A.\n- VIPs & brand: names to prioritise, plus logo/colour direction.\n- Access: entrance, loading dock, on-site contact. Photo ID needed?\n- Confidentiality: any no-photo sessions?\n- Delivery: rough turnaround (24h press selects, full gallery later)?\n\nHappy to jump on a 10-min call beforehand if it is easier than email.\n\nSee you soon,\n{{business_name}}',
     },
     de: {
       subject: 'Vorbereitung Bildbegleitung: {{event_name}} am {{event_date}}',
@@ -169,7 +169,7 @@ ${SIGNATURE_EN}`,
 </ul>
 <p>Falls eine kurze 10-Min-Abstimmung einfacher ist als E-Mail, gerne jederzeit melden.</p>
 ${SIGNATURE_DE}`,
-      body_text: `Sehr geehrte/r {{customer_name}},\n\n{{event_name}} findet am {{event_date}} statt — in etwa {{days_before}} Tag(en). Damit die Bildstrecke euren Zielen entspricht, kurz folgende Punkte abstimmen:\n- Briefing: interne Kommunikation, Pressekit, Social, Website?\n- Agenda / Ablauf: Speaker, Awards, Panels, Q&A.\n- VIPs & Brand: zu priorisierende Personen, Logo-/Farbvorgaben.\n- Zugang: Eingang, Anlieferung, Ansprechperson am Morgen. Lichtbildausweis nötig?\n- Vertraulichkeit: rein interne Sessions / kein Foto?\n- Lieferung: Turnaround-Zeit (24h Press-Selects, vollständige Galerie später)?\n\nFalls eine 10-Min-Abstimmung einfacher ist, gerne melden.\n\nBis bald,\n{{business_name}}`,
+      body_text: 'Sehr geehrte/r {{customer_name}},\n\n{{event_name}} findet am {{event_date}} statt — in etwa {{days_before}} Tag(en). Damit die Bildstrecke euren Zielen entspricht, kurz folgende Punkte abstimmen:\n- Briefing: interne Kommunikation, Pressekit, Social, Website?\n- Agenda / Ablauf: Speaker, Awards, Panels, Q&A.\n- VIPs & Brand: zu priorisierende Personen, Logo-/Farbvorgaben.\n- Zugang: Eingang, Anlieferung, Ansprechperson am Morgen. Lichtbildausweis nötig?\n- Vertraulichkeit: rein interne Sessions / kein Foto?\n- Lieferung: Turnaround-Zeit (24h Press-Selects, vollständige Galerie später)?\n\nFalls eine 10-Min-Abstimmung einfacher ist, gerne melden.\n\nBis bald,\n{{business_name}}',
     },
   },
 
@@ -186,7 +186,7 @@ ${SIGNATURE_DE}`,
 </ul>
 <p>If anything has changed since we last spoke, hit reply.</p>
 ${SIGNATURE_EN}`,
-      body_text: `Hi {{customer_name}},\n\n{{event_name}} is on {{event_date}} — about {{days_before}} day(s) away. A short prep note:\n- Start time & address: please confirm both.\n- Run-of-day: a rough timeline of the key moments.\n- Setup space: a small corner for gear if indoors.\n- Anything specific: people to prioritise, things to avoid, dress code, surprises.\n\nIf anything has changed, just hit reply.\n\nSee you soon,\n{{business_name}}`,
+      body_text: 'Hi {{customer_name}},\n\n{{event_name}} is on {{event_date}} — about {{days_before}} day(s) away. A short prep note:\n- Start time & address: please confirm both.\n- Run-of-day: a rough timeline of the key moments.\n- Setup space: a small corner for gear if indoors.\n- Anything specific: people to prioritise, things to avoid, dress code, surprises.\n\nIf anything has changed, just hit reply.\n\nSee you soon,\n{{business_name}}',
     },
     de: {
       subject: '{{event_name}} am {{event_date}} — Vorbereitungs-Hinweise',
@@ -200,7 +200,7 @@ ${SIGNATURE_EN}`,
 </ul>
 <p>Hat sich seit dem letzten Austausch etwas geändert? Einfach kurz antworten.</p>
 ${SIGNATURE_DE}`,
-      body_text: `Hallo {{customer_name}},\n\n{{event_name}} findet am {{event_date}} statt — in etwa {{days_before}} Tag(en). Kurz zur Vorbereitung:\n- Startzeit & Adresse: bitte beides kurz bestätigen.\n- Ablauf: ein grober Zeitplan der Schlüsselmomente.\n- Aufbauplatz: bei Innen-Locations eine kleine Ecke fürs Equipment.\n- Besonderheiten: Personen im Fokus, Dinge zu vermeiden, Dresscode, Überraschungen.\n\nKurz antworten, falls sich etwas geändert hat.\n\nBis bald,\n{{business_name}}`,
+      body_text: 'Hallo {{customer_name}},\n\n{{event_name}} findet am {{event_date}} statt — in etwa {{days_before}} Tag(en). Kurz zur Vorbereitung:\n- Startzeit & Adresse: bitte beides kurz bestätigen.\n- Ablauf: ein grober Zeitplan der Schlüsselmomente.\n- Aufbauplatz: bei Innen-Locations eine kleine Ecke fürs Equipment.\n- Besonderheiten: Personen im Fokus, Dinge zu vermeiden, Dresscode, Überraschungen.\n\nKurz antworten, falls sich etwas geändert hat.\n\nBis bald,\n{{business_name}}',
     },
   },
 };

backend/src/services/eventRenameService.js

@@ -3,7 +3,7 @@
  * Handles renaming events including slug updates, file system changes, and database updates
  */
 
-const { db, logActivity } = require('../database/db');
+const { db } = require('../database/db');
 const fs = require('fs').promises;
 const path = require('path');
 const logger = require('../utils/logger');
@@ -228,7 +228,7 @@ class EventRenameService {
     const event = await trx('events').where({ id: eventId }).first();
 
     // Generate new share link
-    const { sharePath, shareUrl, shareLinkToStore } = await buildShareLinkVariants({
+    const { shareUrl, shareLinkToStore } = await buildShareLinkVariants({
       slug: newSlug,
       shareToken: event.share_token
     });

backend/src/services/expenseCategoriesService.js

@@ -20,7 +20,7 @@ async function getById(id) {
   return row;
 }
 
-async function create({ name, color, displayOrder }, adminId) {
+async function create({ name, color, displayOrder }, _adminId) {
   if (!name || !String(name).trim()) {
     throw new AppError('Category name is required', 400, 'NAME_REQUIRED');
   }

backend/src/services/externalMediaService.js

@@ -61,27 +61,23 @@ async function list(relativePath = '') {
   const targetDir = safePathJoin(root, relativePath || '.');
 
   const entries = [];
-  try {
-    const dirents = await fs.readdir(targetDir, { withFileTypes: true });
-    for (const d of dirents) {
-      // Skip hidden files and directories
-      if (d.name.startsWith('.')) continue;
-      const full = path.join(targetDir, d.name);
-      const stat = await fs.stat(full).catch(() => null);
-      if (!stat) continue;
+  // Errors propagate to the caller to handle (e.g. invalid path).
+  const dirents = await fs.readdir(targetDir, { withFileTypes: true });
+  for (const d of dirents) {
+    // Skip hidden files and directories
+    if (d.name.startsWith('.')) continue;
+    const full = path.join(targetDir, d.name);
+    const stat = await fs.stat(full).catch(() => null);
+    if (!stat) continue;
 
-      if (d.isDirectory()) {
-        entries.push({ name: d.name, type: 'dir' });
-      } else if (d.isFile()) {
-        const ext = path.extname(d.name).toLowerCase();
-        if (['.jpg', '.jpeg', '.png', '.webp'].includes(ext)) {
-          entries.push({ name: d.name, type: 'file', size: stat.size, mtime: stat.mtime });
-        }
+    if (d.isDirectory()) {
+      entries.push({ name: d.name, type: 'dir' });
+    } else if (d.isFile()) {
+      const ext = path.extname(d.name).toLowerCase();
+      if (['.jpg', '.jpeg', '.png', '.webp'].includes(ext)) {
+        entries.push({ name: d.name, type: 'file', size: stat.size, mtime: stat.mtime });
       }
     }
-  } catch (e) {
-    // Propagate errors for caller to handle (e.g., invalid path)
-    throw e;
   }
 
   const rootResolved = path.resolve(root);

backend/src/services/feedbackModeration.js

@@ -66,17 +66,27 @@ class FeedbackModerationService {
         }
       }
       
-      // Check for severe violations
-      if (violations.some(v => v.severity === 'severe')) {
+      // Check for blocking violations. 'severe' is the legacy vocabulary the
+      // validator used to accept before it was aligned with the UI's
+      // low/moderate/high/block levels — rows stored under it still apply.
+      const isBlocking = (v) => v.severity === 'block' || v.severity === 'severe';
+      if (violations.some(isBlocking)) {
+        // `blocked` is the flag the submit route branches on: the `block`
+        // tier is advertised as "comment is rejected immediately", so it 4xxs
+        // the submission instead of storing it for a moderator. Every other
+        // not-approved outcome (moderate/high, spam checks, and the
+        // moderation-system-error fallback below) deliberately omits it and
+        // keeps the held-for-moderation behaviour.
         return {
           approved: false,
+          blocked: true,
           reason: 'Content contains prohibited words',
-          violations: violations.filter(v => v.severity === 'severe')
+          violations: violations.filter(isBlocking)
         };
       }
-      
-      // Check for moderate violations
-      if (violations.some(v => v.severity === 'moderate')) {
+
+      // Check for moderate/high violations
+      if (violations.some(v => v.severity === 'moderate' || v.severity === 'high')) {
         return {
           approved: false,
           reason: 'Content requires moderation',
@@ -84,7 +94,7 @@ class FeedbackModerationService {
         };
       }
       
-      // Check for mild violations (may just flag for review)
+      // Check for low-severity violations (may just flag for review)
       if (violations.length > 0) {
         return {
           approved: true,

backend/src/services/feedbackService.js

@@ -645,7 +645,14 @@ class FeedbackService {
         guest_id: guest_id || null,
         ip_address,
         user_agent,
-        is_approved: feedback_type !== 'comment' || !feedbackData.moderate_comments,
+        // The submit route can force a comment into moderation (a
+        // `moderate`/`high` word-filter hit) on an event whose
+        // moderate_comments is off — this line used to ignore that entirely,
+        // so those hits published straight away. A caller-supplied `false` is
+        // honoured; nothing a caller passes can RELAX the event's setting.
+        is_approved: feedbackData.is_approved === false
+          ? false
+          : (feedback_type !== 'comment' || !feedbackData.moderate_comments),
         created_at: new Date(),
         updated_at: new Date()
       }).returning('id');
@@ -1172,32 +1179,32 @@ class FeedbackService {
         if (!entry.guest_email && row.guest_email) entry.guest_email = row.guest_email;
 
         switch (row.feedback_type) {
-          case 'favorite':
-            entry.is_favorited = true;
-            break;
-          case 'like':
-            entry.is_liked = true;
-            break;
-          case 'rating':
-            if (row.rating != null) entry.star_rating = row.rating;
-            break;
-          case 'comment':
-            if (row.comment_text) {
-              // Most recent comment wins. Older comments from the same guest
-              // on the same photo are dropped — the export is "current state",
-              // not the comment history.
-              entry.comment = row.comment_text;
-            }
-            break;
-          case 'reaction':
-            if (row.reaction) entry.reaction = row.reaction;
-            break;
-          case 'color_label':
-            if (row.color_label) entry.color_label = row.color_label;
-            break;
-          default:
-            // Unknown feedback type — ignore so a future type doesn't break the export.
-            break;
+        case 'favorite':
+          entry.is_favorited = true;
+          break;
+        case 'like':
+          entry.is_liked = true;
+          break;
+        case 'rating':
+          if (row.rating != null) entry.star_rating = row.rating;
+          break;
+        case 'comment':
+          if (row.comment_text) {
+            // Most recent comment wins. Older comments from the same guest
+            // on the same photo are dropped — the export is "current state",
+            // not the comment history.
+            entry.comment = row.comment_text;
+          }
+          break;
+        case 'reaction':
+          if (row.reaction) entry.reaction = row.reaction;
+          break;
+        case 'color_label':
+          if (row.color_label) entry.color_label = row.color_label;
+          break;
+        default:
+          // Unknown feedback type — ignore so a future type doesn't break the export.
+          break;
         }
         // Track the latest action timestamp across all feedback types.
         if (row.created_at && entry.latest_at && row.created_at > entry.latest_at) {

backend/src/services/fileWatcher.js

@@ -40,7 +40,7 @@ function startFileWatcher() {
   }
 
   const watcher = chokidar.watch(WATCH_PATH(), {
-    ignored: /(^|[\/\\])\../, // ignore dotfiles
+    ignored: /(^|[/\\])\../, // ignore dotfiles
     persistent: true,
     awaitWriteFinish: {
       stabilityThreshold: 2000,

backend/src/services/fontsService.js

@@ -166,7 +166,7 @@ async function scanRoot(rootAbs) {
     if (result.has(lc)) {
       logger.warn(
         `[fonts] Duplicate family ${family.family} within ${rootAbs}; ` +
-        `keeping the first encountered folder`
+        'keeping the first encountered folder'
       );
       continue;
     }

backend/src/services/invoice/create.js

@@ -306,7 +306,7 @@ async function createInvoice(payload, adminId, trx = db) {
     await insertLineItemsHierarchical(trx, 'invoice_line_items', 'invoice_id', invoiceId, items);
   }
 
-  try { await logActivity('invoice_created', { invoiceId, invoiceNumber }, payload.eventId || null, `admin:${adminId}`, trx); } catch (_) {}
+  try { await logActivity('invoice_created', { invoiceId, invoiceNumber }, payload.eventId || null, `admin:${adminId}`, trx); } catch (_) { /* non-fatal */ }
   return { invoiceIds: [invoiceId] };
 }
 
@@ -568,7 +568,7 @@ async function spawnInstallmentInvoices({ trx, eventId, quoteId, customer, curre
       // pool (this runs unattended from the booking flow's prepare_invoice).
       await logActivity('invoice_scheduled', { invoiceId, invoiceNumber, eventId, quoteId, scheduledSendAt },
         eventId, `admin:${adminId}`, trx);
-    } catch (_) {}
+    } catch (_) { /* non-fatal */ }
     invoiceIds.push(invoiceId);
   }
   return { invoiceIds };

backend/src/services/invoice/drafts.js

@@ -221,7 +221,7 @@ async function appendToMonthlyDraft(payload, customer, adminId, trx) {
     await logActivity('monthly_billing_items_queued',
       { invoiceId: draft.id, customerId: customer.id, itemsAdded: newItems.length },
       null, `admin:${adminId}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   return draft.id;
 }

backend/src/services/invoice/installmentPlan.js

@@ -347,7 +347,7 @@ async function updateInstallmentPlan({ trx, dealUuid, installments, adminId }) {
       await logActivity('invoice_scheduled', {
         invoiceId: newId, invoiceNumber, eventId: sample.event_id, source: 'plan_reshape',
       }, sample.event_id, `admin:${adminId}`);
-    } catch (_) {}
+    } catch (_) { /* non-fatal */ }
 
     created.push(newId);
   }
@@ -365,7 +365,7 @@ async function updateInstallmentPlan({ trx, dealUuid, installments, adminId }) {
       dealUuid, newCount,
       kept: kept.length, created: created.length, deleted: deleted.length,
     }, sample.event_id, `admin:${adminId}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   return {
     invoiceIds: [...kept, ...created],

backend/src/services/invoice/payments.js

@@ -88,7 +88,7 @@ async function markPaid(id, { amountMinor, paidAt, paymentMethod, reference, not
 
     try { await logActivity(isFull ? 'invoice_paid' : 'invoice_partial_payment',
       { invoiceId: id, amountMinor: amount, totalPaidMinor: total },
-      invoice.event_id || null, `admin:${adminId}`); } catch (_) {}
+      invoice.event_id || null, `admin:${adminId}`); } catch (_) { /* non-fatal */ }
 
     // Migration 127 — admin payment-received notification. Fires only
     // on the transition into 'paid' so admins don't get duplicate
@@ -134,7 +134,7 @@ async function markPaid(id, { amountMinor, paidAt, paymentMethod, reference, not
           paidTotalMinor: markResult.paidTotalMinor,
         },
       });
-    } catch (_) {}
+    } catch (_) { /* non-fatal */ }
   }
   return markResult;
 }
@@ -203,7 +203,7 @@ async function queueInvoicePaidAdminNotification({
   try {
     await logActivity('invoice_paid_admin_notified', { invoiceId: invoice.id },
       invoice.event_id || null, 'system');
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 }
 
 async function queuePaymentCheckEmail(invoiceId, { skipThrottle = false } = {}) {
@@ -318,7 +318,7 @@ async function queuePaymentCheckEmail(invoiceId, { skipThrottle = false } = {})
   try {
     await logActivity('invoice_payment_check_sent', { invoiceId, token: token.slice(0, 8) },
       invoice.event_id || null, 'scheduler');
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   return { token, sent: true };
 }
@@ -449,7 +449,7 @@ async function recordPaymentCheckAction({ token, action, amountMinor, ip, adminI
       { invoiceId: invoice.id, action, amountMinor: amountMinor || null },
       invoice.event_id || null,
       adminId ? `admin:${adminId}` : 'public:payment-check');
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   // --- Apply the action -----------------------------------------
   if (action === 'paid_full') {

backend/src/services/invoice/reminders.js

@@ -117,7 +117,7 @@ async function applyReminder(invoice, lineItems, level, adminId) {
         currency: invoice.currency,
       },
     });
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   // Render the MAHNUNG (reminder letter). The original invoice PDF is left
   // UNTOUCHED (immutable). The Mahnung reuses the invoice layout via a
@@ -180,7 +180,7 @@ async function applyReminder(invoice, lineItems, level, adminId) {
   try {
     await logActivity('invoice_reminder_sent', { invoiceId: invoice.id, level, lateFeeMinor: lateFeeGross },
       invoice.event_id || null, `admin:${adminId || 'system'}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   return { level, lateFeeMinor: lateFeeGross };
 }

backend/src/services/invoice/scheduler.js

@@ -76,7 +76,7 @@ async function runScheduledTasks() {
           await logActivity('monthly_bill_skipped_empty',
             { invoiceId: draft.id, customerId: draft.customer_account_id },
             null, 'scheduler');
-        } catch (_) {}
+        } catch (_) { /* non-fatal */ }
         continue;
       }
       // Arm for the flush pass: clear the draft flag, set the send
@@ -95,7 +95,7 @@ async function runScheduledTasks() {
           { invoiceId: draft.id, customerId: draft.customer_account_id,
             periodEnd: draft.monthly_period_end },
           null, 'scheduler');
-      } catch (_) {}
+      } catch (_) { /* non-fatal */ }
     } catch (err) {
       logger.error('Monthly bill issuance failed', { invoiceId: draft.id, err: err.message });
     }

backend/src/services/invoice/sending.js

@@ -159,7 +159,7 @@ async function sendInvoice(id, adminId, options = {}) {
     attachments: invoiceAttachments,
   });
 
-  try { await logActivity('invoice_sent', { invoiceId: id }, invoice.event_id || null, `admin:${adminId}`); } catch (_) {}
+  try { await logActivity('invoice_sent', { invoiceId: id }, invoice.event_id || null, `admin:${adminId}`); } catch (_) { /* non-fatal */ }
 
   // Fire the workflow engine's invoice.sent trigger (after the row is updated +
   // the email queued). Idempotent per invoice id; no-op when the workflows flag
@@ -180,7 +180,7 @@ async function sendInvoice(id, adminId, options = {}) {
         currency: invoice.currency,
       },
     });
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   return { sent: true, pdfPath };
 }
@@ -355,7 +355,7 @@ async function createStorno(originalId, adminId, trx = db) {
     await logActivity('invoice_cancelled_via_storno',
       { invoiceId: originalId, stornoId, stornoNumber },
       original.event_id || null, `admin:${adminId}`, trx);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   return stornoId;
 }
@@ -430,7 +430,7 @@ async function sendStorno(stornoId, adminId) {
     await logActivity('storno_sent',
       { stornoId, stornoNumber: storno.invoice_number, originalInvoiceId: storno.cancels_invoice_id || null },
       storno.event_id || null, `admin:${adminId || 'system'}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   return { status: 'sent', stornoId };
 }
@@ -558,7 +558,7 @@ async function reissueInvoice(id, adminId) {
       await logActivity('invoice_reissued',
         { originalInvoiceId: id, newInvoiceId: newId, stornoId },
         original.event_id || null, `admin:${adminId}`, trx);
-    } catch (_) {}
+    } catch (_) { /* non-fatal */ }
 
     return { id: newId, replaces: id, stornoId };
   });
@@ -592,7 +592,7 @@ async function releaseForDelivery(id, adminId) {
   });
   try {
     await logActivity('invoice_released_for_delivery', { invoiceId: id }, invoice.event_id || null, `admin:${adminId}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
   // Fire immediately rather than waiting for the next scheduler
   // tick — admin clicked the button because they want it out now.
   return await sendInvoice(id, adminId);
@@ -646,7 +646,7 @@ async function cancelInvoice(id, adminId) {
       await logActivity('invoice_cancelled',
         { invoiceId: id, viaStorno: false },
         invoice.event_id || null, `admin:${adminId}`);
-    } catch (_) {}
+    } catch (_) { /* non-fatal */ }
     return { cancelled: true, stornoId: null };
   }
 
@@ -690,7 +690,7 @@ async function triggerMonthlyBillNow(customerId, adminId) {
     await logActivity('monthly_bill_triggered_manually',
       { invoiceId: draft.id, customerId, periodEnd: draft.monthly_period_end },
       null, `admin:${adminId}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   // Inline send so admin gets immediate feedback (PDF stored, status
   // flipped to 'sent', email queued). A failure here doesn't roll

backend/src/services/pdfService.js

@@ -527,15 +527,6 @@ function drawTitle(doc, title, x, y) {
   return doc.y + 8;
 }
 
-function drawDate(doc, label, value, x, y, width) {
-  doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#000');
-  const right = x + width;
-  const labelWidth = 80;
-  doc.text(`${label}:`, right - labelWidth - 80, y, { width: 80, align: 'right' });
-  doc.text(value, right - 80, y, { width: 80, align: 'right' });
-  return doc.y + 10;
-}
-
 /**
  * Render the line-items table via swissqrbill's Table helper. We supply
  * widths in points; the helper draws the borderless layout the
@@ -667,20 +658,20 @@ function drawLineItems(doc, ctx) {
       borderWidth: [0, 0, 0, 0],
       columns: showDiscount
         ? [
-            { text: posLabel,                                          width: widths[0], align: 'left'  },
-            { text: descText,                                          width: widths[1], align: 'left',  color: numericColor },
-            { text: stripTrailingZeros(li.quantity),                   width: widths[2], align: 'right', color: numericColor },
-            { text: subItemPriceless ? '' : `${stripTrailingZeros(li.discountPercent)}%`, width: widths[3], align: 'right', color: numericColor },
-            { text: unitText,                                          width: widths[4], align: 'right', color: numericColor },
-            { text: lineTotalText,                                     width: widths[5], align: 'right', color: numericColor },
-          ]
+          { text: posLabel,                                          width: widths[0], align: 'left'  },
+          { text: descText,                                          width: widths[1], align: 'left',  color: numericColor },
+          { text: stripTrailingZeros(li.quantity),                   width: widths[2], align: 'right', color: numericColor },
+          { text: subItemPriceless ? '' : `${stripTrailingZeros(li.discountPercent)}%`, width: widths[3], align: 'right', color: numericColor },
+          { text: unitText,                                          width: widths[4], align: 'right', color: numericColor },
+          { text: lineTotalText,                                     width: widths[5], align: 'right', color: numericColor },
+        ]
         : [
-            { text: posLabel,                                          width: widths[0], align: 'left'  },
-            { text: descText,                                          width: widths[1], align: 'left',  color: numericColor },
-            { text: stripTrailingZeros(li.quantity),                   width: widths[2], align: 'right', color: numericColor },
-            { text: unitText,                                          width: widths[3], align: 'right', color: numericColor },
-            { text: lineTotalText,                                     width: widths[4], align: 'right', color: numericColor },
-          ],
+          { text: posLabel,                                          width: widths[0], align: 'left'  },
+          { text: descText,                                          width: widths[1], align: 'left',  color: numericColor },
+          { text: stripTrailingZeros(li.quantity),                   width: widths[2], align: 'right', color: numericColor },
+          { text: unitText,                                          width: widths[3], align: 'right', color: numericColor },
+          { text: lineTotalText,                                     width: widths[4], align: 'right', color: numericColor },
+        ],
     };
   };
 
@@ -697,20 +688,20 @@ function drawLineItems(doc, ctx) {
     borderWidth: [0, 0, 0, 0],
     columns: showDiscount
       ? [
-          { text: '',   width: widths[0], align: 'left' },
-          { text,       width: widths[1], align: 'left', color: '#666', fontName: 'Helvetica-Oblique' },
-          { text: '',   width: widths[2], align: 'right' },
-          { text: '',   width: widths[3], align: 'right' },
-          { text: '',   width: widths[4], align: 'right' },
-          { text: '',   width: widths[5], align: 'right' },
-        ]
+        { text: '',   width: widths[0], align: 'left' },
+        { text,       width: widths[1], align: 'left', color: '#666', fontName: 'Helvetica-Oblique' },
+        { text: '',   width: widths[2], align: 'right' },
+        { text: '',   width: widths[3], align: 'right' },
+        { text: '',   width: widths[4], align: 'right' },
+        { text: '',   width: widths[5], align: 'right' },
+      ]
       : [
-          { text: '',   width: widths[0], align: 'left' },
-          { text,       width: widths[1], align: 'left', color: '#666', fontName: 'Helvetica-Oblique' },
-          { text: '',   width: widths[2], align: 'right' },
-          { text: '',   width: widths[3], align: 'right' },
-          { text: '',   width: widths[4], align: 'right' },
-        ],
+        { text: '',   width: widths[0], align: 'left' },
+        { text,       width: widths[1], align: 'left', color: '#666', fontName: 'Helvetica-Oblique' },
+        { text: '',   width: widths[2], align: 'right' },
+        { text: '',   width: widths[3], align: 'right' },
+        { text: '',   width: widths[4], align: 'right' },
+      ],
   });
 
   const headerRow = {
@@ -724,20 +715,20 @@ function drawLineItems(doc, ctx) {
     header: true,
     columns: showDiscount
       ? [
-          { text: labels.pos,   width: widths[0], align: 'left'  },
-          { text: labels.desc,  width: widths[1], align: 'left'  },
-          { text: labels.qty,   width: widths[2], align: 'right' },
-          { text: labels.disc,  width: widths[3], align: 'right' },
-          { text: labels.unit,  width: widths[4], align: 'right' },
-          { text: labels.total, width: widths[5], align: 'right' },
-        ]
+        { text: labels.pos,   width: widths[0], align: 'left'  },
+        { text: labels.desc,  width: widths[1], align: 'left'  },
+        { text: labels.qty,   width: widths[2], align: 'right' },
+        { text: labels.disc,  width: widths[3], align: 'right' },
+        { text: labels.unit,  width: widths[4], align: 'right' },
+        { text: labels.total, width: widths[5], align: 'right' },
+      ]
       : [
-          { text: labels.pos,   width: widths[0], align: 'left'  },
-          { text: labels.desc,  width: widths[1], align: 'left'  },
-          { text: labels.qty,   width: widths[2], align: 'right' },
-          { text: labels.unit,  width: widths[3], align: 'right' },
-          { text: labels.total, width: widths[4], align: 'right' },
-        ],
+        { text: labels.pos,   width: widths[0], align: 'left'  },
+        { text: labels.desc,  width: widths[1], align: 'left'  },
+        { text: labels.qty,   width: widths[2], align: 'right' },
+        { text: labels.unit,  width: widths[3], align: 'right' },
+        { text: labels.total, width: widths[4], align: 'right' },
+      ],
   };
 
   // Group rows so a parent + its sub-items + every involved details_text
@@ -1427,388 +1418,388 @@ function renderDocument(type, context) {
     // Errors from the IIFE bubble up via reject(); the doc 'end'
     // event still resolves the outer Promise once writes flush.
     (async () => {
-    try {
-      const ctx = normaliseContext(type, context);
-      const doc = new PDFDocument({
-        size: 'A4',
-        // bufferPages: true keeps every page open in memory after
-        // they're emitted so we can switch back and stamp the page
-        // numbers ("Page 1 of N" / "Seite 1 von N") once we know how
-        // many pages the document ended up with. Without buffering,
-        // PDFKit flushes each page as soon as the next one starts,
-        // so we couldn't know N until it was too late.
-        bufferPages: true,
-        margins: {
-          top: PAGE.marginTop, bottom: PAGE.marginBottom,
-          left: PAGE.marginLeft, right: PAGE.marginRight,
-        },
-        info: {
+      try {
+        const ctx = normaliseContext(type, context);
+        const doc = new PDFDocument({
+          size: 'A4',
+          // bufferPages: true keeps every page open in memory after
+          // they're emitted so we can switch back and stamp the page
+          // numbers ("Page 1 of N" / "Seite 1 von N") once we know how
+          // many pages the document ended up with. Without buffering,
+          // PDFKit flushes each page as soon as the next one starts,
+          // so we couldn't know N until it was too late.
+          bufferPages: true,
+          margins: {
+            top: PAGE.marginTop, bottom: PAGE.marginBottom,
+            left: PAGE.marginLeft, right: PAGE.marginRight,
+          },
+          info: {
           // Chrome's built-in PDF viewer uses this Title metadata
           // as the default save name when the PDF is served from a
           // blob URL (where the original HTTP Content-Disposition
           // header can't propagate). Format mirrors the filename
           // we set on the HTTP response: "<number>_<customerLabel>"
           // so saved files have a meaningful name in either path.
-          Title: (() => {
-            const docNumber = ctx.doc.invoiceNumber || ctx.doc.quoteNumber
+            Title: (() => {
+              const docNumber = ctx.doc.invoiceNumber || ctx.doc.quoteNumber
               || (type === 'quote' ? 'Quote' : 'Invoice');
-            // Prefer the recipient (customer) for the label —
-            // matches how admins typically file invoices.
-            const recipient = ctx.recipient?.companyName || '';
-            return recipient ? `${docNumber}_${recipient}` : String(docNumber);
-          })(),
-          Author: ctx.issuer.companyName || 'picpeak',
-        },
-      });
+              // Prefer the recipient (customer) for the label —
+              // matches how admins typically file invoices.
+              const recipient = ctx.recipient?.companyName || '';
+              return recipient ? `${docNumber}_${recipient}` : String(docNumber);
+            })(),
+            Author: ctx.issuer.companyName || 'picpeak',
+          },
+        });
 
-      const chunks = [];
-      doc.on('data', (c) => chunks.push(c));
-      doc.on('end', () => resolve(Buffer.concat(chunks)));
-      doc.on('error', reject);
+        const chunks = [];
+        doc.on('data', (c) => chunks.push(c));
+        doc.on('end', () => resolve(Buffer.concat(chunks)));
+        doc.on('error', reject);
 
-      // Font registration. Same resolution priority as
-      // createBaseDocument: pdfFontTtfPath (legacy override) →
-      // pdfFontFamily (bundled dropdown) → Helvetica. Helpers below
-      // read `doc._fonts` (one extra word per doc) so we don't have
-      // to thread the font names through every drawing function or
-      // fork the helpers per branding.
-      doc._fonts = { body: FONT_BODY, bold: FONT_BOLD };
-      ctx.fonts = doc._fonts;
-      const registered = registerCustomFonts(doc, ctx.issuer);
-      if (registered) {
-        doc._fonts = registered;
-        ctx.fonts = registered;
-      }
+        // Font registration. Same resolution priority as
+        // createBaseDocument: pdfFontTtfPath (legacy override) →
+        // pdfFontFamily (bundled dropdown) → Helvetica. Helpers below
+        // read `doc._fonts` (one extra word per doc) so we don't have
+        // to thread the font names through every drawing function or
+        // fork the helpers per branding.
+        doc._fonts = { body: FONT_BODY, bold: FONT_BOLD };
+        ctx.fonts = doc._fonts;
+        const registered = registerCustomFonts(doc, ctx.issuer);
+        if (registered) {
+          doc._fonts = registered;
+          ctx.fonts = registered;
+        }
 
-      // ---- header layout (DIN 5008 Form B) -------------------------
-      //   - recipient block in the address window (top-left,
-      //     45mm from top, 20mm from left, 85×45mm)
-      //   - issuer block top-right (logo + company + address +
-      //     contact) sized to NOT overlap the address window
-      //
-      // The two blocks are positioned absolutely; we keep a `y`
-      // cursor for the body content that starts BELOW both blocks.
-      const leftX = PAGE.marginLeft;
-      // Sender block: narrower (180pt vs 220pt), further right, and
-      // nudged down by 16pt so it doesn't crowd the very top of the
-      // page. Leaves more breathing room for the logo + name banner.
-      const issuerWidth = 180;
-      const issuerX = PAGE.width - PAGE.marginRight - issuerWidth;
-      const issuerY = PAGE.marginTop + 16;
+        // ---- header layout (DIN 5008 Form B) -------------------------
+        //   - recipient block in the address window (top-left,
+        //     45mm from top, 20mm from left, 85×45mm)
+        //   - issuer block top-right (logo + company + address +
+        //     contact) sized to NOT overlap the address window
+        //
+        // The two blocks are positioned absolutely; we keep a `y`
+        // cursor for the body content that starts BELOW both blocks.
+        const leftX = PAGE.marginLeft;
+        // Sender block: narrower (180pt vs 220pt), further right, and
+        // nudged down by 16pt so it doesn't crowd the very top of the
+        // page. Leaves more breathing room for the logo + name banner.
+        const issuerWidth = 180;
+        const issuerX = PAGE.width - PAGE.marginRight - issuerWidth;
+        const issuerY = PAGE.marginTop + 16;
 
-      const issuerEndY = drawIssuerBlock(doc, ctx.issuer, issuerX, issuerY, issuerWidth, ctx.locale);
-      const recipientEndY = drawRecipientBlock(doc, ctx.recipient, ctx.locale);
-      // Start the body content below the header blocks AND the
-      // address-window bottom edge — never let the date/title row
-      // cut through the window region. The title position isn't
-      // dictated by DIN 5008 (the spec only fixes the address window
-      // position), so we pull it tight against the window's bottom
-      // edge to give the body more vertical room.
-      let y = Math.max(issuerEndY, recipientEndY, ADDR_WINDOW.top + ADDR_WINDOW.height) + 6;
+        const issuerEndY = drawIssuerBlock(doc, ctx.issuer, issuerX, issuerY, issuerWidth, ctx.locale);
+        const recipientEndY = drawRecipientBlock(doc, ctx.recipient, ctx.locale);
+        // Start the body content below the header blocks AND the
+        // address-window bottom edge — never let the date/title row
+        // cut through the window region. The title position isn't
+        // dictated by DIN 5008 (the spec only fixes the address window
+        // position), so we pull it tight against the window's bottom
+        // edge to give the body more vertical room.
+        let y = Math.max(issuerEndY, recipientEndY, ADDR_WINDOW.top + ADDR_WINDOW.height) + 6;
 
-      // Storno discriminator. Drives:
-      //   - page title swap ("Stornorechnung" instead of "Rechnung")
-      //   - mandatory reference line under the title
-      //   - sign flip on line totals (row-level totals are already
-      //     stored negative in the DB, so drawTotals renders them
-      //     naturally — see drawLineItems for the per-item flip)
-      //   - suppression of payment terms / IBAN / QR-bill blocks
-      // `type === 'invoice'` is preserved as the outer document
-      // family — Storni share the invoice renderer surface, only
-      // the cosmetic + accounting-sign branches differ.
-      const isStorno = type === 'invoice' && ctx.doc.kind === 'storno';
-      // Mahnung (reminder letter) reuses the invoice surface: same line items +
-      // a Mahngebühr row + the new grand total, but a "Mahnung" title and NO
-      // QR (the QR would encode the original amount, not the new total).
-      const isMahnung = type === 'invoice' && ctx.doc.kind === 'mahnung';
+        // Storno discriminator. Drives:
+        //   - page title swap ("Stornorechnung" instead of "Rechnung")
+        //   - mandatory reference line under the title
+        //   - sign flip on line totals (row-level totals are already
+        //     stored negative in the DB, so drawTotals renders them
+        //     naturally — see drawLineItems for the per-item flip)
+        //   - suppression of payment terms / IBAN / QR-bill blocks
+        // `type === 'invoice'` is preserved as the outer document
+        // family — Storni share the invoice renderer surface, only
+        // the cosmetic + accounting-sign branches differ.
+        const isStorno = type === 'invoice' && ctx.doc.kind === 'storno';
+        // Mahnung (reminder letter) reuses the invoice surface: same line items +
+        // a Mahngebühr row + the new grand total, but a "Mahnung" title and NO
+        // QR (the QR would encode the original amount, not the new total).
+        const isMahnung = type === 'invoice' && ctx.doc.kind === 'mahnung';
 
-      // ---- document number (above) + date (below), both right-aligned
-      // The number sits directly under the sender address block so the
-      // customer + accountant find the invoice/quote/Storno reference
-      // exactly where DACH letter convention puts it. The date follows
-      // on its own row with the same right-anchored column structure so
-      // both label-and-value pairs align to the same right edge.
-      const docNumberForDisplay = ctx.doc.invoiceNumber || ctx.doc.quoteNumber || '';
-      const numberLabelKey = type === 'quote' ? 'quote_number_label' : 'invoice_number_label';
-      const metaRight = leftX + PAGE.contentWidth;
-      const metaLabelW = 110; // wider than the date label so "Rechnungsnummer" fits without wrap
-      const metaValueW = 110;
-      if (docNumberForDisplay) {
+        // ---- document number (above) + date (below), both right-aligned
+        // The number sits directly under the sender address block so the
+        // customer + accountant find the invoice/quote/Storno reference
+        // exactly where DACH letter convention puts it. The date follows
+        // on its own row with the same right-anchored column structure so
+        // both label-and-value pairs align to the same right edge.
+        const docNumberForDisplay = ctx.doc.invoiceNumber || ctx.doc.quoteNumber || '';
+        const numberLabelKey = type === 'quote' ? 'quote_number_label' : 'invoice_number_label';
+        const metaRight = leftX + PAGE.contentWidth;
+        const metaLabelW = 110; // wider than the date label so "Rechnungsnummer" fits without wrap
+        const metaValueW = 110;
+        if (docNumberForDisplay) {
+          doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#000');
+          doc.text(`${t(ctx.locale, numberLabelKey)}:`,
+            metaRight - metaValueW - metaLabelW, y,
+            { width: metaLabelW, align: 'right', lineBreak: false });
+          doc.text(docNumberForDisplay, metaRight - metaValueW, y,
+            { width: metaValueW, align: 'right', lineBreak: false });
+          y += 14;
+        }
+        // Date row — same right-anchored layout so the two values stack
+        // visually as a single meta block. Replaces the previous
+        // drawDate() call, which lived below the title and used a
+        // tighter column spec.
         doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#000');
-        doc.text(`${t(ctx.locale, numberLabelKey)}:`,
+        doc.text(`${t(ctx.locale, 'date')}:`,
           metaRight - metaValueW - metaLabelW, y,
           { width: metaLabelW, align: 'right', lineBreak: false });
-        doc.text(docNumberForDisplay, metaRight - metaValueW, y,
+        doc.text(formatDate(ctx.doc.issueDate, ctx.dateFormat),
+          metaRight - metaValueW, y,
           { width: metaValueW, align: 'right', lineBreak: false });
-        y += 14;
-      }
-      // Date row — same right-anchored layout so the two values stack
-      // visually as a single meta block. Replaces the previous
-      // drawDate() call, which lived below the title and used a
-      // tighter column spec.
-      doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#000');
-      doc.text(`${t(ctx.locale, 'date')}:`,
-        metaRight - metaValueW - metaLabelW, y,
-        { width: metaLabelW, align: 'right', lineBreak: false });
-      doc.text(formatDate(ctx.doc.issueDate, ctx.dateFormat),
-        metaRight - metaValueW, y,
-        { width: metaValueW, align: 'right', lineBreak: false });
-      y += 18; // line height + cushion before the title
+        y += 18; // line height + cushion before the title
 
-      // ---- title ----------------------------------------------------
-      const title = type === 'quote'
-        ? t(ctx.locale, 'quote_title')
-        : isStorno
-          ? t(ctx.locale, 'storno_title')
-          : isMahnung
-            ? t(ctx.locale, 'mahnung_title')
-            : t(ctx.locale, 'invoice_title');
-      y = drawTitle(doc, title, leftX, y + 2);
+        // ---- title ----------------------------------------------------
+        const title = type === 'quote'
+          ? t(ctx.locale, 'quote_title')
+          : isStorno
+            ? t(ctx.locale, 'storno_title')
+            : isMahnung
+              ? t(ctx.locale, 'mahnung_title')
+              : t(ctx.locale, 'invoice_title');
+        y = drawTitle(doc, title, leftX, y + 2);
 
-      // Mandatory Storno reference line — "Bezug: Storno zu Rechnung
-      // R-XXXX vom DATE". This is the §14c-defensible link from the
-      // cancellation document to the invoice it reverses; readers
-      // and Finanzamt auditors need both numbers + the original
-      // issue date to reconstruct the chain from the documents
-      // alone. Stamped FIRST (before sourceQuote / replaces) so
-      // it's the prominent reference on a Storno.
-      if (isStorno && ctx.doc.cancelsInvoice) {
-        const { number, issueDate } = ctx.doc.cancelsInvoice;
-        doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#666');
-        const datePart = issueDate ? ` ${t(ctx.locale, 'reference_dated', { date: formatDate(issueDate, ctx.dateFormat) })}` : '';
-        doc.text(
-          `${t(ctx.locale, 'reference_label')}: ${t(ctx.locale, 'reference_cancels')} ${t(ctx.locale, 'invoice_title')} ${number}${datePart}`,
-          leftX, y, { width: PAGE.contentWidth }
-        );
-        y = doc.y + 6;
-        doc.fillColor('#000');
-      }
-
-      // Invoice → source quote cross-reference. We deliberately keep
-      // invoice numbers on a strict monotonic sequence (R-YYYY-NNNN)
-      // for tax-compliance reasons (CH/LI/DE/AT require
-      // "lückenlose Rechnungsnummern") — instead of mirroring the
-      // quote number on the invoice, we surface the link as a small
-      // "Bezug: Angebot Q-…" line under the title. Readers see the
-      // provenance without breaking the numbering scheme. Only
-      // rendered for invoices that came from a quote; no-op for
-      // standalone invoices and Storni (which don't reference quotes).
-      if (type === 'invoice' && !isStorno && ctx.doc.sourceQuoteNumber) {
-        doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#666');
-        doc.text(
-          `${t(ctx.locale, 'reference_label')}: ${t(ctx.locale, 'quote_title')} ${ctx.doc.sourceQuoteNumber}`,
-          leftX, y, { width: PAGE.contentWidth }
-        );
-        y = doc.y + 6;
-        doc.fillColor('#000');
-      }
-      // Cancel + reissue trail (migration 114) — when this invoice
-      // replaces an earlier (cancelled) one, surface "Bezug: Ersetzt
-      // Rechnung R-XXXX vom DATE" so the customer (and auditors) can
-      // trace the chain. Rendered in the same grey-666 small-print
-      // style as the quote-source reference above. Suppressed on
-      // Storni (which carry their own cancelsInvoice reference).
-      if (type === 'invoice' && !isStorno && ctx.doc.replacesInvoice) {
-        const { number, issueDate } = ctx.doc.replacesInvoice;
-        doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#666');
-        const datePart = issueDate ? ` ${t(ctx.locale, 'reference_dated', { date: formatDate(issueDate, ctx.dateFormat) })}` : '';
-        doc.text(
-          `${t(ctx.locale, 'reference_label')}: ${t(ctx.locale, 'reference_replaces')} ${t(ctx.locale, 'invoice_title')} ${number}${datePart}`,
-          leftX, y, { width: PAGE.contentWidth }
-        );
-        y = doc.y + 6;
-        doc.fillColor('#000');
-      }
-
-      // ---- salutation + lead-in ------------------------------------
-      // Personalised greeting when the customer record has an
-      // honorific + last name on file ("Sehr geehrter Herr Bresch,"),
-      // otherwise the generic locale-specific opening from the i18n
-      // dictionary ("Sehr geehrte Damen und Herren,").
-      const greeting = personalSalutation(ctx.locale, ctx.recipient?.salutation, ctx.recipient?.lastName)
-        || t(ctx.locale, 'salutation');
-      doc.font(doc._fonts ? doc._fonts.bold : FONT_BOLD).fontSize(10).fillColor('#000');
-      doc.text(greeting, leftX, y, { width: PAGE.contentWidth });
-      y = doc.y + 4;
-      doc.font(doc._fonts ? doc._fonts.body : FONT_BODY);
-      const leadIn = type === 'quote'
-        ? t(ctx.locale, 'lead_in_quote')
-        : t(ctx.locale, 'lead_in_invoice');
-      doc.text(leadIn, leftX, y, { width: PAGE.contentWidth });
-      y = doc.y + 16;
-
-      // ---- intro text override (admin-customisable) -----------------
-      if (ctx.doc.introText) {
-        doc.text(ctx.doc.introText, leftX, y, { width: PAGE.contentWidth });
-        y = doc.y + 12;
-      }
-
-      // ---- line items table ----------------------------------------
-      // Small top padding — tight against the lead-in text since the
-      // maintainer wants the items right under the greeting/intro.
-      y += 8;
-      doc.y = y;
-      doc.x = leftX;
-
-      // Let the items table paginate with the document's NORMAL
-      // margins so each page fills to the bottom. The header row is
-      // marked `header: true` so it auto-repeats on every
-      // continuation page. Totals/payment placement is handled below:
-      // they're pinned to a fixed anchor near the page bottom, and if
-      // the last item row spilled past that anchor we advance to a
-      // fresh page before drawing them (see the desiredTotalsY check).
-      //
-      // We deliberately do NOT inflate the bottom margin here to
-      // "reserve" the totals zone on every page. That older approach
-      // shortened the usable area on EVERY page (not just the last),
-      // so a long invoice broke far too early — only a handful of
-      // line items rendered on page 1 with a large blank gap beneath.
-      // Worse, the inflated margin was set on the page active when the
-      // table started but restored on whichever page the table ended,
-      // leaving page 1 permanently short: the page-number stamp later
-      // landed below that page's phantom bottom margin and spawned a
-      // stray blank trailing page (which then desynced "Seite X von Y").
-      drawLineItems(doc, ctx);
-      // y after the table — used only to detect whether the items
-      // overflowed past the totals anchor below. We don't use it as
-      // the totals position directly because the totals block is
-      // pinned to a fixed offset from the page bottom regardless of
-      // how many items rendered.
-      y = doc.y;
-
-      // ---- pin totals + payment block to footer ---------------------
-      // The totals box + payment block ALWAYS render at the same
-      // distance from the page bottom regardless of how many line
-      // items rendered. Reserves below are conservative-but-tight:
-      // they reflect the actual measured block heights, with just
-      // enough breathing room that a wrapped line or extra Skonto
-      // row doesn't crash into the footer.
-      //   FOOTER_RESERVE       = 30  (one footer line ~12pt + ~18pt gap)
-      //   PAYMENT_BLOCK_HEIGHT = 80 with paymentTerm, 50 without
-      //                          (header + 3-4 rows including the
-      //                           skonto + skonto_amount lines)
-      //   TOTALS_BLOCK_HEIGHT  = 90  (top divider + Net + Shipping +
-      //                          VAT + middle divider + Total)
-      const FOOTER_RESERVE = 30;
-      const PAYMENT_BLOCK_HEIGHT = ctx.paymentTerm ? 80 : 50;
-      let TOTALS_BLOCK_HEIGHT  = 90;
-      // A free-text VAT note (#794) adds a wrapped row under the MwSt. line —
-      // grow the reserved totals height by its measured height so a long note
-      // can't push the grand total / payment block into the footer.
-      if (ctx.vatNote) {
-        doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(8);
-        const noteWidth = PAGE.contentWidth - ((PAGE.contentWidth - 20) / 2 + 20);
-        TOTALS_BLOCK_HEIGHT += doc.heightOfString(ctx.vatNote, { width: noteWidth }) + 4;
-        doc.fontSize(10);
-      }
-      const desiredPaymentY = PAGE.height - PAGE.marginBottom - FOOTER_RESERVE - PAYMENT_BLOCK_HEIGHT;
-      const desiredTotalsY  = desiredPaymentY - 12 - TOTALS_BLOCK_HEIGHT;
-
-      // If line items used more space than the totals anchor allows,
-      // advance to a new page before drawing totals — keeps the
-      // bottom block at a CONSTANT position from the footer on
-      // whatever page it lands on.
-      if (y > desiredTotalsY) {
-        doc.addPage();
-      }
-      // Always reset to the fixed anchor — independent of where the
-      // table ended on the page.
-      y = desiredTotalsY;
-
-      // ---- totals box (right-aligned) -------------------------------
-      y = drawTotals(doc, ctx, leftX, y, PAGE.contentWidth);
-
-      // ---- outro text -----------------------------------------------
-      if (ctx.doc.outroText) {
-        doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#000');
-        doc.text(ctx.doc.outroText, leftX, y, { width: PAGE.contentWidth });
-        y = doc.y + 12;
-      }
-
-      // ---- payment conditions + IBAN block --------------------------
-      // Pin the payment block to the fixed anchor too — the totals
-      // box can end short of it (e.g. when only Net + Total render
-      // with no shipping/VAT), so we snap back unconditionally.
-      // Suppressed on Stornorechnungen: a cancellation document is
-      // not a payment instrument — no Zahlungsbedingungen, no IBAN,
-      // no Skonto. Customers reading a Storno expect total clarity
-      // that this is the REVERSAL of an obligation, not a new one.
-      if (!isStorno) {
-        y = desiredPaymentY;
-        y = drawPaymentBlock(doc, ctx, leftX, y, PAGE.contentWidth);
-      }
-
-      // ---- folding marks (left edge) --------------------------------
-      drawFoldingMarks(doc, ctx.issuer?.foldingMarks);
-
-      // ---- footer ---------------------------------------------------
-      drawFooter(doc, ctx.issuer, ctx.locale);
-
-      // ---- payment QR on fresh page (invoices only) -----------------
-      // Two paths, mutually exclusive:
-      //   - 'swiss' → SwissQRBill payment slip (CHF / EUR within CH/LI)
-      //   - 'epc'   → SEPA EPC069-12 QR code (EUR-only, every SEPA bank)
-      // Both append a fresh page; 'none' is a no-op.
-      // Suppressed on Stornorechnungen — negative-amount QR codes
-      // aren't a defined construct in either spec.
-      if (type === 'invoice' && !isStorno && !isMahnung) {
-        if (ctx.qrFormat === 'swiss') {
-          appendSwissQrBill(doc, ctx);
-        } else if (ctx.qrFormat === 'epc') {
-          await appendEpcQr(doc, ctx);
-        }
-      }
-
-      // ---- page numbers ("Page 1 of N" / "Seite 1 von N") -----------
-      // Stamped after everything else so we know the final page
-      // count. bufferPages: true (on the PDFDocument options above)
-      // keeps every page open for back-editing — bufferedPageRange()
-      // returns {start, count}. We switchToPage() each one, draw the
-      // pagination label in the bottom-right corner, then end.
-      try {
-        const range = doc.bufferedPageRange();
-        const total = range.count;
-        // Stamp on EVERY page including single-page documents. The
-        // "Page 1 of 1" label is a tamper-evidence cue for the
-        // recipient — if they receive page 1 of 3 in isolation,
-        // they know pages are missing; conversely "1 of 1" lets a
-        // single-page invoice confirm it's complete. The cost (one
-        // grey line in the bottom corner) is negligible.
-        for (let i = 0; i < total; i++) {
-          doc.switchToPage(range.start + i);
-          // Drop this page's bottom margin to 0 so writing the label INTO the
-          // margin band (below the content area the line-item table fills) can't
-          // trigger PDFKit's auto-page-break. Previously the label sat at
-          // marginBottom-12 — INSIDE the content area — so on a full multi-page
-          // invoice the table's last row overlapped the "Seite X von Y" stamp
-          // (#794). The page is already fully laid out (buffered), so zeroing the
-          // margin here is safe.
-          doc.page.margins.bottom = 0;
-          doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(8).fillColor('#888');
-          const label = t(ctx.locale, 'page_of', {
-            current: i + 1,
-            total,
-          });
-          // Bottom-right corner, INSIDE the bottom margin (below the content
-          // edge the table fills), so a full continuation page's last row can't
-          // overlap it.
-          const labelY = doc.page.height - PAGE.marginBottom + 8;
-          const labelW = 120;
-          const labelX = doc.page.width - PAGE.marginRight - labelW;
-          doc.text(label, labelX, labelY, {
-            width: labelW, align: 'right', lineBreak: false,
-          });
+        // Mandatory Storno reference line — "Bezug: Storno zu Rechnung
+        // R-XXXX vom DATE". This is the §14c-defensible link from the
+        // cancellation document to the invoice it reverses; readers
+        // and Finanzamt auditors need both numbers + the original
+        // issue date to reconstruct the chain from the documents
+        // alone. Stamped FIRST (before sourceQuote / replaces) so
+        // it's the prominent reference on a Storno.
+        if (isStorno && ctx.doc.cancelsInvoice) {
+          const { number, issueDate } = ctx.doc.cancelsInvoice;
+          doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#666');
+          const datePart = issueDate ? ` ${t(ctx.locale, 'reference_dated', { date: formatDate(issueDate, ctx.dateFormat) })}` : '';
+          doc.text(
+            `${t(ctx.locale, 'reference_label')}: ${t(ctx.locale, 'reference_cancels')} ${t(ctx.locale, 'invoice_title')} ${number}${datePart}`,
+            leftX, y, { width: PAGE.contentWidth }
+          );
+          y = doc.y + 6;
           doc.fillColor('#000');
         }
-      } catch (err) {
-        const logger = require('../utils/logger');
-        logger.warn('Failed to stamp page numbers on PDF', { err: err.message });
-      }
 
-      doc.end();
-    } catch (err) {
-      reject(err);
-    }
+        // Invoice → source quote cross-reference. We deliberately keep
+        // invoice numbers on a strict monotonic sequence (R-YYYY-NNNN)
+        // for tax-compliance reasons (CH/LI/DE/AT require
+        // "lückenlose Rechnungsnummern") — instead of mirroring the
+        // quote number on the invoice, we surface the link as a small
+        // "Bezug: Angebot Q-…" line under the title. Readers see the
+        // provenance without breaking the numbering scheme. Only
+        // rendered for invoices that came from a quote; no-op for
+        // standalone invoices and Storni (which don't reference quotes).
+        if (type === 'invoice' && !isStorno && ctx.doc.sourceQuoteNumber) {
+          doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#666');
+          doc.text(
+            `${t(ctx.locale, 'reference_label')}: ${t(ctx.locale, 'quote_title')} ${ctx.doc.sourceQuoteNumber}`,
+            leftX, y, { width: PAGE.contentWidth }
+          );
+          y = doc.y + 6;
+          doc.fillColor('#000');
+        }
+        // Cancel + reissue trail (migration 114) — when this invoice
+        // replaces an earlier (cancelled) one, surface "Bezug: Ersetzt
+        // Rechnung R-XXXX vom DATE" so the customer (and auditors) can
+        // trace the chain. Rendered in the same grey-666 small-print
+        // style as the quote-source reference above. Suppressed on
+        // Storni (which carry their own cancelsInvoice reference).
+        if (type === 'invoice' && !isStorno && ctx.doc.replacesInvoice) {
+          const { number, issueDate } = ctx.doc.replacesInvoice;
+          doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#666');
+          const datePart = issueDate ? ` ${t(ctx.locale, 'reference_dated', { date: formatDate(issueDate, ctx.dateFormat) })}` : '';
+          doc.text(
+            `${t(ctx.locale, 'reference_label')}: ${t(ctx.locale, 'reference_replaces')} ${t(ctx.locale, 'invoice_title')} ${number}${datePart}`,
+            leftX, y, { width: PAGE.contentWidth }
+          );
+          y = doc.y + 6;
+          doc.fillColor('#000');
+        }
+
+        // ---- salutation + lead-in ------------------------------------
+        // Personalised greeting when the customer record has an
+        // honorific + last name on file ("Sehr geehrter Herr Bresch,"),
+        // otherwise the generic locale-specific opening from the i18n
+        // dictionary ("Sehr geehrte Damen und Herren,").
+        const greeting = personalSalutation(ctx.locale, ctx.recipient?.salutation, ctx.recipient?.lastName)
+        || t(ctx.locale, 'salutation');
+        doc.font(doc._fonts ? doc._fonts.bold : FONT_BOLD).fontSize(10).fillColor('#000');
+        doc.text(greeting, leftX, y, { width: PAGE.contentWidth });
+        y = doc.y + 4;
+        doc.font(doc._fonts ? doc._fonts.body : FONT_BODY);
+        const leadIn = type === 'quote'
+          ? t(ctx.locale, 'lead_in_quote')
+          : t(ctx.locale, 'lead_in_invoice');
+        doc.text(leadIn, leftX, y, { width: PAGE.contentWidth });
+        y = doc.y + 16;
+
+        // ---- intro text override (admin-customisable) -----------------
+        if (ctx.doc.introText) {
+          doc.text(ctx.doc.introText, leftX, y, { width: PAGE.contentWidth });
+          y = doc.y + 12;
+        }
+
+        // ---- line items table ----------------------------------------
+        // Small top padding — tight against the lead-in text since the
+        // maintainer wants the items right under the greeting/intro.
+        y += 8;
+        doc.y = y;
+        doc.x = leftX;
+
+        // Let the items table paginate with the document's NORMAL
+        // margins so each page fills to the bottom. The header row is
+        // marked `header: true` so it auto-repeats on every
+        // continuation page. Totals/payment placement is handled below:
+        // they're pinned to a fixed anchor near the page bottom, and if
+        // the last item row spilled past that anchor we advance to a
+        // fresh page before drawing them (see the desiredTotalsY check).
+        //
+        // We deliberately do NOT inflate the bottom margin here to
+        // "reserve" the totals zone on every page. That older approach
+        // shortened the usable area on EVERY page (not just the last),
+        // so a long invoice broke far too early — only a handful of
+        // line items rendered on page 1 with a large blank gap beneath.
+        // Worse, the inflated margin was set on the page active when the
+        // table started but restored on whichever page the table ended,
+        // leaving page 1 permanently short: the page-number stamp later
+        // landed below that page's phantom bottom margin and spawned a
+        // stray blank trailing page (which then desynced "Seite X von Y").
+        drawLineItems(doc, ctx);
+        // y after the table — used only to detect whether the items
+        // overflowed past the totals anchor below. We don't use it as
+        // the totals position directly because the totals block is
+        // pinned to a fixed offset from the page bottom regardless of
+        // how many items rendered.
+        y = doc.y;
+
+        // ---- pin totals + payment block to footer ---------------------
+        // The totals box + payment block ALWAYS render at the same
+        // distance from the page bottom regardless of how many line
+        // items rendered. Reserves below are conservative-but-tight:
+        // they reflect the actual measured block heights, with just
+        // enough breathing room that a wrapped line or extra Skonto
+        // row doesn't crash into the footer.
+        //   FOOTER_RESERVE       = 30  (one footer line ~12pt + ~18pt gap)
+        //   PAYMENT_BLOCK_HEIGHT = 80 with paymentTerm, 50 without
+        //                          (header + 3-4 rows including the
+        //                           skonto + skonto_amount lines)
+        //   TOTALS_BLOCK_HEIGHT  = 90  (top divider + Net + Shipping +
+        //                          VAT + middle divider + Total)
+        const FOOTER_RESERVE = 30;
+        const PAYMENT_BLOCK_HEIGHT = ctx.paymentTerm ? 80 : 50;
+        let TOTALS_BLOCK_HEIGHT  = 90;
+        // A free-text VAT note (#794) adds a wrapped row under the MwSt. line —
+        // grow the reserved totals height by its measured height so a long note
+        // can't push the grand total / payment block into the footer.
+        if (ctx.vatNote) {
+          doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(8);
+          const noteWidth = PAGE.contentWidth - ((PAGE.contentWidth - 20) / 2 + 20);
+          TOTALS_BLOCK_HEIGHT += doc.heightOfString(ctx.vatNote, { width: noteWidth }) + 4;
+          doc.fontSize(10);
+        }
+        const desiredPaymentY = PAGE.height - PAGE.marginBottom - FOOTER_RESERVE - PAYMENT_BLOCK_HEIGHT;
+        const desiredTotalsY  = desiredPaymentY - 12 - TOTALS_BLOCK_HEIGHT;
+
+        // If line items used more space than the totals anchor allows,
+        // advance to a new page before drawing totals — keeps the
+        // bottom block at a CONSTANT position from the footer on
+        // whatever page it lands on.
+        if (y > desiredTotalsY) {
+          doc.addPage();
+        }
+        // Always reset to the fixed anchor — independent of where the
+        // table ended on the page.
+        y = desiredTotalsY;
+
+        // ---- totals box (right-aligned) -------------------------------
+        y = drawTotals(doc, ctx, leftX, y, PAGE.contentWidth);
+
+        // ---- outro text -----------------------------------------------
+        if (ctx.doc.outroText) {
+          doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(10).fillColor('#000');
+          doc.text(ctx.doc.outroText, leftX, y, { width: PAGE.contentWidth });
+          y = doc.y + 12;
+        }
+
+        // ---- payment conditions + IBAN block --------------------------
+        // Pin the payment block to the fixed anchor too — the totals
+        // box can end short of it (e.g. when only Net + Total render
+        // with no shipping/VAT), so we snap back unconditionally.
+        // Suppressed on Stornorechnungen: a cancellation document is
+        // not a payment instrument — no Zahlungsbedingungen, no IBAN,
+        // no Skonto. Customers reading a Storno expect total clarity
+        // that this is the REVERSAL of an obligation, not a new one.
+        if (!isStorno) {
+          y = desiredPaymentY;
+          y = drawPaymentBlock(doc, ctx, leftX, y, PAGE.contentWidth);
+        }
+
+        // ---- folding marks (left edge) --------------------------------
+        drawFoldingMarks(doc, ctx.issuer?.foldingMarks);
+
+        // ---- footer ---------------------------------------------------
+        drawFooter(doc, ctx.issuer, ctx.locale);
+
+        // ---- payment QR on fresh page (invoices only) -----------------
+        // Two paths, mutually exclusive:
+        //   - 'swiss' → SwissQRBill payment slip (CHF / EUR within CH/LI)
+        //   - 'epc'   → SEPA EPC069-12 QR code (EUR-only, every SEPA bank)
+        // Both append a fresh page; 'none' is a no-op.
+        // Suppressed on Stornorechnungen — negative-amount QR codes
+        // aren't a defined construct in either spec.
+        if (type === 'invoice' && !isStorno && !isMahnung) {
+          if (ctx.qrFormat === 'swiss') {
+            appendSwissQrBill(doc, ctx);
+          } else if (ctx.qrFormat === 'epc') {
+            await appendEpcQr(doc, ctx);
+          }
+        }
+
+        // ---- page numbers ("Page 1 of N" / "Seite 1 von N") -----------
+        // Stamped after everything else so we know the final page
+        // count. bufferPages: true (on the PDFDocument options above)
+        // keeps every page open for back-editing — bufferedPageRange()
+        // returns {start, count}. We switchToPage() each one, draw the
+        // pagination label in the bottom-right corner, then end.
+        try {
+          const range = doc.bufferedPageRange();
+          const total = range.count;
+          // Stamp on EVERY page including single-page documents. The
+          // "Page 1 of 1" label is a tamper-evidence cue for the
+          // recipient — if they receive page 1 of 3 in isolation,
+          // they know pages are missing; conversely "1 of 1" lets a
+          // single-page invoice confirm it's complete. The cost (one
+          // grey line in the bottom corner) is negligible.
+          for (let i = 0; i < total; i++) {
+            doc.switchToPage(range.start + i);
+            // Drop this page's bottom margin to 0 so writing the label INTO the
+            // margin band (below the content area the line-item table fills) can't
+            // trigger PDFKit's auto-page-break. Previously the label sat at
+            // marginBottom-12 — INSIDE the content area — so on a full multi-page
+            // invoice the table's last row overlapped the "Seite X von Y" stamp
+            // (#794). The page is already fully laid out (buffered), so zeroing the
+            // margin here is safe.
+            doc.page.margins.bottom = 0;
+            doc.font(doc._fonts ? doc._fonts.body : FONT_BODY).fontSize(8).fillColor('#888');
+            const label = t(ctx.locale, 'page_of', {
+              current: i + 1,
+              total,
+            });
+            // Bottom-right corner, INSIDE the bottom margin (below the content
+            // edge the table fills), so a full continuation page's last row can't
+            // overlap it.
+            const labelY = doc.page.height - PAGE.marginBottom + 8;
+            const labelW = 120;
+            const labelX = doc.page.width - PAGE.marginRight - labelW;
+            doc.text(label, labelX, labelY, {
+              width: labelW, align: 'right', lineBreak: false,
+            });
+            doc.fillColor('#000');
+          }
+        } catch (err) {
+          const logger = require('../utils/logger');
+          logger.warn('Failed to stamp page numbers on PDF', { err: err.message });
+        }
+
+        doc.end();
+      } catch (err) {
+        reject(err);
+      }
     })();
   });
 }
@@ -1946,12 +1937,12 @@ function renderContractToBuffer(context) {
 
         // ---- helper: ensure space before drawing, paginate if needed.
         const bottomLimit = PAGE.height - PAGE.marginBottom - 20;
-        function ensureSpace(needed) {
+        const ensureSpace = (needed) => {
           if (y + needed > bottomLimit) {
             doc.addPage();
             y = PAGE.marginTop;
           }
-        }
+        };
 
         // ---- helper: render body text with inline **bold** support.
         // Splits on `**text**` markers, switches the font weight per
@@ -1960,7 +1951,7 @@ function renderContractToBuffer(context) {
         // chunks continue from PDFKit's cursor so wrapping works
         // across font switches. After rendering, we read doc.y as
         // the new cursor.
-        function renderBodyMarkdown(text, opts) {
+        const renderBodyMarkdown = (text, opts) => {
           const parts = String(text || '').split(/(\*\*[^*]+\*\*)/g).filter((p) => p.length > 0);
           if (parts.length === 0) return;
           const last = parts.length - 1;
@@ -1976,7 +1967,7 @@ function renderContractToBuffer(context) {
               doc.text(chunk, { ...opts, continued: i < last });
             }
           }
-        }
+        };
 
         // ---- intro text ---------------------------------------------
         if (ctx.doc?.introText) {
@@ -2174,7 +2165,7 @@ function renderContractToBuffer(context) {
         // Two empty signature boxes — customer on the left, admin on
         // the right. drawn at fixed coordinates so the stamp service
         // can find them later by constant rather than runtime layout.
-        function drawEmptySignaturePane(x, label, info) {
+        const drawEmptySignaturePane = (x, label, info) => {
           doc.font(doc._fonts.bold).fontSize(10).fillColor('#000');
           doc.text(label, x, L.paneLabelY, { width: L.boxWidth });
           doc.strokeColor('#cccccc').lineWidth(0.5)
@@ -2194,7 +2185,7 @@ function renderContractToBuffer(context) {
             `${t(locale, 'signed_label_date')}: ${info?.signedAt ? formatDate(info.signedAt, locale) : ''}`,
             x, captionY + 12, { width: L.boxWidth },
           );
-        }
+        };
 
         drawEmptySignaturePane(L.customerX, t(locale, 'signature_customer'), ctx.signatures?.customer);
         drawEmptySignaturePane(L.adminX,    t(locale, 'signature_admin'),    ctx.signatures?.admin);

backend/src/services/pdfStampService.js

@@ -23,7 +23,6 @@
  */
 
 const fs = require('fs');
-const path = require('path');
 const crypto = require('crypto');
 const PDFKit = require('pdfkit');
 const { PDFDocument } = require('pdf-lib');
@@ -84,7 +83,7 @@ function pdfkitToPdfLib(pageHeight, x, y, w, h) {
  * or the input file.
  */
 async function stampSignature({ pdfBuffer, signaturePngPath, role, caption }) {
-  const { L, FONT_BODY, FONT_BOLD, formatDate } = pdfConsts();
+  const { L, formatDate } = pdfConsts();
   if (!Buffer.isBuffer(pdfBuffer)) {
     throw new Error('stampSignature: pdfBuffer must be a Buffer');
   }
@@ -261,7 +260,7 @@ async function renderAuditCertificate({ contract, customer, admin, locale = 'de'
 
       const labelW = 200;
       const valueW = PAGE.contentWidth - labelW;
-      function row(labelKey, value) {
+      const row = (labelKey, value) => {
         if (!value) return;
         doc.font(doc._fonts.bold).fontSize(9).fillColor('#444');
         doc.text(t(locale, labelKey), PAGE.marginLeft, y, {
@@ -272,7 +271,7 @@ async function renderAuditCertificate({ contract, customer, admin, locale = 'de'
           width: valueW, align: 'left',
         });
         y = Math.max(y + 12, doc.y + 4);
-      }
+      };
 
       row('audit_contract_number', contract.contract_number);
       row('audit_issued_at', contract.sent_at

backend/src/services/photoExportService.js

@@ -12,7 +12,6 @@ const feedbackService = require('./feedbackService');
 const { neutralizeSpreadsheetFormula } = require('../utils/spreadsheetSafe');
 const { db } = require('../database/db');
 const path = require('path');
-const fs = require('fs').promises;
 
 /**
  * The name the camera gave the file, or null when nothing was recorded (#1229).
@@ -128,16 +127,16 @@ class PhotoExportService {
     }
 
     switch (format) {
-      case 'txt':
-        return this.exportAsTxt(photos, options);
-      case 'csv':
-        return this.exportAsCsv(photos, options);
-      case 'xmp':
-        return this.exportAsXmpZip(photos, options);
-      case 'json':
-        return this.exportAsJson(photos, eventId, options);
-      default:
-        throw new Error(`Unknown export format: ${format}`);
+    case 'txt':
+      return this.exportAsTxt(photos, options);
+    case 'csv':
+      return this.exportAsCsv(photos, options);
+    case 'xmp':
+      return this.exportAsXmpZip(photos, options);
+    case 'json':
+      return this.exportAsJson(photos, eventId, options);
+    default:
+      throw new Error(`Unknown export format: ${format}`);
     }
   }
 
@@ -168,14 +167,14 @@ class PhotoExportService {
 
     let content;
     switch (separator) {
-      case 'comma':
-        content = filenames.join(',');
-        break;
-      case 'semicolon':
-        content = filenames.join(';');
-        break;
-      default:
-        content = filenames.join('\n');
+    case 'comma':
+      content = filenames.join(',');
+      break;
+    case 'semicolon':
+      content = filenames.join(';');
+      break;
+    default:
+      content = filenames.join('\n');
     }
 
     return {
@@ -289,7 +288,7 @@ class PhotoExportService {
   /**
    * Export as JSON metadata
    */
-  async exportAsJson(photos, eventId, options = {}) {
+  async exportAsJson(photos, eventId, _options = {}) {
     // Get event info
     const event = await db('events')
       .where('id', eventId)

backend/src/services/picpeakImportService.js

@@ -261,7 +261,7 @@ const PRESERVED_AUTH_FIELDS = [
 async function jsonColumnsFor(trx, table) {
   if (!isPostgres()) return new Set();
   const res = await trx.raw(
-    "SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ? AND data_type IN ('json', 'jsonb')",
+    'SELECT column_name FROM information_schema.columns WHERE table_schema = \'public\' AND table_name = ? AND data_type IN (\'json\', \'jsonb\')',
     [table]
   );
   return new Set(res.rows.map((r) => r.column_name));
@@ -337,7 +337,7 @@ async function replaceAllTables(tables, dataDir, currentAdmin, roleSnapshot, { c
   await db.transaction(async (trx) => {
     if (isPostgres()) {
       try {
-        await trx.raw("SET session_replication_role = 'replica'");
+        await trx.raw('SET session_replication_role = \'replica\'');
       } catch (_) {
         // session_replication_role requires a Postgres SUPERUSER. The bundled
         // postgres image's role is one; managed Postgres (RDS / Cloud SQL / …)
@@ -420,7 +420,7 @@ async function replaceAllTables(tables, dataDir, currentAdmin, roleSnapshot, { c
     }
 
     // Reset the pg session flag BEFORE the connection returns to the pool.
-    if (isPostgres()) await trx.raw("SET session_replication_role = 'origin'");
+    if (isPostgres()) await trx.raw('SET session_replication_role = \'origin\'');
   });
 }
 

backend/src/services/quoteService.js

@@ -46,6 +46,10 @@ const { hasColumnCached } = require('../utils/schemaCache');
 const fs = require('fs');
 const path = require('path');
 
+// NOTE: this transition table is currently never consulted — quote status
+// changes are not validated against it anywhere in the codebase. Kept as the
+// documented intent; wiring it up is tracked separately.
+// eslint-disable-next-line no-unused-vars -- unwired state machine, see note above
 const VALID_QUOTE_TRANSITIONS = {
   draft: new Set(['sent', 'declined']),
   sent: new Set(['draft', 'accepted', 'declined', 'expired']),
@@ -620,7 +624,7 @@ async function createQuote(payload, adminId) {
       // Pass `trx` so the audit insert rides the transaction's connection —
       // the global db here deadlocks the single-connection SQLite pool.
       await logActivity('quote_created', { quoteId, quoteNumber, customerAccountId: payload.customerAccountId }, null, `admin:${adminId}`, trx);
-    } catch (_) {}
+    } catch (_) { /* non-fatal */ }
 
     logger.info('Quote created', { adminId, quoteId, quoteNumber });
     return quoteId;
@@ -760,7 +764,7 @@ async function updateQuote(id, payload, adminId) {
 
     try {
       await logActivity('quote_updated', { quoteId: id }, null, `admin:${adminId}`);
-    } catch (_) {}
+    } catch (_) { /* non-fatal */ }
   });
 }
 
@@ -1033,7 +1037,7 @@ async function sendQuote(id, adminId) {
     // Do NOT log the raw bearer token — it grants quote actions and the
     // activity log is readable later (GHSA-prch). The quoteId is the audit key.
     await logActivity('quote_sent', { quoteId: id }, null, `admin:${adminId}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   // Fire the quote.sent workflow trigger (best-effort; emit is fail-closed when
   // the workflows flag is off). The accepted/declined emits already exist; this
@@ -1259,7 +1263,7 @@ async function recordResponse({ token, action, ip, tosAccepted }) {
   try {
     // Raw bearer token must not reach the activity log (GHSA-prch).
     await logActivity(`quote_${newStatus}`, { quoteId: quote.id }, null, 'customer:public');
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   // Defer the workflow emit until the 15-min toggle window locks — so accepting
   // (then converting) can't strip the customer's ability to decline. The
@@ -1317,7 +1321,7 @@ async function adminAcceptQuote(id, adminId) {
 
   try {
     await logActivity('quote_accepted_by_admin', { quoteId: id }, null, `admin:${adminId}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   // ---- customer confirmation email -------------------------------
   // Renders the quote PDF + queues a "quote accepted — on your
@@ -1428,7 +1432,7 @@ async function adminDeclineQuote(id, adminId, reason = null) {
 
   try {
     await logActivity('quote_declined_by_admin', { quoteId: id, reason: cleanReason }, null, `admin:${adminId}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   // Admin decline locks the window immediately (response_locked_at = now), so
   // this emits straight away (and stamps emitted) rather than deferring.
@@ -1569,7 +1573,7 @@ async function convertToInvoiceOnly(quoteId, adminId, options = {}) {
   try {
     await logActivity('quote_converted_invoices_only', { quoteId: quote.id, installments: result.installmentsCreated },
       null, `admin:${adminId}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   logger.info('Quote converted to invoices only (no event)', { adminId, quoteId: quote.id, installments: result.installmentsCreated });
   return result;
@@ -1750,7 +1754,7 @@ async function convertToEvent(quoteId, adminId, options = {}) {
   // (prepare_event runs this unattended from the booking flow).
   try {
     await logActivity('quote_converted', { quoteId: quote.id, eventId: result.eventId }, result.eventId, `admin:${adminId}`);
-  } catch (_) {}
+  } catch (_) { /* non-fatal */ }
 
   logger.info('Quote converted to event', { adminId, quoteId: quote.id, eventId: result.eventId });
   return result;

backend/src/services/rateLimitService.js

@@ -96,7 +96,7 @@ function clearSettingsCache() {
  */
 function isAuthenticated(req) {
   try {
-    const slugMatch = req.path.match(/\/api\/(?:gallery|secure-images)\/([^\/]+)/);
+    const slugMatch = req.path.match(/\/api\/(?:gallery|secure-images)\/([^/]+)/);
     const slug = slugMatch ? slugMatch[1] : req.requestedSlug;
     const token = getAdminTokenFromRequest(req) || getGalleryTokenFromRequest(req, slug);
     const decoded = jwt.verify(token, process.env.JWT_SECRET);

backend/src/services/restoreService.js

@@ -771,7 +771,7 @@ class RestoreService {
    * Download backup from S3
    */
   async downloadFromS3(s3Url, manifest, options) {
-    const s3PathMatch = s3Url.match(/^s3:\/\/([^\/]+)\/(.+)$/);
+    const s3PathMatch = s3Url.match(/^s3:\/\/([^/]+)\/(.+)$/);
     if (!s3PathMatch) {
       throw new Error('Invalid S3 URL format');
     }
@@ -930,7 +930,7 @@ class RestoreService {
   /**
    * Perform database-only restore
    */
-  async performDatabaseRestore(backupPath, manifest, options) {
+  async performDatabaseRestore(backupPath, manifest, _options) {
     this.updateProgress('Restoring database...');
 
     const dbBackupFile = manifest.database.backup_file;
@@ -1524,7 +1524,8 @@ END $$;`
     try {
       // Read backup manifest
       const manifestPath = path.join(preRestoreBackupPath, 'backup-manifest.json');
-      const backupManifest = JSON.parse(await fs.readFile(manifestPath, 'utf8'));
+      // Parsed for its side effect: throws if the manifest is missing/corrupt.
+      JSON.parse(await fs.readFile(manifestPath, 'utf8'));
 
       // Restore database if backed up
       const dbBackupPath = path.join(preRestoreBackupPath, 'database.sql.gz');
@@ -1622,7 +1623,7 @@ END $$;`
    * Download file from S3
    */
   async downloadFileFromS3(s3Url, localPath, s3Config) {
-    const s3PathMatch = s3Url.match(/^s3:\/\/([^\/]+)\/(.+)$/);
+    const s3PathMatch = s3Url.match(/^s3:\/\/([^/]+)\/(.+)$/);
     if (!s3PathMatch) {
       throw new Error('Invalid S3 URL format');
     }

backend/src/services/secureImageService.js

@@ -1,8 +1,6 @@
 const crypto = require('crypto');
 const sharp = require('sharp');
 const { db } = require('../database/db');
-const watermarkService = require('./watermarkService');
-const path = require('path');
 const fs = require('fs').promises;
 const logger = require('../utils/logger');
 

backend/src/services/settingsService.js

@@ -203,18 +203,18 @@ const parseSettingValue = (value, type) => {
   }
 
   switch (type) {
-    case 'boolean':
-      return parseBooleanInput(value, false);
-    case 'number':
-      return parseNumberInput(value, 0);
-    case 'json':
-      try {
-        return JSON.parse(value);
-      } catch {
-        return null;
-      }
-    default:
-      return value;
+  case 'boolean':
+    return parseBooleanInput(value, false);
+  case 'number':
+    return parseNumberInput(value, 0);
+  case 'json':
+    try {
+      return JSON.parse(value);
+    } catch {
+      return null;
+    }
+  default:
+    return value;
   }
 };
 
@@ -230,14 +230,14 @@ const serializeSettingValue = (value, type) => {
   }
 
   switch (type) {
-    case 'boolean':
-      return String(value === true || value === 'true' || value === 1);
-    case 'number':
-      return String(value);
-    case 'json':
-      return JSON.stringify(value);
-    default:
-      return String(value);
+  case 'boolean':
+    return String(value === true || value === 'true' || value === 1);
+  case 'number':
+    return String(value);
+  case 'json':
+    return JSON.stringify(value);
+  default:
+    return String(value);
   }
 };
 

backend/src/services/storage/__tests__/s3Storage.test.js

@@ -51,7 +51,7 @@ describe('S3StorageAdapter', () => {
     });
     
     it('should configure for MinIO with path style', () => {
-      const minioStorage = new S3StorageAdapter({
+      new S3StorageAdapter({
         bucket: 'test-bucket',
         endpoint: 'http://localhost:9000',
         forcePathStyle: true,

backend/src/services/webhookDeliveryWorker.js

@@ -51,7 +51,7 @@ async function fetchPending(limit) {
   const excludeIds = Array.from(inFlight);
   let q = db('webhook_deliveries')
     .where('status', 'pending')
-    .where('next_retry_at', '<=', new Date())
+    .where('next_retry_at', '<=', new Date().toISOString())
     .orderBy('next_retry_at', 'asc')
     .limit(limit);
   if (excludeIds.length > 0) {
@@ -71,7 +71,7 @@ async function deliverOne(row) {
       .update({
         status: 'failed',
         last_error: 'webhook subscription no longer exists',
-        completed_at: new Date(),
+        completed_at: new Date().toISOString(),
         attempt_count: row.attempt_count + 1,
       });
     return;
@@ -85,7 +85,7 @@ async function deliverOne(row) {
       .update({
         status: 'failed',
         last_error: 'webhook is disabled',
-        completed_at: new Date(),
+        completed_at: new Date().toISOString(),
         attempt_count: row.attempt_count + 1,
       });
     return;
@@ -172,10 +172,10 @@ async function deliverOne(row) {
         response_body: truncate(stringifyBody(response.data), RESPONSE_TRUNCATE_BYTES),
         latency_ms: latency,
         attempt_count: newAttempt,
-        completed_at: new Date(),
+        completed_at: new Date().toISOString(),
         next_retry_at: null,
       });
-    await db('webhooks').where({ id: webhook.id }).update({ last_success_at: new Date() });
+    await db('webhooks').where({ id: webhook.id }).update({ last_success_at: new Date().toISOString() });
     return;
   }
 
@@ -194,10 +194,10 @@ async function deliverOne(row) {
         last_error: errorMsg,
         latency_ms: latency,
         attempt_count: newAttempt,
-        completed_at: new Date(),
+        completed_at: new Date().toISOString(),
         next_retry_at: null,
       });
-    await db('webhooks').where({ id: webhook.id }).update({ last_failure_at: new Date() });
+    await db('webhooks').where({ id: webhook.id }).update({ last_failure_at: new Date().toISOString() });
     return;
   }
 
@@ -211,9 +211,9 @@ async function deliverOne(row) {
       last_error: errorMsg,
       latency_ms: latency,
       attempt_count: newAttempt,
-      next_retry_at: new Date(Date.now() + backoff),
+      next_retry_at: new Date(Date.now() + backoff).toISOString(),
     });
-  await db('webhooks').where({ id: webhook.id }).update({ last_failure_at: new Date() });
+  await db('webhooks').where({ id: webhook.id }).update({ last_failure_at: new Date().toISOString() });
 }
 
 async function markFailedFinal(row, reason) {
@@ -223,10 +223,10 @@ async function markFailedFinal(row, reason) {
       status: 'failed',
       last_error: reason,
       attempt_count: row.attempt_count + 1,
-      completed_at: new Date(),
+      completed_at: new Date().toISOString(),
       next_retry_at: null,
     });
-  await db('webhooks').where({ id: row.webhook_id }).update({ last_failure_at: new Date() });
+  await db('webhooks').where({ id: row.webhook_id }).update({ last_failure_at: new Date().toISOString() });
 }
 
 // Schedule the normal retry/backoff for a transient failure that must not
@@ -242,7 +242,7 @@ async function scheduleTransientRetry(row, webhook, errorMsg) {
         status: 'failed',
         last_error: errorMsg,
         attempt_count: newAttempt,
-        completed_at: new Date(),
+        completed_at: new Date().toISOString(),
         next_retry_at: null,
       });
   } else {
@@ -253,10 +253,10 @@ async function scheduleTransientRetry(row, webhook, errorMsg) {
         status: 'pending',
         last_error: errorMsg,
         attempt_count: newAttempt,
-        next_retry_at: new Date(Date.now() + backoff),
+        next_retry_at: new Date(Date.now() + backoff).toISOString(),
       });
   }
-  await db('webhooks').where({ id: webhook.id }).update({ last_failure_at: new Date() });
+  await db('webhooks').where({ id: webhook.id }).update({ last_failure_at: new Date().toISOString() });
 }
 
 function stringifyBody(data) {

backend/src/services/webhookService.js

@@ -190,8 +190,8 @@ async function fire(eventType, data) {
         payload: JSON.stringify(envelope),
         attempt_count: 0,
         status: 'pending',
-        next_retry_at: now,
-        created_at: now,
+        next_retry_at: now.toISOString(),
+        created_at: now.toISOString(),
       });
     }
 
@@ -232,8 +232,8 @@ async function enqueueForWebhook(webhookId, eventType, data) {
       payload: JSON.stringify(envelope),
       attempt_count: 0,
       status: 'pending',
-      next_retry_at: now,
-      created_at: now,
+      next_retry_at: now.toISOString(),
+      created_at: now.toISOString(),
     });
     return { enqueued: true, webhookId: w.id, deliveryId: deliveryUuid };
   } catch (err) {

backend/src/services/workerManager.js

@@ -64,7 +64,7 @@ process.on('uncaughtException', (error) => {
   process.exit(1);
 });
 
-process.on('unhandledRejection', (reason, promise) => {
+process.on('unhandledRejection', (reason) => {
   logger.error('Unhandled rejection in worker manager:', reason);
 });
 

backend/src/services/workflows/engine.js

@@ -72,11 +72,11 @@ function matchFilter(filter, payload) {
   // Strict equality: a filter {value: 0} must NOT match false/''/null (loose ==
   // conflated them). Authors must therefore match the payload's actual type.
   switch (op) {
-    case 'neq': return actual !== value;
-    case 'truthy': return Boolean(actual);
-    case 'falsy': return !actual;
-    case 'eq':
-    default: return actual === value;
+  case 'neq': return actual !== value;
+  case 'truthy': return Boolean(actual);
+  case 'falsy': return !actual;
+  case 'eq':
+  default: return actual === value;
   }
 }
 
@@ -125,84 +125,84 @@ async function advanceRun(runId) {
 
     try {
       switch (node.type) {
-        case 'trigger': {
+      case 'trigger': {
+        const e = outEdge(edges, currentKey, null);
+        nextKey = e ? e.to_node : null;
+        await recordStep(runId, node, 'done', null);
+        break;
+      }
+      case 'condition':
+      case 'branch': {
+        const cond = registry.getCondition(node.config?.condition || 'expr');
+        const result = cond ? await cond(ctx) : false;
+        const handle = result ? (node.config?.trueHandle || 'yes') : (node.config?.falseHandle || 'no');
+        const e = outEdge(edges, currentKey, handle) || outEdge(edges, currentKey, result ? 'true' : 'false');
+        nextKey = e ? e.to_node : null;
+        await recordStep(runId, node, 'done', { result, handle });
+        break;
+      }
+      case 'loop': {
+        const counterKey = `__loop_${node.node_key}`;
+        const count = (Number(context.vars[counterKey]) || 0) + 1;
+        context.vars[counterKey] = count;
+        const max = Number(node.config?.maxIterations ?? node.config?.max ?? 3);
+        const handle = count > max ? (node.config?.exitHandle || 'exit') : (node.config?.loopHandle || 'loop');
+        const e = outEdge(edges, currentKey, handle);
+        nextKey = e ? e.to_node : null;
+        await recordStep(runId, node, 'done', { count, max, handle });
+        break;
+      }
+      case 'wait': {
+        // Dry-run (test-fire): don't park — pass straight through so the whole
+        // flow runs in one shot, recording what it WOULD have waited for.
+        if (context.vars.__dryRun) {
           const e = outEdge(edges, currentKey, null);
           nextKey = e ? e.to_node : null;
-          await recordStep(runId, node, 'done', null);
+          await recordStep(runId, node, 'skipped', { dryRun: true, wouldWaitUntil: computeWakeAt(node.config, context.vars) });
           break;
         }
-        case 'condition':
-        case 'branch': {
-          const cond = registry.getCondition(node.config?.condition || 'expr');
-          const result = cond ? await cond(ctx) : false;
-          const handle = result ? (node.config?.trueHandle || 'yes') : (node.config?.falseHandle || 'no');
-          const e = outEdge(edges, currentKey, handle) || outEdge(edges, currentKey, result ? 'true' : 'false');
+        const wakeAt = computeWakeAt(node.config, context.vars);
+        await db('workflow_runs').where({ id: runId })
+          .update({ status: 'waiting', wake_at: wakeAt, current_node: currentKey, context: JSON.stringify(context) });
+        await recordStep(runId, node, 'waiting', { wake_at: wakeAt });
+        return; // paused — scheduler resumes when wake_at passes
+      }
+      case 'gate': {
+        // Dry-run (test-fire): auto-take the 'confirm' path so the escalation
+        // is exercised end-to-end, without creating an approval / emailing.
+        if (context.vars.__dryRun) {
+          const e = outEdge(edges, currentKey, 'confirm') || outEdge(edges, currentKey, null);
           nextKey = e ? e.to_node : null;
-          await recordStep(runId, node, 'done', { result, handle });
+          await recordStep(runId, node, 'skipped', { dryRun: true, gateAutoConfirm: true });
           break;
         }
-        case 'loop': {
-          const counterKey = `__loop_${node.node_key}`;
-          const count = (Number(context.vars[counterKey]) || 0) + 1;
-          context.vars[counterKey] = count;
-          const max = Number(node.config?.maxIterations ?? node.config?.max ?? 3);
-          const handle = count > max ? (node.config?.exitHandle || 'exit') : (node.config?.loopHandle || 'loop');
-          const e = outEdge(edges, currentKey, handle);
-          nextKey = e ? e.to_node : null;
-          await recordStep(runId, node, 'done', { count, max, handle });
-          break;
-        }
-        case 'wait': {
-          // Dry-run (test-fire): don't park — pass straight through so the whole
-          // flow runs in one shot, recording what it WOULD have waited for.
-          if (context.vars.__dryRun) {
-            const e = outEdge(edges, currentKey, null);
-            nextKey = e ? e.to_node : null;
-            await recordStep(runId, node, 'skipped', { dryRun: true, wouldWaitUntil: computeWakeAt(node.config, context.vars) });
-            break;
-          }
-          const wakeAt = computeWakeAt(node.config, context.vars);
-          await db('workflow_runs').where({ id: runId })
-            .update({ status: 'waiting', wake_at: wakeAt, current_node: currentKey, context: JSON.stringify(context) });
-          await recordStep(runId, node, 'waiting', { wake_at: wakeAt });
-          return; // paused — scheduler resumes when wake_at passes
-        }
-        case 'gate': {
-          // Dry-run (test-fire): auto-take the 'confirm' path so the escalation
-          // is exercised end-to-end, without creating an approval / emailing.
-          if (context.vars.__dryRun) {
-            const e = outEdge(edges, currentKey, 'confirm') || outEdge(edges, currentKey, null);
-            nextKey = e ? e.to_node : null;
-            await recordStep(runId, node, 'skipped', { dryRun: true, gateAutoConfirm: true });
-            break;
-          }
-          await db('workflow_runs').where({ id: runId })
-            .update({ status: 'waiting', wake_at: gateTimeout(node.config), current_node: currentKey, context: JSON.stringify(context) });
-          await recordStep(runId, node, 'waiting', { gate: true });
-          // Optional setup hook (create approval + send admin email) — registered
-          // by the approval phase. Engine still pauses cleanly without it.
-          const setup = registry.getAction('gate_setup');
-          if (setup) {
-            try { await setup(ctx); } catch (e) { logger.error('[workflow] gate setup failed', { runId, error: e.message }); }
-          }
-          return; // paused — an approval (email or inbox) resumes via resumeRun
-        }
-        case 'action':
-        case 'webhook': {
-          const actionKey = node.config?.action || (node.type === 'webhook' ? 'webhook' : 'noop');
-          const action = registry.getAction(actionKey);
-          const result = action ? (await action(ctx)) || {} : { skipped: true, reason: `unknown action ${actionKey}` };
-          if (result.set && typeof result.set === 'object') Object.assign(context.vars, result.set);
-          const e = outEdge(edges, currentKey, null);
-          nextKey = e ? e.to_node : null;
-          await recordStep(runId, node, result.skipped ? 'skipped' : 'done', result);
-          break;
-        }
-        default: {
-          await recordStep(runId, node, 'skipped', { reason: `unknown node type ${node.type}` });
-          const e = outEdge(edges, currentKey, null);
-          nextKey = e ? e.to_node : null;
+        await db('workflow_runs').where({ id: runId })
+          .update({ status: 'waiting', wake_at: gateTimeout(node.config), current_node: currentKey, context: JSON.stringify(context) });
+        await recordStep(runId, node, 'waiting', { gate: true });
+        // Optional setup hook (create approval + send admin email) — registered
+        // by the approval phase. Engine still pauses cleanly without it.
+        const setup = registry.getAction('gate_setup');
+        if (setup) {
+          try { await setup(ctx); } catch (e) { logger.error('[workflow] gate setup failed', { runId, error: e.message }); }
         }
+        return; // paused — an approval (email or inbox) resumes via resumeRun
+      }
+      case 'action':
+      case 'webhook': {
+        const actionKey = node.config?.action || (node.type === 'webhook' ? 'webhook' : 'noop');
+        const action = registry.getAction(actionKey);
+        const result = action ? (await action(ctx)) || {} : { skipped: true, reason: `unknown action ${actionKey}` };
+        if (result.set && typeof result.set === 'object') Object.assign(context.vars, result.set);
+        const e = outEdge(edges, currentKey, null);
+        nextKey = e ? e.to_node : null;
+        await recordStep(runId, node, result.skipped ? 'skipped' : 'done', result);
+        break;
+      }
+      default: {
+        await recordStep(runId, node, 'skipped', { reason: `unknown node type ${node.type}` });
+        const e = outEdge(edges, currentKey, null);
+        nextKey = e ? e.to_node : null;
+      }
       }
     } catch (err) {
       await recordStep(runId, node, 'failed', null, err.message);

backend/src/services/workflows/registry.js

@@ -28,15 +28,15 @@ registerCondition('expr', async (ctx) => {
   const { field, op = 'truthy', value } = ctx.node.config || {};
   const actual = field != null ? ctx.vars[field] : undefined;
   switch (op) {
-    case 'eq': return actual == value; // eslint-disable-line eqeqeq
-    case 'neq': return actual != value; // eslint-disable-line eqeqeq
-    case 'gt': return Number(actual) > Number(value);
-    case 'gte': return Number(actual) >= Number(value);
-    case 'lt': return Number(actual) < Number(value);
-    case 'lte': return Number(actual) <= Number(value);
-    case 'falsy': return !actual;
-    case 'truthy':
-    default: return Boolean(actual);
+  case 'eq': return actual == value; // eslint-disable-line eqeqeq
+  case 'neq': return actual != value; // eslint-disable-line eqeqeq
+  case 'gt': return Number(actual) > Number(value);
+  case 'gte': return Number(actual) >= Number(value);
+  case 'lt': return Number(actual) < Number(value);
+  case 'lte': return Number(actual) <= Number(value);
+  case 'falsy': return !actual;
+  case 'truthy':
+  default: return Boolean(actual);
   }
 });
 

backend/src/utils/__tests__/filenameSanitizer.test.js

@@ -28,9 +28,9 @@ describe('sanitizeFilename — accented characters transliterate via NFD (#607)'
   const legacyBroken = (s) =>
     String(s).trim()
       .replace(/\s+/g, '_')
-      .replace(/[^a-zA-Z0-9_\-\.]/g, '')
-      .replace(/[_\-]{2,}/g, '_')
-      .replace(/^[_\-]+|[_\-]+$/g, '');
+      .replace(/[^a-zA-Z0-9_\-.]/g, '')
+      .replace(/[_-]{2,}/g, '_')
+      .replace(/^[_-]+|[_-]+$/g, '');
 
   it.each([
     ['Ägypten', 'Agypten'],
@@ -138,8 +138,8 @@ describe('sanitizeForContentDisposition — header-safe ASCII fallback', () => {
 describe('buildContentDisposition — RFC 6266 / RFC 5987 dual form', () => {
   it('emits both filename="..." (ASCII) and filename*=UTF-8\'\'... (unicode) for accented names', () => {
     const header = buildContentDisposition('Ägypten.jpg');
-    expect(header).toContain("filename=\"gypten.jpg\"");
-    expect(header).toContain("filename*=UTF-8''%C3%84gypten.jpg");
+    expect(header).toContain('filename="gypten.jpg"');
+    expect(header).toContain('filename*=UTF-8\'\'%C3%84gypten.jpg');
     expect(header.startsWith('attachment;')).toBe(true);
   });
 

backend/src/utils/authSecurity.js

@@ -79,37 +79,37 @@ async function loadSecurityConfigFromSettings() {
     const value = parseStoredValue(row.setting_value);
 
     switch (row.setting_key) {
-      case 'security_max_login_attempts': {
-        config.maxAttempts = normalizePositiveInteger(
-          'security_max_login_attempts',
-          value,
-          DEFAULT_SECURITY_CONFIG.maxAttempts,
-          { min: 1, max: 50 }
-        );
-        break;
-      }
-      case 'security_lockout_duration_minutes': {
-        const minutes = normalizePositiveInteger(
-          'security_lockout_duration_minutes',
-          value,
-          DEFAULT_SECURITY_CONFIG.lockoutDurationMs / (60 * 1000),
-          { min: 1, max: 24 * 60 }
-        );
-        config.lockoutDurationMs = minutes * 60 * 1000;
-        break;
-      }
-      case 'security_attempt_window_minutes': {
-        const minutes = normalizePositiveInteger(
-          'security_attempt_window_minutes',
-          value,
-          DEFAULT_SECURITY_CONFIG.attemptWindowMs / (60 * 1000),
-          { min: 1, max: 24 * 60 }
-        );
-        config.attemptWindowMs = minutes * 60 * 1000;
-        break;
-      }
-      default:
-        break;
+    case 'security_max_login_attempts': {
+      config.maxAttempts = normalizePositiveInteger(
+        'security_max_login_attempts',
+        value,
+        DEFAULT_SECURITY_CONFIG.maxAttempts,
+        { min: 1, max: 50 }
+      );
+      break;
+    }
+    case 'security_lockout_duration_minutes': {
+      const minutes = normalizePositiveInteger(
+        'security_lockout_duration_minutes',
+        value,
+        DEFAULT_SECURITY_CONFIG.lockoutDurationMs / (60 * 1000),
+        { min: 1, max: 24 * 60 }
+      );
+      config.lockoutDurationMs = minutes * 60 * 1000;
+      break;
+    }
+    case 'security_attempt_window_minutes': {
+      const minutes = normalizePositiveInteger(
+        'security_attempt_window_minutes',
+        value,
+        DEFAULT_SECURITY_CONFIG.attemptWindowMs / (60 * 1000),
+        { min: 1, max: 24 * 60 }
+      );
+      config.attemptWindowMs = minutes * 60 * 1000;
+      break;
+    }
+    default:
+      break;
     }
   });
 

backend/src/utils/cssSanitizer.js

@@ -58,6 +58,7 @@ function sanitizeCss(css) {
     sanitized = sanitized.replace(pattern, '');
   });
 
+  // eslint-disable-next-line no-control-regex -- intentional: strips control chars from untrusted CSS
   sanitized = sanitized.replace(/[\u0000-\u001F\u007F]/g, '');
 
   const MAX_LENGTH = 100 * 1024;
@@ -112,6 +113,7 @@ function sanitizeCSS(cssContent) {
   sanitized = sanitized.replace(/<!--[\s\S]*?-->/g, '');
 
   // Remove control characters
+  // eslint-disable-next-line no-control-regex -- intentional: strips control chars from untrusted CSS
   sanitized = sanitized.replace(/[\u0000-\u001F\u007F]/g, '');
 
   // Remove any remaining script-like content

backend/src/utils/feedbackValidation.js

@@ -89,6 +89,7 @@ function sanitizeComment(text) {
   text = text.replace(/[\u200B-\u200D\uFEFF]/g, '');
   
   // Remove control characters
+  // eslint-disable-next-line no-control-regex -- intentional: strips control chars from feedback text
   text = text.replace(/[\x00-\x1F\x7F]/g, '');
   
   // Limit consecutive special characters
@@ -241,7 +242,7 @@ const validateWordFilter = [
     .withMessage('Word must be between 2 and 100 characters'),
   body('severity')
     .optional()
-    .isIn(['mild', 'moderate', 'severe'])
+    .isIn(['low', 'moderate', 'high', 'block'])
     .withMessage('Invalid severity level')
 ];
 

backend/src/utils/fileSecurityUtils.js

@@ -37,8 +37,9 @@ function safePathJoin(basePath, userPath) {
 function isPathSafe(filePath) {
   // Check for common path traversal patterns
   const dangerousPatterns = [
-    /\.\.[\/\\]/,  // ../ or ..\
+    /\.\.[/\\]/,  // ../ or ..\
     /^[A-Za-z]:/,  // Windows drive letters
+    // eslint-disable-next-line no-control-regex -- intentional: detects control chars in paths
     /[\x00-\x1f]/  // Control characters
   ];
   

backend/src/utils/filenameSanitizer.js

@@ -27,13 +27,13 @@ function sanitizeFilename(str, maxLength = 50) {
   sanitized = sanitized.replace(/\s+/g, '_');
 
   // Remove special characters except hyphens, underscores, and dots
-  sanitized = sanitized.replace(/[^a-zA-Z0-9_\-\.]/g, '');
+  sanitized = sanitized.replace(/[^a-zA-Z0-9_\-.]/g, '');
   
   // Remove multiple consecutive underscores or hyphens
-  sanitized = sanitized.replace(/[_\-]{2,}/g, '_');
+  sanitized = sanitized.replace(/[_-]{2,}/g, '_');
   
   // Remove leading/trailing underscores or hyphens
-  sanitized = sanitized.replace(/^[_\-]+|[_\-]+$/g, '');
+  sanitized = sanitized.replace(/^[_-]+|[_-]+$/g, '');
   
   // Limit length
   if (sanitized.length > maxLength) {

backend/src/utils/passwordGenerator.js

@@ -93,7 +93,7 @@ function validatePasswordStrength(password) {
     result.score += 1;
   }
   
-  if (!/[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(password)) {
+  if (!/[!@#$%^&*()_+\-=[\]{}|;:,.<>?]/.test(password)) {
     result.messages.push('Password must contain special characters');
   } else {
     result.score += 1;

backend/src/utils/passwordValidation.js

@@ -66,7 +66,7 @@ function validatePassword(password, options = {}) {
   }
   
   // Check special character requirement
-  if (config.requireSpecialChars && !/[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password)) {
+  if (config.requireSpecialChars && !/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(password)) {
     errors.push('Password must contain at least one special character');
   }
   
@@ -230,7 +230,7 @@ async function validatePasswordInContext(password, context, userData = {}) {
     
     // Only allow date-format passwords when complexity is 'simple'
     if (complexityLevel === 'simple') {
-      const datePattern = /^\d{1,2}[.\/-]\d{1,2}[.\/-]\d{4}$/;
+      const datePattern = /^\d{1,2}[./-]\d{1,2}[./-]\d{4}$/;
       if (datePattern.test(password)) {
         return {
           valid: true,

backend/src/utils/whatsNew.js

@@ -25,7 +25,7 @@ function decodeEntities(s) {
     .replace(/&lt;/g, '<')
     .replace(/&gt;/g, '>')
     .replace(/&quot;/g, '"')
-    .replace(/&#0*39;|&#x0*27;|&apos;/gi, "'")
+    .replace(/&#0*39;|&#x0*27;|&apos;/gi, '\'')
     .replace(/&amp;/g, '&');
 }
 

frontend/i18next.config.ts

@@ -3,19 +3,34 @@ import { typescriptPlugin } from "./scripts/i18nextExtractionHelper";
 
 
 export default defineConfig({
-  locales: ['en', 'de', 'nl', 'pt', 'ru', 'fr'],
+  // Only the locales that are kept at full key parity are managed by the extractor.
+  // nl/pt/ru/fr/sl/es are deliberately partial and rely on `fallbackLng: 'en'`; letting
+  // the extractor own them would fill each file with ~2700 empty-string values, and
+  // i18next's default `returnEmptyString: true` renders those as blank UI instead of
+  // falling back to English.
+  locales: ['en', 'de'],
 
   extract: {
-    input: ['src/**/*.{ts,tsx,js,jsx}', '!src/**/*.{test,spec,d}.{ts,tsx}'],
+    input: ['src/**/*.{ts,tsx,js,jsx}'],
+    // `glob` (used by i18next-cli) ignores `!`-prefixed entries inside `input`,
+    // so exclusions have to live here or they are silently no-ops.
+    ignore: [
+      'src/**/*.{test,spec}.{ts,tsx,js,jsx}',
+      'src/**/__tests__/**',
+      'src/**/*.d.ts',
+    ],
     output: 'src/i18n/locales/{{language}}.json',
     defaultNS: false,
 
     primaryLanguage: 'en',
 
-    removeUnusedKeys: true,
-
-    // Dynamic keys to preserve (e.g.: t(`errors.${code}`))
-    preservePatterns: [],
+    // Pruning is unsafe in this codebase: a large share of keys is never visible to the
+    // AST extractor because it is built at runtime — t(`admin.activities.${type}`),
+    // t(`admin.notificationMessages.${type}`), t(`projects.status.${status}`) — or held in
+    // constant tables the extractor does not resolve (AdminSidebar `nameKey`,
+    // CrmDevelopmentPage `titleKey`/`descKey`, the crmSettings toggle map). Enabling it
+    // deletes ~355 live keys per locale, so removal stays a manual decision.
+    removeUnusedKeys: false,
 
     preserveContextVariants: true,