Regenerate frontend package-lock to match package.json

Regenerate lock file to include missing esbuild platform dependencies
required by newer npm versions.

.drone.yml

@@ -1,114 +0,0 @@
-kind: pipeline
-type: docker
-name: default
-
-steps:
-  # Build Backend Docker Image
-  - name: build-backend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-backend
-      tags: 
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_BRANCH}-latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: registry.local.nothaft.cloud
-      build_args:
-        - VERSION=${DRONE_TAG:-dev}
-      
-  # Build Frontend Docker Image
-  - name: build-frontend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-frontend
-      tags: 
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_BRANCH}-latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: registry.local.nothaft.cloud
-      build_args:
-        - VERSION=${DRONE_TAG:-dev}
-        - VITE_API_URL=${VITE_API_URL:-/api}
-
-trigger:
-  branch:
-    - main
-    - develop
-  event:
-    - push
-    - pull_request
-
----
-kind: pipeline
-type: docker
-name: release
-
-steps:
-  # Build Backend Release
-  - name: build-backend-release
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-backend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: registry.local.nothaft.cloud
-      
-  # Build Frontend Release
-  - name: build-frontend-release
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-frontend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: registry.local.nothaft.cloud
-
-  # -------- NEW: Publish Docker images to GitHub Container Registry --------
-  - name: push-backend-ghcr
-    image: plugins/docker
-    settings:
-      repo: ghcr.io/the-luap/picpeak-backend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: ghcr.io
-      username:
-        from_secret: GITHUB_USERNAME
-      password:
-        from_secret: GITHUB_TOKEN
-      build_args:
-        - VERSION=${DRONE_TAG}
-
-  - name: push-frontend-ghcr
-    image: plugins/docker
-    settings:
-      repo: ghcr.io/the-luap/picpeak-frontend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: ghcr.io
-      username:
-        from_secret: GITHUB_USERNAME
-      password:
-        from_secret: GITHUB_TOKEN
-      build_args:
-        - VERSION=${DRONE_TAG}
-        - VITE_API_URL=${VITE_API_URL:-/api}
-
-
-trigger:
-  event:
-    - tag

.gitea/workflows/mirror-to-github.yml

@@ -1,132 +0,0 @@
-name: Mirror to GitHub
-
-on:
-  workflow_dispatch:  # Allow manual triggering only
-
-jobs:
-  mirror:
-    runs-on: ubuntu-latest
-    # Note: For GitHub fine-grained tokens, ensure the token has:
-    # - Repository access to the-luap/picpeak
-    # - Repository permissions: Contents (Read and Write), Metadata (Read)
-    # For classic tokens: repo scope is sufficient
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0  # Full history for proper mirroring
-
-      - name: Setup Git
-        run: |
-          git config --global user.name "the-luap"
-          git config --global user.email "paul-nothaft@hotmail.de"
-
-      - name: Remove sensitive files and directories
-        run: |
-          echo "Current files before cleanup:"
-          ls -la | head -10 || true
-          echo "..."
-          
-          # Remove sensitive files/directories if they exist
-          echo "Removing sensitive files..."
-          rm -rf .gitea/ || true
-          rm -rf scripts/install-gitea-runner.sh || true
-          rm -rf .drone* || true
-          rm -rf photo-sharing-prd.md || true
-          rm -rf CLAUDE.md || true
-          rm -rf storage/ || true
-          rm -rf events/ || true
-          rm -rf .playwright-mcp/
-          rm -rf .swarm || true
-          rm -rf .claude-flow || true
-
-          
-          echo "Sensitive files removal completed"
-          
-          # Add and commit the cleanup if there are changes
-          git add -A
-          if ! git diff --cached --quiet; then
-            git commit -m "chore: remove sensitive files for GitHub mirror"
-            echo "✅ Committed cleanup of sensitive files"
-          else
-            echo "✅ No sensitive files to remove"
-          fi
-          
-          echo "Final file structure (top level):"
-          ls -la | head -10 || true
-
-      - name: Check GitHub token
-        env:
-          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
-        run: |
-          if [ -z "$GITHUBTOKEN" ]; then
-            echo "ERROR: GITHUBTOKEN secret is not set!"
-            echo "Please add a GitHub Personal Access Token as a secret named GITHUBTOKEN"
-            echo ""
-            echo "For fine-grained tokens:"
-            echo "  - Go to GitHub Settings > Developer settings > Personal access tokens > Fine-grained tokens"
-            echo "  - Create token with repository access to the-luap/picpeak"
-            echo "  - Grant permissions: Contents (Read and Write), Metadata (Read)"
-            echo ""
-            echo "For classic tokens:"
-            echo "  - Go to GitHub Settings > Developer settings > Personal access tokens > Tokens (classic)"
-            echo "  - Create token with 'repo' scope"
-            exit 1
-          else
-            echo "✅ GitHub token is available (length: ${#GITHUBTOKEN})"
-            # Try to detect token type (fine-grained tokens are typically longer)
-            if [ ${#GITHUBTOKEN} -gt 80 ]; then
-              echo "📌 Token appears to be a fine-grained personal access token"
-            else
-              echo "📌 Token appears to be a classic personal access token"
-            fi
-          fi
-
-      - name: Push to GitHub
-        env:
-          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
-          GIT_TRACE: 1  # Enable Git trace for debugging if needed
-        run: |
-          # Remove existing github remote if it exists
-          git remote remove github || true
-          
-          # Configure Git to use the token for authentication
-          # This method works for both classic and fine-grained tokens
-          git config --global url."https://the-luap:${GITHUBTOKEN}@github.com/".insteadOf "https://github.com/"
-          
-          # Add GitHub remote (clean URL without credentials)
-          git remote add github https://github.com/the-luap/picpeak.git
-          
-          # Verify remote was added
-          echo "GitHub remote configuration:"
-          git remote -v
-          
-          # Push to GitHub main branch with error handling
-          echo "Pushing to GitHub..."
-          if git push github main --force 2>&1; then
-            echo "✅ Push to GitHub completed successfully!"
-          else
-            echo "❌ Push to GitHub failed!"
-            echo ""
-            echo "Common issues and solutions:"
-            echo "1. Token permissions: Ensure your token has 'Contents: write' permission"
-            echo "2. Token expiration: Check if your token has expired"
-            echo "3. Repository access: Verify the token has access to the-luap/picpeak repository"
-            echo ""
-            echo "For fine-grained tokens, required permissions:"
-            echo "  - Repository access: the-luap/picpeak"
-            echo "  - Repository permissions: Contents (Read and Write), Metadata (Read)"
-            echo ""
-            echo "For classic tokens, required scope: 'repo'"
-            exit 1
-          fi
-          
-          # Clean up the git config after push
-          git config --global --unset url."https://the-luap:${GITHUBTOKEN}@github.com/".insteadOf
-
-      - name: Workflow completed
-        run: |
-          echo "✅ Mirror to GitHub workflow completed successfully!"
-          echo "📊 Repository mirrored to: https://github.com/the-luap/picpeak"
-          echo "🔒 Sensitive files have been removed from the mirror"
-

.gitea/workflows/test.yml

@@ -1,52 +0,0 @@
-name: Test and Lint
-
-on:
-  push:
-    branches: [ main, develop ]
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  backend-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Install backend dependencies
-        working-directory: ./backend
-        run: npm ci
-      
-      - name: Run backend linting
-        working-directory: ./backend
-        run: npm run lint || true  # Continue on lint errors for now
-      
-      - name: Run backend tests
-        working-directory: ./backend
-        run: npm test || true  # Continue on test failures for now
-  
-  frontend-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm ci --legacy-peer-deps
-      
-      - name: Run frontend linting
-        working-directory: ./frontend
-        run: npm run lint || true  # Continue on lint errors for now
-      
-      - name: Build frontend
-        working-directory: ./frontend
-        run: npm run build

.gitea/workflows/version-and-release.yml

@@ -1,269 +0,0 @@
-name: Version and Release
-
-on:
-  workflow_dispatch:
-
-jobs:
-  version-bump:
-    runs-on: ubuntu-latest
-    outputs:
-      new_version: ${{ steps.version.outputs.new_version }}
-      version_changed: ${{ steps.version.outputs.version_changed }}
-      component_changed: ${{ steps.version.outputs.component_changed }}
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITEA_TOKEN || github.token }}
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Configure Git
-        run: |
-          git config --global user.name 'Gitea Actions Bot'
-          git config --global user.email 'actions@gitea.local'
-      
-      - name: Detect changes and bump version
-        id: version
-        run: |
-          set -e  # Exit on error
-          
-          echo "=== Debug Info ==="
-          echo "GitHub event before: ${{ github.event.before }}"
-          echo "GitHub SHA: ${{ github.sha }}"
-          echo "Current directory: $(pwd)"
-          echo "Git log (last 5): $(git log --oneline -5)"
-          
-          # Get the commit range for changed files
-          if [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ] && [ "${{ github.event.before }}" != "" ]; then
-            COMMIT_RANGE="${{ github.event.before }}..${{ github.sha }}"
-            echo "Using commit range: $COMMIT_RANGE"
-            CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
-          else
-            # First commit or no previous commit, check against HEAD~1 if it exists
-            if git rev-parse HEAD~1 >/dev/null 2>&1; then
-              COMMIT_RANGE="HEAD~1..HEAD"
-              echo "Using commit range: $COMMIT_RANGE"
-              CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
-            else
-              echo "First commit detected, checking all files"
-              CHANGED_FILES=$(git ls-files)
-            fi
-          fi
-          
-          echo "Changed files:"
-          echo "$CHANGED_FILES"
-          
-          # Check what changed (using echo to pipe to grep to avoid grep exit codes)
-          BACKEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^backend/' || echo "0")
-          FRONTEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^frontend/' || echo "0")
-          ROOT_CHANGED=$(echo "$CHANGED_FILES" | grep -c -E '^(package\.json|docker-compose|Dockerfile|scripts/)' || echo "0")
-          
-          echo "Backend files changed: $BACKEND_CHANGED"
-          echo "Frontend files changed: $FRONTEND_CHANGED"
-          echo "Root files changed: $ROOT_CHANGED"
-          
-          # Get current versions
-          BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "1.1.0")
-          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "1.1.0")
-          
-          echo "Current backend version: $BACKEND_VERSION"
-          echo "Current frontend version: $FRONTEND_VERSION"
-          
-          # Determine what to update based on changes
-          BACKEND_UPDATE=false
-          FRONTEND_UPDATE=false
-          COMPONENT_CHANGED="none"
-          
-          if [ "$ROOT_CHANGED" -gt 0 ]; then
-            # Root changes affect both components
-            BACKEND_UPDATE=true
-            FRONTEND_UPDATE=true
-            COMPONENT_CHANGED="both"
-            SOURCE_VERSION=$BACKEND_VERSION
-            echo "Root changes detected - updating both components"
-          elif [ "$BACKEND_CHANGED" -gt 0 ] && [ "$FRONTEND_CHANGED" -gt 0 ]; then
-            # Both components changed
-            BACKEND_UPDATE=true
-            FRONTEND_UPDATE=true
-            COMPONENT_CHANGED="both"
-            # Use the higher version as source
-            if [ "$(printf '%s\n' "$BACKEND_VERSION" "$FRONTEND_VERSION" | sort -V | tail -n1)" = "$BACKEND_VERSION" ]; then
-              SOURCE_VERSION=$BACKEND_VERSION
-            else
-              SOURCE_VERSION=$FRONTEND_VERSION
-            fi
-            echo "Both backend and frontend changed - updating both"
-          elif [ "$BACKEND_CHANGED" -gt 0 ]; then
-            # Only backend changed
-            BACKEND_UPDATE=true
-            COMPONENT_CHANGED="backend"
-            SOURCE_VERSION=$BACKEND_VERSION
-            echo "Only backend changed - updating backend"
-          elif [ "$FRONTEND_CHANGED" -gt 0 ]; then
-            # Only frontend changed
-            FRONTEND_UPDATE=true
-            COMPONENT_CHANGED="frontend"
-            SOURCE_VERSION=$FRONTEND_VERSION
-            echo "Only frontend changed - updating frontend"
-          else
-            echo "No relevant changes detected"
-            echo "version_changed=false" >> $GITHUB_OUTPUT
-            echo "component_changed=none" >> $GITHUB_OUTPUT
-            echo "new_version=" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-          
-          echo "Component changed: $COMPONENT_CHANGED"
-          echo "Source version: $SOURCE_VERSION"
-          echo "Backend update: $BACKEND_UPDATE"
-          echo "Frontend update: $FRONTEND_UPDATE"
-          
-          # Calculate new version
-          IFS='.' read -r -a version_parts <<< "$SOURCE_VERSION"
-          MAJOR="${version_parts[0]}"
-          MINOR="${version_parts[1]}"
-          PATCH="${version_parts[2]}"
-          
-          # Increment patch version and ensure tag uniqueness
-          git fetch --tags --quiet || true
-          NEW_PATCH=$((PATCH + 1))
-          NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
-          
-          while git rev-parse "v${NEW_VERSION}" >/dev/null 2>&1; do
-            echo "Tag v${NEW_VERSION} already exists, bumping patch version again"
-            NEW_PATCH=$((NEW_PATCH + 1))
-            NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
-          done
-          
-          echo "New version: $NEW_VERSION"
-          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
-          echo "component_changed=$COMPONENT_CHANGED" >> $GITHUB_OUTPUT
-          
-          # Update versions in package.json files
-          if [ "$BACKEND_UPDATE" = true ]; then
-            echo "Updating backend version to $NEW_VERSION"
-            cd backend && npm version $NEW_VERSION --no-git-tag-version
-            cd ..
-          fi
-          
-          if [ "$FRONTEND_UPDATE" = true ]; then
-            echo "Updating frontend version to $NEW_VERSION"
-            cd frontend && npm version $NEW_VERSION --no-git-tag-version
-            cd ..
-          fi
-          
-          # Check if there are changes to commit
-          if [[ -n $(git status --porcelain) ]]; then
-            echo "version_changed=true" >> $GITHUB_OUTPUT
-          else
-            echo "version_changed=false" >> $GITHUB_OUTPUT
-          fi
-      
-      - name: Commit version bump
-        if: steps.version.outputs.version_changed == 'true'
-        run: |
-          set -e  # Exit on any error
-          
-          # First, ensure we have the latest changes
-          echo "Fetching latest changes..."
-          git fetch origin main
-          
-          # Check if we're behind and need to update
-          LOCAL=$(git rev-parse HEAD)
-          REMOTE=$(git rev-parse origin/main)
-          
-          if [ "$LOCAL" != "$REMOTE" ]; then
-            echo "Local is behind remote, pulling changes..."
-            git pull origin main --no-rebase
-          fi
-          
-          COMPONENT="${{ steps.version.outputs.component_changed }}"
-          
-          if [ "$COMPONENT" = "both" ]; then
-            git add backend/package.json backend/package-lock.json frontend/package.json frontend/package-lock.json
-            git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }} (backend + frontend)"
-          elif [ "$COMPONENT" = "backend" ]; then
-            git add backend/package.json backend/package-lock.json
-            git commit -m "chore: bump backend version to ${{ steps.version.outputs.new_version }}"
-          elif [ "$COMPONENT" = "frontend" ]; then
-            git add frontend/package.json frontend/package-lock.json
-            git commit -m "chore: bump frontend version to ${{ steps.version.outputs.new_version }}"
-          fi
-          
-          # Pull latest changes before pushing to avoid conflicts
-          echo "Pulling latest changes from origin/main..."
-          if ! git pull --rebase origin main; then
-            echo "Rebase failed, attempting to resolve..."
-            # If rebase fails, abort and try a regular merge
-            git rebase --abort || true
-            git pull origin main --no-rebase
-          fi
-          
-          # Push the changes with retry logic
-          echo "Pushing version bump..."
-          PUSH_SUCCESS=false
-          
-          for i in 1 2 3; do
-            echo "Push attempt $i of 3..."
-            
-            # Try to push
-            if git push origin main 2>&1; then
-              echo "Successfully pushed version bump on attempt $i"
-              PUSH_SUCCESS=true
-              break
-            else
-              echo "Push failed on attempt $i"
-              
-              if [ $i -lt 3 ]; then
-                echo "Waiting 5 seconds before retry..."
-                sleep 5
-                
-                echo "Pulling latest changes..."
-                git fetch origin main
-                
-                # Try rebase first, fall back to merge
-                if ! git rebase origin/main; then
-                  echo "Rebase failed, trying merge..."
-                  git rebase --abort 2>/dev/null || true
-                  git pull origin main --no-rebase
-                fi
-              fi
-            fi
-          done
-          
-          if [ "$PUSH_SUCCESS" = "false" ]; then
-            echo "ERROR: Failed to push after 3 attempts"
-            exit 1
-          fi
-      
-      - name: Create Git tag
-        if: steps.version.outputs.version_changed == 'true'
-        run: |
-          COMPONENT="${{ steps.version.outputs.component_changed }}"
-          
-          if [ "$COMPONENT" = "both" ]; then
-            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend + frontend)"
-          elif [ "$COMPONENT" = "backend" ]; then
-            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend)"
-          elif [ "$COMPONENT" = "frontend" ]; then
-            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (frontend)"
-          fi
-          
-          git tag -a "v${{ steps.version.outputs.new_version }}" -m "$TAG_MESSAGE"
-          git push origin "v${{ steps.version.outputs.new_version }}"
-  
-  trigger-drone:
-    needs: version-bump
-    if: needs.version-bump.outputs.version_changed == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger Drone Build
-        run: |
-          echo "Version bumped to ${{ needs.version-bump.outputs.new_version }}"
-          echo "Component(s) changed: ${{ needs.version-bump.outputs.component_changed }}"
-          echo "Drone will automatically trigger on the new tag"
-          # Drone CI will automatically trigger on the tag push event

.github/workflows/docker-build.yml

@@ -31,15 +31,26 @@ jobs:
       contents: read
       packages: write
       security-events: write
-    
+
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
 
+    - name: Determine build platforms
+      id: platforms
+      run: |
+        # For PRs, build only amd64 to avoid QEMU emulation issues with Sharp
+        # For main/develop/tags, build multi-arch
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
+        else
+          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
+        fi
+
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
       with:
-        platforms: linux/amd64,linux/arm64
+        platforms: ${{ steps.platforms.outputs.platforms }}
 
     - name: Log in to Container Registry
       if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
@@ -67,7 +78,7 @@ jobs:
           type=semver,pattern={{version}}
           type=semver,pattern={{major}}.{{minor}}
           type=semver,pattern={{major}}
-          type=sha,prefix={{branch}}-,format=short
+          type=sha,format=short
           type=raw,value=latest,enable={{is_default_branch}}
 
     - name: Build and push Backend Docker image
@@ -79,7 +90,7 @@ jobs:
         push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
         tags: ${{ steps.meta-backend.outputs.tags }}
         labels: ${{ steps.meta-backend.outputs.labels }}
-        platforms: linux/amd64,linux/arm64
+        platforms: ${{ steps.platforms.outputs.platforms }}
         cache-from: type=gha,scope=backend
         cache-to: type=gha,mode=max,scope=backend
         build-args: |
@@ -111,15 +122,26 @@ jobs:
       contents: read
       packages: write
       security-events: write
-    
+
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
 
+    - name: Determine build platforms
+      id: platforms
+      run: |
+        # For PRs, build only amd64 to avoid QEMU emulation issues
+        # For main/develop/tags, build multi-arch
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
+        else
+          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
+        fi
+
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
       with:
-        platforms: linux/amd64,linux/arm64
+        platforms: ${{ steps.platforms.outputs.platforms }}
 
     - name: Log in to Container Registry
       if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
@@ -147,7 +169,7 @@ jobs:
           type=semver,pattern={{version}}
           type=semver,pattern={{major}}.{{minor}}
           type=semver,pattern={{major}}
-          type=sha,prefix={{branch}}-,format=short
+          type=sha,format=short
           type=raw,value=latest,enable={{is_default_branch}}
 
     - name: Build and push Frontend Docker image
@@ -159,7 +181,7 @@ jobs:
         push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
         tags: ${{ steps.meta-frontend.outputs.tags }}
         labels: ${{ steps.meta-frontend.outputs.labels }}
-        platforms: linux/amd64,linux/arm64
+        platforms: ${{ steps.platforms.outputs.platforms }}
         cache-from: type=gha,scope=frontend
         cache-to: type=gha,mode=max,scope=frontend
         build-args: |

.gitignore

@@ -75,6 +75,7 @@ certbot/
 
 # Ignore local contributor guide copy
 AGENTS.md
+CLAUDE.md
 
 # Local artifacts from browser tooling
 .playwright-mcp/

CLAUDE.md

@@ -1,386 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Product Overview
-
-A secure photo sharing platform designed for weddings and events, enabling photographers to share time-limited, password-protected galleries. The platform features automatic expiration, archiving, and a scrappbook.de-inspired modern, minimalist UI.
-
-## Architecture Overview
-
-- **Backend**: Node.js/Express API with SQLite/PostgreSQL, file-based photo storage
-- **Frontend**: React SPA with scrappbook.de-style design (requires implementation)
-- **Storage**: File-based with active/archived separation
-- **Services**: Background workers for email, archiving, file watching, and expiration monitoring
-- **Analytics**: Umami integration for engagement tracking
-
-## Essential Commands
-
-### Backend Development
-```bash
-cd backend
-npm install               # Install dependencies
-npm run migrate          # Initialize database schema
-npm run dev              # Start with hot-reload (port 3001)
-npm test                 # Run Jest tests
-npm run lint             # ESLint checks
-```
-
-### Running a Single Test
-```bash
-cd backend
-npm test -- path/to/test.test.js
-npm test -- --testNamePattern="test name"
-```
-
-### Production Deployment
-See [DEPLOYMENT_GUIDE.md](./DEPLOYMENT_GUIDE.md) for comprehensive deployment instructions including:
-- Docker Compose deployment
-- PM2 deployment
-- Manual installation
-- Non-nginx deployment options
-- SSL/HTTPS setup
-- Troubleshooting guide
-
-**⚠️ CRITICAL PRODUCTION NOTICE:**
-- Production runs on a SEPARATE SERVER - never assume local changes affect production
-- ALWAYS request production server details before any troubleshooting
-- NO trial-and-error approaches in production - data loss is unacceptable
-- Every change must be thoroughly analyzed and tested locally first
-
-## Key Product Requirements (from PRD)
-
-### Core Features
-1. **File-Based System**: Drop photos in folders → automatic gallery creation
-2. **Automatic Expiration**: Default 30 days, with 7-day warning emails
-3. **Password Protection**: Secure access with customizable passwords
-4. **Automatic Archiving**: ZIP compression and storage after expiration
-5. **Email Notifications**: Creation, warning, and expiration notifications
-6. **Analytics**: Umami tracking for views, downloads, and engagement
-
-### Folder Structure
-```
-/events/
-  ├── active/
-  │   ├── wedding-smith-jones-2024-06-15/
-  │   │   ├── collages/
-  │   │   └── individual/
-  │   └── birthday-emma-2024-07-20/
-  └── archived/
-      └── wedding-smith-jones-2024-06-15.zip
-```
-
-## Frontend Implementation Requirements
-
-### Design Style (scrappbook.de-inspired)
-- **Color Palette**: Primary green (#5C8762), neutral backgrounds
-- **Typography**: Clean, modern sans-serif (Noto Sans or similar)
-- **Layout**: Minimalist, modular sections with grid-based photo displays
-- **Aesthetic**: Professional yet approachable, photographer-focused
-
-### Key Frontend Components to Build
-1. **Landing Page**: Password entry with event preview
-2. **Gallery View**: 
-   - Responsive photo grid with lazy loading
-   - Toggle between collages/individual photos
-   - Prominent expiration banner
-   - Download urgency indicators
-3. **Photo Lightbox**: Full-screen viewing with zoom
-4. **Mobile-First**: Responsive design with touch gestures
-5. **Personalization**: Dynamic theming per event type
-
-### User Experience Priorities
-- Clear expiration warnings (sticky banner)
-- One-click "Download All" for urgent galleries
-- Smooth image loading with skeleton screens
-- Intuitive navigation between photo categories
-- Professional presentation matching photographer branding
-
-## Key Architecture Patterns
-
-### Authentication Flow
-- JWT-based with separate tokens for admin and gallery access
-- Gallery tokens include event-specific claims
-- Auth middleware: `backend/src/middleware/auth.js`
-  - `adminAuth` - Admin panel protection
-  - `photoAuth` - Protected photo access  
-  - `verifyGalleryAccess` - Gallery-specific validation
-
-### Database Schema (Knex/SQLite)
-Main tables:
-- `events` - Gallery metadata with expiration, custom messages, themes
-- `photos` - Photo records linked to events
-- `access_logs` - IP-based usage tracking
-- `email_queue` - Async email processing
-- `admin_users` - Admin authentication
-
-### Service Architecture
-Background services run as separate processes:
-- **emailService**: Processes email queue with retry logic
-- **archiveService**: Creates ZIP archives of expired events
-- **expirationChecker**: Cron job for expiration warnings
-- **fileWatcher**: Monitors for new photo uploads
-- **backupService**: Scheduled backups with checksum-based change detection
-
-### API Structure
-- `/api/admin/*` - Admin panel endpoints (requires adminAuth)
-- `/api/gallery/*` - Public gallery endpoints  
-- `/api/auth/*` - Authentication endpoints
-- Rate limiting: 100 req/15min (general), 5 req/15min (auth)
-
-## Critical Implementation Notes
-
-1. **Security**: All gallery access requires valid JWT with event-specific claims
-2. **Expiration**: Events auto-expire based on `expires_at`, with 7-day email warnings
-3. **Email Queue**: Async processing with retry logic, check `email_queue` table
-4. **File Processing**: Sharp library for thumbnail generation (300x300)
-5. **Frontend Status**: Only skeleton exists - requires full implementation based on PRD
-6. **Umami Analytics**: Track password entries, downloads, views, expiration warnings
-
-## Troubleshooting Guidelines
-
-### Before ANY Production Troubleshooting:
-1. **ALWAYS request specific details**:
-   - Production server URL/IP
-   - Current error messages/logs
-   - Recent changes or deployments
-   - Affected users/galleries
-   - Time of issue occurrence
-
-2. **Thorough Analysis Required**:
-   - Use detailed thinking/analysis for EVERY troubleshooting task
-   - Review all related code before suggesting changes
-   - Consider all potential side effects
-   - Never make assumptions about production environment
-
-3. **Safe Troubleshooting Steps**:
-   - First, reproduce issue in local/dev environment
-   - Analyze logs without modifying production
-   - Create detailed action plan before any changes
-   - Always have rollback strategy ready
-   - Document every step taken
-
-### Common Issues & Safe Approaches:
-- **Email not sending**: Check email_queue table, SMTP settings, service status
-- **Photos not loading**: Verify file permissions, storage paths, nginx config
-- **Gallery access issues**: Check JWT tokens, expiration dates, access_logs
-- **Performance problems**: Analyze with monitoring tools first, never experiment
-
-### Data Safety Rules:
-- NEVER delete or modify production data without explicit backup confirmation
-- ALWAYS verify backups exist before any data operations
-- NO direct database modifications without transaction safety
-- Log all actions for audit trail
-
-## Environment Variables
-
-### Backend (.env)
-- `JWT_SECRET` - Token signing
-- `ADMIN_URL`, `FRONTEND_URL` - CORS origins
-- `SMTP_*` - Email configuration
-- `DB_*` - PostgreSQL credentials (production)
-- `UMAMI_URL` - Umami instance URL (for server-side tracking)
-- `UMAMI_WEBSITE_ID` - Website ID from Umami
-
-### Frontend (.env)
-- `VITE_API_URL` - Backend API URL
-- `VITE_UMAMI_URL` - Umami analytics URL
-- `VITE_UMAMI_WEBSITE_ID` - Website ID from Umami
-- `VITE_UMAMI_SHARE_URL` - (Optional) Public share URL for embedded dashboard
-
-## Testing Approach
-- Jest with Supertest for API testing
-- Test files in `__tests__` directories
-- Database migrations run before tests
-- Mock email sending in tests
-
-## Umami Analytics Integration
-
-The frontend includes comprehensive Umami analytics integration for tracking user behavior and gallery performance.
-
-### Tracked Events:
-- **Gallery Events**:
-  - `gallery_password_entry` - Password attempts (success/failure)
-  - `gallery_photo_view` - Individual photo views
-  - `gallery_photo_download` - Single photo downloads
-  - `gallery_bulk_download` - Bulk/all photo downloads
-  - `gallery_expired` - Expired gallery access attempts
-- **Admin Events**:
-  - `admin_login` - Admin authentication
-  - `admin_event_created` - New event creation
-  - `admin_event_archived` - Event archiving
-  - `admin_event_deleted` - Event deletion
-  - `admin_settings_updated` - Settings changes
-- **User Behavior**:
-  - Search queries (with debouncing)
-  - Expiration warning views
-  - Page views with automatic tracking
-
-### Setup:
-1. Install Umami (self-hosted or cloud)
-2. Create a website in Umami dashboard
-3. Set environment variables:
-   ```
-   VITE_UMAMI_URL=https://your-umami-instance.com
-   VITE_UMAMI_WEBSITE_ID=your-website-id
-   VITE_UMAMI_SHARE_URL=https://your-umami-instance.com/share/...
-   ```
-
-### Analytics Dashboard:
-- Admin panel includes analytics page at `/admin/analytics`
-- Summary view with key metrics
-- Option to embed full Umami dashboard
-- Real-time event tracking
-
-## Accessibility & Performance Features
-
-### Accessibility (WCAG 2.1 AA Compliance)
-- **Error Boundaries**: Graceful error handling with recovery options
-- **Skip Links**: Skip to main content for keyboard navigation
-- **ARIA Labels**: Proper labeling for screen readers
-- **Focus Management**: Focus trap in modals, visible focus indicators
-- **Keyboard Navigation**: Full keyboard support in gallery lightbox (arrows, escape, +/-, d for download)
-- **Loading States**: Skeleton screens instead of spinners for better UX
-- **Offline Support**: Visual indicator when offline
-- **Form Validation**: Accessible error messages with aria-describedby
-
-### Performance Optimizations
-- **Lazy Loading**: Images load on scroll with Intersection Observer
-- **Skeleton Screens**: Instant visual feedback during loading
-- **Error Recovery**: Component-level error boundaries prevent full page crashes
-- **Optimistic Updates**: Immediate UI updates with background sync
-- **Debounced Search**: Prevents excessive API calls
-- **Analytics**: Non-blocking Umami integration
-
-### Component Library Enhancements
-- `<ErrorBoundary>` - Catches and displays errors gracefully
-- `<PageErrorBoundary>` - Full-page error recovery
-- `<Skeleton>` - Flexible skeleton loader with variants
-- `<OfflineIndicator>` - Network status monitoring
-- `<SkipLink>` - Accessibility navigation
-- `useFocusTrap` - Modal focus management hook
-- `useOnlineStatus` - Network status hook
-
-## Theme System & Branding
-
-### Theme Features
-- **Dynamic Theming**: CSS variables for runtime theme switching
-- **Preset Themes**: Default, Wedding, Birthday, Corporate, Minimal
-- **Customization Options**:
-  - Primary/Accent/Background/Text colors
-  - Font family selection
-  - Border radius (none, sm, md, lg)
-  - Custom logo upload
-  - Custom CSS injection
-- **Event-Specific Themes**: Override global theme per gallery
-- **Live Preview**: Real-time theme changes in admin panel
-
-### Theme Context API
-```typescript
-const { theme, setTheme, setThemeByName } = useTheme();
-```
-
-### Branding Settings
-- Company name, tagline, and support email
-- Custom footer text
-- Optional watermarking on downloads
-- Logo upload for gallery header
-
-### CSS Variables
-```css
---color-primary: #5C8762;
---color-primary-light: #7aa583;
---color-primary-dark: #4a6f4f;
---color-accent: #22c55e;
---color-background: #fafafa;
---color-text: #171717;
---font-family: 'Inter', sans-serif;
---border-radius: 0.5rem;
-```
-
-## Backup Service
-
-### Overview
-The backup service provides automated, scheduled backups of all photo data with checksum-based change detection to minimize transfer overhead.
-
-### Features
-- **Multiple Destinations**: Local directory, remote server (rsync), S3-compatible storage
-- **Change Detection**: SHA256 checksums track file changes, only modified files are backed up
-- **Scheduled Execution**: Configurable cron-based scheduling (default: 2 AM daily)
-- **Email Notifications**: Alerts on backup failure, optional success notifications
-- **Retention Management**: Automatic cleanup of old backup runs based on retention policy
-- **Progress Tracking**: Database storage of backup history, file states, and statistics
-
-### Configuration
-Backup settings are stored in `app_settings` table with `backup_` prefix:
-- `backup_enabled`: Enable/disable the service
-- `backup_schedule`: Cron expression (e.g., '0 2 * * *')
-- `backup_destination_type`: 'local', 'rsync', or 's3'
-- `backup_retention_days`: How long to keep backup history
-- `backup_include_archived`: Whether to backup archived events
-- `backup_exclude_patterns`: File patterns to exclude
-
-### API Endpoints
-- `GET /api/admin/backup/config` - Get current configuration
-- `PUT /api/admin/backup/config` - Update configuration
-- `GET /api/admin/backup/status` - Get backup status and history
-- `POST /api/admin/backup/run` - Trigger manual backup
-- `POST /api/admin/backup/test-connection` - Test destination connectivity
-
-### Testing
-Run backup service test: `npm run test-backup`
-
-### Database Tables
-- `backup_runs`: Tracks each backup execution with statistics
-- `backup_file_states`: Stores file checksums for change detection
-
-## Thumbnail Generation
-
-### Square Thumbnail Implementation (Issue #12 Fix)
-The system now generates **square 300x300px thumbnails** to prevent blurry/stretched images in the gallery grid:
-
-- **Problem**: Previously generated 300px width with proportional height (e.g., 300x200 for 3:2 photos), but CSS forced square display causing distortion
-- **Solution**: Thumbnails now use `cover` fit mode to crop to exact 300x300px dimensions with center positioning
-- **Configuration**: Settings stored in `app_settings` table with keys: `thumbnail_width`, `thumbnail_height`, `thumbnail_fit`, `thumbnail_quality`, `thumbnail_format`
-- **Migration**: Run `040_add_thumbnail_settings.js` to add default square thumbnail settings
-- **Regeneration Script**: Use `scripts/regenerate-square-thumbnails.js` to update existing thumbnails
-
-### Thumbnail Settings API
-- `GET /api/admin/thumbnails/settings` - Get current thumbnail configuration
-- `PUT /api/admin/thumbnails/settings` - Update thumbnail settings (requires regeneration)
-- `POST /api/admin/thumbnails/regenerate` - Regenerate all thumbnails with new settings
-- `GET /api/admin/thumbnails/regenerate/status` - Check regeneration progress
-
-## Success Metrics (from PRD)
-- Time to generate gallery: <2 minutes
-- Guest satisfaction: >90%
-- System uptime: 99.9%
-- Email delivery rate: >98%
-- Successful archiving: 100%
-
-## Documentation & Development Practices
-
-### Documentation Guidelines:
-- **NEVER create new documentation files for simple tasks**
-- **ALWAYS update existing documentation (like this CLAUDE.md)**
-- Only create new .md files when explicitly requested
-- Avoid creating temporary scripts for one-off tasks
-
-### Development Best Practices:
-- Test all changes thoroughly in local environment first
-- Use version control for all changes
-- Keep commits atomic and well-described
-- Review impact on all integrated services
-- Consider backward compatibility
-- Update tests when changing functionality
-
-### Production Deployment Checklist:
-- [ ] All tests passing locally
-- [ ] Linting and type checks pass
-- [ ] Database migrations tested with rollback plan
-- [ ] Environment variables documented
-- [ ] Backup strategy confirmed
-- [ ] Monitoring alerts configured
-- [ ] Rollback procedure documented
-- [ ] Stakeholders notified of maintenance window
-- always use docker deployment for testing

DEPLOYMENT_GUIDE.md

@@ -7,9 +7,9 @@ This guide covers multiple deployment options for PicPeak, from simple local set
 For the easiest installation without Docker or complex configurations, use our **unified setup script**:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/setup.sh -o setup.sh && \
-chmod +x setup.sh && \
-sudo ./setup.sh
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
+chmod +x picpeak-setup.sh && \
+sudo ./picpeak-setup.sh
 ```
 
 This automated script handles everything including:
@@ -219,14 +219,17 @@ Update `.env` with:
 - **URL Configuration** (for backend CORS):
   - `FRONTEND_URL` - Frontend origin (use full URL with scheme, no trailing slash)
     - Example (Docker): `http://localhost:3000`
-  - `ADMIN_URL` - Admin origin (same as `FRONTEND_URL` for Docker; full URL, no trailing slash)
-    - Example (Docker): `http://localhost:3000`
+- `ADMIN_URL` - Admin origin (same as `FRONTEND_URL` for Docker; full URL, no trailing slash)
+  - Example (Docker): `http://localhost:3000`
   
   Notes:
   - Do not include trailing `/` (e.g., use `http://host:3000`, not `http://host:3000/`).
   - Always include the scheme (`http://` or `https://`).
   - The backend compares origins strictly for CORS; malformed values will cause login requests to fail with 500.
 
+#### Authentication Security
+- Configure login attempt thresholds from **Admin → Settings → Security**. Defaults are 5 failed attempts per IP within 15 minutes, resulting in a 30 minute lockout.
+
 #### External Database Example
 To use an external PostgreSQL instead of the bundled container, set the following in `.env` and ensure the `postgres` service is disabled or removed:
 
@@ -424,10 +427,10 @@ If you lose your admin credentials after the first login, you'll need to manuall
 
 ```bash
 # Native reinstall example
-sudo ./setup.sh --native --force-admin-password-reset
+sudo ./picpeak-setup.sh --native --force-admin-password-reset
 
 # Docker reinstall example
-sudo ./setup.sh --docker --force-admin-password-reset
+sudo ./picpeak-setup.sh --docker --force-admin-password-reset
 ```
 
 The flag calls `scripts/reset-admin-password.js` in non-interactive mode, writes a fresh random password into `data/ADMIN_CREDENTIALS.txt`, and prints the new credentials at the end of the installer run.

README.md

@@ -85,6 +85,8 @@ Note on Docker file permissions (PUID/PGID)
 
 - 📘 [**Deployment Guide**](DEPLOYMENT_GUIDE.md) - Detailed installation instructions
   - Includes the new [External Media Library](DEPLOYMENT_GUIDE.md#external-media-library) reference mode
+- 📚 [**Admin API (OpenAPI)**](docs/picpeak-admin-api.openapi.yaml) - Machine-readable documentation for event automation endpoints
+- 🛠️ [**Admin API Quickstart**](docs/admin-api-quickstart.md) - Step-by-step authentication and testing guide for the documented endpoints
 - 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
 - 📜 [**License**](LICENSE) - MIT License
 - 🔒 [**Security**](SECURITY.md) - Security policies
@@ -133,6 +135,31 @@ Perfect for:
 - **Docker**: v20.10.0+
 - **Docker Compose**: v2.0.0+
 
+### Video Support Requirements
+When enabling video uploads, consider these additional resources:
+
+| Resource | Recommendation | Notes |
+|----------|----------------|-------|
+| **RAM** | 4GB+ recommended | FFmpeg processing requires more memory |
+| **Storage** | Plan for 10-100x more | Videos are significantly larger than images |
+| **CPU** | Additional cores help | Video thumbnail extraction is CPU-intensive |
+| **Bandwidth** | Higher throughput | Video streaming requires more bandwidth |
+
+**Technical Notes:**
+- FFmpeg is bundled via npm (`@ffmpeg-installer/ffmpeg`) - no system installation required
+- Maximum upload size: **10GB per video file**
+- Chunked upload support for files >100MB (resumable uploads)
+- Supported formats: MP4, WebM, MOV, AVI
+- Video thumbnails are automatically generated from the first few seconds
+
+**For Nginx/Reverse Proxy:**
+If using Nginx, increase the client max body size:
+```nginx
+client_max_body_size 10G;
+proxy_read_timeout 3600;
+proxy_send_timeout 3600;
+```
+
 ## 🤝 Contributing
 
 We love contributions! PicPeak is built by photographers, for photographers. Whether you're fixing bugs, adding features, or improving documentation, your help is welcome.
@@ -220,7 +247,7 @@ These features are currently in beta testing and may have limited functionality
 | **Gallery Templates** | Additional gallery layouts and themes (masonry, slideshow, story-style) for different event types | Medium | 🔄 Open |
 | **Face Recognition** | AI-powered face detection to help guests find their photos and create automatic person-based albums | Low | 🔄 Open |
 | **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | ✅ Implemented |
-| **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | 🔄 Open |
+| **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | ✅ Implemented |
 | **Multiple Administrators** | Support for multiple admin accounts with role-based permissions and activity tracking | Low | 📋 Planned |
 | **Filtering & Export Options** | Add filters to show only rated, liked, or marked photos and export filtered selections for Capture One or Lightroom workflows | Low | 🔄 Open |
 

SIMPLE_SETUP.md

@@ -8,9 +8,9 @@ This guide provides easy installation instructions for PicPeak on Linux servers
 
 ```bash
 # Download and run the unified setup script
-curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/setup.sh -o setup.sh && \
-chmod +x setup.sh && \
-sudo ./setup.sh
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
+chmod +x picpeak-setup.sh && \
+sudo ./picpeak-setup.sh
 ```
 
 The script will automatically detect your environment and recommend the best installation method.
@@ -21,7 +21,7 @@ The script will automatically detect your environment and recommend the best ins
 Best for: Most users, easy updates, isolated environment
 
 ```bash
-sudo ./setup.sh --docker
+sudo ./picpeak-setup.sh --docker
 ```
 
 **Pros:**
@@ -38,7 +38,7 @@ sudo ./setup.sh --docker
 Best for: Resource-constrained systems, Raspberry Pi, direct control
 
 ```bash
-sudo ./setup.sh --native
+sudo ./picpeak-setup.sh --native
 ```
 
 **Pros:**
@@ -73,7 +73,7 @@ sudo ./setup.sh --native
 
 ### Interactive Mode (Default)
 ```bash
-sudo ./setup.sh
+sudo ./picpeak-setup.sh
 ```
 
 The script will prompt you to choose:
@@ -87,7 +87,7 @@ The script will prompt you to choose:
 
 #### Docker with full configuration:
 ```bash
-sudo ./setup.sh --docker --unattended \
+sudo ./picpeak-setup.sh --docker --unattended \
   --domain photos.example.com \
   --email admin@example.com \
   --admin-password SecurePass123 \
@@ -100,7 +100,7 @@ sudo ./setup.sh --docker --unattended \
 
 #### Native with minimal configuration:
 ```bash
-sudo ./setup.sh --native --unattended \
+sudo ./picpeak-setup.sh --native --unattended \
   --email admin@example.com \
   --admin-password SecurePass123
 ```
@@ -293,7 +293,7 @@ sudo systemctl restart picpeak-backend picpeak-workers
 
 # Update PicPeak
 # (reruns migrations to pick up schema fixes for native installs)
-sudo ./setup.sh --update
+sudo ./picpeak-setup.sh --update
 ```
 
 ## ⚙️ Configuration
@@ -385,14 +385,14 @@ docker compose pull
 docker compose up -d
 
 # Native
-sudo ./setup.sh --update
+sudo ./picpeak-setup.sh --update
 ```
 
 ### Uninstall
 
 ```bash
 # Will prompt for confirmation and data removal options
-sudo ./setup.sh --uninstall
+sudo ./picpeak-setup.sh --uninstall
 ```
 
 ## 🐛 Troubleshooting
@@ -508,13 +508,13 @@ sudo systemctl restart picpeak-backend
 ### Home/Office Network
 ```bash
 # Simple local setup without domain
-sudo ./setup.sh --native --email admin@local.com
+sudo ./picpeak-setup.sh --native --email admin@local.com
 ```
 
 ### Public Website with HTTPS
 ```bash
 # Full production setup
-sudo ./setup.sh --docker \
+sudo ./picpeak-setup.sh --docker \
   --domain photos.company.com \
   --email admin@company.com \
   --enable-ssl
@@ -523,7 +523,7 @@ sudo ./setup.sh --docker \
 ### Raspberry Pi Setup
 ```bash
 # Optimized for ARM devices
-sudo ./setup.sh --native \
+sudo ./picpeak-setup.sh --native \
   --port 8080 \
   --email pi@local.com
 ```

backend/Dockerfile

@@ -11,13 +11,16 @@ LABEL org.opencontainers.image.source="https://github.com/the-luap/picpeak"
 LABEL org.opencontainers.image.description="PicPeak Backend Service"
 LABEL org.opencontainers.image.licenses="MIT"
 
+# Upgrade npm to fix glob CVE-2025-64756 vulnerability
+RUN npm install -g npm@latest
+
 WORKDIR /app
 
 # Copy package files
 COPY package*.json ./
 
-# Install dependencies
-RUN npm ci --only=production
+# Install dependencies (--omit=dev replaces deprecated --only=production)
+RUN npm ci --omit=dev
 
 # Copy application files
 COPY . .
@@ -27,6 +30,12 @@ FROM node:20-alpine
 
 WORKDIR /app
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
+# Upgrade npm to fix glob CVE-2025-64756 vulnerability
+RUN npm install -g npm@latest
+
 # Install dumb-init for proper signal handling and postgresql-client for database checks
 RUN apk add --no-cache dumb-init postgresql-client
 

backend/Dockerfile.dev

@@ -1,7 +1,10 @@
-FROM node:18-alpine
+FROM node:20-alpine
 
 WORKDIR /app
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init
 

backend/dependencies-backend.json

@@ -1831,8 +1831,8 @@
       }
     },
     "nodemailer": {
-      "version": "6.10.1",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.10.1.tgz",
+      "version": "7.0.7",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.7.tgz",
       "overridden": false
     },
     "nodemon": {
@@ -2086,8 +2086,8 @@
               "version": "4.0.1"
             },
             "tar-fs": {
-              "version": "2.1.3",
-              "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
+              "version": "2.1.4",
+              "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
               "overridden": false
             },
             "tunnel-agent": {

backend/migrations/core/045_add_max_files_per_upload_setting.js

@@ -0,0 +1,48 @@
+const { DEFAULT_MAX_FILES_PER_UPLOAD, MAX_ALLOWED_FILES_PER_UPLOAD } = require('../../src/services/uploadSettings');
+
+exports.up = async function up(knex) {
+  const settingKey = 'general_max_files_per_upload';
+
+  const existing = await knex('app_settings')
+    .where({ setting_key: settingKey })
+    .first();
+
+  if (existing) {
+    // Normalize existing value into allowed bounds
+    let parsedValue;
+    try {
+      parsedValue = existing.setting_value != null ? JSON.parse(existing.setting_value) : null;
+    } catch {
+      parsedValue = existing.setting_value;
+    }
+
+    const numeric = Number(parsedValue);
+    let normalized = DEFAULT_MAX_FILES_PER_UPLOAD;
+    if (Number.isFinite(numeric) && numeric >= 1) {
+      normalized = Math.min(MAX_ALLOWED_FILES_PER_UPLOAD, Math.floor(numeric));
+    }
+
+    if (normalized !== numeric) {
+      await knex('app_settings')
+        .where({ setting_key: settingKey })
+        .update({
+          setting_value: JSON.stringify(normalized),
+          updated_at: new Date()
+        });
+    }
+    return;
+  }
+
+  await knex('app_settings').insert({
+    setting_key: settingKey,
+    setting_value: JSON.stringify(DEFAULT_MAX_FILES_PER_UPLOAD),
+    setting_type: 'general',
+    updated_at: new Date()
+  });
+};
+
+exports.down = async function down(knex) {
+  await knex('app_settings')
+    .where({ setting_key: 'general_max_files_per_upload' })
+    .del();
+};

backend/migrations/core/046_add_customer_contact_fields.js

@@ -0,0 +1,44 @@
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function up(knex) {
+  await addColumnIfNotExists(knex, 'events', 'customer_name', (table) => {
+    table.string('customer_name');
+  });
+
+  await addColumnIfNotExists(knex, 'events', 'customer_email', (table) => {
+    table.string('customer_email');
+  });
+
+  // Backfill new columns from legacy host_* fields
+  const client = knex?.client?.config?.client;
+
+  if (client === 'pg') {
+    await knex.raw(`
+      UPDATE events
+      SET customer_name = COALESCE(customer_name, host_name),
+          customer_email = COALESCE(customer_email, host_email)
+    `);
+  } else {
+    // SQLite fallback
+    await knex('events').update({
+      customer_name: knex.raw('COALESCE(customer_name, host_name)'),
+      customer_email: knex.raw('COALESCE(customer_email, host_email)')
+    });
+  }
+};
+
+exports.down = async function down(knex) {
+  const hasCustomerName = await knex.schema.hasColumn('events', 'customer_name');
+  if (hasCustomerName) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('customer_name');
+    });
+  }
+
+  const hasCustomerEmail = await knex.schema.hasColumn('events', 'customer_email');
+  if (hasCustomerEmail) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('customer_email');
+    });
+  }
+};

backend/migrations/core/047_add_tls_reject_unauthorized.js

@@ -0,0 +1,18 @@
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function up(knex) {
+  // Add tls_reject_unauthorized column to email_configs table
+  // Default is true (validate certificates), false means ignore SSL/TLS certificate errors
+  await addColumnIfNotExists(knex, 'email_configs', 'tls_reject_unauthorized', (table) => {
+    table.boolean('tls_reject_unauthorized').defaultTo(true);
+  });
+};
+
+exports.down = async function down(knex) {
+  const hasColumn = await knex.schema.hasColumn('email_configs', 'tls_reject_unauthorized');
+  if (hasColumn) {
+    await knex.schema.alterTable('email_configs', (table) => {
+      table.dropColumn('tls_reject_unauthorized');
+    });
+  }
+};

backend/migrations/core/048_add_video_support.js

@@ -0,0 +1,109 @@
+const { addColumnIfNotExists } = require('../helpers');
+
+/**
+ * Migration: Add video support to photos table
+ * - Adds columns for video metadata (media_type, duration, codecs, dimensions)
+ * - Updates existing photos to have media_type 'image'
+ */
+
+exports.up = async function(knex) {
+  console.log('Running migration: 042_add_video_support');
+
+  // Add media_type column (image or video)
+  await addColumnIfNotExists(knex, 'photos', 'media_type', (table) => {
+    table.string('media_type').defaultTo('image');
+  });
+
+  // Add mime_type column if not exists
+  await addColumnIfNotExists(knex, 'photos', 'mime_type', (table) => {
+    table.string('mime_type');
+  });
+
+  // Add duration column (for videos, in seconds)
+  await addColumnIfNotExists(knex, 'photos', 'duration', (table) => {
+    table.integer('duration');
+  });
+
+  // Add video codec information
+  await addColumnIfNotExists(knex, 'photos', 'video_codec', (table) => {
+    table.string('video_codec');
+  });
+
+  // Add audio codec information
+  await addColumnIfNotExists(knex, 'photos', 'audio_codec', (table) => {
+    table.string('audio_codec');
+  });
+
+  // Add width dimension
+  await addColumnIfNotExists(knex, 'photos', 'width', (table) => {
+    table.integer('width');
+  });
+
+  // Add height dimension
+  await addColumnIfNotExists(knex, 'photos', 'height', (table) => {
+    table.integer('height');
+  });
+
+  // Update existing photos to have media_type 'image' if not set
+  const hasMediaType = await knex.schema.hasColumn('photos', 'media_type');
+  if (hasMediaType) {
+    await knex('photos')
+      .whereNull('media_type')
+      .orWhere('media_type', '')
+      .update({ media_type: 'image' });
+    console.log('Updated existing photos to have media_type "image"');
+  }
+
+  console.log('Migration 042_add_video_support completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rolling back migration: 042_add_video_support');
+
+  // Remove video support columns
+  const hasMediaType = await knex.schema.hasColumn('photos', 'media_type');
+  if (hasMediaType) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('media_type');
+    });
+  }
+
+  const hasDuration = await knex.schema.hasColumn('photos', 'duration');
+  if (hasDuration) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('duration');
+    });
+  }
+
+  const hasVideoCodec = await knex.schema.hasColumn('photos', 'video_codec');
+  if (hasVideoCodec) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('video_codec');
+    });
+  }
+
+  const hasAudioCodec = await knex.schema.hasColumn('photos', 'audio_codec');
+  if (hasAudioCodec) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('audio_codec');
+    });
+  }
+
+  const hasWidth = await knex.schema.hasColumn('photos', 'width');
+  if (hasWidth) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('width');
+    });
+  }
+
+  const hasHeight = await knex.schema.hasColumn('photos', 'height');
+  if (hasHeight) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('height');
+    });
+  }
+
+  // Note: We don't drop mime_type as it may be used by images as well
+
+  console.log('Rollback of 042_add_video_support completed');
+};

backend/migrations/legacy/011_add_user_upload_settings.js

@@ -1,23 +1,56 @@
 exports.up = async function(knex) {
-  // Add user upload settings to events table
-  await knex.schema.alterTable('events', function(table) {
-    table.boolean('allow_user_uploads').defaultTo(false);
-    table.integer('upload_category_id').references('id').inTable('photo_categories').onDelete('SET NULL');
-  });
-  
+  // Add user upload settings to events table (check if columns exist first)
+  const hasAllowUserUploads = await knex.schema.hasColumn('events', 'allow_user_uploads');
+  if (!hasAllowUserUploads) {
+    console.log('Adding allow_user_uploads column to events table...');
+    await knex.schema.alterTable('events', function(table) {
+      table.boolean('allow_user_uploads').defaultTo(false);
+    });
+  } else {
+    console.log('Column allow_user_uploads already exists in events table, skipping...');
+  }
+
+  const hasUploadCategoryId = await knex.schema.hasColumn('events', 'upload_category_id');
+  if (!hasUploadCategoryId) {
+    console.log('Adding upload_category_id column to events table...');
+    await knex.schema.alterTable('events', function(table) {
+      table.integer('upload_category_id').references('id').inTable('photo_categories').onDelete('SET NULL');
+    });
+  } else {
+    console.log('Column upload_category_id already exists in events table, skipping...');
+  }
+
   // Add uploaded_by field to photos table to track who uploaded
-  await knex.schema.alterTable('photos', function(table) {
-    table.string('uploaded_by').defaultTo('admin'); // 'admin' or guest identifier
-  });
+  const hasUploadedBy = await knex.schema.hasColumn('photos', 'uploaded_by');
+  if (!hasUploadedBy) {
+    console.log('Adding uploaded_by column to photos table...');
+    await knex.schema.alterTable('photos', function(table) {
+      table.string('uploaded_by').defaultTo('admin'); // 'admin' or guest identifier
+    });
+  } else {
+    console.log('Column uploaded_by already exists in photos table, skipping...');
+  }
 };
 
 exports.down = async function(knex) {
-  await knex.schema.alterTable('events', function(table) {
-    table.dropColumn('allow_user_uploads');
-    table.dropColumn('upload_category_id');
-  });
-  
-  await knex.schema.alterTable('photos', function(table) {
-    table.dropColumn('uploaded_by');
-  });
+  const hasAllowUserUploads = await knex.schema.hasColumn('events', 'allow_user_uploads');
+  if (hasAllowUserUploads) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('allow_user_uploads');
+    });
+  }
+
+  const hasUploadCategoryId = await knex.schema.hasColumn('events', 'upload_category_id');
+  if (hasUploadCategoryId) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('upload_category_id');
+    });
+  }
+
+  const hasUploadedBy = await knex.schema.hasColumn('photos', 'uploaded_by');
+  if (hasUploadedBy) {
+    await knex.schema.alterTable('photos', function(table) {
+      table.dropColumn('uploaded_by');
+    });
+  }
 };

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "picpeak-backend",
-  "version": "1.1.5",
+  "version": "1.1.15",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "scripts": {
@@ -15,6 +15,7 @@
     "@aws-sdk/client-s3": "^3.850.0",
     "@aws-sdk/lib-storage": "^3.850.0",
     "@aws-sdk/s3-request-presigner": "^3.850.0",
+    "@ffmpeg-installer/ffmpeg": "^1.1.0",
     "adm-zip": "^0.5.16",
     "archiver": "^5.3.1",
     "axios": "^1.12.2",
@@ -26,6 +27,7 @@
     "express": "^4.18.2",
     "express-rate-limit": "^6.7.0",
     "express-validator": "^7.0.1",
+    "fluent-ffmpeg": "^2.1.3",
     "form-data": "^4.0.4",
     "handlebars": "^4.7.8",
     "helmet": "^7.0.0",
@@ -33,7 +35,7 @@
     "i18next-browser-languagedetector": "^8.2.0",
     "i18next-http-backend": "^3.0.2",
     "joi": "^17.9.1",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.1.1",
     "jsonwebtoken": "^9.0.0",
     "knex": "^2.4.2",
     "mime-types": "^3.0.1",
@@ -55,5 +57,13 @@
     "mock-fs": "^5.5.0",
     "nodemon": "^3.1.10",
     "supertest": "^6.3.3"
+  },
+  "overrides": {
+    "prebuild-install": {
+      "tar-fs": "2.1.4"
+    },
+    "glob": "^11.1.0",
+    "body-parser": "^2.2.1",
+    "js-yaml": "^4.1.1"
   }
 }

backend/server.js

@@ -324,9 +324,9 @@ async function initializeRateLimiters() {
 
 // Note: Rate limiters will be initialized after database connection
 
-// Body parsing middleware with increased limits for large uploads
-app.use(express.json({ limit: '100mb' }));
-app.use(express.urlencoded({ extended: true, limit: '100mb' }));
+<<<<<<< HEAD
+app.use(express.json({ limit: '10gb' }));
+app.use(express.urlencoded({ extended: true, limit: '10gb' }));
 
 // Request logging for API routes (with timestamps)
 const apiRequestLogger = (req, res, next) => {

backend/src/database/db.js

@@ -3,6 +3,7 @@ const path = require('path');
 const knex = require('knex');
 const knexConfig = require('../../knexfile');
 const logger = require('../utils/logger');
+const { extractShareToken } = require('../utils/shareLinkUtils');
 
 // Ensure SQLite directory exists when using file-based DB (native installs)
 try {
@@ -63,12 +64,16 @@ async function initializeDatabase() {
       table.string('event_type').notNullable();
       table.string('event_name').notNullable();
       table.date('event_date').notNullable();
+      table.string('customer_name');
+      table.string('customer_email');
       table.string('host_email').notNullable();
+      table.string('host_name');
       table.string('admin_email').notNullable();
       table.string('password_hash').notNullable();
       table.text('welcome_message');
       table.text('color_theme');
       table.string('share_link').unique().notNullable();
+      table.string('share_token').unique();
       table.datetime('created_at').defaultTo(db.fn.now());
       table.datetime('expires_at').notNullable();
       table.boolean('is_active').defaultTo(true);
@@ -99,12 +104,16 @@ async function initializeDatabase() {
             event_type TEXT NOT NULL,
             event_name TEXT NOT NULL,
             event_date DATE NOT NULL,
+            customer_name TEXT,
+            customer_email TEXT,
+            host_name TEXT,
             host_email TEXT NOT NULL,
             admin_email TEXT NOT NULL,
             password_hash TEXT NOT NULL,
             welcome_message TEXT,
             color_theme TEXT,
             share_link TEXT UNIQUE NOT NULL,
+            share_token TEXT UNIQUE,
             created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
             expires_at DATETIME NOT NULL,
             is_active BOOLEAN DEFAULT 1,
@@ -157,6 +166,37 @@ async function initializeDatabase() {
     }
   }
 
+  const hasShareTokenColumn = await db.schema.hasColumn('events', 'share_token');
+  if (!hasShareTokenColumn) {
+    await db.schema.table('events', (table) => {
+      table.string('share_token').unique();
+    });
+  }
+
+  const hasHostNameColumn = await db.schema.hasColumn('events', 'host_name');
+  if (!hasHostNameColumn) {
+    await db.schema.table('events', (table) => {
+      table.string('host_name');
+    });
+  }
+
+  try {
+    const eventsWithoutToken = await db('events')
+      .whereNull('share_token')
+      .select('id', 'share_link');
+
+    for (const event of eventsWithoutToken) {
+      const token = extractShareToken(event.share_link);
+      if (token) {
+        await db('events')
+          .where({ id: event.id })
+          .update({ share_token: token });
+      }
+    }
+  } catch (error) {
+    logger.warn('Share token backfill skipped', { error: error.message });
+  }
+
   // Photo metadata table
   const hasPhotosTable = await db.schema.hasTable('photos');
   if (!hasPhotosTable) {

backend/src/routes/adminAuth.js

@@ -8,6 +8,93 @@ const { validatePasswordStrength } = require('../utils/passwordGenerator');
 const router = express.Router();
 
 // Change password
+router.get('/profile', adminAuth, async (req, res) => {
+  try {
+    const admin = await db('admin_users')
+      .where('id', req.admin.id)
+      .select('id', 'username', 'email', 'last_login', 'last_login_ip', 'created_at', 'updated_at', 'must_change_password as mustChangePassword')
+      .first();
+
+    if (!admin) {
+      return res.status(404).json({ error: 'Admin user not found' });
+    }
+
+    res.json(admin);
+  } catch (error) {
+    console.error('Admin profile fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch admin profile' });
+  }
+});
+
+router.put('/profile', [
+  adminAuth,
+  body('username')
+    .trim()
+    .isLength({ min: 3, max: 50 })
+    .withMessage('Username must be between 3 and 50 characters'),
+  body('email')
+    .trim()
+    .isEmail()
+    .withMessage('A valid email address is required')
+    .normalizeEmail()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const username = req.body.username.trim();
+    const email = req.body.email.trim().toLowerCase();
+    const adminId = req.admin.id;
+
+    const existingUsername = await db('admin_users')
+      .where('username', username)
+      .whereNot('id', adminId)
+      .first();
+
+    if (existingUsername) {
+      return res.status(409).json({ error: 'Username is already in use' });
+    }
+
+    const existingEmail = await db('admin_users')
+      .where('email', email)
+      .whereNot('id', adminId)
+      .first();
+
+    if (existingEmail) {
+      return res.status(409).json({ error: 'Email address is already in use' });
+    }
+
+    await db('admin_users')
+      .where('id', adminId)
+      .update({
+        username,
+        email,
+        updated_at: new Date()
+      });
+
+    await logActivity('admin_profile_updated',
+      { username, email },
+      null,
+      { type: 'admin', id: adminId, name: req.admin.username }
+    );
+
+    const updatedAdmin = await db('admin_users')
+      .where('id', adminId)
+      .select('id', 'username', 'email', 'must_change_password as mustChangePassword')
+      .first();
+
+    res.json({
+      message: 'Admin profile updated successfully',
+      user: updatedAdmin
+    });
+  } catch (error) {
+    console.error('Admin profile update error:', error);
+    res.status(500).json({ error: 'Failed to update admin profile' });
+  }
+});
+
 router.post('/change-password', [
   adminAuth,
   body('currentPassword').notEmpty().withMessage('Current password is required'),

backend/src/routes/adminEmail.js

@@ -18,7 +18,8 @@ router.get('/config', adminAuth, async (req, res) => {
         smtp_user: '',
         smtp_pass: '', // Don't send actual password
         from_email: '',
-        from_name: ''
+        from_name: '',
+        tls_reject_unauthorized: true
       });
     }
 
@@ -53,7 +54,8 @@ router.post('/config', [
       smtp_user,
       smtp_pass,
       from_email,
-      from_name
+      from_name,
+      tls_reject_unauthorized
     } = req.body;
 
     // Check if config exists
@@ -66,6 +68,7 @@ router.post('/config', [
       smtp_user: smtp_user || '',
       from_email,
       from_name: from_name || 'Photo Sharing',
+      tls_reject_unauthorized: tls_reject_unauthorized !== false, // Default to true
       updated_at: new Date()
     };
 
@@ -137,6 +140,10 @@ router.post('/test', adminAuth, async (req, res) => {
         user: config.smtp_user,
         pass: config.smtp_pass
       } : undefined,
+      tls: {
+        // Allow ignoring SSL certificate errors when tls_reject_unauthorized is false
+        rejectUnauthorized: config.tls_reject_unauthorized !== false
+      },
       logger: process.env.NODE_ENV === 'development',
       debug: process.env.NODE_ENV === 'development'
     };
@@ -173,26 +180,57 @@ router.post('/test', adminAuth, async (req, res) => {
   } catch (error) {
     console.error('Test email error:', error);
     console.error('Error stack:', error.stack);
-    
-    // Provide more specific error messages
-    let errorMessage = 'Failed to send test email';
+
+    // Provide more specific error messages with translation keys
+    let errorMessage = 'Error sending email';
+    let errorKey = 'email.errors.sendFailed';
     let details = error.message;
-    
+    let detailsKey = 'email.errors.unknownError';
+
     if (error.code === 'ECONNREFUSED') {
       errorMessage = 'Failed to connect to SMTP server';
+      errorKey = 'email.errors.connectionRefused';
       details = 'Please check your SMTP host and port settings';
+      detailsKey = 'email.errors.checkHostPort';
     } else if (error.code === 'EAUTH') {
       errorMessage = 'SMTP authentication failed';
+      errorKey = 'email.errors.authFailed';
       details = 'Please check your SMTP username and password';
+      detailsKey = 'email.errors.checkCredentials';
     } else if (error.code === 'ESOCKET') {
-      errorMessage = 'Network error';
+      errorMessage = 'Network error connecting to SMTP server';
+      errorKey = 'email.errors.networkError';
       details = 'Could not establish connection to SMTP server';
+      detailsKey = 'email.errors.connectionFailed';
+    } else if (error.code === 'ETIMEDOUT') {
+      errorMessage = 'Connection to SMTP server timed out';
+      errorKey = 'email.errors.timeout';
+      details = 'The server took too long to respond. Please check your network and SMTP settings.';
+      detailsKey = 'email.errors.timeoutDetails';
+    } else if (error.code === 'ENOTFOUND') {
+      errorMessage = 'SMTP server not found';
+      errorKey = 'email.errors.serverNotFound';
+      details = 'The SMTP host could not be resolved. Please verify the hostname.';
+      detailsKey = 'email.errors.checkHostname';
+    } else if (error.responseCode >= 500) {
+      errorMessage = 'SMTP server error';
+      errorKey = 'email.errors.serverError';
+      details = `Server returned error code ${error.responseCode}`;
+      detailsKey = 'email.errors.serverErrorDetails';
+    } else if (error.responseCode >= 400) {
+      errorMessage = 'Email rejected by server';
+      errorKey = 'email.errors.rejected';
+      details = error.response || 'The email was rejected. Check recipient address and settings.';
+      detailsKey = 'email.errors.rejectedDetails';
     }
-    
-    res.status(500).json({ 
+
+    res.status(500).json({
       error: errorMessage,
+      errorKey: errorKey,
       details: details,
-      code: error.code
+      detailsKey: detailsKey,
+      code: error.code,
+      responseCode: error.responseCode
     });
   }
 });

backend/src/routes/adminEvents-enhanced.js

@@ -2,13 +2,14 @@
 // Only the relevant parts are shown - merge with existing adminEvents.js
 
 const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
+const { buildShareLinkVariants } = require('../services/shareLinkService');
 
 // Enhanced event creation with password validation
 router.post('/', adminAuth, [
   body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
   body('event_name').notEmpty().trim(),
   body('event_date').isDate(),
-  body('host_email').isEmail().normalizeEmail(),
+  body('customer_email').isEmail().normalizeEmail(),
   body('admin_email').isEmail().normalizeEmail(),
   body('password').notEmpty(), // Remove the weak isLength validation
   body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
@@ -16,7 +17,7 @@ router.post('/', adminAuth, [
   body('color_theme').optional().trim(),
   body('allow_user_uploads').optional().isBoolean().toBoolean(),
   body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
-  body('host_name').notEmpty().trim()
+  body('customer_name').notEmpty().trim()
 ], async (req, res) => {
   try {
     console.log('Create event request body:', req.body);
@@ -30,8 +31,8 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
-      host_name,
-      host_email,
+      customer_name,
+      customer_email,
       admin_email,
       password,
       welcome_message = '',
@@ -65,9 +66,9 @@ router.post('/', adminAuth, [
       counter++;
     }
     
-    // Generate share link
+    // Generate share link based on configured style
     const shareToken = crypto.randomBytes(16).toString('hex');
-    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    const { shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
     
     // Hash password with configurable rounds
     const password_hash = await bcrypt.hash(password, getBcryptRounds());
@@ -88,13 +89,16 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
-      host_name,
-      host_email,
+      customer_name,
+      customer_email,
+      host_name: customer_name,
+      host_email: customer_email,
       admin_email,
       password_hash,
       welcome_message,
       color_theme,
-      share_link: shareLink,
+      share_link: shareLinkToStore,
+      share_token: shareToken,
       expires_at: expires_at.toISOString(),
       created_at: new Date().toISOString(),
       allow_user_uploads,
@@ -121,4 +125,4 @@ router.post('/', adminAuth, [
     console.error('Error creating event:', error);
     res.status(500).json({ error: 'Failed to create event' });
   }
-});
+});

backend/src/routes/adminEvents.js

@@ -14,6 +14,7 @@ const { escapeLikePattern } = require('../utils/sqlSecurity');
 // formatDate import removed - dates are formatted by email processor
 const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
 const logger = require('../utils/logger');
+const { buildShareLinkVariants } = require('../services/shareLinkService');
 
 const parseBooleanInput = (value, defaultValue = true) => {
   if (value === undefined || value === null) {
@@ -37,12 +38,67 @@ const parseBooleanInput = (value, defaultValue = true) => {
   return defaultValue;
 };
 
+const getCustomerNameFromPayload = (payload = {}) => {
+  if (typeof payload.customer_name === 'string') {
+    const trimmed = payload.customer_name.trim();
+    return trimmed || null;
+  }
+  return null;
+};
+
+const getCustomerEmailFromPayload = (payload = {}) => {
+  if (typeof payload.customer_email === 'string') {
+    const trimmed = payload.customer_email.trim();
+    return trimmed || null;
+  }
+  return null;
+};
+
+const mapEventForApi = (event) => {
+  if (!event || typeof event !== 'object') {
+    return event;
+  }
+
+  const {
+    host_name,
+    host_email,
+    customer_name,
+    customer_email,
+    ...rest
+  } = event;
+
+  return {
+    ...rest,
+    customer_name: customer_name ?? host_name ?? null,
+    customer_email: customer_email ?? host_email ?? null
+  };
+};
+
+let customerColumnCache = null;
+const hasCustomerContactColumns = async () => {
+  if (customerColumnCache === true) {
+    return true;
+  }
+
+  try {
+    const hasColumn = await db.schema.hasColumn('events', 'customer_email');
+    if (hasColumn) {
+      customerColumnCache = true;
+    }
+    return hasColumn;
+  } catch (error) {
+    logger.debug('Failed to detect customer_email column', { error: error.message });
+    return false;
+  }
+};
+
 // Create new event
 router.post('/', adminAuth, [
   body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
   body('event_name').notEmpty().trim(),
   body('event_date').isDate(),
-  body('host_email').isEmail().normalizeEmail(),
+  body('customer_name').notEmpty().trim(),
+  body('customer_email').isEmail().normalizeEmail(),
   body('admin_email').isEmail().normalizeEmail(),
   body('require_password').optional().isBoolean(),
   body('password').optional().isString().custom((value, { req }) => {
@@ -73,7 +129,6 @@ router.post('/', adminAuth, [
   body('color_theme').optional().trim(),
   body('allow_user_uploads').optional().isBoolean().toBoolean(),
   body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
-  body('host_name').notEmpty().trim(),
   body('allow_downloads').optional().isBoolean(),
   body('disable_right_click').optional().isBoolean(),
   body('watermark_downloads').optional().isBoolean(),
@@ -91,8 +146,6 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
-      host_name,
-      host_email,
       admin_email,
       password,
       welcome_message = '',
@@ -115,7 +168,16 @@ router.post('/', adminAuth, [
       moderate_comments = true,
       show_feedback_to_guests = true
     } = req.body;
-    
+
+    const customerName = getCustomerNameFromPayload(req.body);
+    const customerEmail = getCustomerEmailFromPayload(req.body);
+
+    const customerColumnsAvailable = await hasCustomerContactColumns();
+
+    if (!customerName || !customerEmail) {
+      return res.status(400).json({ error: 'customer_name and customer_email are required' });
+    }
+
     const requirePassword = parseBooleanInput(requirePasswordInput, true);
 
     // Debug logging
@@ -133,7 +195,6 @@ router.post('/', adminAuth, [
     });
     
     let passwordValidation = null;
-    let galleryPassword = password;
 
     if (requirePassword) {
       passwordValidation = await validatePasswordInContext(password, 'gallery', {
@@ -148,8 +209,6 @@ router.post('/', adminAuth, [
           feedback: passwordValidation.feedback
         });
       }
-    } else {
-      galleryPassword = '';
     }
     
     // Generate unique slug
@@ -167,11 +226,9 @@ router.post('/', adminAuth, [
       counter++;
     }
     
-    // Generate share link
+    // Generate share link respecting configured format
     const shareToken = crypto.randomBytes(16).toString('hex');
-    const sharePath = `/gallery/${slug}/${shareToken}`;
-    const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
-    const shareLink = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
+    const { sharePath, shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
     
     // Hash password with configurable rounds (random placeholder when not required)
     const password_hash = requirePassword
@@ -201,13 +258,15 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
-      host_name,
-      host_email,
+      ...(customerColumnsAvailable ? { customer_name: customerName, customer_email: customerEmail } : {}),
+      host_name: customerName,
+      host_email: customerEmail,
       admin_email,
       password_hash,
       welcome_message,
       color_theme,
-      share_link: shareLink,
+      share_link: shareLinkToStore,
+      share_token: shareToken,
       expires_at: expires_at.toISOString(),
       created_at: new Date().toISOString(),
       allow_user_uploads,
@@ -251,13 +310,15 @@ router.post('/', adminAuth, [
     
     await db('email_queue').insert({
       event_id: eventId,
-      recipient_email: host_email,
+      recipient_email: customerEmail,
       email_type: 'gallery_created',
       email_data: JSON.stringify({
-        host_name: host_name,
+        customer_name: customerName,
+        customer_email: customerEmail,
+        host_name: customerName || (customerEmail ? customerEmail.split('@')[0] : null),
         event_name,
         event_date: event_date,  // Pass raw date - will be formatted by email processor
-        gallery_link: shareLink,
+        gallery_link: shareUrl,
         gallery_password: requirePassword ? password : 'No password required',
         expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
         welcome_message: welcome_message || ''
@@ -272,8 +333,10 @@ router.post('/', adminAuth, [
       slug,
       event_name,
       event_type,
+      customer_name: customerName,
+      customer_email: customerEmail,
       require_password: requirePassword,
-      share_link: shareLink,
+      share_link: shareUrl,
       expires_at: expires_at.toISOString(),
       created_at: new Date().toISOString()
     });
@@ -356,7 +419,7 @@ router.get('/', adminAuth, async (req, res) => {
       created_at: event.created_at ? new Date(event.created_at).toISOString() : null,
       expires_at: event.expires_at ? new Date(event.expires_at).toISOString() : null,
       archived_at: event.archived_at ? new Date(event.archived_at).toISOString() : null
-    }));
+    })).map(mapEventForApi);
 
     res.json({
       events: eventsWithCounts,
@@ -418,7 +481,7 @@ router.get('/:id', adminAuth, async (req, res) => {
       .where('event_id', id)
       .countDistinct('ip_address as uniqueVisitors');
 
-    res.json({
+    res.json(mapEventForApi({
       ...event,
       photo_count: parseInt(photoCount) || 0,
       total_size: parseInt(totalSize) || 0,
@@ -426,7 +489,7 @@ router.get('/:id', adminAuth, async (req, res) => {
       total_downloads: parseInt(totalDownloads) || 0,
       unique_visitors: parseInt(uniqueVisitors) || 0,
       recent_photos: recentPhotos
-    });
+    }));
   } catch (error) {
     console.error('Error fetching event:', error);
     res.status(500).json({ error: 'Failed to fetch event details' });
@@ -442,7 +505,8 @@ router.put('/:id', adminAuth, [
   body('welcome_message').optional({ nullable: true, checkFalsy: true }).trim(),
   body('color_theme').optional({ nullable: true }),
   body('allow_user_uploads').optional().isBoolean(),
-  body('host_name').optional().trim().notEmpty(),
+  body('customer_name').optional().trim().notEmpty(),
+  body('customer_email').optional().isEmail().normalizeEmail(),
   body('upload_category_id').optional().custom((value) => {
     // Accept null, undefined, or integer values
     if (value === null || value === undefined) return true;
@@ -481,6 +545,39 @@ router.put('/:id', adminAuth, [
 
     const { id } = req.params;
     const updates = { ...req.body };
+    const customerColumnsAvailable = await hasCustomerContactColumns();
+
+    if (Object.prototype.hasOwnProperty.call(updates, 'host_name') || Object.prototype.hasOwnProperty.call(updates, 'host_email')) {
+      return res.status(400).json({ error: 'host_name and host_email are no longer supported. Use customer_name and customer_email instead.' });
+    }
+
+    if (Object.prototype.hasOwnProperty.call(updates, 'customer_name')) {
+      const nextName = getCustomerNameFromPayload(updates);
+      if (nextName) {
+        if (customerColumnsAvailable) {
+          updates.customer_name = nextName;
+        } else {
+          delete updates.customer_name;
+        }
+        updates.host_name = nextName;
+      } else {
+        delete updates.customer_name;
+      }
+    }
+
+    if (Object.prototype.hasOwnProperty.call(updates, 'customer_email')) {
+      const nextEmail = getCustomerEmailFromPayload(updates);
+      if (nextEmail) {
+        if (customerColumnsAvailable) {
+          updates.customer_email = nextEmail;
+        } else {
+          delete updates.customer_email;
+        }
+        updates.host_email = nextEmail;
+      } else {
+        delete updates.customer_email;
+      }
+    }
 
     const hasRequirePasswordUpdate = Object.prototype.hasOwnProperty.call(updates, 'require_password');
     let requirePasswordUpdate;
@@ -715,10 +812,13 @@ router.post('/:id/reset-password', adminAuth, async (req, res) => {
 
     // Queue email notification if requested
     if (sendEmail) {
-      // For password reset, we'll need to create a template or use a different approach
-      // For now, let's use the gallery_created template with updated password
-      await queueEmail(id, event.host_email, 'gallery_created', {
-        host_name: event.host_email.split('@')[0],
+      const recipientEmail = event.customer_email || event.host_email;
+      const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
+
+      await queueEmail(id, recipientEmail, 'gallery_created', {
+        customer_name: recipientName,
+        customer_email: recipientEmail,
+        host_name: recipientName,
         event_name: event.event_name,
         event_date: event.event_date,  // Pass raw date - will be formatted by email processor
         gallery_link: event.share_link,
@@ -773,8 +873,13 @@ router.post('/:id/resend-email', adminAuth, async (req, res) => {
     // Dates will be formatted by the email processor based on recipient language
     
     // Queue the email
-    await queueEmail(id, event.host_email, 'gallery_created', {
-      host_name: event.host_name || event.host_email.split('@')[0],
+    const recipientEmail = event.customer_email || event.host_email;
+    const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
+
+    await queueEmail(id, recipientEmail, 'gallery_created', {
+      customer_name: recipientName,
+      customer_email: recipientEmail,
+      host_name: recipientName,
       event_name: event.event_name,
       event_date: event.event_date,  // Pass raw date - will be formatted by email processor
       gallery_link: event.share_link,
@@ -789,7 +894,7 @@ router.post('/:id/resend-email', adminAuth, async (req, res) => {
     try {
       await logActivity('email_resent', {
         email_type: 'gallery_created',
-        recipient: event.host_email,
+        recipient: recipientEmail,
         ip_address: req.ip || '0.0.0.0',
         user_agent: req.get('user-agent') || 'Unknown'
       }, id, {

backend/src/routes/adminNotifications.js

@@ -103,14 +103,51 @@ router.delete('/clear-old', adminAuth, async (req, res) => {
     // Use database-agnostic date calculation
     const thirtyDaysAgo = new Date();
     thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
-    
-    const deletedCount = await db('activity_logs')
-      .whereNotNull('read_at')
-      .where('created_at', '<', thirtyDaysAgo)
-      .delete();
+
+    let deletedCount = 0;
+    const client = db?.client?.config?.client;
+
+    if (client === 'pg') {
+      const primaryResult = await db.raw(
+        `
+          WITH deleted AS (
+            DELETE FROM activity_logs
+            WHERE read_at IS NOT NULL OR created_at < ?
+            RETURNING id
+          )
+          SELECT COUNT(*)::int AS count FROM deleted
+        `,
+        [thirtyDaysAgo.toISOString()]
+      );
+      deletedCount = primaryResult.rows?.[0]?.count || 0;
+
+      if (deletedCount === 0) {
+        const fallbackResult = await db.raw(
+          `
+            WITH deleted AS (
+              DELETE FROM activity_logs
+              RETURNING id
+            )
+            SELECT COUNT(*)::int AS count FROM deleted
+          `
+        );
+        deletedCount = fallbackResult.rows?.[0]?.count || 0;
+      }
+    } else {
+      deletedCount = await db('activity_logs')
+        .where(function () {
+          this.whereNotNull('read_at')
+            .orWhere('created_at', '<', thirtyDaysAgo);
+        })
+        .delete();
+
+      if (deletedCount === 0) {
+        deletedCount = await db('activity_logs').delete();
+      }
+    }
 
     res.json({ 
-      message: 'Old notifications cleared',
+      message: deletedCount > 0 ? 'Old notifications cleared' : 'No notifications to clear',
       deletedCount 
     });
   } catch (error) {
@@ -119,18 +156,4 @@ router.delete('/clear-old', adminAuth, async (req, res) => {
   }
 });
 
-// Delete all notifications
-router.delete('/clear-all', adminAuth, async (req, res) => {
-  try {
-    const deletedCount = await db('activity_logs').delete();
-    res.json({
-      message: 'All notifications cleared',
-      deletedCount
-    });
-  } catch (error) {
-    console.error('Clear all notifications error:', error);
-    res.status(500).json({ error: 'Failed to clear notifications' });
-  }
-});
-
 module.exports = router;

backend/src/routes/adminPhotos.js

@@ -8,29 +8,14 @@ const { generateThumbnail, ensureThumbnail } = require('../services/imageProcess
 const { generatePhotoFilename } = require('../utils/filenameSanitizer');
 const { escapeLikePattern } = require('../utils/sqlSecurity');
 const { validateUploadedFiles } = require('../middleware/uploadValidation');
+const { getMaxFilesPerUpload } = require('../services/uploadSettings');
+const { processUploadedPhotos } = require('../services/photoProcessor');
+const chunkedUpload = require('../services/chunkedUploadService');
 const router = express.Router();
 
 // Get storage path from environment or default
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 
-const parseCategoryId = (value) => {
-  if (value === undefined || value === null) return null;
-  if (typeof value === 'number' && Number.isInteger(value)) {
-    return value === 0 ? null : value;
-  }
-  if (typeof value === 'string') {
-    const trimmed = value.trim();
-    if (!trimmed || trimmed === 'null') return null;
-    if (/^\d+$/.test(trimmed)) {
-      const parsed = parseInt(trimmed, 10);
-      if (!Number.isNaN(parsed)) {
-        return parsed === 0 ? null : parsed;
-      }
-    }
-  }
-  return null;
-};
-
 // Configure multer for file uploads
 // IMPORTANT: Using synchronous functions to prevent file corruption
 const storage = multer.diskStorage({
@@ -65,8 +50,8 @@ const { validateFileType } = require('../utils/fileSecurityUtils');
 const upload = multer({
   storage: storage,
   limits: {
-    fileSize: 50 * 1024 * 1024, // 50MB limit per file
-    files: 500, // Maximum 500 files
+    fileSize: 10 * 1024 * 1024 * 1024, // 10GB limit per file to support large videos
+    files: 2000, // Hard safety ceiling; actual limit enforced dynamically
     // Set a reasonable field size limit to prevent memory issues
     fieldSize: 10 * 1024 * 1024, // 10MB for non-file fields
     // Add part size limits to prevent incomplete uploads
@@ -74,13 +59,16 @@ const upload = multer({
     headerPairs: 2000 // Maximum number of header key-value pairs
   },
   fileFilter: (req, file, cb) => {
-    // Accept images only with proper validation
-    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp'];
-    
+    // Accept images and videos with proper validation
+    const allowedMimeTypes = [
+      'image/jpeg', 'image/png', 'image/webp',
+      'video/mp4', 'video/webm', 'video/quicktime', 'video/x-msvideo'
+    ];
+
     if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
       return cb(null, true);
     } else {
-      cb(new Error('Only JPEG, PNG and WebP images are allowed'));
+      cb(new Error('Only JPEG, PNG, WebP images and MP4, WebM, MOV, AVI videos are allowed'));
     }
   },
   // Add abort on limit to stop processing when limits are exceeded
@@ -91,8 +79,11 @@ const { createFileUploadValidator } = require('../utils/fileSecurityUtils');
 
 // Create content validator middleware
 const validateUploadContent = createFileUploadValidator({
-  allowedTypes: ['image/jpeg', 'image/png', 'image/webp'],
-  maxFileSize: 50 * 1024 * 1024,
+  allowedTypes: [
+    'image/jpeg', 'image/png', 'image/webp',
+    'video/mp4', 'video/webm', 'video/quicktime', 'video/x-msvideo'
+  ],
+  maxFileSize: 10 * 1024 * 1024 * 1024, // 10GB to support large videos
   validateContent: true
 });
 
@@ -117,17 +108,25 @@ const uploadTimeout = (timeout = 300000) => { // 5 minutes default
 };
 
 // Upload photos for an event
-// Increased limit to 500 files, but recommend chunked uploads for better performance
-router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, next) => { // 10 minute timeout
-  upload.array('photos', 500)(req, res, (err) => {
+// Max file count is configurable via general settings
+router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), async (req, res, next) => { // 10 minute timeout
+  let maxFilesPerUpload;
+  try {
+    maxFilesPerUpload = await getMaxFilesPerUpload();
+  } catch (error) {
+    console.error('Failed to resolve max files per upload:', error);
+    return res.status(500).json({ error: 'Unable to determine upload limits' });
+  }
+
+  upload.array('photos', maxFilesPerUpload)(req, res, (err) => {
     if (err) {
       console.error('Multer error:', err);
       if (err instanceof multer.MulterError) {
         if (err.code === 'LIMIT_FILE_SIZE') {
-          return res.status(400).json({ error: 'File too large. Maximum size is 50MB per file.' });
+          return res.status(400).json({ error: 'File too large. Maximum size is 10GB per file.' });
         }
-        if (err.code === 'LIMIT_FILE_COUNT') {
-          return res.status(400).json({ error: 'Too many files. Maximum 500 files per upload.' });
+        if (err.code === 'LIMIT_FILE_COUNT' || err.code === 'LIMIT_UNEXPECTED_FILE') {
+          return res.status(400).json({ error: `Too many files. Maximum ${maxFilesPerUpload} files per upload.` });
         }
         return res.status(400).json({ error: `Upload error: ${err.message}` });
       }
@@ -176,16 +175,16 @@ router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, nex
     }
     
     // Parse category_id to number if provided
-    const numericCategoryId = parseCategoryId(category_id);
+    const parsedCategoryId = category_id ? parseInt(category_id, 10) : null;
     
     // Determine photo type from category_id parameter (for backwards compatibility)
     let photoType = 'individual'; // default
     let categoryName = 'individual';
     
-    if (numericCategoryId === 1 || category_id === 'collage') {
+    if (parsedCategoryId === 1 || category_id === 'collage') {
       photoType = 'collage';
       categoryName = 'collages';
-    } else if (numericCategoryId === 2 || category_id === 'individual') {
+    } else if (parsedCategoryId === 2 || category_id === 'individual') {
       photoType = 'individual';
       categoryName = 'individual';
     }
@@ -257,9 +256,7 @@ router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, nex
               path: relativePath,
               thumbnail_path: null, // Will generate after successful commit
               type: photoType,
-              size_bytes: tempStats.size, // Use actual file size from stat
-              category_id: numericCategoryId,
-              source_origin: 'managed'
+              size_bytes: tempStats.size // Use actual file size from stat
             };
             
             batchPhotos.push(photoData);
@@ -484,23 +481,42 @@ router.patch('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
   try {
     const { eventId, photoId } = req.params;
     const { category_id } = req.body;
-    
+
     // Verify photo belongs to event
     const photo = await db('photos')
       .where({ id: photoId, event_id: eventId })
       .first();
-    
+
     if (!photo) {
       return res.status(404).json({ error: 'Photo not found' });
     }
-    
-    // Update photo
-    const normalizedCategoryId = parseCategoryId(category_id);
 
+    // Prepare update data
+    const updateData = {};
+
+    // Handle type-based categories ('individual' or 'collage')
+    // These are string values that map to the photo.type field
+    if (category_id === 'individual' || category_id === 'collage') {
+      updateData.type = category_id;
+      updateData.category_id = null; // Clear legacy category_id
+    } else if (category_id === null || category_id === undefined) {
+      // Explicitly clear category
+      updateData.category_id = null;
+    } else {
+      // Handle numeric category IDs from photo_categories table
+      const numericCategoryId = parseInt(category_id, 10);
+      if (!isNaN(numericCategoryId)) {
+        updateData.category_id = numericCategoryId;
+      } else {
+        updateData.category_id = null;
+      }
+    }
+
+    // Update photo
     await db('photos')
-      .where({ id: photoId })
-      .update({ category_id: normalizedCategoryId });
-    
+      .where({ id: photoId, event_id: eventId })
+      .update(updateData);
+
     res.json({ message: 'Photo updated successfully' });
   } catch (error) {
     console.error('Error updating photo:', error);
@@ -593,21 +609,40 @@ router.post('/:eventId/photos/bulk-update', adminAuth, async (req, res) => {
       .count('id as count')
       .first();
     
-    if (photoCount.count !== photoIds.length) {
+    if (parseInt(photoCount.count) !== photoIds.length) {
       return res.status(400).json({ error: 'Some photos do not belong to this event' });
     }
     
-    // Update photos
-    const updateData = {};
+    // Prepare update data
+    const updateData = {
+      updated_at: new Date()
+    };
+
     if (updates.category_id !== undefined) {
-      updateData.category_id = parseCategoryId(updates.category_id);
+      // Handle type-based categories ('individual' or 'collage')
+      // These are string values that map to the photo.type field
+      if (updates.category_id === 'individual' || updates.category_id === 'collage') {
+        updateData.type = updates.category_id;
+        updateData.category_id = null; // Clear legacy category_id
+      } else if (updates.category_id === null) {
+        // Explicitly clear category
+        updateData.category_id = null;
+      } else {
+        // Handle numeric category IDs from photo_categories table
+        const numericCategoryId = parseInt(updates.category_id, 10);
+        if (!isNaN(numericCategoryId)) {
+          updateData.category_id = numericCategoryId;
+        } else {
+          updateData.category_id = null;
+        }
+      }
     }
-    
+
     await db('photos')
       .whereIn('id', photoIds)
       .where('event_id', eventId)
       .update(updateData);
-    
+
     res.json({ message: `${photoIds.length} photos updated successfully` });
   } catch (error) {
     console.error('Error bulk updating photos:', error);
@@ -654,22 +689,14 @@ router.get('/:eventId/photos', adminAuth, async (req, res) => {
     const { category_id, type, search, sort = 'date', order = 'desc' } = req.query;
     
     let query = db('photos')
-      .leftJoin('photo_categories as pc', 'pc.id', 'photos.category_id')
       .where({ 'photos.event_id': eventId })
-      .select(
-        'photos.*',
-        'pc.name as category_display_name',
-        'pc.slug as category_display_slug'
-      );
+      .select('photos.*');
     
     // Filter by type (individual/collage) - category_id maps to type
     if (category_id !== undefined) {
-      if (category_id === '') {
-        // No filter when empty string is provided
-      } else if (category_id === '0') {
-        query = query.whereNull('photos.category_id');
-      } else if (/^\d+$/.test(category_id)) {
-        query = query.where('photos.category_id', parseInt(category_id, 10));
+      if (category_id === '' || category_id === '0') {
+        // For backwards compatibility, empty category means no filter
+        // Don't filter anything
       } else if (category_id === 'individual' || category_id === 'collage') {
         query = query.where({ 'photos.type': category_id });
       }
@@ -695,11 +722,7 @@ router.get('/:eventId/photos', adminAuth, async (req, res) => {
     }
     
     const photos = await query.orderBy(orderByColumn, order);
-
-    if (photos.length === 0) {
-      return res.json({ photos: [] });
-    }
-
+    
     // Get comment counts separately
     const commentCounts = await db('photo_feedback')
       .whereIn('photo_id', photos.map(p => p.id))
@@ -724,11 +747,9 @@ router.get('/:eventId/photos', adminAuth, async (req, res) => {
         // Always expose a thumbnail URL; backend will generate on demand if missing
         thumbnail_url: `/admin/photos/${eventId}/thumbnail/${photo.id}`,
         type: photo.type,
-        category_id: photo.category_id !== null && photo.category_id !== undefined
-          ? Number(photo.category_id)
-          : null,
-        category_name: photo.category_display_name || (photo.type === 'individual' ? 'Individual Photos' : 'Collages'),
-        category_slug: photo.category_display_slug || photo.type,
+        category_id: photo.type,
+        category_name: photo.type === 'individual' ? 'Individual Photos' : 'Collages',
+        category_slug: photo.type,
         size: photo.size_bytes,
         uploaded_at: photo.uploaded_at,
         // Feedback data
@@ -843,4 +864,142 @@ router.get('/:eventId/debug', adminAuth, async (req, res) => {
   }
 });
 
+// ============================================
+// CHUNKED UPLOAD ENDPOINTS
+// For large file uploads (videos up to 10GB)
+// ============================================
+
+// Initialize a chunked upload
+router.post('/:eventId/chunked-upload/init', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { filename, fileSize, mimeType, totalChunks } = req.body;
+
+    // Validate event exists
+    const event = await db('events').where({ id: eventId }).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    // Validate required fields
+    if (!filename || !fileSize || !mimeType) {
+      return res.status(400).json({ error: 'Missing required fields: filename, fileSize, mimeType' });
+    }
+
+    // Validate file size (max 10GB)
+    const maxSize = 10 * 1024 * 1024 * 1024;
+    if (fileSize > maxSize) {
+      return res.status(400).json({ error: `File too large. Maximum size is 10GB.` });
+    }
+
+    const result = await chunkedUpload.initializeUpload({
+      filename,
+      fileSize,
+      mimeType,
+      eventId: parseInt(eventId),
+      totalChunks
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error initializing chunked upload:', error);
+    res.status(500).json({ error: 'Failed to initialize upload' });
+  }
+});
+
+// Upload a chunk
+router.post('/:eventId/chunked-upload/:uploadId/chunk/:chunkIndex', adminAuth, async (req, res) => {
+  try {
+    const { uploadId, chunkIndex } = req.params;
+
+    // Get chunk data from request body
+    const chunks = [];
+    for await (const chunk of req) {
+      chunks.push(chunk);
+    }
+    const chunkData = Buffer.concat(chunks);
+
+    const result = await chunkedUpload.uploadChunk(uploadId, parseInt(chunkIndex), chunkData);
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error uploading chunk:', error);
+    res.status(500).json({ error: error.message || 'Failed to upload chunk' });
+  }
+});
+
+// Complete chunked upload and process the file
+router.post('/:eventId/chunked-upload/:uploadId/complete', adminAuth, async (req, res) => {
+  try {
+    const { eventId, uploadId } = req.params;
+    const { category_id } = req.body;
+
+    // Complete the chunked upload (merge chunks)
+    const mergedFile = await chunkedUpload.completeUpload(uploadId);
+
+    // Process the merged file as a regular upload
+    const fileObj = {
+      originalname: mergedFile.filename,
+      mimetype: mergedFile.mimeType,
+      size: mergedFile.size,
+      path: mergedFile.path
+    };
+
+    const uploadedPhotos = await processUploadedPhotos(
+      [fileObj],
+      parseInt(eventId),
+      'admin',
+      category_id || null
+    );
+
+    // Clean up temp directory
+    try {
+      await fs.rm(mergedFile.tempDir, { recursive: true, force: true });
+    } catch (cleanupErr) {
+      console.warn('Failed to clean up temp directory:', cleanupErr.message);
+    }
+
+    res.json({
+      success: true,
+      uploaded: uploadedPhotos.length,
+      photos: uploadedPhotos
+    });
+  } catch (error) {
+    console.error('Error completing chunked upload:', error);
+    res.status(500).json({ error: error.message || 'Failed to complete upload' });
+  }
+});
+
+// Get upload status
+router.get('/:eventId/chunked-upload/:uploadId/status', adminAuth, async (req, res) => {
+  try {
+    const { uploadId } = req.params;
+
+    const status = chunkedUpload.getUploadStatus(uploadId);
+
+    if (!status) {
+      return res.status(404).json({ error: 'Upload not found or expired' });
+    }
+
+    res.json(status);
+  } catch (error) {
+    console.error('Error getting upload status:', error);
+    res.status(500).json({ error: 'Failed to get upload status' });
+  }
+});
+
+// Abort chunked upload
+router.delete('/:eventId/chunked-upload/:uploadId', adminAuth, async (req, res) => {
+  try {
+    const { uploadId } = req.params;
+
+    await chunkedUpload.abortUpload(uploadId);
+
+    res.json({ success: true, message: 'Upload aborted' });
+  } catch (error) {
+    console.error('Error aborting upload:', error);
+    res.status(500).json({ error: 'Failed to abort upload' });
+  }
+});
+
 module.exports = router;

backend/src/routes/adminSettings.js

@@ -18,7 +18,10 @@ const {
   getRawPublicSiteSettings,
 } = require('../services/publicSiteService');
 const { sanitizeCss } = require('../utils/cssSanitizer');
+const { clearShareLinkSettingsCache } = require('../services/shareLinkService');
+const { resetSecurityConfigCache } = require('../utils/authSecurity');
 const router = express.Router();
+const { clearMaxFilesPerUploadCache, MAX_ALLOWED_FILES_PER_UPLOAD } = require('../services/uploadSettings');
 
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 
@@ -188,7 +191,8 @@ router.put('/branding', adminAuth, async (req, res) => {
       logo_position,
       logo_display_header,
       logo_display_hero,
-      logo_display_mode
+      logo_display_mode,
+      hide_powered_by
     } = req.body;
 
     const brandingSettings = {
@@ -208,7 +212,8 @@ router.put('/branding', adminAuth, async (req, res) => {
       logo_position,
       logo_display_header,
       logo_display_hero,
-      logo_display_mode
+      logo_display_mode,
+      hide_powered_by
     };
 
     // Handle favicon deletion if empty string or null is provided
@@ -472,9 +477,24 @@ router.put('/theme', adminAuth, async (req, res) => {
 router.put('/general', adminAuth, async (req, res) => {
   try {
     const settings = { ...req.body };
+    let uploadLimitTouched = false;
 
     const publicSiteKeysTouched = Object.keys(settings).some((key) => key.startsWith('general_public_site_'));
 
+    if (Object.prototype.hasOwnProperty.call(settings, 'general_max_files_per_upload')) {
+      uploadLimitTouched = true;
+      const rawValue = Number(settings.general_max_files_per_upload);
+      const normalizedValue = Number.isFinite(rawValue) ? Math.floor(rawValue) : NaN;
+
+      if (!Number.isInteger(normalizedValue) || normalizedValue < 1 || normalizedValue > MAX_ALLOWED_FILES_PER_UPLOAD) {
+        return res.status(400).json({
+          error: `general_max_files_per_upload must be an integer between 1 and ${MAX_ALLOWED_FILES_PER_UPLOAD}`
+        });
+      }
+
+      settings.general_max_files_per_upload = normalizedValue;
+    }
+
     if (publicSiteKeysTouched) {
       if (Object.prototype.hasOwnProperty.call(settings, 'general_public_site_custom_css')) {
         settings.general_public_site_custom_css = sanitizeCss(settings.general_public_site_custom_css || '');
@@ -529,6 +549,12 @@ router.put('/general', adminAuth, async (req, res) => {
     if (publicSiteKeysTouched) {
       clearPublicSiteCache();
     }
+    if (uploadLimitTouched) {
+      clearMaxFilesPerUploadCache();
+    }
+    if (Object.prototype.hasOwnProperty.call(settings, 'general_short_gallery_urls')) {
+      clearShareLinkSettingsCache();
+    }
 
     // Log activity
     await db('activity_logs').insert({
@@ -567,6 +593,8 @@ router.put('/security', adminAuth, async (req, res) => {
         });
     }
 
+    resetSecurityConfigCache();
+
     // Log activity
     await db('activity_logs').insert({
       activity_type: 'security_settings_updated',

backend/src/routes/auth-enhanced-v2.js

@@ -12,13 +12,14 @@ const {
   checkSuspiciousActivity,
   getGenericAuthError
 } = require('../utils/authSecurity');
-const { 
+const {
   validatePasswordInContext,
   getBcryptRounds,
   logPasswordValidationFailure
 } = require('../utils/passwordValidation');
 const { endSession } = require('../middleware/sessionTimeout');
 const logger = require('../utils/logger');
+const { getClientIp } = require('../utils/requestIp');
 const router = express.Router();
 
 // Admin login with enhanced security
@@ -33,7 +34,7 @@ router.post('/admin/login', [
     }
     
     const { username, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
     const userAgent = req.headers['user-agent'] || '';
     
     // Check account lockout first
@@ -175,7 +176,7 @@ router.post('/admin/change-password', [
     logger.info('Admin password changed', {
       userId: adminId,
       username: admin.username,
-      ip: req.ip
+      ip: ipAddress
     });
     
     res.json({ 
@@ -229,14 +230,14 @@ router.post('/gallery/verify', [
     }
     
     const { slug, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
     const userAgent = req.headers['user-agent'] || '';
     
     const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
     const requiresPassword = !(event && (event.require_password === false || event.require_password === 0 || event.require_password === '0'));
 
     if (requiresPassword) {
-      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`, ipAddress);
       if (lockoutStatus.isLocked) {
         logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
         return res.status(423).json({ 

backend/src/routes/auth-enhanced.js

@@ -22,6 +22,8 @@ const {
   getAdminTokenFromRequest,
   getGalleryTokenFromRequest,
 } = require('../utils/tokenUtils');
+const { getEventShareToken, resolveShareIdentifier } = require('../services/shareLinkService');
+const { getClientIp } = require('../utils/requestIp');
 const router = express.Router();
 
 // Admin login with enhanced security
@@ -36,7 +38,7 @@ router.post('/admin/login', [
     }
     
     const { username, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
     const userAgent = req.headers['user-agent'] || '';
     
     // Check account lockout first
@@ -171,7 +173,7 @@ router.post('/gallery/verify', [
     }
     
     const { slug, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
     const userAgent = req.headers['user-agent'] || '';
     const event = await db('events')
       .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
@@ -185,7 +187,7 @@ router.post('/gallery/verify', [
     const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
 
     if (requiresPassword) {
-      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`, ipAddress);
       if (lockoutStatus.isLocked) {
         logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
         return res.status(423).json({ 
@@ -281,21 +283,25 @@ router.post('/gallery/share-login', [
     }
 
     const { slug, token } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
     const userAgent = req.headers['user-agent'] || '';
 
-    const event = await db('events')
+    let event = await db('events')
       .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
       .first();
 
+    if (!event) {
+      const resolved = await resolveShareIdentifier(slug);
+      if (resolved?.event) {
+        event = resolved.event;
+      }
+    }
+
     if (!event) {
       return res.status(404).json({ error: 'Gallery not found' });
     }
 
-    let expectedToken = event.share_link;
-    if (expectedToken && expectedToken.includes('/')) {
-      expectedToken = expectedToken.split('/').pop();
-    }
+    const expectedToken = getEventShareToken(event);
 
     if (!expectedToken || token !== expectedToken) {
       return res.status(401).json({ error: 'Invalid or expired share link' });
@@ -312,7 +318,7 @@ router.post('/gallery/share-login', [
       issuer: 'picpeak-auth'
     });
 
-    await trackSuccessfulLogin(`gallery:${slug}:share`, ipAddress, userAgent);
+    await trackSuccessfulLogin(`gallery:${event.slug}:share`, ipAddress, userAgent);
     setGalleryAuthCookies(res, jwtToken, event.slug);
 
     const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');

backend/src/routes/events.js

@@ -9,6 +9,7 @@ const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const fs = require('fs').promises;
 const path = require('path');
 const router = express.Router();
+const { buildShareLinkVariants } = require('../services/shareLinkService');
 
 const parseBooleanInput = (value, defaultValue = true) => {
   if (value === undefined || value === null) {
@@ -32,12 +33,66 @@ const parseBooleanInput = (value, defaultValue = true) => {
   return defaultValue;
 };
 
+const getCustomerNameFromPayload = (payload = {}) => {
+  if (typeof payload.customer_name === 'string') {
+    const trimmed = payload.customer_name.trim();
+    return trimmed || null;
+  }
+  return null;
+};
+
+const getCustomerEmailFromPayload = (payload = {}) => {
+  if (typeof payload.customer_email === 'string') {
+    const trimmed = payload.customer_email.trim();
+    return trimmed || null;
+  }
+  return null;
+};
+
+const mapEventForApi = (event) => {
+  if (!event || typeof event !== 'object') {
+    return event;
+  }
+
+  const {
+    host_name,
+    host_email,
+    customer_name,
+    customer_email,
+    ...rest
+  } = event;
+
+  return {
+    ...rest,
+    customer_name: customer_name ?? host_name ?? null,
+    customer_email: customer_email ?? host_email ?? null
+  };
+};
+
+let customerColumnCache = null;
+const hasCustomerContactColumns = async () => {
+  if (customerColumnCache === true) {
+    return true;
+  }
+
+  try {
+    const hasColumn = await db.schema.hasColumn('events', 'customer_email');
+    if (hasColumn) {
+      customerColumnCache = true;
+    }
+    return hasColumn;
+  } catch (error) {
+    return false;
+  }
+};
+
 // Create new event
 router.post('/', adminAuth, [
   body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
   body('event_name').notEmpty(),
   body('event_date').isDate(),
-  body('host_email').isEmail(),
+  body('customer_name').notEmpty().trim(),
+  body('customer_email').isEmail().normalizeEmail(),
   body('admin_email').isEmail(),
   body('require_password').optional().isBoolean(),
   body('password').optional().isString().custom((value, { req }) => {
@@ -62,7 +117,6 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
-      host_email,
       admin_email,
       password,
       require_password: requirePasswordInput = true,
@@ -71,6 +125,15 @@ router.post('/', adminAuth, [
       expiration_days = 30
     } = req.body;
 
+    const customerEmail = getCustomerEmailFromPayload(req.body);
+    const customerName = getCustomerNameFromPayload(req.body);
+
+    if (!customerName || !customerEmail) {
+      return res.status(400).json({ error: 'customer_name and customer_email are required' });
+    }
+
+    const customerColumnsAvailable = await hasCustomerContactColumns();
+
     const requirePassword = parseBooleanInput(requirePasswordInput, true);
 
     if (requirePassword) {
@@ -98,12 +161,9 @@ router.post('/', adminAuth, [
       counter++;
     }
     
-    // Generate share link (just slug/token, not full URL)
+    // Generate share link variants (auto-detects short URL preference)
     const shareToken = crypto.randomBytes(16).toString('hex');
-    const sharePath = `/gallery/${slug}/${shareToken}`;
-    const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
-    const fullShareLink = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
-    const shareLinkSlug = `${slug}/${shareToken}`;
+    const { sharePath, shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
     
     // Hash password (or placeholder when not required)
     const password_hash = requirePassword
@@ -126,12 +186,15 @@ router.post('/', adminAuth, [
       event_type,
       event_name,
       event_date,
-      host_email,
+      ...(customerColumnsAvailable ? { customer_name: customerName, customer_email: customerEmail } : {}),
+      host_name: customerName,
+      host_email: customerEmail,
       admin_email,
       password_hash,
       welcome_message,
       color_theme,
-      share_link: shareLinkSlug,
+      share_link: shareLinkToStore,
+      share_token: shareToken,
       expires_at,
       require_password: formatBoolean(requirePassword)
     }).returning('id');
@@ -141,11 +204,13 @@ router.post('/', adminAuth, [
     
     // Queue creation email
     const { queueEmail } = require('../services/emailProcessor');
-    await queueEmail(eventId, host_email, 'gallery_created', {
-      host_name: host_email.split('@')[0], // Extract name from email
+    await queueEmail(eventId, customerEmail, 'gallery_created', {
+      customer_name: customerName,
+      customer_email: customerEmail,
+      host_name: customerName,
       event_name,
       event_date: event_date,  // Pass raw date - will be formatted by email processor
-      gallery_link: fullShareLink,
+      gallery_link: shareUrl,
       gallery_password: requirePassword ? password : 'No password required',
       expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
       welcome_message: welcome_message || ''
@@ -154,9 +219,11 @@ router.post('/', adminAuth, [
     res.json({
       id: eventId,
       slug,
-      share_link: fullShareLink,
+      share_link: shareUrl,
       expires_at,
-      require_password: requirePassword
+      require_password: requirePassword,
+      customer_name: customerName,
+      customer_email: customerEmail
     });
   } catch (error) {
     console.error(error);
@@ -185,17 +252,27 @@ router.get('/', adminAuth, async (req, res) => {
       event.photo_count = photoCount.count;
     }
     
-    res.json(events);
+    res.json(events.map(mapEventForApi));
   } catch (error) {
     res.status(500).json({ error: 'Failed to fetch events' });
   }
 });
 
 // Update event
-router.put('/:id', adminAuth, async (req, res) => {
+router.put('/:id', adminAuth, [
+  body('customer_name').optional().trim().notEmpty(),
+  body('customer_email').optional().isEmail().normalizeEmail(),
+  body('require_password').optional().isBoolean()
+], async (req, res) => {
   try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
     const { id } = req.params;
     const updates = { ...req.body };
+    const customerColumnsAvailable = await hasCustomerContactColumns();
     
     // Don't allow updating certain fields
     delete updates.id;
@@ -203,6 +280,38 @@ router.put('/:id', adminAuth, async (req, res) => {
     delete updates.created_at;
     delete updates.password_confirmation;
 
+    if (Object.prototype.hasOwnProperty.call(updates, 'host_name') || Object.prototype.hasOwnProperty.call(updates, 'host_email')) {
+      return res.status(400).json({ error: 'host_name and host_email are no longer supported. Use customer_name and customer_email instead.' });
+    }
+
+    if (Object.prototype.hasOwnProperty.call(updates, 'customer_name')) {
+      const nextName = getCustomerNameFromPayload(updates);
+      if (nextName) {
+        if (customerColumnsAvailable) {
+          updates.customer_name = nextName;
+        } else {
+          delete updates.customer_name;
+        }
+        updates.host_name = nextName;
+      } else {
+        delete updates.customer_name;
+      }
+    }
+
+    if (Object.prototype.hasOwnProperty.call(updates, 'customer_email')) {
+      const nextEmail = getCustomerEmailFromPayload(updates);
+      if (nextEmail) {
+        if (customerColumnsAvailable) {
+          updates.customer_email = nextEmail;
+        } else {
+          delete updates.customer_email;
+        }
+        updates.host_email = nextEmail;
+      } else {
+        delete updates.customer_email;
+      }
+    }
+
     const hasRequirePasswordUpdate = Object.prototype.hasOwnProperty.call(updates, 'require_password');
     let requirePasswordUpdate;
     if (hasRequirePasswordUpdate) {

backend/src/routes/gallery.js

@@ -9,10 +9,41 @@ const { verifyGalleryAccess } = require('../middleware/gallery');
 const secureImageService = require('../services/secureImageService');
 const logger = require('../utils/logger');
 const { resolvePhotoFilePath } = require('../services/photoResolver');
+const { getEventShareToken, resolveShareIdentifier, buildShareLinkVariants } = require('../services/shareLinkService');
 
 // Get storage path from environment or default
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
 
+// Resolve gallery identifier (slug or token) to canonical data
+router.get('/resolve/:identifier', async (req, res) => {
+  try {
+    const { identifier } = req.params;
+    const result = await resolveShareIdentifier(identifier);
+
+    if (!result) {
+      return res.status(404).json({ error: 'Gallery not found' });
+    }
+
+    const { event, matchType, shareToken } = result;
+    const linkVariants = await buildShareLinkVariants({ slug: event.slug, shareToken });
+    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
+
+    res.json({
+      slug: event.slug,
+      token: shareToken,
+      matchType,
+      share_link: event.share_link,
+      share_path: linkVariants.sharePath,
+      share_url: linkVariants.shareUrl,
+      short_enabled: linkVariants.shortEnabled,
+      requires_password: requiresPassword
+    });
+  } catch (error) {
+    logger.error('Error resolving gallery identifier:', error);
+    res.status(500).json({ error: 'Failed to resolve gallery link' });
+  }
+});
+
 // Verify share token
 router.get('/:slug/verify-token/:token', async (req, res) => {
   try {
@@ -20,15 +51,14 @@ router.get('/:slug/verify-token/:token', async (req, res) => {
     
     const event = await db('events')
       .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
-      .select('id', 'share_link')
+      .select('id', 'share_link', 'share_token')
       .first();
     
     if (!event) {
       return res.status(404).json({ error: 'Gallery not found' });
     }
     
-    // Extract token from share link and verify
-    const expectedToken = event.share_link.split('/').pop();
+    const expectedToken = getEventShareToken(event);
     if (token !== expectedToken) {
       return res.status(404).json({ error: 'Invalid gallery link' });
     }
@@ -56,6 +86,7 @@ router.get('/:slug/info', async (req, res) => {
         'is_active',
         'is_archived',
         'share_link',
+        'share_token',
         'allow_downloads',
         'disable_right_click',
         'watermark_downloads',
@@ -76,12 +107,8 @@ router.get('/:slug/info', async (req, res) => {
     
     // If token provided, verify it matches the share link
     if (token) {
-      let expectedToken = event.share_link;
-      // Handle both formats: full URL or just token
-      if (event.share_link && event.share_link.includes('/')) {
-        expectedToken = event.share_link.split('/').pop();
-      }
-      if (token !== expectedToken) {
+      const expectedToken = getEventShareToken(event);
+      if (!expectedToken || token !== expectedToken) {
         return res.status(404).json({ error: 'Invalid gallery link' });
       }
     }
@@ -583,38 +610,41 @@ router.post('/:slug/download-selected', verifyGalleryAccess, async (req, res) =>
 
 
 // View single photo (with watermark if enabled)
-router.get('/:slug/photo/:photoId', 
-  verifyGalleryAccess, 
+router.get('/:slug/photo/:photoId',
+  verifyGalleryAccess,
   async (req, res) => {
     try {
       const { photoId } = req.params;
-      
+
       const photo = await db('photos')
         .where({ id: photoId, event_id: req.event.id })
         .first();
-      
-      
+
+
       if (!photo) {
         return res.status(404).json({ error: 'Photo not found' });
       }
 
+      // Check if this is a video
+      const isVideo = photo.media_type === 'video' || (photo.mime_type && photo.mime_type.startsWith('video/'));
+
       // Check protection level - basic and standard protection allow direct JWT access
       const protectionLevel = req.event.protection_level || 'standard';
-      
+
       if (protectionLevel === 'enhanced' || protectionLevel === 'maximum') {
         // For enhanced/maximum protection, redirect to secure endpoint
-        return res.status(302).json({ 
+        return res.status(302).json({
           error: 'Secure access required',
           secureEndpoint: `/api/secure-images/${req.params.slug}/generate-token`,
           photoId: photoId
         });
       }
-      
+
       // Resolve the absolute file path for this photo, supporting both managed and external reference modes
       const { resolvePhotoFilePath } = require('../services/photoResolver');
       const filePath = resolvePhotoFilePath(req.event, photo);
-      
-      
+
+
       // Log access - temporarily disabled for debugging
       // await secureImageService.logImageAccess(
       //   photoId,
@@ -622,20 +652,61 @@ router.get('/:slug/photo/:photoId',
       //   req.clientInfo,
       //   'view_basic'
       // );
-      
+
+      // Handle video streaming with range requests
+      if (isVideo) {
+        const fs = require('fs');
+        const stat = fs.statSync(filePath);
+        const fileSize = stat.size;
+        const range = req.headers.range;
+
+        if (range) {
+          // Parse range header
+          const parts = range.replace(/bytes=/, "").split("-");
+          const start = parseInt(parts[0], 10);
+          const end = parts[1] ? parseInt(parts[1], 10) : fileSize - 1;
+          const chunksize = (end - start) + 1;
+          const file = fs.createReadStream(filePath, { start, end });
+
+          res.writeHead(206, {
+            'Content-Range': `bytes ${start}-${end}/${fileSize}`,
+            'Accept-Ranges': 'bytes',
+            'Content-Length': chunksize,
+            'Content-Type': photo.mime_type || 'video/mp4',
+            'Cache-Control': 'private, max-age=1800',
+            'X-Protection-Level': 'basic'
+          });
+
+          file.pipe(res);
+        } else {
+          // No range request, send entire file
+          res.writeHead(200, {
+            'Content-Length': fileSize,
+            'Content-Type': photo.mime_type || 'video/mp4',
+            'Accept-Ranges': 'bytes',
+            'Cache-Control': 'private, max-age=1800',
+            'X-Protection-Level': 'basic'
+          });
+
+          fs.createReadStream(filePath).pipe(res);
+        }
+        return;
+      }
+
+      // Handle images (existing logic)
       // Get watermark settings
       const watermarkSettings = await watermarkService.getWatermarkSettings();
-      
+
       if (watermarkSettings && watermarkSettings.enabled) {
         // Apply watermark and send
         const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
-        
+
         res.set({
           'Content-Type': photo.mime_type || 'image/jpeg',
           'Cache-Control': 'private, max-age=1800', // Cache for 30 minutes
           'X-Protection-Level': 'basic'
         });
-        
+
         res.send(watermarkedBuffer);
       } else {
         // Send original file with basic protection headers
@@ -773,22 +844,35 @@ router.get('/:slug/stats', verifyGalleryAccess, async (req, res) => {
 router.post('/:eventId/upload', verifyGalleryAccess, async (req, res) => {
   try {
     const eventId = parseInt(req.params.eventId);
-    
+
     // Verify the event matches the token
     if (req.event.id !== eventId) {
       return res.status(403).json({ error: 'Access denied' });
     }
-    
+
     // Check if user uploads are allowed
     if (!req.event.allow_user_uploads) {
       return res.status(403).json({ error: 'User uploads are not allowed for this event' });
     }
-    
+
+    // Ensure temp upload directory exists
+    const fs = require('fs');
+    const tempUploadDir = '/tmp/uploads/';
+    if (!fs.existsSync(tempUploadDir)) {
+      try {
+        fs.mkdirSync(tempUploadDir, { recursive: true, mode: 0o755 });
+        logger.info('Created temp upload directory:', tempUploadDir);
+      } catch (mkdirErr) {
+        logger.error('Failed to create temp upload directory:', mkdirErr);
+        return res.status(500).json({ error: 'Server configuration error: unable to create upload directory' });
+      }
+    }
+
     // Import multer and photo processing
     const multer = require('multer');
-    const upload = multer({ 
-      dest: '/tmp/uploads/',
-      limits: { 
+    const upload = multer({
+      dest: tempUploadDir,
+      limits: {
         fileSize: 50 * 1024 * 1024, // 50MB
         files: 10 // Max 10 files at once
       },

backend/src/services/chunkedUploadService.js

@@ -0,0 +1,285 @@
+const path = require('path');
+const fs = require('fs').promises;
+const crypto = require('crypto');
+const logger = require('../utils/logger');
+
+// Get storage path from environment or default
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+const getChunksPath = () => path.join(getStoragePath(), 'chunks');
+
+// In-memory store for active uploads (in production, consider Redis)
+const activeUploads = new Map();
+
+// Chunk size: 10MB
+const CHUNK_SIZE = 10 * 1024 * 1024;
+
+// Upload expiration: 24 hours
+const UPLOAD_EXPIRATION_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Initialize a new chunked upload
+ * @param {Object} options - Upload options
+ * @returns {Promise<Object>} - Upload metadata
+ */
+async function initializeUpload(options) {
+  const {
+    filename,
+    fileSize,
+    mimeType,
+    eventId,
+    totalChunks
+  } = options;
+
+  // Generate unique upload ID
+  const uploadId = crypto.randomUUID();
+
+  // Create chunks directory for this upload
+  const uploadDir = path.join(getChunksPath(), uploadId);
+  await fs.mkdir(uploadDir, { recursive: true });
+
+  // Calculate expected chunks
+  const expectedChunks = totalChunks || Math.ceil(fileSize / CHUNK_SIZE);
+
+  // Store upload metadata
+  const uploadMeta = {
+    uploadId,
+    filename,
+    fileSize,
+    mimeType,
+    eventId,
+    expectedChunks,
+    receivedChunks: new Set(),
+    uploadDir,
+    createdAt: Date.now(),
+    expiresAt: Date.now() + UPLOAD_EXPIRATION_MS,
+    status: 'in_progress'
+  };
+
+  activeUploads.set(uploadId, uploadMeta);
+
+  logger.info('Initialized chunked upload', {
+    uploadId,
+    filename,
+    fileSize,
+    expectedChunks,
+    eventId
+  });
+
+  return {
+    uploadId,
+    chunkSize: CHUNK_SIZE,
+    expectedChunks,
+    expiresAt: uploadMeta.expiresAt
+  };
+}
+
+/**
+ * Upload a single chunk
+ * @param {string} uploadId - Upload ID
+ * @param {number} chunkIndex - Chunk index (0-based)
+ * @param {Buffer} chunkData - Chunk data
+ * @returns {Promise<Object>} - Chunk upload result
+ */
+async function uploadChunk(uploadId, chunkIndex, chunkData) {
+  const uploadMeta = activeUploads.get(uploadId);
+
+  if (!uploadMeta) {
+    throw new Error('Upload not found or expired');
+  }
+
+  if (uploadMeta.status !== 'in_progress') {
+    throw new Error(`Upload is ${uploadMeta.status}`);
+  }
+
+  // Check expiration
+  if (Date.now() > uploadMeta.expiresAt) {
+    await abortUpload(uploadId);
+    throw new Error('Upload expired');
+  }
+
+  // Write chunk to disk
+  const chunkPath = path.join(uploadMeta.uploadDir, `chunk_${String(chunkIndex).padStart(6, '0')}`);
+  await fs.writeFile(chunkPath, chunkData);
+
+  // Mark chunk as received
+  uploadMeta.receivedChunks.add(chunkIndex);
+
+  const progress = (uploadMeta.receivedChunks.size / uploadMeta.expectedChunks) * 100;
+
+  logger.debug('Chunk uploaded', {
+    uploadId,
+    chunkIndex,
+    receivedChunks: uploadMeta.receivedChunks.size,
+    expectedChunks: uploadMeta.expectedChunks,
+    progress: progress.toFixed(1)
+  });
+
+  return {
+    chunkIndex,
+    received: uploadMeta.receivedChunks.size,
+    expected: uploadMeta.expectedChunks,
+    progress,
+    complete: uploadMeta.receivedChunks.size === uploadMeta.expectedChunks
+  };
+}
+
+/**
+ * Complete the upload by merging all chunks
+ * @param {string} uploadId - Upload ID
+ * @returns {Promise<Object>} - Merged file info
+ */
+async function completeUpload(uploadId) {
+  const uploadMeta = activeUploads.get(uploadId);
+
+  if (!uploadMeta) {
+    throw new Error('Upload not found or expired');
+  }
+
+  // Verify all chunks received
+  if (uploadMeta.receivedChunks.size !== uploadMeta.expectedChunks) {
+    throw new Error(`Missing chunks: received ${uploadMeta.receivedChunks.size} of ${uploadMeta.expectedChunks}`);
+  }
+
+  uploadMeta.status = 'merging';
+
+  // Create temp file for merged result
+  const tempDir = path.join(getStoragePath(), 'temp', `merge_${Date.now()}_${Math.random().toString(36).substring(7)}`);
+  await fs.mkdir(tempDir, { recursive: true });
+
+  const mergedFilePath = path.join(tempDir, uploadMeta.filename);
+  const writeStream = require('fs').createWriteStream(mergedFilePath);
+
+  try {
+    // Merge chunks in order
+    for (let i = 0; i < uploadMeta.expectedChunks; i++) {
+      const chunkPath = path.join(uploadMeta.uploadDir, `chunk_${String(i).padStart(6, '0')}`);
+      const chunkData = await fs.readFile(chunkPath);
+
+      await new Promise((resolve, reject) => {
+        writeStream.write(chunkData, (err) => {
+          if (err) reject(err);
+          else resolve();
+        });
+      });
+    }
+
+    await new Promise((resolve) => writeStream.end(resolve));
+
+    // Verify file size
+    const stats = await fs.stat(mergedFilePath);
+    if (stats.size !== uploadMeta.fileSize) {
+      logger.warn('Merged file size mismatch', {
+        expected: uploadMeta.fileSize,
+        actual: stats.size
+      });
+    }
+
+    // Clean up chunks
+    await fs.rm(uploadMeta.uploadDir, { recursive: true, force: true });
+
+    uploadMeta.status = 'completed';
+    activeUploads.delete(uploadId);
+
+    logger.info('Chunked upload completed', {
+      uploadId,
+      filename: uploadMeta.filename,
+      fileSize: stats.size,
+      eventId: uploadMeta.eventId
+    });
+
+    return {
+      path: mergedFilePath,
+      filename: uploadMeta.filename,
+      size: stats.size,
+      mimeType: uploadMeta.mimeType,
+      eventId: uploadMeta.eventId,
+      tempDir
+    };
+  } catch (error) {
+    writeStream.destroy();
+    uploadMeta.status = 'failed';
+    throw error;
+  }
+}
+
+/**
+ * Abort and clean up an upload
+ * @param {string} uploadId - Upload ID
+ */
+async function abortUpload(uploadId) {
+  const uploadMeta = activeUploads.get(uploadId);
+
+  if (uploadMeta) {
+    try {
+      await fs.rm(uploadMeta.uploadDir, { recursive: true, force: true });
+    } catch (err) {
+      logger.warn('Failed to clean up upload directory', { uploadId, error: err.message });
+    }
+
+    activeUploads.delete(uploadId);
+
+    logger.info('Chunked upload aborted', { uploadId });
+  }
+}
+
+/**
+ * Get upload status
+ * @param {string} uploadId - Upload ID
+ * @returns {Object|null} - Upload status or null if not found
+ */
+function getUploadStatus(uploadId) {
+  const uploadMeta = activeUploads.get(uploadId);
+
+  if (!uploadMeta) {
+    return null;
+  }
+
+  return {
+    uploadId,
+    filename: uploadMeta.filename,
+    fileSize: uploadMeta.fileSize,
+    receivedChunks: uploadMeta.receivedChunks.size,
+    expectedChunks: uploadMeta.expectedChunks,
+    progress: (uploadMeta.receivedChunks.size / uploadMeta.expectedChunks) * 100,
+    status: uploadMeta.status,
+    createdAt: uploadMeta.createdAt,
+    expiresAt: uploadMeta.expiresAt
+  };
+}
+
+/**
+ * Clean up expired uploads
+ */
+async function cleanupExpiredUploads() {
+  const now = Date.now();
+  const expiredIds = [];
+
+  for (const [uploadId, meta] of activeUploads.entries()) {
+    if (now > meta.expiresAt) {
+      expiredIds.push(uploadId);
+    }
+  }
+
+  for (const uploadId of expiredIds) {
+    await abortUpload(uploadId);
+  }
+
+  if (expiredIds.length > 0) {
+    logger.info(`Cleaned up ${expiredIds.length} expired uploads`);
+  }
+
+  return expiredIds.length;
+}
+
+// Run cleanup every hour
+setInterval(cleanupExpiredUploads, 60 * 60 * 1000);
+
+module.exports = {
+  initializeUpload,
+  uploadChunk,
+  completeUpload,
+  abortUpload,
+  getUploadStatus,
+  cleanupExpiredUploads,
+  CHUNK_SIZE
+};

backend/src/services/emailProcessor.js

@@ -9,7 +9,7 @@ let lastConfigHash = null;
 // Generate hash from config for change detection
 function generateConfigHash(config) {
   const crypto = require('crypto');
-  const configString = `${config.smtp_host}:${config.smtp_port}:${config.smtp_user}:${config.smtp_pass}:${config.smtp_secure}`;
+  const configString = `${config.smtp_host}:${config.smtp_port}:${config.smtp_user}:${config.smtp_pass}:${config.smtp_secure}:${config.tls_reject_unauthorized}`;
   return crypto.createHash('md5').update(configString).digest('hex');
 }
 
@@ -40,7 +40,11 @@ async function initializeTransporter(forceReinit = false) {
       auth: config.smtp_user ? {
         user: config.smtp_user,
         pass: config.smtp_pass
-      } : undefined
+      } : undefined,
+      tls: {
+        // Allow ignoring SSL certificate errors when tls_reject_unauthorized is false
+        rejectUnauthorized: config.tls_reject_unauthorized !== false
+      }
     });
 
     // Verify configuration

backend/src/services/expirationChecker.js

@@ -58,11 +58,15 @@ async function queueExpirationWarning(event) {
   const daysRemaining = Math.ceil((new Date(event.expires_at) - new Date()) / (1000 * 60 * 60 * 24));
   
   // Determine language based on email domain
-  const emailLang = event.host_email.endsWith('.de') ? 'de' : 'en';
+  const recipientEmail = event.customer_email || event.host_email;
+  const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
+  const emailLang = recipientEmail && recipientEmail.endsWith('.de') ? 'de' : 'en';
   
-  // Queue email to host
-  await queueEmail(event.id, event.host_email, 'expiration_warning', {
-    host_name: event.host_name || event.host_email.split('@')[0],
+  // Queue email to customer
+  await queueEmail(event.id, recipientEmail, 'expiration_warning', {
+    customer_name: recipientName,
+    customer_email: recipientEmail,
+    host_name: recipientName,
     event_name: event.event_name,
     days_remaining: daysRemaining.toString(),
     expiration_date: await formatDate(event.expires_at, emailLang),
@@ -78,9 +82,14 @@ async function handleExpiredEvent(event) {
     await db('events').where('id', event.id).update({ is_active: formatBoolean(false) });
     
     // Queue expiration emails
-    await queueEmail(event.id, event.host_email, 'gallery_expired', {
+    const recipientEmail = event.customer_email || event.host_email;
+    const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
+
+    await queueEmail(event.id, recipientEmail, 'gallery_expired', {
       event_name: event.event_name,
-      admin_email: event.admin_email
+      admin_email: event.admin_email,
+      customer_name: recipientName,
+      customer_email: recipientEmail
     });
     
     // Also notify admin

backend/src/services/fileWatcher.js

@@ -3,8 +3,10 @@ const path = require('path');
 const fs = require('fs').promises;
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
-const { generateThumbnail } = require('./imageProcessor');
+const { generateThumbnail, generateVideoPlaceholder } = require('./imageProcessor');
 const logger = require('../utils/logger');
+const { isVideoMimeType } = require('../utils/fileSecurityUtils');
+const mime = require('mime-types');
 
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 const WATCH_PATH = () => path.join(getStoragePath(), 'events/active');
@@ -47,9 +49,11 @@ async function processNewPhoto(filePath) {
   const eventSlug = pathParts[0];
   const photoType = pathParts[1] === 'collages' ? 'collage' : 'individual';
   
-  // Check if this is an image file
+  // Check if this is an image or video file
   const ext = path.extname(filePath).toLowerCase();
-  if (!['.jpg', '.jpeg', '.png', '.webp'].includes(ext)) return;
+  const detectedMime = mime.lookup(filePath) || '';
+  const isVideo = isVideoMimeType(detectedMime, filePath) || ['.mp4', '.mov', '.webm'].includes(ext);
+  if (!isVideo && !['.jpg', '.jpeg', '.png', '.webp'].includes(ext)) return;
   
   // Skip temporary upload files
   const filename = path.basename(filePath);
@@ -65,11 +69,17 @@ async function processNewPhoto(filePath) {
   // Get file stats
   const stats = await fs.stat(filePath);
   
-  // Generate thumbnail
-  const thumbnailPath = await generateThumbnail(filePath);
+  // Generate thumbnail or placeholder
+  let thumbnailPath = null;
+  if (isVideo) {
+    thumbnailPath = await generateVideoPlaceholder(filename);
+  } else {
+    thumbnailPath = await generateThumbnail(filePath);
+  }
   
   // Calculate relative thumbnail path
   const relativeThumbPath = thumbnailPath; // thumbnailPath is already relative to storage root
+  const mimeType = detectedMime || (isVideo ? 'video/mp4' : 'image/jpeg');
   
   // Check if photo already exists
   const existingPhoto = await db('photos')
@@ -83,8 +93,9 @@ async function processNewPhoto(filePath) {
       filename: path.basename(filePath),
       path: relativePath,
       thumbnail_path: relativeThumbPath,
-      type: photoType,
-      size_bytes: stats.size
+      type: isVideo ? 'video' : photoType,
+      size_bytes: stats.size,
+      mime_type: mimeType
     });
     
     logger.info(`Added new photo: ${relativePath}`);

backend/src/services/imageProcessor.js

@@ -18,6 +18,29 @@ const DEFAULT_THUMBNAIL_FORMAT = 'jpeg';
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 const getThumbnailPath = () => path.join(getStoragePath(), 'thumbnails');
 
+// Helper to parse setting value (handles both JSON-encoded and plain values)
+function parseSettingValue(value) {
+  if (value === null || value === undefined) {
+    return null;
+  }
+  // Try to parse as JSON first (in case it's a JSON-encoded string like '"cover"')
+  try {
+    return JSON.parse(value);
+  } catch (e) {
+    // If it's not valid JSON, return the raw value
+    return value;
+  }
+}
+
+// Validate that fit value is valid for Sharp
+function validateFitValue(fit) {
+  const validFitValues = ['cover', 'contain', 'fill', 'inside', 'outside'];
+  if (fit && validFitValues.includes(fit)) {
+    return fit;
+  }
+  return DEFAULT_THUMBNAIL_FIT;
+}
+
 // Get thumbnail settings from database
 async function getThumbnailSettings() {
   try {
@@ -30,16 +53,19 @@ async function getThumbnailSettings() {
         'thumbnail_format'
       ])
       .select('setting_key', 'setting_value');
-    
+
     const settingsMap = {};
     settings.forEach(s => {
-      settingsMap[s.setting_key] = s.setting_value;
+      settingsMap[s.setting_key] = parseSettingValue(s.setting_value);
     });
-    
+
+    // Parse and validate fit value
+    const fitValue = validateFitValue(settingsMap.thumbnail_fit);
+
     return {
       width: parseInt(settingsMap.thumbnail_width) || DEFAULT_THUMBNAIL_WIDTH,
       height: parseInt(settingsMap.thumbnail_height) || DEFAULT_THUMBNAIL_HEIGHT,
-      fit: settingsMap.thumbnail_fit || DEFAULT_THUMBNAIL_FIT,
+      fit: fitValue,
       quality: parseInt(settingsMap.thumbnail_quality) || DEFAULT_THUMBNAIL_QUALITY,
       format: settingsMap.thumbnail_format || DEFAULT_THUMBNAIL_FORMAT
     };
@@ -211,4 +237,54 @@ async function ensureThumbnail(photo) {
   return null;
 }
 
-module.exports = { generateThumbnail, isThumbnailValid, ensureThumbnail };
+async function generateVideoPlaceholder(originalFilename, options = {}) {
+  const parsed = path.parse(originalFilename || '');
+  const baseName = parsed.name || 'video';
+  const thumbnailDir = getThumbnailPath();
+  const thumbnailFilename = `thumb_${baseName}.jpg`;
+  const thumbnailPath = path.join(thumbnailDir, thumbnailFilename);
+
+  const settings = await getThumbnailSettings();
+  const width = settings.width || DEFAULT_THUMBNAIL_WIDTH;
+  const height = settings.height || DEFAULT_THUMBNAIL_HEIGHT;
+
+  if (options.regenerate) {
+    try {
+      await fs.unlink(thumbnailPath);
+    } catch (_) {
+      // ignore if missing
+    }
+  }
+
+  try {
+    await fs.mkdir(thumbnailDir, { recursive: true });
+    const svg = `
+      <svg width="${width}" height="${height}" viewBox="0 0 ${width} ${height}" xmlns="http://www.w3.org/2000/svg">
+        <defs>
+          <linearGradient id="grad" x1="0%" y1="0%" x2="100%" y2="100%">
+            <stop offset="0%" stop-color="#0f172a" stop-opacity="0.9"/>
+            <stop offset="100%" stop-color="#1e293b" stop-opacity="0.9"/>
+          </linearGradient>
+        </defs>
+        <rect width="${width}" height="${height}" rx="18" fill="url(#grad)"/>
+        <circle cx="${width / 2}" cy="${height / 2}" r="${Math.min(width, height) / 6}" fill="rgba(255,255,255,0.85)"/>
+        <polygon points="${width / 2 - 10},${height / 2 - 14} ${width / 2 - 10},${height / 2 + 14} ${width / 2 + 16},${height / 2}" fill="#0f172a"/>
+        <text x="50%" y="${height - 18}" font-family="Arial, sans-serif" font-size="16" fill="rgba(255,255,255,0.9)" text-anchor="middle">
+          VIDEO
+        </text>
+      </svg>
+    `;
+
+    await sharp(Buffer.from(svg))
+      .resize(width, height, { fit: 'cover' })
+      .jpeg({ quality: settings.quality || DEFAULT_THUMBNAIL_QUALITY })
+      .toFile(thumbnailPath);
+
+    return path.relative(getStoragePath(), thumbnailPath);
+  } catch (error) {
+    logger.error('Failed to generate video placeholder thumbnail:', error.message);
+    return null;
+  }
+}
+
+module.exports = { generateThumbnail, isThumbnailValid, ensureThumbnail, generateVideoPlaceholder };

backend/src/services/photoProcessor.js

@@ -3,25 +3,52 @@ const fs = require('fs').promises;
 const { db } = require('../database/db');
 const { generateThumbnail } = require('./imageProcessor');
 const { generatePhotoFilename } = require('../utils/filenameSanitizer');
+const { processUploadedVideo, isVideoMimeType } = require('./videoProcessor');
 
 // Get storage path from environment or default
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 
 function normalizeFiles(files) {
-  if (!files) return [];
-  if (Array.isArray(files)) return files.filter(Boolean);
-
-  // Multer may expose files as an iterable object
-  if (typeof files[Symbol.iterator] === 'function') {
-    return Array.from(files).filter(Boolean);
+  // Handle null, undefined, or falsy values
+  if (!files) {
+    console.log('[normalizeFiles] No files provided');
+    return [];
   }
 
+  // Handle arrays
+  if (Array.isArray(files)) {
+    const validFiles = files.filter(Boolean);
+    console.log(`[normalizeFiles] Normalized ${validFiles.length} files from array`);
+    return validFiles;
+  }
+
+  // Handle iterable objects (some multer configurations)
+  try {
+    if (typeof files === 'object' && typeof files[Symbol.iterator] === 'function') {
+      const validFiles = Array.from(files).filter(Boolean);
+      console.log(`[normalizeFiles] Normalized ${validFiles.length} files from iterable`);
+      return validFiles;
+    }
+  } catch (err) {
+    console.warn('[normalizeFiles] Failed to iterate files object:', err.message);
+  }
+
+  // Handle plain objects (multer fieldname mapping)
   if (typeof files === 'object') {
-    return Object.values(files)
-      .flatMap((value) => (Array.isArray(value) ? value : [value]))
-      .filter(Boolean);
+    try {
+      const validFiles = Object.values(files)
+        .flatMap((value) => (Array.isArray(value) ? value : [value]))
+        .filter(Boolean);
+      console.log(`[normalizeFiles] Normalized ${validFiles.length} files from object`);
+      return validFiles;
+    } catch (err) {
+      console.warn('[normalizeFiles] Failed to process files object:', err.message);
+      return [];
+    }
   }
 
+  // Unexpected type
+  console.warn('[normalizeFiles] Unexpected files type:', typeof files);
   return [];
 }
 
@@ -80,59 +107,110 @@ async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categ
       const tempPath = file?.path || file?.filepath || file?.tempFilePath;
 
       if (!tempPath) {
-        throw new Error('Uploaded file is missing a temporary path');
+        const fileInfo = JSON.stringify({
+          originalname: file?.originalname,
+          mimetype: file?.mimetype,
+          size: file?.size,
+          availableKeys: Object.keys(file || {})
+        });
+        throw new Error(`Uploaded file is missing a temporary path. File info: ${fileInfo}`);
+      }
+
+      // Verify temp file exists before copying
+      try {
+        await fs.access(tempPath);
+      } catch (accessErr) {
+        console.error(`Temp file not accessible: ${tempPath}`, {
+          originalname: file?.originalname,
+          error: accessErr.message
+        });
+        throw new Error(`Uploaded file not found at temporary location: ${tempPath}`);
       }
 
       // Use copyFile and unlink instead of rename to avoid cross-device issues
       try {
         await fs.copyFile(tempPath, newPath);
+        console.log(`Successfully copied ${file.originalname} to ${newPath}`);
+      } catch (copyErr) {
+        console.error(`Failed to copy file from ${tempPath} to ${newPath}:`, copyErr);
+        throw new Error(`Failed to copy uploaded file: ${copyErr.message}`);
       } finally {
+        // Clean up temp file with better error handling
         try {
           await fs.unlink(tempPath);
+          console.log(`Cleaned up temp file: ${tempPath}`);
         } catch (unlinkErr) {
+          // Only warn if file exists but couldn't be deleted
+          // ENOENT means file was already deleted, which is fine
           if (unlinkErr?.code !== 'ENOENT') {
-            console.warn(`Failed to clean up temp upload ${tempPath}:`, unlinkErr);
+            console.warn(`Failed to clean up temp upload ${tempPath}:`, {
+              error: unlinkErr.message,
+              code: unlinkErr.code
+            });
           }
         }
       }
       
-      // Generate thumbnail
-      const thumbnailPath = await generateThumbnail(newPath);
-      
+      // Determine if this is a video or image
+      const isVideo = isVideoMimeType(file.mimetype);
+      const mediaType = isVideo ? 'video' : 'image';
+
+      // Generate thumbnail and extract metadata
+      let thumbnailPath;
+      let videoMetadata = null;
+
+      if (isVideo) {
+        // Process video: extract metadata and generate thumbnail
+        const thumbnailDir = path.join(getStoragePath(), 'thumbnails');
+        await fs.mkdir(thumbnailDir, { recursive: true });
+        const videoThumbnailPath = path.join(thumbnailDir, `thumb_${newFilename.replace(/\.[^.]+$/, '.jpg')}`);
+
+        const result = await processUploadedVideo(newPath, videoThumbnailPath);
+        videoMetadata = result.metadata;
+        thumbnailPath = path.relative(getStoragePath(), videoThumbnailPath);
+      } else {
+        // Process image: generate thumbnail
+        thumbnailPath = await generateThumbnail(newPath);
+      }
+
       // Calculate relative paths
       const storagePath = getStoragePath();
       const relativePath = path.relative(path.join(storagePath, 'events/active'), newPath);
       const relativeThumbPath = thumbnailPath; // thumbnailPath is already relative to storage root
-      
-      // Add to database with uploaded_by field
+
+      // Add to database with uploaded_by field and media metadata
       let insertResult;
       const clientName = trx?.client?.config?.client;
       const supportsReturning = ['pg', 'postgres', 'postgresql'].includes(clientName);
 
+      const photoData = {
+        event_id: eventId,
+        filename: newFilename,
+        path: relativePath,
+        thumbnail_path: relativeThumbPath,
+        type: photoType,
+        size_bytes: file.size,
+        uploaded_by: uploadedBy,
+        source_origin: 'managed',
+        media_type: mediaType,
+        mime_type: file.mimetype
+      };
+
+      // Add video-specific metadata if applicable
+      if (isVideo && videoMetadata) {
+        photoData.duration = videoMetadata.duration;
+        photoData.video_codec = videoMetadata.videoCodec;
+        photoData.audio_codec = videoMetadata.audioCodec;
+        photoData.width = videoMetadata.width;
+        photoData.height = videoMetadata.height;
+      }
+
       if (supportsReturning) {
         insertResult = await trx('photos')
-          .insert({
-            event_id: eventId,
-            filename: newFilename,
-            path: relativePath,
-            thumbnail_path: relativeThumbPath,
-            type: photoType,
-            size_bytes: file.size,
-            uploaded_by: uploadedBy,
-            source_origin: 'managed'
-          })
+          .insert(photoData)
           .returning('id');
       } else {
-        insertResult = await trx('photos').insert({
-          event_id: eventId,
-          filename: newFilename,
-          path: relativePath,
-          thumbnail_path: relativeThumbPath,
-          type: photoType,
-          size_bytes: file.size,
-          uploaded_by: uploadedBy,
-          source_origin: 'managed'
-        });
+        insertResult = await trx('photos').insert(photoData);
       }
 
       const insertedId = Array.isArray(insertResult)
@@ -154,10 +232,28 @@ async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categ
         size: file.size,
         type: photoType
       });
+
+      console.log(`Successfully processed file ${file.originalname} (ID: ${photoId})`);
     } catch (error) {
-      console.error(`Error processing file ${file.originalname}:`, error);
-      if (trx) await trx.rollback();
+      console.error(`Error processing file ${file.originalname}:`, {
+        error: error.message,
+        stack: error.stack,
+        originalname: file.originalname,
+        mimetype: file.mimetype,
+        size: file.size,
+        tempPath: file?.path || file?.filepath || file?.tempFilePath
+      });
+
+      if (trx) {
+        try {
+          await trx.rollback();
+        } catch (rollbackErr) {
+          console.error('Failed to rollback transaction:', rollbackErr);
+        }
+      }
+
       // Continue with other files
+      // Note: Individual file failures don't stop the entire upload batch
     }
   }
   

backend/src/services/photoResolver.js

@@ -12,10 +12,12 @@ const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '.
 function resolvePhotoFilePath(event, photo) {
   if (!event || !photo) throw new Error('resolvePhotoFilePath requires event and photo');
 
-  const isExternal = photo.source_origin === 'external' ||
-    (!!photo.external_relpath && (event.source_mode === 'reference' || event.source_mode === 'external'));
-
-  if (isExternal) {
+  // IMPORTANT: photo.source_origin takes precedence over event.source_mode
+  // This allows events in "reference" mode to have mixed sources:
+  // - Imported photos: source_origin = 'external'
+  // - Uploaded photos: source_origin = 'managed'
+  const mode = (photo.source_origin || event.source_mode || 'managed');
+  if (mode === 'reference' || mode === 'external') {
     if (!photo.external_relpath) {
       throw new Error('Missing external_relpath for external photo');
     }

backend/src/services/shareLinkService.js

@@ -0,0 +1,181 @@
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { extractShareToken, isPotentialShareToken, buildSharePath } = require('../utils/shareLinkUtils');
+
+const SETTING_KEY = 'general_short_gallery_urls';
+const CACHE_TTL_MS = 60_000;
+
+let cachedSetting = null;
+let cacheExpiresAt = 0;
+
+const parseSettingValue = (rawValue) => {
+  if (rawValue === undefined || rawValue === null) {
+    return null;
+  }
+
+  if (typeof rawValue === 'boolean') {
+    return rawValue;
+  }
+
+  if (typeof rawValue === 'number') {
+    return rawValue !== 0;
+  }
+
+  if (typeof rawValue === 'string') {
+    const trimmed = rawValue.trim();
+    if (!trimmed) {
+      return null;
+    }
+
+    try {
+      const parsed = JSON.parse(trimmed);
+      return parseSettingValue(parsed);
+    } catch {
+      const normalized = trimmed.toLowerCase();
+      if (normalized === 'true' || normalized === '1' || normalized === 'yes') {
+        return true;
+      }
+      if (normalized === 'false' || normalized === '0' || normalized === 'no') {
+        return false;
+      }
+      return null;
+    }
+  }
+
+  if (typeof rawValue === 'object') {
+    try {
+      return parseSettingValue(JSON.parse(JSON.stringify(rawValue)));
+    } catch {
+      return null;
+    }
+  }
+
+  return null;
+};
+
+const getRawSettingValue = async () => {
+  try {
+    const setting = await db('app_settings').where({ setting_key: SETTING_KEY }).first();
+    return setting?.setting_value ?? null;
+  } catch (error) {
+    console.error('Failed to read gallery URL setting:', error.message);
+    return null;
+  }
+};
+
+const isShortGalleryUrlsEnabled = async () => {
+  if (cachedSetting !== null && Date.now() < cacheExpiresAt) {
+    return cachedSetting;
+  }
+
+  const rawValue = await getRawSettingValue();
+  const parsed = parseSettingValue(rawValue);
+  cachedSetting = parsed === null ? false : Boolean(parsed);
+  cacheExpiresAt = Date.now() + CACHE_TTL_MS;
+  return cachedSetting;
+};
+
+const clearShareLinkSettingsCache = () => {
+  cachedSetting = null;
+  cacheExpiresAt = 0;
+};
+
+const buildShareLinkVariants = async ({ slug, shareToken }) => {
+  if (!shareToken) {
+    throw new Error('shareToken is required to build share link variants');
+  }
+
+  const shortEnabled = await isShortGalleryUrlsEnabled();
+  const sharePath = buildSharePath(slug, shareToken, shortEnabled);
+  const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
+  const shareUrl = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
+
+  return {
+    shortEnabled,
+    sharePath,
+    shareUrl,
+    shareLinkToStore: sharePath
+  };
+};
+
+const getEventShareToken = (event) => {
+  if (!event) {
+    return null;
+  }
+
+  if (event.share_token) {
+    return event.share_token;
+  }
+
+  return extractShareToken(event.share_link);
+};
+
+const ACTIVE_EVENT_FILTER = {
+  is_active: formatBoolean(true),
+  is_archived: formatBoolean(false)
+};
+
+const resolveShareIdentifier = async (identifier) => {
+  if (!identifier) {
+    return null;
+  }
+
+  const trimmed = String(identifier).trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  const baseQuery = db('events')
+    .select(
+      'id',
+      'slug',
+      'share_link',
+      'share_token',
+      'require_password',
+      'event_name',
+      'event_type',
+      'event_date',
+      'expires_at',
+      'is_active',
+      'is_archived'
+    )
+    .where(ACTIVE_EVENT_FILTER);
+
+  let event = await baseQuery.clone().where({ slug: trimmed }).first();
+  if (event) {
+    return { event, matchType: 'slug', shareToken: getEventShareToken(event) };
+  }
+
+  event = await baseQuery.clone().where({ share_token: trimmed }).first();
+  if (event) {
+    return { event, matchType: 'token', shareToken: getEventShareToken(event) };
+  }
+
+  event = await baseQuery.clone().where({ share_link: trimmed }).first();
+  if (event) {
+    return { event, matchType: 'link', shareToken: getEventShareToken(event) };
+  }
+
+  event = await baseQuery.clone().where('share_link', 'like', `%/${trimmed}`).first();
+  if (event) {
+    return { event, matchType: 'link_partial', shareToken: getEventShareToken(event) };
+  }
+
+  // As a final fallback, if identifier looks like a token but we did not match via share_token
+  if (isPotentialShareToken(trimmed)) {
+    event = await baseQuery.clone().whereRaw('LOWER(share_token) = ?', [trimmed.toLowerCase()]).first();
+    if (event) {
+      return { event, matchType: 'token_case_insensitive', shareToken: getEventShareToken(event) };
+    }
+  }
+
+  return null;
+};
+
+module.exports = {
+  isShortGalleryUrlsEnabled,
+  clearShareLinkSettingsCache,
+  buildShareLinkVariants,
+  getEventShareToken,
+  resolveShareIdentifier
+};

backend/src/services/uploadSettings.js

@@ -0,0 +1,87 @@
+const { db } = require('../database/db');
+
+const DEFAULT_MAX_FILES_PER_UPLOAD = 500;
+const MAX_ALLOWED_FILES_PER_UPLOAD = 2000;
+const CACHE_TTL_MS = 60_000;
+
+let cachedValue = DEFAULT_MAX_FILES_PER_UPLOAD;
+let cacheExpiresAt = 0;
+
+const parseSettingValue = (setting) => {
+  if (!setting || setting.setting_value == null) {
+    return null;
+  }
+
+  let rawValue = setting.setting_value;
+
+  if (typeof rawValue === 'string') {
+    try {
+      rawValue = JSON.parse(rawValue);
+    } catch {
+      // keep original string
+    }
+  }
+
+  if (typeof rawValue === 'string') {
+    const trimmed = rawValue.trim();
+    if (trimmed === '') {
+      return null;
+    }
+    const parsed = Number(trimmed);
+    return Number.isFinite(parsed) ? parsed : null;
+  }
+
+  if (typeof rawValue === 'number') {
+    return rawValue;
+  }
+
+  return null;
+};
+
+const normalizeLimit = (value) => {
+  if (!Number.isFinite(value)) {
+    return DEFAULT_MAX_FILES_PER_UPLOAD;
+  }
+
+  const intValue = Math.floor(value);
+  if (intValue < 1) {
+    return DEFAULT_MAX_FILES_PER_UPLOAD;
+  }
+  if (intValue > MAX_ALLOWED_FILES_PER_UPLOAD) {
+    return MAX_ALLOWED_FILES_PER_UPLOAD;
+  }
+  return intValue;
+};
+
+const getMaxFilesPerUpload = async () => {
+  if (Date.now() < cacheExpiresAt) {
+    return cachedValue;
+  }
+
+  try {
+    const setting = await db('app_settings')
+      .where({ setting_key: 'general_max_files_per_upload' })
+      .first();
+
+    const parsedValue = normalizeLimit(parseSettingValue(setting));
+    cachedValue = parsedValue;
+    cacheExpiresAt = Date.now() + CACHE_TTL_MS;
+    return parsedValue;
+  } catch (error) {
+    console.error('Failed to read max files per upload setting:', error.message);
+    cachedValue = DEFAULT_MAX_FILES_PER_UPLOAD;
+    cacheExpiresAt = Date.now() + CACHE_TTL_MS;
+    return DEFAULT_MAX_FILES_PER_UPLOAD;
+  }
+};
+
+const clearMaxFilesPerUploadCache = () => {
+  cacheExpiresAt = 0;
+};
+
+module.exports = {
+  getMaxFilesPerUpload,
+  clearMaxFilesPerUploadCache,
+  DEFAULT_MAX_FILES_PER_UPLOAD,
+  MAX_ALLOWED_FILES_PER_UPLOAD
+};

backend/src/services/videoProcessor.js

@@ -0,0 +1,182 @@
+const ffmpeg = require('fluent-ffmpeg');
+const ffmpegPath = require('@ffmpeg-installer/ffmpeg').path;
+const path = require('path');
+const fs = require('fs').promises;
+const logger = require('../utils/logger');
+
+// Set FFmpeg path
+ffmpeg.setFfmpegPath(ffmpegPath);
+
+/**
+ * Extract video metadata using FFmpeg
+ * @param {string} videoPath - Path to the video file
+ * @returns {Promise<Object>} - Video metadata
+ */
+async function extractVideoMetadata(videoPath) {
+  return new Promise((resolve, reject) => {
+    ffmpeg.ffprobe(videoPath, (err, metadata) => {
+      if (err) {
+        logger.error('Error extracting video metadata', { error: err.message, videoPath });
+        return reject(err);
+      }
+
+      try {
+        const videoStream = metadata.streams.find(s => s.codec_type === 'video');
+        const audioStream = metadata.streams.find(s => s.codec_type === 'audio');
+
+        const result = {
+          duration: Math.floor(metadata.format.duration || 0),
+          width: videoStream?.width || null,
+          height: videoStream?.height || null,
+          videoCodec: videoStream?.codec_name || null,
+          audioCodec: audioStream?.codec_name || null,
+          size: metadata.format.size || 0,
+          bitrate: metadata.format.bit_rate || null,
+          format: metadata.format.format_name || null
+        };
+
+        resolve(result);
+      } catch (parseErr) {
+        logger.error('Error parsing video metadata', { error: parseErr.message });
+        reject(parseErr);
+      }
+    });
+  });
+}
+
+/**
+ * Generate thumbnail from video
+ * @param {string} videoPath - Path to the video file
+ * @param {string} outputPath - Path for the output thumbnail
+ * @param {Object} options - Thumbnail options
+ * @returns {Promise<string>} - Path to generated thumbnail
+ */
+async function generateVideoThumbnail(videoPath, outputPath, options = {}) {
+  const {
+    timeOffset = '00:00:01', // Take screenshot at 1 second
+    size = '300x300',
+    quality = 2 // 1-31, lower is better quality
+  } = options;
+
+  return new Promise((resolve, reject) => {
+    ffmpeg(videoPath)
+      .screenshots({
+        timestamps: [timeOffset],
+        filename: path.basename(outputPath),
+        folder: path.dirname(outputPath),
+        size: size
+      })
+      .on('end', () => {
+        logger.info('Video thumbnail generated', { videoPath, outputPath });
+        resolve(outputPath);
+      })
+      .on('error', (err) => {
+        logger.error('Error generating video thumbnail', { error: err.message, videoPath });
+        reject(err);
+      });
+  });
+}
+
+/**
+ * Validate that a file is a valid video
+ * @param {string} videoPath - Path to the video file
+ * @returns {Promise<boolean>} - True if valid video
+ */
+async function isValidVideo(videoPath) {
+  try {
+    const metadata = await extractVideoMetadata(videoPath);
+    return metadata.duration > 0 && metadata.width > 0 && metadata.height > 0;
+  } catch (error) {
+    logger.error('Video validation failed', { error: error.message, videoPath });
+    return false;
+  }
+}
+
+/**
+ * Get video duration in seconds
+ * @param {string} videoPath - Path to the video file
+ * @returns {Promise<number>} - Duration in seconds
+ */
+async function getVideoDuration(videoPath) {
+  try {
+    const metadata = await extractVideoMetadata(videoPath);
+    return metadata.duration;
+  } catch (error) {
+    logger.error('Error getting video duration', { error: error.message });
+    return 0;
+  }
+}
+
+/**
+ * Process uploaded video - extract metadata and generate thumbnail
+ * @param {string} videoPath - Path to the video file
+ * @param {string} thumbnailPath - Path for the thumbnail
+ * @param {Object} options - Processing options
+ * @returns {Promise<Object>} - Video metadata and processing result
+ */
+async function processUploadedVideo(videoPath, thumbnailPath, options = {}) {
+  try {
+    // Validate video
+    const isValid = await isValidVideo(videoPath);
+    if (!isValid) {
+      throw new Error('Invalid video file');
+    }
+
+    // Extract metadata
+    const metadata = await extractVideoMetadata(videoPath);
+
+    // Generate thumbnail
+    await generateVideoThumbnail(videoPath, thumbnailPath, options);
+
+    // Verify thumbnail was created
+    try {
+      await fs.access(thumbnailPath);
+    } catch (err) {
+      throw new Error('Thumbnail generation failed');
+    }
+
+    return {
+      success: true,
+      metadata,
+      thumbnailPath
+    };
+  } catch (error) {
+    logger.error('Error processing video', { error: error.message, videoPath });
+    throw error;
+  }
+}
+
+/**
+ * Get video thumbnail at specific time
+ * @param {string} videoPath - Path to video file
+ * @param {string} outputPath - Output path for thumbnail
+ * @param {number} timeInSeconds - Time in seconds to capture thumbnail
+ * @returns {Promise<string>} - Path to thumbnail
+ */
+async function getThumbnailAtTime(videoPath, outputPath, timeInSeconds = 1) {
+  const hours = Math.floor(timeInSeconds / 3600);
+  const minutes = Math.floor((timeInSeconds % 3600) / 60);
+  const seconds = Math.floor(timeInSeconds % 60);
+  const timeOffset = `${String(hours).padStart(2, '0')}:${String(minutes).padStart(2, '0')}:${String(seconds).padStart(2, '0')}`;
+
+  return generateVideoThumbnail(videoPath, outputPath, { timeOffset });
+}
+
+/**
+ * Check if file is a video based on MIME type
+ * @param {string} mimeType - MIME type of the file
+ * @returns {boolean} - True if video MIME type
+ */
+function isVideoMimeType(mimeType) {
+  return mimeType && mimeType.startsWith('video/');
+}
+
+module.exports = {
+  extractVideoMetadata,
+  generateVideoThumbnail,
+  isValidVideo,
+  getVideoDuration,
+  processUploadedVideo,
+  getThumbnailAtTime,
+  isVideoMimeType
+};

backend/src/services/workerManager.js

@@ -0,0 +1,72 @@
+/**
+ * Worker Manager - Background service for PicPeak
+ *
+ * This service runs as a separate process to handle:
+ * - File watching for new photos
+ * - Expiration checking for events
+ * - Other background tasks
+ */
+
+const path = require('path');
+const logger = require('../utils/logger');
+
+// Load environment variables
+require('dotenv').config({ path: path.join(__dirname, '../../.env') });
+
+// Import services
+const { startFileWatcher } = require('./fileWatcher');
+const { startExpirationChecker } = require('./expirationChecker');
+
+let isShuttingDown = false;
+
+async function startWorkers() {
+  logger.info('Starting PicPeak background workers...');
+
+  try {
+    // Start file watcher for automatic photo processing
+    startFileWatcher();
+    logger.info('File watcher started successfully');
+
+    // Start expiration checker for event lifecycle management
+    startExpirationChecker();
+    logger.info('Expiration checker started successfully');
+
+    logger.info('All background workers started successfully');
+  } catch (error) {
+    logger.error('Failed to start background workers:', error);
+    process.exit(1);
+  }
+}
+
+function handleShutdown(signal) {
+  if (isShuttingDown) {
+    logger.info('Shutdown already in progress...');
+    return;
+  }
+
+  isShuttingDown = true;
+  logger.info(`Received ${signal}. Shutting down gracefully...`);
+
+  // Give time for cleanup
+  setTimeout(() => {
+    logger.info('Worker manager shutdown complete');
+    process.exit(0);
+  }, 1000);
+}
+
+// Handle shutdown signals
+process.on('SIGTERM', () => handleShutdown('SIGTERM'));
+process.on('SIGINT', () => handleShutdown('SIGINT'));
+
+// Handle uncaught errors
+process.on('uncaughtException', (error) => {
+  logger.error('Uncaught exception in worker manager:', error);
+  process.exit(1);
+});
+
+process.on('unhandledRejection', (reason, promise) => {
+  logger.error('Unhandled rejection in worker manager:', reason);
+});
+
+// Start workers
+startWorkers();

backend/src/utils/authSecurity.js

@@ -7,10 +7,140 @@ const { db } = require('../database/db');
 const { formatBoolean } = require('./dbCompat');
 const logger = require('./logger');
 
-// Configuration constants
-const MAX_LOGIN_ATTEMPTS = 5;
-const LOCKOUT_DURATION = 30 * 60 * 1000; // 30 minutes in milliseconds
-const ATTEMPT_WINDOW = 15 * 60 * 1000; // 15 minutes window for counting attempts
+const DEFAULT_SECURITY_CONFIG = Object.freeze({
+  maxAttempts: 5,
+  lockoutDurationMs: 30 * 60 * 1000, // 30 minutes
+  attemptWindowMs: 15 * 60 * 1000 // 15 minutes
+});
+
+const SECURITY_CONFIG_CACHE_MS = 60 * 1000; // 1 minute cache
+let cachedSecurityConfig = { ...DEFAULT_SECURITY_CONFIG };
+let cachedConfigFetchedAt = 0;
+
+function parseStoredValue(rawValue) {
+  if (rawValue === undefined || rawValue === null) {
+    return undefined;
+  }
+
+  if (typeof rawValue !== 'string') {
+    return rawValue;
+  }
+
+  try {
+    return JSON.parse(rawValue);
+  } catch (error) {
+    logger.warn(`Unable to parse stored security setting value "${rawValue}", using raw string.`);
+    return rawValue;
+  }
+}
+
+function normalizePositiveInteger(name, value, fallback, options = {}) {
+  if (value === undefined || value === null || value === '') {
+    return fallback;
+  }
+
+  const numericValue = Number(value);
+
+  if (!Number.isFinite(numericValue)) {
+    logger.warn(`Invalid numeric value for ${name}: ${value}. Falling back to default (${fallback}).`);
+    return fallback;
+  }
+
+  let adjustedValue = Math.floor(numericValue);
+
+  if (options.min !== undefined && adjustedValue < options.min) {
+    logger.warn(`Value for ${name} below minimum (${options.min}). Clamping to minimum.`);
+    adjustedValue = options.min;
+  }
+
+  if (options.max !== undefined && adjustedValue > options.max) {
+    logger.warn(`Value for ${name} exceeds maximum (${options.max}). Clamping to maximum.`);
+    adjustedValue = options.max;
+  }
+
+  if (adjustedValue <= 0) {
+    logger.warn(`Value for ${name} must be positive. Falling back to default (${fallback}).`);
+    return fallback;
+  }
+
+  return adjustedValue;
+}
+
+async function loadSecurityConfigFromSettings() {
+  const rows = await db('app_settings').whereIn('setting_key', [
+    'security_max_login_attempts',
+    'security_lockout_duration_minutes',
+    'security_attempt_window_minutes'
+  ]);
+
+  const config = { ...DEFAULT_SECURITY_CONFIG };
+
+  rows.forEach(row => {
+    const value = parseStoredValue(row.setting_value);
+
+    switch (row.setting_key) {
+      case 'security_max_login_attempts': {
+        config.maxAttempts = normalizePositiveInteger(
+          'security_max_login_attempts',
+          value,
+          DEFAULT_SECURITY_CONFIG.maxAttempts,
+          { min: 1, max: 50 }
+        );
+        break;
+      }
+      case 'security_lockout_duration_minutes': {
+        const minutes = normalizePositiveInteger(
+          'security_lockout_duration_minutes',
+          value,
+          DEFAULT_SECURITY_CONFIG.lockoutDurationMs / (60 * 1000),
+          { min: 1, max: 24 * 60 }
+        );
+        config.lockoutDurationMs = minutes * 60 * 1000;
+        break;
+      }
+      case 'security_attempt_window_minutes': {
+        const minutes = normalizePositiveInteger(
+          'security_attempt_window_minutes',
+          value,
+          DEFAULT_SECURITY_CONFIG.attemptWindowMs / (60 * 1000),
+          { min: 1, max: 24 * 60 }
+        );
+        config.attemptWindowMs = minutes * 60 * 1000;
+        break;
+      }
+      default:
+        break;
+    }
+  });
+
+  return config;
+}
+
+async function getSecurityConfig(options = {}) {
+  const now = Date.now();
+  const forceRefresh = options.forceRefresh === true;
+
+  if (!forceRefresh && cachedSecurityConfig && (now - cachedConfigFetchedAt) < SECURITY_CONFIG_CACHE_MS) {
+    return cachedSecurityConfig;
+  }
+
+  try {
+    const config = await loadSecurityConfigFromSettings();
+    cachedSecurityConfig = config;
+    cachedConfigFetchedAt = now;
+    return cachedSecurityConfig;
+  } catch (error) {
+    logger.error('Error loading security configuration:', error);
+    cachedSecurityConfig = { ...DEFAULT_SECURITY_CONFIG };
+    cachedConfigFetchedAt = now;
+    return cachedSecurityConfig;
+  }
+}
+
+function resetSecurityConfigCache() {
+  cachedSecurityConfig = { ...DEFAULT_SECURITY_CONFIG };
+  cachedConfigFetchedAt = 0;
+}
 
 /**
  * Track failed login attempt
@@ -59,6 +189,8 @@ async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
     if (!tableExists) {
       return;
     }
+
+    const { attemptWindowMs } = await getSecurityConfig();
     
     await db('login_attempts').insert({
       identifier,
@@ -69,7 +201,7 @@ async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
     });
 
     // Clear old failed attempts for this user
-    const cutoffTime = new Date(Date.now() - ATTEMPT_WINDOW);
+    const cutoffTime = new Date(Date.now() - attemptWindowMs);
     await db('login_attempts')
       .where('identifier', identifier)
       .where('success', formatBoolean(false))
@@ -83,30 +215,39 @@ async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
 /**
  * Check if account is locked due to too many failed attempts
  * @param {string} identifier - Username or email
+ * @param {string} [ipAddress] - Optional IP address scope
  * @returns {Promise<{isLocked: boolean, remainingTime?: number}>}
  */
-async function checkAccountLockout(identifier) {
+async function checkAccountLockout(identifier, ipAddress) {
   try {
     // Check if table exists first
     const tableExists = await db.schema.hasTable('login_attempts');
     if (!tableExists) {
       return { isLocked: false };
     }
+
+    const { attemptWindowMs, maxAttempts, lockoutDurationMs } = await getSecurityConfig();
     
-    const recentWindow = new Date(Date.now() - ATTEMPT_WINDOW);
+    const recentWindow = new Date(Date.now() - attemptWindowMs);
     
     // Get recent failed attempts
-    const failedAttempts = await db('login_attempts')
+    const failedAttemptsQuery = db('login_attempts')
       .where('identifier', identifier)
       .where('success', formatBoolean(false))
-      .where('attempt_time', '>=', recentWindow.toISOString())
-      .orderBy('attempt_time', 'desc')
-      .limit(MAX_LOGIN_ATTEMPTS);
+      .where('attempt_time', '>=', recentWindow.toISOString());
 
-    if (failedAttempts.length >= MAX_LOGIN_ATTEMPTS) {
+    if (ipAddress) {
+      failedAttemptsQuery.andWhere('ip_address', ipAddress);
+    }
+
+    const failedAttempts = await failedAttemptsQuery
+      .orderBy('attempt_time', 'desc')
+      .limit(maxAttempts);
+
+    if (failedAttempts.length >= maxAttempts) {
       // Check if still within lockout period
       const oldestAttempt = failedAttempts[failedAttempts.length - 1];
-      const lockoutEnd = new Date(oldestAttempt.attempt_time).getTime() + LOCKOUT_DURATION;
+      const lockoutEnd = new Date(oldestAttempt.attempt_time).getTime() + lockoutDurationMs;
       const now = Date.now();
 
       if (now < lockoutEnd) {
@@ -216,6 +357,6 @@ module.exports = {
   checkSuspiciousActivity,
   getGenericAuthError,
   initializeCleanupJob,
-  MAX_LOGIN_ATTEMPTS,
-  LOCKOUT_DURATION
-};
+  getSecurityConfig,
+  resetSecurityConfigCache
+};

backend/src/utils/fileSecurityUtils.js

@@ -45,7 +45,7 @@ function isPathSafe(filePath) {
 }
 
 /**
- * Enhanced MIME type validation
+ * Enhanced MIME type validation for images and videos
  */
 const ALLOWED_IMAGE_TYPES = {
   'image/jpeg': {
@@ -81,6 +81,40 @@ const ALLOWED_IMAGE_TYPES = {
   }
 };
 
+const ALLOWED_VIDEO_TYPES = {
+  'video/mp4': {
+    extensions: ['.mp4', '.m4v'],
+    magicNumbers: [
+      { offset: 4, bytes: [0x66, 0x74, 0x79, 0x70] } // 'ftyp' signature for MP4
+    ]
+  },
+  'video/webm': {
+    extensions: ['.webm'],
+    magicNumbers: [
+      { offset: 0, bytes: [0x1A, 0x45, 0xDF, 0xA3] } // EBML header for WebM/MKV
+    ]
+  },
+  'video/quicktime': {
+    extensions: ['.mov'],
+    magicNumbers: [
+      { offset: 4, bytes: [0x66, 0x74, 0x79, 0x70, 0x71, 0x74] } // 'ftypqt' signature for QuickTime
+    ]
+  },
+  'video/x-msvideo': {
+    extensions: ['.avi'],
+    magicNumbers: [
+      { offset: 0, bytes: [0x52, 0x49, 0x46, 0x46] }, // RIFF
+      { offset: 8, bytes: [0x41, 0x56, 0x49, 0x20] }  // 'AVI '
+    ]
+  }
+};
+
+// Combined media types
+const ALLOWED_MEDIA_TYPES = {
+  ...ALLOWED_IMAGE_TYPES,
+  ...ALLOWED_VIDEO_TYPES
+};
+
 /**
  * Validate file type by MIME type and extension
  * @param {string} filename - The filename
@@ -93,16 +127,16 @@ function validateFileType(filename, mimetype, allowedTypes) {
   if (!allowedTypes.includes(mimetype)) {
     return false;
   }
-  
+
   // Get file extension
   const ext = path.extname(filename).toLowerCase();
-  
+
   // Check if extension matches the MIME type
-  const typeConfig = ALLOWED_IMAGE_TYPES[mimetype];
+  const typeConfig = ALLOWED_MEDIA_TYPES[mimetype];
   if (!typeConfig || !typeConfig.extensions.includes(ext)) {
     return false;
   }
-  
+
   return true;
 }
 
@@ -114,22 +148,22 @@ function validateFileType(filename, mimetype, allowedTypes) {
  */
 async function validateFileContent(filePath, expectedMimeType) {
   try {
-    const typeConfig = ALLOWED_IMAGE_TYPES[expectedMimeType];
+    const typeConfig = ALLOWED_MEDIA_TYPES[expectedMimeType];
     if (!typeConfig) {
       return false;
     }
-    
+
     // Skip validation for file types without magic numbers (like SVG)
     if (!typeConfig.magicNumbers) {
       return true;
     }
-    
+
     // Read the first 20 bytes of the file (enough for most magic numbers)
     const buffer = Buffer.alloc(20);
     const fileHandle = await fs.open(filePath, 'r');
     await fileHandle.read(buffer, 0, 20, 0);
     await fileHandle.close();
-    
+
     // Check magic numbers
     return typeConfig.magicNumbers.every(magic => {
       for (let i = 0; i < magic.bytes.length; i++) {
@@ -154,13 +188,13 @@ function getSafeFilename(originalFilename) {
   const timestamp = Date.now();
   const randomString = Math.random().toString(36).substring(2, 15);
   const ext = path.extname(originalFilename).toLowerCase();
-  
-  // Validate extension
-  const validExtensions = ['.jpg', '.jpeg', '.png', '.webp', '.gif', '.svg', '.ico'];
+
+  // Validate extension - including both image and video extensions
+  const validExtensions = ['.jpg', '.jpeg', '.png', '.webp', '.gif', '.svg', '.ico', '.mp4', '.m4v', '.webm', '.mov', '.avi'];
   if (!validExtensions.includes(ext)) {
     throw new Error('Invalid file extension');
   }
-  
+
   return `upload_${timestamp}_${randomString}${ext}`;
 }
 
@@ -229,5 +263,7 @@ module.exports = {
   validateFileContent,
   getSafeFilename,
   createFileUploadValidator,
-  ALLOWED_IMAGE_TYPES
+  ALLOWED_IMAGE_TYPES,
+  ALLOWED_VIDEO_TYPES,
+  ALLOWED_MEDIA_TYPES
 };

backend/src/utils/requestIp.js

@@ -0,0 +1,36 @@
+/**
+ * Resolve the originating client IP address, accounting for reverse proxies.
+ * Returns the first entry from X-Forwarded-For when available, otherwise falls back
+ * to Express/Node connection properties.
+ * @param {import('express').Request} req
+ * @returns {string}
+ */
+function getClientIp(req) {
+  if (!req) {
+    return '';
+  }
+
+  const forwardedFor = req.headers['x-forwarded-for'];
+
+  if (typeof forwardedFor === 'string' && forwardedFor.length > 0) {
+    const [firstIp] = forwardedFor.split(',').map(part => part.trim()).filter(Boolean);
+    if (firstIp) {
+      return firstIp;
+    }
+  } else if (Array.isArray(forwardedFor) && forwardedFor.length > 0) {
+    const [firstIp] = forwardedFor;
+    if (firstIp) {
+      return firstIp.trim();
+    }
+  }
+
+  return (
+    req.ip ||
+    req.connection?.remoteAddress ||
+    req.socket?.remoteAddress ||
+    req.connection?.socket?.remoteAddress ||
+    ''
+  );
+}
+
+module.exports = { getClientIp };

backend/src/utils/shareLinkUtils.js

@@ -0,0 +1,63 @@
+const SHARE_TOKEN_REGEX = /^[0-9a-fA-F]{32}$/;
+
+/**
+ * Extracts the share token portion from a stored share link.
+ * Supports full URLs, absolute paths, and legacy slug/token formats.
+ * @param {string|null|undefined} shareLink
+ * @returns {string|null}
+ */
+function extractShareToken(shareLink) {
+  if (!shareLink) {
+    return null;
+  }
+
+  const trimmed = String(shareLink).trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  // Remove protocol + host when a full URL is stored
+  const path = trimmed.replace(/^https?:\/\/[^/]+/i, '');
+  const segments = path.split('/').filter(Boolean);
+  if (segments.length === 0) {
+    return null;
+  }
+
+  const candidate = segments[segments.length - 1];
+  return candidate || null;
+}
+
+/**
+ * Returns true if the provided identifier looks like a generated share token.
+ * @param {string|null|undefined} identifier
+ * @returns {boolean}
+ */
+function isPotentialShareToken(identifier) {
+  if (!identifier) {
+    return false;
+  }
+  return SHARE_TOKEN_REGEX.test(String(identifier).trim());
+}
+
+/**
+ * Builds the gallery share path depending on whether short URLs are enabled.
+ * @param {string} slug
+ * @param {string} shareToken
+ * @param {boolean} useShort
+ * @returns {string}
+ */
+function buildSharePath(slug, shareToken, useShort) {
+  if (!shareToken) {
+    throw new Error('shareToken is required to build share path');
+  }
+  if (useShort || !slug) {
+    return `/gallery/${shareToken}`;
+  }
+  return `/gallery/${slug}/${shareToken}`;
+}
+
+module.exports = {
+  extractShareToken,
+  isPotentialShareToken,
+  buildSharePath
+};

backend/wait-for-db.sh

@@ -43,6 +43,13 @@ done
 
 >&2 echo "Target database \"$target_db\" is ready."
 
+# Ensure storage directories exist with proper permissions (Issue #67 fix)
+# When host directories are bind-mounted, the container's built-in directories are overridden
+# This ensures the required directory structure exists before the application starts
+echo "Ensuring storage directories exist..."
+STORAGE_BASE="${STORAGE_PATH:-/app/storage}"
+mkdir -p "$STORAGE_BASE/events/active" "$STORAGE_BASE/events/archived" "$STORAGE_BASE/thumbnails" 2>/dev/null || true
+
 # Run migrations (use safe runner in production)
 echo "Running database migrations..."
 if [ "$NODE_ENV" = "production" ]; then

docker-compose.production.yml

@@ -4,6 +4,7 @@ services:
   postgres:
     image: postgres:15-alpine
     container_name: picpeak-postgres
+    userns_mode: "host"
     environment:
       POSTGRES_USER: ${DB_USER:-picpeak}
       POSTGRES_PASSWORD: ${DB_PASSWORD}
@@ -22,6 +23,7 @@ services:
   redis:
     image: redis:7-alpine
     container_name: picpeak-redis
+    userns_mode: "host"
     command: redis-server --requirepass ${REDIS_PASSWORD}
     volumes:
       - redis-data:/data

docker-compose.yml

@@ -60,6 +60,7 @@ services:
     image: postgres:15-alpine
     container_name: picpeak-postgres
     restart: unless-stopped
+    userns_mode: "host"
     environment:
       - POSTGRES_USER=${DB_USER}
       - POSTGRES_PASSWORD=${DB_PASSWORD}
@@ -83,6 +84,7 @@ services:
     image: redis:7-alpine
     container_name: picpeak-redis
     restart: unless-stopped
+    userns_mode: "host"
     command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-picpeak_redis_pass}
     volumes:
       - redis-data:/data

docs/ADMIN_SETUP_GUIDE.md

@@ -109,7 +109,7 @@ If ADMIN_CREDENTIALS.txt is missing:
 - File is created in the backend directory root
 - File might have been deleted for security (as recommended)
 - Regenerate it by running `node scripts/reset-admin-password.js --force --credentials-file data/ADMIN_CREDENTIALS.txt`
-- When using the unified `setup.sh` installer for a reinstall, append `--force-admin-password-reset` to have the script perform the reset automatically
+- When using the unified `picpeak-setup.sh` installer for a reinstall, append `--force-admin-password-reset` to have the script perform the reset automatically
 
 ## Best Practices
 

docs/admin-api-quickstart.md

@@ -0,0 +1,147 @@
+# PicPeak Admin API Quickstart
+
+This guide explains how to authenticate against the PicPeak Admin API, use the OpenAPI documentation, and exercise the three automation endpoints (`create event`, `photo upload`, `resend email`) that now ship with machine-readable docs.
+
+> **Prerequisites**
+>
+> - PicPeak backend running (Docker or local `node backend/server.js`)
+> - An admin account (see `data/ADMIN_CREDENTIALS.txt` for the seeded defaults)
+> - API base URL (defaults to `http://localhost:3001/api`)
+
+---
+
+## 1. Obtain an Admin API Token
+
+1. Determine whether reCAPTCHA is enabled in **Admin → Settings → Security**. If disabled (the default), you can skip the `recaptchaToken` field shown below.
+2. Authenticate with your admin username/email and password:
+
+```bash
+curl --fail --silent --show-error \
+  -X POST "http://localhost:3001/api/auth/admin/login" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "username": "admin",
+    "password": "BoldTiger5872%",
+    "recaptchaToken": ""
+  }' | jq
+```
+
+Successful responses look like:
+
+```json
+{
+  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
+  "user": {
+    "id": 1,
+    "username": "admin",
+    "email": "admin@example.com",
+    "mustChangePassword": false
+  }
+}
+```
+
+- PicPeak also sets the `admin_token` cookie; however, when scripting you typically pass the token in an `Authorization: Bearer <token>` header.
+- Tokens expire after 24 hours. Log in again to refresh them.
+
+---
+
+## 2. Use the OpenAPI Documentation
+
+The machine-readable spec lives at `docs/picpeak-admin-api.openapi.yaml`. You can:
+
+- Preview it interactively with Redocly:
+
+  ```bash
+  npx --yes @redocly/cli preview-docs docs/picpeak-admin-api.openapi.yaml
+  ```
+
+- Import it into Postman, Insomnia, or VS Code REST client.
+- Validate changes as part of CI with:
+
+  ```bash
+  npx --yes @apidevtools/swagger-cli@4.0.4 validate docs/picpeak-admin-api.openapi.yaml
+  ```
+
+Keep this file in sync whenever the backend endpoints evolve.
+
+---
+
+## 3. Call the Key Admin Endpoints
+
+Below are minimal `curl` examples that rely on the bearer token captured earlier.
+
+### 3.1 Create an Event
+
+```bash
+API_URL="http://localhost:3001/api"
+TOKEN="REPLACE_WITH_JWT"
+
+curl --fail --silent --show-error \
+  -X POST "$API_URL/admin/events" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "event_type": "wedding",
+    "event_name": "Emily & Jordan Celebration",
+    "event_date": "2025-06-07",
+    "customer_name": "Emily Carter",
+    "customer_email": "emily@example.com",
+    "admin_email": "studio@example.com",
+    "require_password": true,
+    "password": "Shutter123",
+    "expiration_days": 45
+  }' | jq
+```
+
+### 3.2 Upload Photos to the Event
+
+```bash
+EVENT_ID=512
+
+curl --fail --silent --show-error \
+  -X POST "$API_URL/admin/events/$EVENT_ID/upload" \
+  -H "Authorization: Bearer $TOKEN" \
+  -F "photos=@/path/to/DSC_2031.jpg" \
+  -F "photos=@/path/to/DSC_2032.jpg" \
+  -F "category_id=individual" | jq
+```
+
+- Files must be JPEG/PNG/WebP, each ≤ 50 MB.
+- The per-request file count respects the `general_max_files_per_upload` admin setting (default 500).
+
+### 3.3 Resend the Gallery Email
+
+```bash
+curl --fail --silent --show-error \
+  -X POST "$API_URL/admin/events/$EVENT_ID/resend-email" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"password": "Shutter123"}' | jq
+```
+
+Omit `"password"` to send the standard security message instead.
+
+---
+
+## 4. Quick Testing Checklist
+
+- ✅ Login succeeds and returns a token (HTTP 200).
+- ✅ Creating an event returns `id`, `slug`, and `share_link`.
+- ✅ Uploading more files than allowed returns HTTP 400 with a helpful message.
+- ✅ Resending email for a missing event returns HTTP 404.
+- ✅ `swagger-cli validate` passes after any spec edits.
+
+Automate these checks using your preferred test harness or CI pipeline to catch regressions early.
+
+---
+
+## 5. Migrating From `host_*`
+
+- Run backend migrations to add the new `customer_name` / `customer_email` columns: `npm --prefix backend run migrate` (or your existing deployment flow). The migration copies legacy data automatically, so upgrades remain seamless.
+- All admin APIs now require the `customer_*` fields. Older `host_*` payloads are rejected, which makes downstream client issues obvious during testing instead of silently dropping data.
+- API responses still mirror `customer_*` even if migrations have not run yet (the server falls back to legacy columns until the upgrade is complete), so existing frontends can move over incrementally.
+- Once every consumer writes and reads the new fields, you can safely plan the removal of the legacy `host_*` columns in a future release.
+
+---
+
+Need deeper integration examples or language-specific SDKs? Import the OpenAPI spec into code generators such as `openapi-generator` or `orval` to scaffold API clients quickly.

docs/picpeak-admin-api.openapi.yaml

@@ -0,0 +1,584 @@
+openapi: 3.1.0
+info:
+  title: PicPeak Admin API
+  version: 1.1.11
+  summary: High-level administrative endpoints for creating events, uploading photos, and resending gallery access emails.
+  description: |
+    This document describes the core administrative endpoints that power PicPeak automations.
+    It focuses on the three workflows requested by integrators:
+
+    1. Creating events with customer access credentials.
+    2. Uploading photos in bulk to an event gallery.
+    3. Resending the customer-facing gallery email.
+
+    The specification follows the latest [OpenAPI 3.1](https://spec.openapis.org/oas/v3.1.0) best practices
+    and is intended to be kept in sync with backend changes.
+  contact:
+    name: PicPeak Maintainers
+    url: https://github.com/the-luap/picpeak
+servers:
+  - url: https://api.picpeak.example.com/api
+    description: Example production deployment
+  - url: http://localhost:3001/api
+    description: Local development
+tags:
+  - name: Admin Events
+    description: Administrative endpoints for managing event galleries.
+components:
+  securitySchemes:
+    CookieAuth:
+      type: apiKey
+      in: cookie
+      name: admin_token
+      description: >
+        Session cookie issued by the admin authentication flow. When present, the backend mirrors
+        it into the `Authorization` header automatically.
+    BearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: >
+        JSON Web Token created by the admin login endpoint. You can also pass the token explicitly
+        as `Authorization: Bearer <token>` instead of using the admin cookie.
+  parameters:
+    EventId:
+      name: eventId
+      in: path
+      description: Numeric identifier of the event.
+      required: true
+      schema:
+        type: integer
+        minimum: 1
+      example: 341
+  schemas:
+    ErrorResponse:
+      type: object
+      properties:
+        error:
+          type: string
+          description: Human readable error message.
+        details:
+          type: string
+          nullable: true
+          description: Additional context (when available).
+      required:
+        - error
+      example:
+        error: Invalid token
+    ValidationErrorItem:
+      type: object
+      properties:
+        type:
+          type: string
+          nullable: true
+          description: Validation error type reported by express-validator.
+        msg:
+          type: string
+        path:
+          type: string
+          description: Dot-delimited path to the invalid field.
+        value:
+          description: Value that failed validation.
+        location:
+          type: string
+          description: Location of the invalid value (always `body` for these endpoints).
+      required:
+        - msg
+        - path
+        - location
+      example:
+        type: field
+        msg: Event date must be a valid ISO 8601 date
+        path: event_date
+        value: 2025/05/01
+        location: body
+    ValidationErrorResponse:
+      type: object
+      properties:
+        errors:
+          type: array
+          items:
+            $ref: '#/components/schemas/ValidationErrorItem'
+      required:
+        - errors
+      example:
+        errors:
+          - type: field
+            msg: Customer email must be a valid address
+            path: customer_email
+            value: example@invalid
+            location: body
+    CreateEventRequest:
+      type: object
+      required:
+        - event_type
+        - event_name
+        - event_date
+        - customer_name
+        - customer_email
+        - admin_email
+      properties:
+        event_type:
+          type: string
+          description: Type of event. Controls default theme and copy in the UI.
+          enum: [wedding, birthday, corporate, other]
+        event_name:
+          type: string
+          minLength: 1
+          description: Display name for the gallery shown to end customers.
+        event_date:
+          type: string
+          format: date
+          description: Event date (YYYY-MM-DD). Used to calculate the default expiration.
+        customer_name:
+          type: string
+          minLength: 1
+          description: Name of the customer receiving gallery access.
+        customer_email:
+          type: string
+          format: email
+          description: Email address of the customer who will receive the gallery link.
+        admin_email:
+          type: string
+          format: email
+          description: Admin contact email included in notification messages.
+        require_password:
+          type: boolean
+          default: true
+          description: When true, the gallery requires `password`; when false a random placeholder is stored.
+        password:
+          type: string
+          minLength: 6
+          description: >
+            Gallery password issued to the customer. Required when `require_password` is `true`.
+            Left unset to auto-generate a placeholder when password protection is disabled.
+        expiration_days:
+          type: integer
+          minimum: 1
+          maximum: 365
+          default: 30
+          description: Number of days after the event date before the gallery expires.
+        welcome_message:
+          type: string
+          description: Optional welcome message displayed in the gallery.
+        color_theme:
+          type: string
+          nullable: true
+          description: Optional theme identifier or CSS color settings.
+        allow_user_uploads:
+          type: boolean
+          default: false
+          description: Allow gallery guests to upload their own photos.
+        upload_category_id:
+          type: integer
+          nullable: true
+          description: ID of the default category for user uploads.
+        allow_downloads:
+          type: boolean
+          default: true
+          description: Allow guests to download photos.
+        disable_right_click:
+          type: boolean
+          default: false
+          description: Disable right-click in the gallery view.
+        watermark_downloads:
+          type: boolean
+          default: false
+          description: Enable watermarking on downloaded images.
+        watermark_text:
+          type: string
+          nullable: true
+          description: Custom watermark text when `watermark_downloads` is true.
+        feedback_enabled:
+          type: boolean
+          default: false
+          description: Enable the feedback module for this gallery.
+        allow_ratings:
+          type: boolean
+          default: true
+        allow_likes:
+          type: boolean
+          default: true
+        allow_comments:
+          type: boolean
+          default: true
+        allow_favorites:
+          type: boolean
+          default: true
+        require_name_email:
+          type: boolean
+          default: false
+          description: Require guests to provide name and email when leaving feedback.
+        moderate_comments:
+          type: boolean
+          default: true
+          description: Hold guest comments for moderation.
+        show_feedback_to_guests:
+          type: boolean
+          default: true
+          description: Display aggregated feedback metrics back to guests.
+      example:
+        event_type: wedding
+        event_name: Emily & Jordan Celebration
+        event_date: 2025-06-07
+        customer_name: Emily Carter
+        customer_email: emily@example.com
+        admin_email: studio@example.com
+        require_password: true
+        password: Shutter123
+        expiration_days: 45
+        welcome_message: >
+          We loved capturing your day! Use the password below to view and download your photos.
+        allow_user_uploads: false
+        allow_downloads: true
+        feedback_enabled: true
+        allow_comments: true
+        show_feedback_to_guests: true
+    EventSummary:
+      type: object
+      properties:
+        id:
+          type: integer
+          description: Database identifier of the newly created event.
+        slug:
+          type: string
+          description: Unique slug used to build the gallery URL.
+        event_name:
+          type: string
+        event_type:
+          type: string
+          enum: [wedding, birthday, corporate, other]
+        customer_name:
+          type: string
+          nullable: true
+          description: Name of the customer associated with the event.
+        customer_email:
+          type: string
+          format: email
+          nullable: true
+          description: Email address of the customer associated with the event.
+        require_password:
+          type: boolean
+        share_link:
+          type: string
+          description: Absolute or relative URL guests can use to reach the gallery.
+        expires_at:
+          type: string
+          format: date-time
+          description: ISO 8601 timestamp when the gallery expires.
+        created_at:
+          type: string
+          format: date-time
+          description: ISO 8601 timestamp when the event was created.
+      required:
+        - id
+        - slug
+        - event_name
+        - event_type
+        - require_password
+        - share_link
+        - expires_at
+        - created_at
+      example:
+        id: 512
+        slug: wedding-emily-jordan-2025-06-07
+        event_name: Emily & Jordan Celebration
+        event_type: wedding
+        customer_name: Emily Carter
+        customer_email: emily@example.com
+        require_password: true
+        share_link: https://app.picpeak.io/gallery/wedding-emily-jordan-2025-06-07/2f3c8a4d90bb11ef9b2e0242ac120002
+        expires_at: 2025-07-22T00:00:00.000Z
+        created_at: 2025-05-01T14:32:45.000Z
+    UploadPhotosResponse:
+      type: object
+      properties:
+        message:
+          type: string
+        photos:
+          type: array
+          items:
+            $ref: '#/components/schemas/UploadedPhotoSummary'
+          description: Metadata for each photo that was persisted successfully.
+        totalFiles:
+          type: integer
+          minimum: 0
+          description: Total number of files included in the request (valid + invalid).
+        successCount:
+          type: integer
+          minimum: 0
+        failureCount:
+          type: integer
+          minimum: 0
+        errors:
+          type: array
+          items:
+            $ref: '#/components/schemas/UploadFailure'
+          description: Present when some files failed validation or processing.
+      required:
+        - message
+        - photos
+        - totalFiles
+        - successCount
+        - failureCount
+      example:
+        message: Uploaded 18 of 20 photos. 2 failed.
+        photos:
+          - id: 9821
+            filename: DSC_2031.jpg
+            size: 4812096
+            category_id: 2
+          - id: 9822
+            filename: DSC_2032.jpg
+            size: 5216743
+            category_id: 2
+        totalFiles: 20
+        successCount: 18
+        failureCount: 2
+        errors:
+          - filename: DSC_2020.raw
+            error: Only JPEG, PNG and WebP images are allowed
+          - filename: portrait.png
+            error: File is empty
+    UploadedPhotoSummary:
+      type: object
+      properties:
+        id:
+          type: integer
+        filename:
+          type: string
+        size:
+          type: integer
+          description: File size in bytes.
+        category_id:
+          type: integer
+          nullable: true
+      required:
+        - id
+        - filename
+        - size
+      example:
+        id: 9821
+        filename: DSC_2031.jpg
+        size: 4812096
+        category_id: 2
+    UploadFailure:
+      type: object
+      properties:
+        filename:
+          type: string
+        error:
+          type: string
+      required:
+        - filename
+        - error
+      example:
+        filename: DSC_2031.gif
+        error: Only JPEG, PNG and WebP images are allowed
+    ResendEmailRequest:
+      type: object
+      properties:
+        password:
+          type: string
+          minLength: 1
+          description: >
+            Optional plain-text password to include in the email. When omitted a security notice
+            placeholder is inserted because the stored hash cannot be reversed.
+      example:
+        password: Shutter123
+    ResendEmailResponse:
+      type: object
+      properties:
+        success:
+          type: boolean
+        message:
+          type: string
+      required:
+        - success
+        - message
+      example:
+        success: true
+        message: Creation email has been queued for sending
+paths:
+  /admin/events:
+    post:
+      tags: [Admin Events]
+      operationId: createAdminEvent
+      summary: Create a new event
+      description: >
+        Creates a new event, provisions storage folders, stores the gallery password, and queues
+        the initial gallery email for the customer. Requires admin authentication.
+      security:
+        - CookieAuth: []
+        - BearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateEventRequest'
+            examples:
+              weddingExample:
+                summary: Wedding with password protection
+                value:
+                  event_type: wedding
+                  event_name: Emily & Jordan Celebration
+                  event_date: 2025-06-07
+                  customer_name: Emily Carter
+                  customer_email: emily@example.com
+                  admin_email: studio@example.com
+                  require_password: true
+                  password: Shutter123
+                  expiration_days: 45
+                  welcome_message: >
+                    We loved capturing your day! Use the password below to view and download your photos.
+                  allow_user_uploads: false
+                  allow_downloads: true
+                  feedback_enabled: true
+                  allow_comments: true
+                  show_feedback_to_guests: true
+      responses:
+        '200':
+          description: Event created successfully.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/EventSummary'
+        '400':
+          description: Validation failed. At least one field is invalid or missing.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ValidationErrorResponse'
+        '401':
+          description: Authentication required or token invalid.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '500':
+          description: Unexpected server error while creating the event.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+  /admin/events/{eventId}/upload:
+    post:
+      tags: [Admin Events]
+      operationId: uploadEventPhotos
+      summary: Upload photos to an event gallery
+      description: |
+        Uploads one or more photos to the specified event. Files are validated, moved into the
+        event storage directory, and thumbnails are generated asynchronously.
+
+        The maximum number of files per upload is controlled via the `general_max_files_per_upload`
+        setting (default 500, capped at 2000). Files exceeding 50 MB are rejected.
+      security:
+        - CookieAuth: []
+        - BearerAuth: []
+      parameters:
+        - $ref: '#/components/parameters/EventId'
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                photos:
+                  type: array
+                  description: >
+                    One or more image files (JPEG, PNG, WebP). Each file must be <= 50 MB.
+                  items:
+                    type: string
+                    format: binary
+                category_id:
+                  oneOf:
+                    - type: integer
+                    - type: string
+                  description: >
+                    Optional category assignment. Accepts numeric IDs or the string values `collage`
+                    and `individual` for backward compatibility.
+              required:
+                - photos
+            encoding:
+              photos:
+                style: form
+                explode: false
+      responses:
+        '200':
+          description: Upload completed. Failed files (if any) are listed in the response.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UploadPhotosResponse'
+        '400':
+          description: Request failed validation (invalid files, too many files, etc.).
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '401':
+          description: Authentication required or token invalid.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '404':
+          description: The referenced event does not exist.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '500':
+          description: Unexpected server error while processing uploads.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+  /admin/events/{eventId}/resend-email:
+    post:
+      tags: [Admin Events]
+      operationId: resendEventEmail
+      summary: Resend the gallery access email to the customer
+      description: >
+        Queues the standard `gallery_created` email for the event's customer. Useful when resending
+        credentials to the customer or communicating an updated password. Requires admin authentication.
+      security:
+        - CookieAuth: []
+        - BearerAuth: []
+      parameters:
+        - $ref: '#/components/parameters/EventId'
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/ResendEmailRequest'
+            example:
+              password: NewSecurePassword!
+      responses:
+        '200':
+          description: Email successfully queued for delivery.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ResendEmailResponse'
+        '401':
+          description: Authentication required or token invalid.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '404':
+          description: Event not found.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '500':
+          description: Unexpected server error while queuing the email.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'

frontend/Dockerfile

@@ -12,6 +12,9 @@ LABEL org.opencontainers.image.source="https://github.com/the-luap/picpeak"
 LABEL org.opencontainers.image.description="PicPeak Frontend Application"
 LABEL org.opencontainers.image.licenses="MIT"
 
+# Upgrade npm to fix glob CVE-2025-64756 vulnerability
+RUN npm install -g npm@latest
+
 # Set working directory
 WORKDIR /app
 
@@ -27,8 +30,13 @@ COPY . .
 # Build the application
 RUN npm run build
 
-# Production stage
-FROM nginx:alpine
+# Production stage (use Alpine with patched libpng)
+FROM nginx:1.27-alpine3.21
+
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+# Ensure libpng includes CVE fixes (pull patched version from edge)
+RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main 'libpng>=1.6.51-r0'
 
 # Install runtime dependencies
 RUN apk add --no-cache curl
@@ -60,4 +68,4 @@ HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
 USER nginx
 
 # Start nginx
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["nginx", "-g", "daemon off;"]

frontend/Dockerfile.dev

@@ -3,6 +3,9 @@ FROM node:20-alpine
 
 WORKDIR /app
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Copy package files
 COPY package*.json ./
 

frontend/Dockerfile.prod

@@ -25,6 +25,9 @@ RUN npm run build
 # Production stage
 FROM nginx:alpine
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Install runtime dependencies
 RUN apk add --no-cache curl
 

frontend/package.json

@@ -1,12 +1,12 @@
 {
   "name": "picpeak-frontend",
   "private": true,
-  "version": "1.1.7",
+  "version": "1.1.15",
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "cross-env ROLLUP_USE_NODE_JS=true vite build",
-    "build:check": "tsc -b && cross-env ROLLUP_USE_NODE_JS=true vite build",
+    "build": "node ./scripts/build.js",
+    "build:check": "tsc -b && node ./scripts/build.js",
     "lint": "eslint .",
     "preview": "vite preview",
     "test": "vitest run src/components/admin/__tests__/ThemeCustomizerEnhanced.test.tsx"
@@ -67,5 +67,12 @@
     "typescript-eslint": "^8.34.1",
     "vite": "^7.1.12",
     "vitest": "^3.2.4"
+  },
+  "optionalDependencies": {
+    "@rollup/rollup-linux-x64-gnu": "^4.45.1"
+  },
+  "overrides": {
+    "glob": "^11.1.0",
+    "js-yaml": "^4.1.1"
   }
 }

frontend/scripts/build.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { execSync } from 'node:child_process';
+import { resolve, join } from 'node:path';
+import process from 'node:process';
+import { promises as fs } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+import { createWriteStream } from 'node:fs';
+import https from 'node:https';
+
+const TARGET_NODE_VERSION = '20.19.1';
+const env = { ...process.env, ROLLUP_USE_NODE_JS: 'true' };
+const viteBin = resolve(process.cwd(), 'node_modules', 'vite', 'bin', 'vite.js');
+
+async function ensureNodeBinary(version) {
+  const platformMap = {
+    linux: 'linux',
+    darwin: 'darwin',
+    win32: 'win'
+  };
+  const archMap = {
+    x64: 'x64',
+    arm64: 'arm64'
+  };
+
+  const platform = platformMap[process.platform];
+  const arch = archMap[process.arch];
+
+  if (!platform || !arch) {
+    throw new Error(`Unsupported platform/architecture combination: ${process.platform} ${process.arch}`);
+  }
+
+  if (platform === 'win') {
+    throw new Error('Automatic Node.js download is not supported on Windows runners. Please upgrade Node.js to >=20.19 manually.');
+  }
+
+  const cacheDir = join(process.cwd(), 'node_modules', '.cache', `node-v${version}-${platform}-${arch}`);
+  const nodeBinary = join(cacheDir, `node-v${version}-${platform}-${arch}`, 'bin', 'node');
+
+  try {
+    await fs.access(nodeBinary);
+    return nodeBinary;
+  } catch {
+    // continue with download
+  }
+
+  await fs.mkdir(cacheDir, { recursive: true });
+  const archiveExt = platform === 'win' ? 'zip' : 'tar.xz';
+  const archiveName = `node-v${version}-${platform}-${arch}.${archiveExt}`;
+  const archivePath = join(cacheDir, archiveName);
+  const downloadUrl = `https://nodejs.org/dist/v${version}/${archiveName}`;
+
+  await downloadFile(downloadUrl, archivePath);
+
+  if (archiveExt === 'tar.xz') {
+    execSync(`tar -xf "${archivePath}" -C "${cacheDir}"`, { stdio: 'inherit' });
+  } else {
+    throw new Error('ZIP extraction not implemented. Please upgrade Node.js manually.');
+  }
+
+  await fs.rm(archivePath, { force: true });
+  return nodeBinary;
+}
+
+async function downloadFile(url, destination) {
+  await new Promise((resolvePromise, rejectPromise) => {
+    const fileStream = createWriteStream(destination);
+    https.get(url, (response) => {
+      if (response.statusCode && response.statusCode >= 400) {
+        rejectPromise(new Error(`Failed to download ${url}: HTTP ${response.statusCode}`));
+        return;
+      }
+      pipeline(response, fileStream).then(resolvePromise).catch(rejectPromise);
+    }).on('error', rejectPromise);
+  });
+}
+
+async function main() {
+  console.log(`Node.js ${process.version} detected; forcing Rollup's JavaScript fallback for compatibility.`);
+
+  if (!process.env.USE_DOWNLOADED_NODE) {
+    const [major] = process.versions.node.split('.').map(Number);
+    if (major < 20) {
+      const nodeBinary = await ensureNodeBinary(TARGET_NODE_VERSION);
+      const childEnv = { ...env, USE_DOWNLOADED_NODE: '1' };
+      execSync(`"${nodeBinary}" "${viteBin}" build`, { stdio: 'inherit', env: childEnv });
+      return;
+    }
+  }
+
+  execSync(`node "${viteBin}" build`, { stdio: 'inherit', env });
+}
+
+await main();

frontend/src/components/admin/AdminAuthenticatedVideo.tsx

@@ -0,0 +1,77 @@
+import React, { useEffect, useState } from 'react';
+import { api } from '../../config/api';
+
+interface AdminAuthenticatedVideoProps extends React.VideoHTMLAttributes<HTMLVideoElement> {
+  src: string;
+  fallback?: React.ReactNode;
+}
+
+export const AdminAuthenticatedVideo: React.FC<AdminAuthenticatedVideoProps> = ({
+  src,
+  fallback,
+  ...props
+}) => {
+  const [videoSrc, setVideoSrc] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(false);
+
+  useEffect(() => {
+    let cancelled = false;
+    let objectUrl: string | null = null;
+
+    const loadVideo = async () => {
+      try {
+        setLoading(true);
+        setError(false);
+        setVideoSrc(null);
+
+        const response = await api.get(src, { responseType: 'blob' });
+
+        if (!cancelled) {
+          objectUrl = URL.createObjectURL(response.data);
+          setVideoSrc(objectUrl);
+          setLoading(false);
+        }
+      } catch {
+        if (!cancelled) {
+          setError(true);
+          setLoading(false);
+        }
+      }
+    };
+
+    if (src) {
+      loadVideo();
+    }
+
+    return () => {
+      cancelled = true;
+      if (objectUrl) {
+        URL.revokeObjectURL(objectUrl);
+      }
+    };
+  }, [src]);
+
+  if (loading) {
+    return <div className="w-full h-full bg-neutral-200 animate-pulse" />;
+  }
+
+  if (error || !videoSrc) {
+    return fallback ? (
+      <>{fallback}</>
+    ) : (
+      <div className="w-full h-full bg-neutral-100 flex items-center justify-center text-neutral-400">
+        <span className="text-xs">Failed to load</span>
+      </div>
+    );
+  }
+
+  return (
+    <video
+      src={videoSrc}
+      controls
+      preload="metadata"
+      {...props}
+    />
+  );
+};

frontend/src/components/admin/AdminPhotoGrid.tsx

@@ -1,6 +1,7 @@
 import React, { useState } from 'react';
-import { Check, Download, Trash2, Eye, Package, MessageSquare, Star } from 'lucide-react';
+import { Check, Download, Trash2, Eye, Package, MessageSquare, Star, Video } from 'lucide-react';
 import { toast } from 'react-toastify';
+import { useTranslation } from 'react-i18next';
 
 import { AdminPhoto } from '../../services/photos.service';
 import { photosService } from '../../services/photos.service';
@@ -20,6 +21,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
   onPhotoClick,
   onPhotosDeleted
 }) => {
+  const { t } = useTranslation();
   const [selectedPhotos, setSelectedPhotos] = useState<Set<number>>(new Set());
   const [isSelectionMode, setIsSelectionMode] = useState(false);
   const [isDeleting, setIsDeleting] = useState(false);
@@ -126,7 +128,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
             onClick={toggleSelectionMode}
             leftIcon={<Package className="w-4 h-4" />}
           >
-            {isSelectionMode ? 'Cancel Selection' : 'Select Photos'}
+            {isSelectionMode ? t('gallery.cancelSelection', 'Cancel Selection') : t('gallery.selectPhotos', 'Select Photos')}
           </Button>
           
           {(isSelectionMode || selectedPhotos.size > 0) && (
@@ -136,13 +138,13 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
                 size="sm"
                 onClick={handleSelectAll}
               >
-                {selectedPhotos.size === photos.length ? 'Deselect All' : 'Select All'}
+                {selectedPhotos.size === photos.length ? t('gallery.deselectAll', 'Deselect All') : t('gallery.selectAll', 'Select All')}
               </Button>
               
               {selectedPhotos.size > 0 && (
                 <>
                   <span className="text-sm text-neutral-600">
-                    {selectedPhotos.size} selected
+                    {t('gallery.photosSelected', { count: selectedPhotos.size })}
                   </span>
                   <button
                     onClick={handleDeleteSelected}
@@ -150,7 +152,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
                     className="px-3 py-1.5 text-sm font-medium text-white bg-red-600 hover:bg-red-700 disabled:bg-red-400 rounded-lg flex items-center gap-2"
                   >
                     <Trash2 className="w-4 h-4" />
-                    Delete Selected
+                    {t('gallery.deleteSelected', 'Delete Selected')}
                   </button>
                 </>
               )}
@@ -159,7 +161,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
         </div>
         
         <div className="text-sm text-neutral-600">
-          {photos.length} photo{photos.length !== 1 ? 's' : ''}
+          {t('gallery.photosCount', { count: photos.length })}
         </div>
       </div>
 
@@ -170,6 +172,9 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
           const commentCount = photo.comment_count ?? 0;
           const averageRating = photo.average_rating ?? 0;
           const likeCount = photo.like_count ?? 0;
+          const isVideo = (photo.media_type === 'video') ||
+            (photo.mime_type && photo.mime_type.startsWith('video/')) ||
+            photo.type === 'video';
           return (
             <div
               key={photo.id}
@@ -259,6 +264,15 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
                 </span>
               </div>
             )}
+
+            {isVideo && (
+              <div className="absolute bottom-2 left-2 pointer-events-none">
+                <span className="px-2 py-1 text-[11px] font-semibold bg-black/70 text-white rounded flex items-center gap-1">
+                  <Video className="w-3 h-3" />
+                  {t('common.video', 'Video')}
+                </span>
+              </div>
+            )}
             
             {/* Feedback Indicators (moved to bottom-right to avoid covering category) */}
             {(commentCount > 0 || averageRating > 0 || likeCount > 0) && (
@@ -284,7 +298,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
 
       {photos.length === 0 && (
         <div className="text-center py-12">
-          <p className="text-neutral-500">No photos uploaded yet</p>
+          <p className="text-neutral-500">{t('gallery.noMedia', 'No media uploaded yet')}</p>
         </div>
       )}
     </div>

frontend/src/components/admin/AdminPhotoViewer.tsx

@@ -9,6 +9,7 @@ import { photosService } from '../../services/photos.service';
 import { feedbackService, type PhotoFeedback, type FeedbackSummary } from '../../services/feedback.service';
 import { Button } from '../common';
 import { AdminAuthenticatedImage } from './AdminAuthenticatedImage';
+import { AdminAuthenticatedVideo } from './AdminAuthenticatedVideo';
 
 type AdminFeedbackResponse = {
   feedback: PhotoFeedback[];
@@ -39,6 +40,11 @@ export const AdminPhotoViewer: React.FC<AdminPhotoViewerProps> = ({
   const queryClient = useQueryClient();
   
   const currentPhoto = photos[currentIndex];
+  const isVideo = currentPhoto
+    ? (currentPhoto.media_type === 'video' ||
+      (currentPhoto.mime_type && String(currentPhoto.mime_type).startsWith('video/')) ||
+      currentPhoto.type === 'video')
+    : false;
   const averageRating = currentPhoto?.average_rating ?? 0;
   const likeCount = currentPhoto?.like_count ?? 0;
   const favoriteCount = currentPhoto?.favorite_count ?? 0;
@@ -109,8 +115,11 @@ export const AdminPhotoViewer: React.FC<AdminPhotoViewerProps> = ({
       await photosService.updatePhotoCategory(eventId, currentPhoto.id, categoryId);
       toast.success('Category updated');
       setShowCategoryMenu(false);
-      // Trigger refresh to update the photo data
-      onPhotoDeleted(); // This will refresh the photos list
+      // Invalidate photos query to refresh data
+      await queryClient.invalidateQueries({ queryKey: ['admin-event-photos', eventId.toString()] });
+      await queryClient.invalidateQueries({ queryKey: ['admin-event-photos', eventId] });
+      // Also trigger the parent's refresh callback
+      onPhotoDeleted();
     } catch (error) {
       toast.error('Failed to update category');
     }
@@ -188,19 +197,35 @@ export const AdminPhotoViewer: React.FC<AdminPhotoViewerProps> = ({
       <div className="flex flex-col lg:flex-row gap-6 max-w-7xl mx-auto p-4 w-full h-full">
         {/* Image */}
         <div className="flex-1 flex items-center justify-center min-h-0">
-          <AdminAuthenticatedImage
-            src={currentPhoto.url}
-            alt={currentPhoto.filename}
-            className="max-w-full max-h-full object-contain"
-            fallback={
-              <div className="flex items-center justify-center text-neutral-400">
-                <div className="text-center">
-                  <Eye className="w-12 h-12 mx-auto mb-2" />
-                  <p className="text-sm">Failed to load image</p>
+          {isVideo ? (
+            <AdminAuthenticatedVideo
+              src={currentPhoto.url}
+              className="max-w-full max-h-full bg-black"
+              poster={currentPhoto.thumbnail_url || undefined}
+              fallback={
+                <div className="flex items-center justify-center text-neutral-400">
+                  <div className="text-center">
+                    <Eye className="w-12 h-12 mx-auto mb-2" />
+                    <p className="text-sm">Failed to load media</p>
+                  </div>
                 </div>
-              </div>
-            }
-          />
+              }
+            />
+          ) : (
+            <AdminAuthenticatedImage
+              src={currentPhoto.url}
+              alt={currentPhoto.filename}
+              className="max-w-full max-h-full object-contain"
+              fallback={
+                <div className="flex items-center justify-center text-neutral-400">
+                  <div className="text-center">
+                    <Eye className="w-12 h-12 mx-auto mb-2" />
+                    <p className="text-sm">Failed to load image</p>
+                  </div>
+                </div>
+              }
+            />
+          )}
         </div>
 
         {/* Sidebar */}

frontend/src/components/admin/PhotoFilters.tsx

@@ -1,16 +1,20 @@
 import React from 'react';
 import { Search, Filter, SortAsc, SortDesc } from 'lucide-react';
 import { Input } from '../common';
+import { useTranslation } from 'react-i18next';
 
 interface PhotoFiltersProps {
-  categories: Array<{ id: number; name: string; slug: string }>;
-  selectedCategory: number | null | undefined;
+  categories: Array<{ id: number | string; name: string; slug: string }>;
+  selectedCategory: number | string | null | undefined;
   searchTerm: string;
   sortBy: 'date' | 'name' | 'size' | 'rating';
   sortOrder: 'asc' | 'desc';
-  onCategoryChange: (categoryId: number | null | undefined) => void;
+  onCategoryChange: (categoryId: number | string | null | undefined) => void;
   onSearchChange: (search: string) => void;
   onSortChange: (sort: 'date' | 'name' | 'size' | 'rating', order: 'asc' | 'desc') => void;
+  mediaType?: 'all' | 'photo' | 'video';
+  onMediaTypeChange?: (mediaType: 'all' | 'photo' | 'video') => void;
+  showMediaFilter?: boolean;
 }
 
 export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
@@ -21,8 +25,12 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
   sortOrder,
   onCategoryChange,
   onSearchChange,
-  onSortChange
+  onSortChange,
+  mediaType = 'all',
+  onMediaTypeChange,
+  showMediaFilter = false
 }) => {
+  const { t } = useTranslation();
   const handleSortToggle = () => {
     onSortChange(sortBy, sortOrder === 'asc' ? 'desc' : 'asc');
   };
@@ -34,7 +42,7 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
         <div className="flex-1">
           <Input
             type="text"
-            placeholder="Search by filename..."
+            placeholder={t('gallery.searchByFilename', 'Search by filename...')}
             value={searchTerm}
             onChange={(e) => onSearchChange(e.target.value)}
             leftIcon={<Search className="w-5 h-5 text-neutral-400" />}
@@ -46,11 +54,16 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
           <Filter className="w-5 h-5 text-neutral-400" />
           <select
             value={selectedCategory === null ? '' : selectedCategory || ''}
-            onChange={(e) => onCategoryChange(e.target.value === '' ? null : Number(e.target.value) || undefined)}
+            onChange={(e) => {
+              const raw = e.target.value;
+              if (raw === '') return onCategoryChange(null);
+              const numeric = Number(raw);
+              onCategoryChange(Number.isNaN(numeric) ? raw : numeric);
+            }}
             className="px-3 py-2 border border-neutral-300 rounded-lg focus:ring-2 focus:ring-primary-500 focus:border-primary-500"
           >
-            <option value="">All Categories</option>
-            <option value="0">Uncategorized</option>
+            <option value="">{t('gallery.allCategories', 'All Categories')}</option>
+            <option value="0">{t('gallery.uncategorized', 'Uncategorized')}</option>
             {categories.map(cat => (
               <option key={cat.id} value={cat.id}>
                 {cat.name}
@@ -59,6 +72,21 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
           </select>
         </div>
 
+        {showMediaFilter && onMediaTypeChange && (
+          <div className="flex items-center gap-2">
+            <Filter className="w-5 h-5 text-neutral-400" />
+            <select
+              value={mediaType}
+              onChange={(e) => onMediaTypeChange(e.target.value as 'all' | 'photo' | 'video')}
+              className="px-3 py-2 border border-neutral-300 rounded-lg focus:ring-2 focus:ring-primary-500 focus:border-primary-500"
+            >
+              <option value="all">{t('gallery.allMedia', 'All media')}</option>
+              <option value="photo">{t('gallery.photosOnly', 'Photos only')}</option>
+              <option value="video">{t('gallery.videosOnly', 'Videos only')}</option>
+            </select>
+          </div>
+        )}
+
         {/* Sort Options */}
         <div className="flex items-center gap-2">
           <select
@@ -66,16 +94,16 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
             onChange={(e) => onSortChange(e.target.value as 'date' | 'name' | 'size' | 'rating', sortOrder)}
             className="px-3 py-2 border border-neutral-300 rounded-lg focus:ring-2 focus:ring-primary-500 focus:border-primary-500"
           >
-            <option value="date">Sort by Date</option>
-            <option value="name">Sort by Name</option>
-            <option value="size">Sort by Size</option>
-            <option value="rating">Sort by Rating</option>
+            <option value="date">{t('gallery.sortByDate', 'Sort by Date')}</option>
+            <option value="name">{t('gallery.sortByName', 'Sort by Name')}</option>
+            <option value="size">{t('gallery.sortBySize', 'Sort by Size')}</option>
+            <option value="rating">{t('gallery.sortByRating', 'Sort by Rating')}</option>
           </select>
           
           <button
             onClick={handleSortToggle}
             className="p-2 border border-neutral-300 rounded-lg hover:bg-neutral-50 transition-colors"
-            aria-label={sortOrder === 'asc' ? 'Sort descending' : 'Sort ascending'}
+            aria-label={sortOrder === 'asc' ? t('gallery.sortDescending', 'Sort descending') : t('gallery.sortAscending', 'Sort ascending')}
           >
             {sortOrder === 'asc' ? (
               <SortAsc className="w-5 h-5 text-neutral-600" />
@@ -87,4 +115,4 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
       </div>
     </div>
   );
-};
+};

frontend/src/components/admin/PhotoUpload.tsx

@@ -6,6 +6,7 @@ import { api } from '../../config/api';
 import { toast } from 'react-toastify';
 import { useQuery } from '@tanstack/react-query';
 import { categoriesService } from '../../services/categories.service';
+import { settingsService } from '../../services/settings.service';
 import { useTranslation } from 'react-i18next';
 
 interface PhotoUploadProps {
@@ -13,6 +14,9 @@ interface PhotoUploadProps {
   onUploadComplete?: () => void;
 }
 
+const DEFAULT_MAX_FILES_PER_UPLOAD = 500;
+const MAX_FILES_PER_UPLOAD_LIMIT = 2000;
+
 export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadComplete }) => {
   const { t } = useTranslation();
   const [isUploading, setIsUploading] = useState(false);
@@ -29,6 +33,22 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
     queryFn: () => categoriesService.getEventCategories(eventId),
   });
 
+  const { data: settings } = useQuery({
+    queryKey: ['admin-settings'],
+    queryFn: () => settingsService.getAllSettings(),
+  });
+
+  const maxFilesPerUpload = React.useMemo(() => {
+    const rawValue = settings?.general_max_files_per_upload;
+    const parsed = Number(rawValue);
+    if (!Number.isFinite(parsed)) {
+      return DEFAULT_MAX_FILES_PER_UPLOAD;
+    }
+    return Math.min(MAX_FILES_PER_UPLOAD_LIMIT, Math.max(1, Math.floor(parsed)));
+  }, [settings]);
+
+  const remainingSlots = Math.max(maxFilesPerUpload - selectedFiles.length, 0);
+
   const handleFileSelect = (e: React.ChangeEvent<HTMLInputElement>) => {
     const files = Array.from(e.target.files || []);
     const imageFiles = files.filter(file => 
@@ -37,13 +57,19 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
     
     // Check total file count with existing files
     const totalFiles = selectedFiles.length + imageFiles.length;
-    if (totalFiles > 500) {
-      const allowedNewFiles = 500 - selectedFiles.length;
+    if (totalFiles > maxFilesPerUpload) {
+      const allowedNewFiles = maxFilesPerUpload - selectedFiles.length;
       if (allowedNewFiles <= 0) {
-        toast.error(t('upload.maxFilesReached') || 'Maximum 500 files allowed');
+        toast.error(
+          t('upload.maxFilesReached', { limit: maxFilesPerUpload }) ||
+          `Maximum ${maxFilesPerUpload} files allowed`
+        );
         return;
       }
-      toast.warning(t('upload.someFilesSkipped') || `Only ${allowedNewFiles} more files can be added (500 max)`);
+      toast.warning(
+        t('upload.someFilesSkipped', { allowed: allowedNewFiles, limit: maxFilesPerUpload }) ||
+        `Only ${allowedNewFiles} more files can be added (limit ${maxFilesPerUpload})`
+      );
       setSelectedFiles(prev => [...prev, ...imageFiles.slice(0, allowedNewFiles)]);
       return;
     }
@@ -59,8 +85,11 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
     if (selectedFiles.length === 0) return;
     
     // Validate file count
-    if (selectedFiles.length > 500) {
-      toast.error(t('upload.tooManyFiles') || 'Maximum 500 files can be uploaded at once');
+    if (selectedFiles.length > maxFilesPerUpload) {
+      toast.error(
+        t('upload.tooManyFiles', { limit: maxFilesPerUpload }) ||
+        `Maximum ${maxFilesPerUpload} files can be uploaded at once`
+      );
       return;
     }
 
@@ -68,7 +97,7 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
     setUploadProgress(0);
 
     // For large uploads, chunk the files to prevent memory issues
-    const CHUNK_SIZE = 50; // Upload 50 files at a time
+    const CHUNK_SIZE = Math.max(1, Math.min(50, maxFilesPerUpload)); // Upload up to 50 (or limit) files at a time
     const chunks = [];
     
     for (let i = 0; i < selectedFiles.length; i += CHUNK_SIZE) {
@@ -187,13 +216,27 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
           {t('upload.clickToUpload')}
         </p>
         <p className="text-sm text-neutral-500">
-          {t('upload.fileRequirements')}
+          {t('upload.fileRequirements', { limit: maxFilesPerUpload })}
+        </p>
+        <p
+          className={clsx(
+            "text-xs mt-2",
+            remainingSlots === 0 ? "text-red-600" : "text-neutral-500"
+          )}
+        >
+          {remainingSlots === 0
+            ? t('upload.limitReached', { limit: maxFilesPerUpload })
+            : t('upload.limitInfo', {
+                selected: selectedFiles.length,
+                limit: maxFilesPerUpload,
+                remaining: remainingSlots,
+              })}
         </p>
         <input
           ref={fileInputRef}
           type="file"
           multiple
-          accept="image/jpeg,image/png,image/webp"
+          accept="image/jpeg,image/png,image/webp,video/mp4,video/webm,video/quicktime,video/x-msvideo"
           onChange={handleFileSelect}
           className="hidden"
         />

frontend/src/components/admin/PhotoUploadModal.tsx

@@ -33,7 +33,7 @@ export const PhotoUploadModal: React.FC<PhotoUploadModalProps> = ({
       <div className="bg-white rounded-lg shadow-xl w-full max-w-2xl flex flex-col max-h-[90vh]">
         {/* Fixed Header */}
         <div className="flex items-center justify-between p-6 border-b border-neutral-200">
-          <h2 className="text-xl font-semibold text-neutral-900">{t('events.uploadPhotos')}</h2>
+          <h2 className="text-xl font-semibold text-neutral-900">{t('upload.uploadMedia', t('events.uploadPhotos'))}</h2>
           <Button
             variant="ghost"
             size="sm"
@@ -56,4 +56,4 @@ export const PhotoUploadModal: React.FC<PhotoUploadModalProps> = ({
   );
 };
 
-PhotoUploadModal.displayName = 'PhotoUploadModal';
+PhotoUploadModal.displayName = 'PhotoUploadModal';

frontend/src/components/admin/index.ts

@@ -17,6 +17,7 @@ export { AdminPhotoViewer } from './AdminPhotoViewer';
 export { PhotoFilters } from './PhotoFilters';
 export { PasswordResetModal } from './PasswordResetModal';
 export { AdminAuthenticatedImage } from './AdminAuthenticatedImage';
+export { AdminAuthenticatedVideo } from './AdminAuthenticatedVideo';
 export { ThemeCustomizerEnhanced } from './ThemeCustomizerEnhanced';
 export { ThemeDisplay } from './ThemeDisplay';
 export { ThemeEditorModal } from './ThemeEditorModal';
@@ -29,4 +30,4 @@ export { BackupHistory } from './BackupHistory';
 export { RestoreWizard } from './RestoreWizard';
 export { FeedbackSettings } from './FeedbackSettings';
 export { FeedbackModerationPanel } from './FeedbackModerationPanel';
-export { WordFilterManager } from './WordFilterManager';
+export { WordFilterManager } from './WordFilterManager';

frontend/src/components/common/AuthenticatedImage.tsx

@@ -1,5 +1,11 @@
 import React, { useState, useEffect } from 'react';
 import { buildResourceUrl } from '../../utils/url';
+import {
+  getActiveGallerySlug,
+  getGalleryToken,
+  inferGallerySlugFromLocation,
+  resolveSlugFromRequestUrl,
+} from '../../utils/galleryAuthStorage';
 
 interface AuthenticatedImageProps extends React.ImgHTMLAttributes<HTMLImageElement> {
   src: string;
@@ -52,7 +58,6 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
 }) => {
   const unusedProps = {
     protectFromDownload,
-    slug,
     photoId,
     requiresToken,
     secureUrlTemplate,
@@ -76,7 +81,8 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
   const [isLoading, setIsLoading] = useState(true);
 
   useEffect(() => {
-    let objectUrl: string | null = null;
+    let aborted = false;
+    const objectUrls: string[] = [];
 
     // Determine which token to use based on context
     if (!src) {
@@ -88,37 +94,79 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
     setIsLoading(true);
     setError(false);
 
-    // Create a new URL with auth header
+    const resolveSlug = (candidateSrc?: string): string | null => {
+      if (slug) {
+        return slug;
+      }
+      const fromUrl = candidateSrc ? resolveSlugFromRequestUrl(candidateSrc) : null;
+      if (fromUrl) {
+        return fromUrl;
+      }
+      return getActiveGallerySlug() || inferGallerySlugFromLocation();
+    };
+
+    const fetchWithAuth = async (rawUrl: string | undefined | null): Promise<string> => {
+      if (!rawUrl) {
+        throw new Error('No URL provided');
+      }
+
+      // Build full URL for the image
+      const fullImageUrl = rawUrl.startsWith('/admin')
+        ? buildResourceUrl(`/api${rawUrl}`)
+        : rawUrl.startsWith('/')
+          ? buildResourceUrl(rawUrl)
+          : rawUrl;
+
+      const headers: Record<string, string> = {};
+      const slugForRequest = resolveSlug(rawUrl);
+      const token = getGalleryToken(slugForRequest);
+      if (token) {
+        headers.Authorization = `Bearer ${token}`;
+      }
+
+      const response = await fetch(fullImageUrl, {
+        credentials: 'include',
+        headers: Object.keys(headers).length ? headers : undefined,
+      });
+
+      if (!response.ok) {
+        throw new Error(`Failed to fetch image: ${response.status} ${response.statusText}`);
+      }
+
+      const blob = await response.blob();
+      const objectUrl = URL.createObjectURL(blob);
+      objectUrls.push(objectUrl);
+      return objectUrl;
+    };
+
     const fetchImage = async () => {
       try {
-        // Use the src as-is since it should already be the correct endpoint
-        let imageUrl = src;
-        
-        // Build full URL for the image
-        // For API paths that start with /admin, we need to prepend /api
-        const fullImageUrl = imageUrl.startsWith('/admin') 
-          ? buildResourceUrl(`/api${imageUrl}`)
-          : imageUrl.startsWith('/') 
-          ? buildResourceUrl(imageUrl) 
-          : imageUrl;
-        
-        // Fetch authenticated image
-        const response = await fetch(fullImageUrl, {
-          credentials: 'include'
-        });
-
-        if (!response.ok) {
-          throw new Error(`Failed to fetch image: ${response.status} ${response.statusText}`);
+        const primaryUrl = await fetchWithAuth(src);
+        if (!aborted) {
+          setImageSrc(primaryUrl);
+          setError(false);
         }
-
-        const blob = await response.blob();
-        objectUrl = URL.createObjectURL(blob);
-        setImageSrc(objectUrl);
-        setIsLoading(false);
       } catch (err) {
-        // Image loading failed - use fallback
-        setError(true);
-        setImageSrc(fallbackSrc || '');
+        setIsLoading(false);
+        if (fallbackSrc && fallbackSrc !== src) {
+          try {
+            const fallbackUrl = await fetchWithAuth(fallbackSrc);
+            if (!aborted) {
+              setImageSrc(fallbackUrl);
+              setError(false);
+            }
+            return;
+          } catch (fallbackError) {
+            // Swallow and mark error below
+          }
+        }
+        if (!aborted) {
+          setError(true);
+          setImageSrc('');
+        }
+        return;
+      }
+      if (!aborted) {
         setIsLoading(false);
       }
     };
@@ -127,11 +175,11 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
 
     // Cleanup function
     return () => {
-      if (objectUrl) {
-        URL.revokeObjectURL(objectUrl);
-      }
+      aborted = true;
+      objectUrls.forEach((url) => URL.revokeObjectURL(url));
     };
-  }, [src, fallbackSrc, useWatermark, isGallery]);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [src, fallbackSrc, slug]);
 
   if (isLoading) {
     return (

frontend/src/components/common/AuthenticatedVideo.tsx

@@ -0,0 +1,125 @@
+import React, { useEffect, useState } from 'react';
+import { buildResourceUrl } from '../../utils/url';
+import {
+  getActiveGallerySlug,
+  getGalleryToken,
+  inferGallerySlugFromLocation,
+  resolveSlugFromRequestUrl,
+} from '../../utils/galleryAuthStorage';
+
+interface AuthenticatedVideoProps extends React.VideoHTMLAttributes<HTMLVideoElement> {
+  src: string;
+  fallbackSrc?: string;
+  slug?: string;
+}
+
+export const AuthenticatedVideo: React.FC<AuthenticatedVideoProps> = ({
+  src,
+  fallbackSrc,
+  slug,
+  ...props
+}) => {
+  const [videoSrc, setVideoSrc] = useState<string>('');
+  const [error, setError] = useState(false);
+
+  useEffect(() => {
+    let aborted = false;
+    const objectUrls: string[] = [];
+
+    if (!src) {
+      setVideoSrc('');
+      setError(true);
+      return;
+    }
+
+    const resolveSlug = (candidateSrc?: string): string | null => {
+      if (slug) {
+        return slug;
+      }
+      const fromUrl = candidateSrc ? resolveSlugFromRequestUrl(candidateSrc) : null;
+      if (fromUrl) {
+        return fromUrl;
+      }
+      return getActiveGallerySlug() || inferGallerySlugFromLocation();
+    };
+
+    const fetchWithAuth = async (rawUrl: string | undefined | null): Promise<string> => {
+      if (!rawUrl) {
+        throw new Error('No URL provided');
+      }
+
+      const fullUrl = rawUrl.startsWith('/')
+        ? buildResourceUrl(rawUrl)
+        : rawUrl;
+
+      const headers: Record<string, string> = {};
+      const slugForRequest = resolveSlug(rawUrl);
+      const token = getGalleryToken(slugForRequest);
+      if (token) {
+        headers.Authorization = `Bearer ${token}`;
+      }
+
+      const response = await fetch(fullUrl, {
+        credentials: 'include',
+        headers: Object.keys(headers).length ? headers : undefined,
+      });
+
+      if (!response.ok) {
+        throw new Error(`Failed to fetch media: ${response.status} ${response.statusText}`);
+      }
+
+      const blob = await response.blob();
+      const objectUrl = URL.createObjectURL(blob);
+      objectUrls.push(objectUrl);
+      return objectUrl;
+    };
+
+    const load = async () => {
+      try {
+        const primaryUrl = await fetchWithAuth(src);
+        if (!aborted) {
+          setVideoSrc(primaryUrl);
+          setError(false);
+        }
+      } catch (err) {
+        if (fallbackSrc && fallbackSrc !== src) {
+          try {
+            const fallbackUrl = await fetchWithAuth(fallbackSrc);
+            if (!aborted) {
+              setVideoSrc(fallbackUrl);
+              setError(false);
+            }
+            return;
+          } catch (_) {
+            // ignore and set error below
+          }
+        }
+        if (!aborted) {
+          setError(true);
+          setVideoSrc('');
+        }
+      }
+    };
+
+    load();
+
+    return () => {
+      aborted = true;
+      objectUrls.forEach((url) => URL.revokeObjectURL(url));
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [src, fallbackSrc, slug]);
+
+  if (error || !videoSrc) {
+    return null;
+  }
+
+  return (
+    <video
+      src={videoSrc}
+      controls
+      preload="metadata"
+      {...props}
+    />
+  );
+};

frontend/src/components/common/index.ts

@@ -16,7 +16,8 @@ export { SkipLink } from './SkipLink';
 export { DynamicFavicon } from './DynamicFavicon';
 export { LanguageSelector } from './LanguageSelector';
 export { AuthenticatedImage } from './AuthenticatedImage';
+export { AuthenticatedVideo } from './AuthenticatedVideo';
 export { ProtectedImage } from './ProtectedImage';
 export { ProtectionWarning } from './ProtectionWarning';
 export { ReCaptcha } from './ReCaptcha';
-export { PasswordGenerator } from './PasswordGenerator';
+export { PasswordGenerator } from './PasswordGenerator';

frontend/src/components/gallery/GalleryLayout.tsx

@@ -29,6 +29,7 @@ interface GalleryLayoutProps {
     logo_display_header?: boolean;
     logo_display_hero?: boolean;
     logo_display_mode?: 'logo_only' | 'text_only' | 'logo_and_text';
+    hide_powered_by?: boolean;
   };
   showLogout?: boolean;
   onLogout?: () => void;
@@ -438,7 +439,10 @@ export const GalleryLayout: React.FC<GalleryLayoutProps> = ({
             </p>
           )}
           <p className="text-xs sm:text-sm text-neutral-500">
-            {brandingSettings?.footer_text || '© 2024 Your Company. All rights reserved.'} | Powered by <span className="font-semibold">PicPeak</span>
+            {brandingSettings?.footer_text || '© 2024 Your Company. All rights reserved.'}
+            {!brandingSettings?.hide_powered_by && (
+              <> | Powered by <span className="font-semibold">PicPeak</span></>
+            )}
           </p>
           {brandingSettings?.company_name && brandingSettings?.company_tagline && (
             <p className="text-xs text-neutral-400 mt-2">

frontend/src/components/gallery/GallerySidebar.tsx

@@ -9,8 +9,8 @@ interface GallerySidebarProps {
   isOpen: boolean;
   onClose: () => void;
   categories: PhotoCategory[];
-  selectedCategoryId: number | null;
-  onCategoryChange: (categoryId: number | null) => void;
+  selectedCategoryId: number | string | null;
+  onCategoryChange: (categoryId: number | string | null) => void;
   searchTerm: string;
   onSearchChange: (term: string) => void;
   sortBy: 'date' | 'name' | 'size' | 'rating';
@@ -22,7 +22,7 @@ interface GallerySidebarProps {
   onDownloadSelected: () => void;
   isDownloading: boolean;
   allowDownloads?: boolean;
-  photoCounts?: Record<number, number>;
+  photoCounts?: Record<number | string, number>;
   totalPhotos: number;
   isMobile: boolean;
   galleryLayout?: string;
@@ -34,6 +34,9 @@ interface GallerySidebarProps {
   likeCount?: number;
   favoriteCount?: number;
   ratedCount?: number;
+  mediaFilter?: 'all' | 'photo' | 'video';
+  onMediaFilterChange?: (filter: 'all' | 'photo' | 'video') => void;
+  showMediaFilter?: boolean;
 }
 
 export const GallerySidebar: React.FC<GallerySidebarProps> = ({
@@ -64,7 +67,10 @@ export const GallerySidebar: React.FC<GallerySidebarProps> = ({
   onFilterChange,
   likeCount = 0,
   favoriteCount = 0,
-  ratedCount = 0
+  ratedCount = 0,
+  mediaFilter = 'all',
+  onMediaFilterChange,
+  showMediaFilter = false
 }) => {
   const { t } = useTranslation();
   const sidebarRef = useRef<HTMLDivElement>(null);
@@ -288,6 +294,47 @@ export const GallerySidebar: React.FC<GallerySidebarProps> = ({
             </div>
           )}
 
+          {showMediaFilter && onMediaFilterChange && (
+            <div className="p-4 border-b border-neutral-200">
+              <h3 className="text-sm font-semibold text-neutral-700 mb-3 flex items-center gap-2">
+                <Filter className="w-4 h-4" />
+                {t('gallery.mediaType', 'Media')}
+              </h3>
+              <div className="flex items-center gap-2 flex-wrap">
+                <Button
+                  variant={mediaFilter === 'all' ? 'primary' : 'outline'}
+                  size="sm"
+                  onClick={() => {
+                    onMediaFilterChange('all');
+                    if (isMobile) onClose();
+                  }}
+                >
+                  {t('gallery.allMedia', 'All')}
+                </Button>
+                <Button
+                  variant={mediaFilter === 'photo' ? 'primary' : 'outline'}
+                  size="sm"
+                  onClick={() => {
+                    onMediaFilterChange('photo');
+                    if (isMobile) onClose();
+                  }}
+                >
+                  {t('gallery.photosOnly', 'Photos')}
+                </Button>
+                <Button
+                  variant={mediaFilter === 'video' ? 'primary' : 'outline'}
+                  size="sm"
+                  onClick={() => {
+                    onMediaFilterChange('video');
+                    if (isMobile) onClose();
+                  }}
+                >
+                  {t('gallery.videosOnly', 'Videos')}
+                </Button>
+              </div>
+            </div>
+          )}
+
           {/* Sort Section - Hidden for carousel and timeline layouts */}
           {galleryLayout !== 'carousel' && galleryLayout !== 'timeline' && (
             <div className="p-4">

frontend/src/components/gallery/GalleryView.tsx

@@ -44,7 +44,7 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
   const { t } = useTranslation();
   const { logout } = useGalleryAuth();
   const { setTheme, theme } = useTheme();
-  const [selectedCategoryId, setSelectedCategoryId] = useState<number | null>(null);
+  const [selectedCategoryId, setSelectedCategoryId] = useState<number | string | null>(null);
   const [searchTerm, setSearchTerm] = useState('');
   const [sortBy, setSortBy] = useState<'date' | 'name' | 'size' | 'rating'>('date');
   const [brandingSettings, setBrandingSettings] = useState<any>(null);
@@ -57,8 +57,22 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
   const { watermarkEnabled } = useWatermarkSettings();
   const [protectionLevel, setProtectionLevel] = useState<'basic' | 'standard' | 'enhanced' | 'maximum'>('standard');
   const [filterType, setFilterType] = useState<FilterType>('all');
+  const [mediaFilter, setMediaFilter] = useState<'all' | 'photo' | 'video'>('all');
   const [guestId, setGuestId] = useState<string>('');
   const [staticHeroPhoto, setStaticHeroPhoto] = useState<Photo | null>(null);
+
+  const resolveMediaType = (photo: Photo) => {
+    if (photo.media_type === 'video' || photo.media_type === 'photo') {
+      return photo.media_type;
+    }
+    if (photo.mime_type && photo.mime_type.startsWith('video/')) {
+      return 'video';
+    }
+    if ((photo as any).type === 'video') {
+      return 'video';
+    }
+    return 'photo';
+  };
   
   // Generate a unique guest ID for this session
   useEffect(() => {
@@ -71,8 +85,9 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
     setGuestId(storedGuestId);
   }, []);
   
-  // Fetch photos with filter support
-  const { data, isLoading, error, refetch } = useGalleryPhotos(slug, filterType, guestId);
+  // Fetch photos WITHOUT filter (always get all photos, filter on frontend)
+  // This ensures counts are always calculated from the full dataset
+  const { data, isLoading, error, refetch } = useGalleryPhotos(slug, 'all', guestId);
   
   // Set protection level when data is available
   useEffect(() => {
@@ -164,10 +179,36 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
         footer_text: settingsData.branding_footer_text || '© 2024 Your Company. All rights reserved.',
         watermark_enabled: settingsData.branding_watermark_enabled || false,
         logo_url: settingsData.branding_logo_url || null,
+        logo_size: settingsData.branding_logo_size || 'medium',
+        logo_max_height: settingsData.branding_logo_max_height || 48,
+        logo_position: settingsData.branding_logo_position || 'left',
+        logo_display_header: settingsData.branding_logo_display_header !== false,
+        logo_display_hero: settingsData.branding_logo_display_hero !== false,
+        logo_display_mode: settingsData.branding_logo_display_mode || 'logo_and_text',
+        hide_powered_by: settingsData.branding_hide_powered_by === true,
       });
     }
   }, [settingsData]);
 
+  const availableMediaTypes = useMemo(() => {
+    const types = new Set<'photo' | 'video'>();
+    (data?.photos || []).forEach((photo) => {
+      const mediaType = resolveMediaType(photo);
+      if (mediaType === 'photo' || mediaType === 'video') {
+        types.add(mediaType);
+      }
+    });
+    return types;
+  }, [data?.photos]);
+
+  const showMediaFilter = availableMediaTypes.has('photo') && availableMediaTypes.has('video');
+
+  useEffect(() => {
+    if (!showMediaFilter && mediaFilter !== 'all') {
+      setMediaFilter('all');
+    }
+  }, [showMediaFilter, mediaFilter]);
+
   // Determine a stable hero photo from the initial (unfiltered) load
   useEffect(() => {
     if (!staticHeroPhoto && data?.photos && filterType === 'all') {
@@ -177,7 +218,8 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
         hero = data.photos.find(p => p.id === heroId) || null;
       }
       if (!hero && data.photos.length > 0) {
-        hero = data.photos[0];
+        const firstPhoto = data.photos.find(p => resolveMediaType(p) === 'photo');
+        hero = firstPhoto || data.photos[0];
       }
       if (hero) {
         setStaticHeroPhoto(hero);
@@ -251,6 +293,12 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
     if (!data?.photos) return [];
     
     let photos = [...data.photos];
+
+    if (mediaFilter === 'photo') {
+      photos = photos.filter(photo => resolveMediaType(photo) !== 'video');
+    } else if (mediaFilter === 'video') {
+      photos = photos.filter(photo => resolveMediaType(photo) === 'video');
+    }
     
     // Apply category filter
     if (selectedCategoryId) {
@@ -315,7 +363,7 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
     }
     
     return photos;
-  }, [data?.photos, selectedCategoryId, searchTerm, sortBy, watermarkEnabled, slug, filterType]);
+  }, [data?.photos, selectedCategoryId, searchTerm, sortBy, watermarkEnabled, slug, filterType, mediaFilter]);
 
   const likeCount = useMemo(
     () => data?.photos?.filter(p => (p.like_count ?? 0) > 0).length || 0,
@@ -380,14 +428,20 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
   // Calculate photo counts per category
   const photoCounts = useMemo(() => {
     if (!data?.photos) return {};
-    const counts: Record<number, number> = {};
-    data.photos.forEach(photo => {
+    const counts: Record<number | string, number> = {};
+    data.photos
+      .filter(photo => {
+        if (mediaFilter === 'photo') return resolveMediaType(photo) !== 'video';
+        if (mediaFilter === 'video') return resolveMediaType(photo) === 'video';
+        return true;
+      })
+      .forEach(photo => {
       if (photo.category_id) {
         counts[photo.category_id] = (counts[photo.category_id] || 0) + 1;
       }
     });
     return counts;
-  }, [data?.photos]);
+  }, [data?.photos, mediaFilter]);
 
   // Track search usage with debouncing
   useEffect(() => {
@@ -489,6 +543,9 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
           feedbackEnabled={feedbackEnabled}
           filterType={filterType}
           onFilterChange={setFilterType}
+          mediaFilter={mediaFilter}
+          onMediaFilterChange={setMediaFilter}
+          showMediaFilter={showMediaFilter}
           likeCount={likeCount}
           favoriteCount={favoriteCount}
           ratedCount={ratedCount}
@@ -574,16 +631,19 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
               onCategoryChange={setSelectedCategoryId}
               searchTerm={searchTerm}
               onSearchChange={setSearchTerm}
-              sortBy={sortBy}
-              onSortChange={setSortBy}
-              photoCount={filteredPhotos.length}
-              // Feedback filter props
-              feedbackEnabled={feedbackEnabled}
-              currentFilter={filterType}
-              onFilterChange={setFilterType}
-            />
-          </div>
-        ) : null}
+            sortBy={sortBy}
+            onSortChange={setSortBy}
+            photoCount={filteredPhotos.length}
+            // Feedback filter props
+            feedbackEnabled={feedbackEnabled}
+            currentFilter={filterType}
+            onFilterChange={setFilterType}
+            mediaFilter={mediaFilter}
+            onMediaFilterChange={setMediaFilter}
+            showMediaFilter={showMediaFilter}
+          />
+        </div>
+      ) : null}
 
         {/* Photo Grid */}
         <div className={showSidebar ? "mt-6" : "mt-6"}>

frontend/src/components/gallery/PhotoFilterBar.tsx

@@ -32,6 +32,9 @@ interface PhotoFilterBarProps {
   feedbackEnabled?: boolean;
   currentFilter?: FilterType;
   onFilterChange?: (filter: FilterType) => void;
+  mediaFilter?: 'all' | 'photo' | 'video';
+  onMediaFilterChange?: (filter: 'all' | 'photo' | 'video') => void;
+  showMediaFilter?: boolean;
 }
 
 export const PhotoFilterBar: React.FC<PhotoFilterBarProps> = ({
@@ -47,6 +50,9 @@ export const PhotoFilterBar: React.FC<PhotoFilterBarProps> = ({
   feedbackEnabled = false,
   currentFilter = 'all',
   onFilterChange,
+  mediaFilter = 'all',
+  onMediaFilterChange,
+  showMediaFilter = false
 }) => {
   const { t } = useTranslation();
   const [showSortMenu, setShowSortMenu] = useState(false);
@@ -148,7 +154,7 @@ export const PhotoFilterBar: React.FC<PhotoFilterBarProps> = ({
                   leftIcon={<Grid className="w-3 h-3 md:w-4 md:h-4" />}
                   className="text-xs md:text-sm whitespace-nowrap flex-shrink-0"
                 >
-                  {t('gallery.allPhotos')} ({photos.length})
+                  {showMediaFilter ? t('gallery.allMedia', 'All media') : t('gallery.allPhotos')} ({photos.length})
                 </Button>
                 {categories.map((category) => {
                   const categoryPhotoCount = photos.filter(p => p.category_id === category.id).length;
@@ -226,10 +232,44 @@ export const PhotoFilterBar: React.FC<PhotoFilterBarProps> = ({
             )}
 
             <p className="text-xs md:text-sm text-neutral-600 flex-shrink-0 ml-auto">
-              {photoCount} {photoCount === 1 ? t('common.photo') : t('common.photos')}
+              {photoCount} {t('common.media', 'media')}
             </p>
           </div>
         )}
+
+        {showMediaFilter && onMediaFilterChange && (
+          <div className="flex items-center gap-2 flex-wrap">
+            <span className="text-xs md:text-sm text-neutral-600 whitespace-nowrap">
+              {t('gallery.mediaType', 'Media')}
+            </span>
+            <div className="flex items-center gap-2">
+              <Button
+                variant={mediaFilter === 'all' ? 'primary' : 'outline'}
+                size="sm"
+                onClick={() => onMediaFilterChange('all')}
+                className="text-xs md:text-sm"
+              >
+                {t('gallery.allMedia', 'All')}
+              </Button>
+              <Button
+                variant={mediaFilter === 'photo' ? 'primary' : 'outline'}
+                size="sm"
+                onClick={() => onMediaFilterChange('photo')}
+                className="text-xs md:text-sm"
+              >
+                {t('gallery.photosOnly', 'Photos')}
+              </Button>
+              <Button
+                variant={mediaFilter === 'video' ? 'primary' : 'outline'}
+                size="sm"
+                onClick={() => onMediaFilterChange('video')}
+                className="text-xs md:text-sm"
+              >
+                {t('gallery.videosOnly', 'Videos')}
+              </Button>
+            </div>
+          </div>
+        )}
         
         {/* Mobile/Tablet: compact horizontal icons with headline below categories */}
         {feedbackEnabled && onFilterChange && (

frontend/src/components/gallery/PhotoGrid.tsx

@@ -1,5 +1,5 @@
 import React, { useState, useEffect } from 'react';
-import { Download, Maximize2, Check, Package, MessageSquare, Star } from 'lucide-react';
+import { Download, Maximize2, Check, Package, MessageSquare, Star, Play } from 'lucide-react';
 import { useInView } from 'react-intersection-observer';
 import { toast as toastify } from 'react-toastify';
 import { useTranslation } from 'react-i18next';
@@ -336,14 +336,25 @@ const PhotoThumbnail: React.FC<PhotoThumbnailProps> = ({
             </div>
           )}
 
-          {/* Photo type badge */}
-          {photo.type === 'collage' && (
-            <div className="absolute bottom-2 left-2">
+          {/* Media type badges */}
+          <div className="absolute bottom-2 left-2 flex gap-2">
+            {photo.type === 'collage' && (
               <span className="px-2 py-1 bg-black/60 text-white text-xs rounded">
                 Collage
               </span>
-            </div>
-          )}
+            )}
+            {photo.media_type === 'video' && (
+              <span className="px-2 py-1 bg-black/60 text-white text-xs rounded flex items-center gap-1">
+                <Play className="w-3 h-3" fill="white" />
+                Video
+                {photo.duration && (
+                  <span className="ml-1">
+                    {Math.floor(photo.duration / 60)}:{String(photo.duration % 60).padStart(2, '0')}
+                  </span>
+                )}
+              </span>
+            )}
+          </div>
         </>
       ) : (
         <div className="skeleton aspect-square w-full" />

frontend/src/components/gallery/PhotoLightbox.tsx

@@ -7,6 +7,7 @@ import { AuthenticatedImage } from '../common';
 import { PhotoFeedback } from './PhotoFeedback';
 import { feedbackService } from '../../services/feedback.service';
 import { FeedbackIdentityModal } from './FeedbackIdentityModal';
+import { VideoPlayer } from './VideoPlayer';
 
 interface PhotoLightboxProps {
   photos: Photo[];
@@ -448,49 +449,58 @@ export const PhotoLightbox: React.FC<PhotoLightboxProps> = ({
         </div>
       </div>
 
-      {/* Image container */}
+      {/* Image/Video container */}
       <div
         className="absolute top-0 left-0 bottom-0 flex items-center justify-center z-0"
-        onClick={handleImageClick}
-        onMouseDown={handleMouseDown}
-        onMouseMove={handleMouseMove}
-        onMouseUp={handleMouseUp}
-        onMouseLeave={handleMouseUp}
-        onTouchStart={handleTouchStart}
-        onTouchMove={handleTouchMove}
-        onTouchEnd={handleTouchEnd}
+        onClick={currentPhoto.media_type === 'video' ? undefined : handleImageClick}
+        onMouseDown={currentPhoto.media_type === 'video' ? undefined : handleMouseDown}
+        onMouseMove={currentPhoto.media_type === 'video' ? undefined : handleMouseMove}
+        onMouseUp={currentPhoto.media_type === 'video' ? undefined : handleMouseUp}
+        onMouseLeave={currentPhoto.media_type === 'video' ? undefined : handleMouseUp}
+        onTouchStart={currentPhoto.media_type === 'video' ? undefined : handleTouchStart}
+        onTouchMove={currentPhoto.media_type === 'video' ? undefined : handleTouchMove}
+        onTouchEnd={currentPhoto.media_type === 'video' ? undefined : handleTouchEnd}
         style={{
-          cursor: zoom > 1 ? (isDragging ? 'grabbing' : 'grab') : 'default',
+          cursor: currentPhoto.media_type === 'video' ? 'default' : (zoom > 1 ? (isDragging ? 'grabbing' : 'grab') : 'default'),
           right: isDesktopFeedback ? `${desktopFeedbackWidth}px` : 0,
         }}
       >
-        <AuthenticatedImage
-          src={currentPhoto.url}
-          alt={currentPhoto.filename}
-          fallbackSrc={currentPhoto.thumbnail_url || undefined}
-          className="max-w-full max-h-full object-contain select-none"
-          style={{
-            transform: `scale(${zoom}) translate(${dragOffset.x / zoom}px, ${dragOffset.y / zoom}px)`,
-            transition: isDragging ? 'none' : 'transform 0.2s',
-          }}
-          draggable={false}
-          useWatermark={useEnhancedProtection}
-          watermarkText={useEnhancedProtection ? `${currentPhoto.filename} - Protected` : undefined}
-          isGallery={true}
-          slug={slug}
-          photoId={currentPhoto.id}
-          requiresToken={currentPhoto.requires_token}
-          secureUrlTemplate={currentPhoto.secure_url_template}
-          protectFromDownload={!allowDownloads || useEnhancedProtection}
-          protectionLevel={protectionLevel}
-          useEnhancedProtection={useEnhancedProtection}
-          useCanvasRendering={protectionLevel === 'maximum'}
-          fragmentGrid={protectionLevel === 'enhanced' || protectionLevel === 'maximum'}
-          blockKeyboardShortcuts={useEnhancedProtection}
-          detectPrintScreen={useEnhancedProtection}
-          detectDevTools={protectionLevel === 'enhanced' || protectionLevel === 'maximum'}
-          onProtectionViolation={(violationType) => {
-            console.warn(`Protection violation in lightbox for photo ${currentPhoto.id}: ${violationType}`);
+        {currentPhoto.media_type === 'video' ? (
+          <VideoPlayer
+            src={currentPhoto.url}
+            poster={currentPhoto.thumbnail_url}
+            className="max-w-full max-h-full"
+            controls={true}
+            autoPlay={false}
+          />
+        ) : (
+          <AuthenticatedImage
+            src={currentPhoto.url}
+            alt={currentPhoto.filename}
+            fallbackSrc={currentPhoto.thumbnail_url || undefined}
+            className="max-w-full max-h-full object-contain select-none"
+            style={{
+              transform: `scale(${zoom}) translate(${dragOffset.x / zoom}px, ${dragOffset.y / zoom}px)`,
+              transition: isDragging ? 'none' : 'transform 0.2s',
+            }}
+            draggable={false}
+            useWatermark={useEnhancedProtection}
+            watermarkText={useEnhancedProtection ? `${currentPhoto.filename} - Protected` : undefined}
+            isGallery={true}
+            slug={slug}
+            photoId={currentPhoto.id}
+            requiresToken={currentPhoto.requires_token}
+            secureUrlTemplate={currentPhoto.secure_url_template}
+            protectFromDownload={!allowDownloads || useEnhancedProtection}
+            protectionLevel={protectionLevel}
+            useEnhancedProtection={useEnhancedProtection}
+            useCanvasRendering={protectionLevel === 'maximum'}
+            fragmentGrid={protectionLevel === 'enhanced' || protectionLevel === 'maximum'}
+            blockKeyboardShortcuts={useEnhancedProtection}
+            detectPrintScreen={useEnhancedProtection}
+            detectDevTools={protectionLevel === 'enhanced' || protectionLevel === 'maximum'}
+            onProtectionViolation={(violationType) => {
+              console.warn(`Protection violation in lightbox for photo ${currentPhoto.id}: ${violationType}`);
             
             // Track analytics
             if (typeof window !== 'undefined' && (window as any).umami) {
@@ -503,12 +513,13 @@ export const PhotoLightbox: React.FC<PhotoLightboxProps> = ({
             }
             
             // For maximum protection, close lightbox on violation
-            if (protectionLevel === 'maximum' && 
+            if (protectionLevel === 'maximum' &&
                 ['devtools_detected', 'print_screen_detected', 'canvas_access_blocked'].includes(violationType)) {
               onClose();
             }
           }}
         />
+        )}
       </div>
 
       {/* Touch/swipe indicators for mobile */}

frontend/src/components/gallery/UserPhotoUpload.tsx

@@ -143,7 +143,7 @@ export const UserPhotoUpload: React.FC<UserPhotoUploadProps> = ({
                     type="file"
                     className="hidden"
                     multiple
-                    accept="image/jpeg,image/png,image/webp"
+                    accept="image/jpeg,image/png,image/webp,video/mp4,video/webm,video/quicktime,video/x-msvideo"
                     onChange={handleFileSelect}
                     disabled={uploading}
                   />

frontend/src/components/gallery/VideoPlayer.tsx

@@ -0,0 +1,232 @@
+import React, { useRef, useState, useEffect } from 'react';
+import { Play, Pause, Volume2, VolumeX, Maximize, Minimize } from 'lucide-react';
+
+interface VideoPlayerProps {
+  src: string;
+  poster?: string;
+  className?: string;
+  autoPlay?: boolean;
+  muted?: boolean;
+  loop?: boolean;
+  controls?: boolean;
+  width?: string | number;
+  height?: string | number;
+}
+
+export const VideoPlayer: React.FC<VideoPlayerProps> = ({
+  src,
+  poster,
+  className = '',
+  autoPlay = false,
+  muted = false,
+  loop = false,
+  controls = true,
+  width = '100%',
+  height = 'auto'
+}) => {
+  const videoRef = useRef<HTMLVideoElement>(null);
+  const [isPlaying, setIsPlaying] = useState(false);
+  const [isMuted, setIsMuted] = useState(muted);
+  const [isFullscreen, setIsFullscreen] = useState(false);
+  const [progress, setProgress] = useState(0);
+  const [currentTime, setCurrentTime] = useState(0);
+  const [duration, setDuration] = useState(0);
+  const [showControls, setShowControls] = useState(true);
+  const controlsTimeoutRef = useRef<NodeJS.Timeout>();
+
+  useEffect(() => {
+    const video = videoRef.current;
+    if (!video) return;
+
+    const handleTimeUpdate = () => {
+      setCurrentTime(video.currentTime);
+      setProgress((video.currentTime / video.duration) * 100 || 0);
+    };
+
+    const handleLoadedMetadata = () => {
+      setDuration(video.duration);
+    };
+
+    const handlePlay = () => setIsPlaying(true);
+    const handlePause = () => setIsPlaying(false);
+    const handleEnded = () => setIsPlaying(false);
+
+    video.addEventListener('timeupdate', handleTimeUpdate);
+    video.addEventListener('loadedmetadata', handleLoadedMetadata);
+    video.addEventListener('play', handlePlay);
+    video.addEventListener('pause', handlePause);
+    video.addEventListener('ended', handleEnded);
+
+    return () => {
+      video.removeEventListener('timeupdate', handleTimeUpdate);
+      video.removeEventListener('loadedmetadata', handleLoadedMetadata);
+      video.removeEventListener('play', handlePlay);
+      video.removeEventListener('pause', handlePause);
+      video.removeEventListener('ended', handleEnded);
+    };
+  }, []);
+
+  const togglePlayPause = () => {
+    const video = videoRef.current;
+    if (!video) return;
+
+    if (isPlaying) {
+      video.pause();
+    } else {
+      video.play();
+    }
+  };
+
+  const toggleMute = () => {
+    const video = videoRef.current;
+    if (!video) return;
+
+    video.muted = !video.muted;
+    setIsMuted(!isMuted);
+  };
+
+  const toggleFullscreen = async () => {
+    const video = videoRef.current;
+    if (!video) return;
+
+    try {
+      if (!isFullscreen) {
+        if (video.requestFullscreen) {
+          await video.requestFullscreen();
+        }
+        setIsFullscreen(true);
+      } else {
+        if (document.exitFullscreen) {
+          await document.exitFullscreen();
+        }
+        setIsFullscreen(false);
+      }
+    } catch (error) {
+      console.error('Error toggling fullscreen:', error);
+    }
+  };
+
+  const handleProgressClick = (e: React.MouseEvent<HTMLDivElement>) => {
+    const video = videoRef.current;
+    if (!video) return;
+
+    const rect = e.currentTarget.getBoundingClientRect();
+    const pos = (e.clientX - rect.left) / rect.width;
+    video.currentTime = pos * video.duration;
+  };
+
+  const formatTime = (seconds: number): string => {
+    if (!seconds || isNaN(seconds)) return '0:00';
+    const mins = Math.floor(seconds / 60);
+    const secs = Math.floor(seconds % 60);
+    return `${mins}:${secs.toString().padStart(2, '0')}`;
+  };
+
+  const handleMouseMove = () => {
+    setShowControls(true);
+    if (controlsTimeoutRef.current) {
+      clearTimeout(controlsTimeoutRef.current);
+    }
+    controlsTimeoutRef.current = setTimeout(() => {
+      if (isPlaying) {
+        setShowControls(false);
+      }
+    }, 3000);
+  };
+
+  useEffect(() => {
+    return () => {
+      if (controlsTimeoutRef.current) {
+        clearTimeout(controlsTimeoutRef.current);
+      }
+    };
+  }, []);
+
+  return (
+    <div
+      className={`relative bg-black rounded-lg overflow-hidden ${className}`}
+      style={{ width, height: height === 'auto' ? undefined : height }}
+      onMouseMove={handleMouseMove}
+      onMouseLeave={() => isPlaying && setShowControls(false)}
+    >
+      <video
+        ref={videoRef}
+        src={src}
+        poster={poster}
+        autoPlay={autoPlay}
+        muted={muted}
+        loop={loop}
+        className="w-full h-full object-contain"
+        playsInline
+        onClick={togglePlayPause}
+      />
+
+      {controls && (
+        <div
+          className={`absolute bottom-0 left-0 right-0 bg-gradient-to-t from-black/80 to-transparent p-4 transition-opacity duration-300 ${
+            showControls ? 'opacity-100' : 'opacity-0'
+          }`}
+        >
+          {/* Progress bar */}
+          <div
+            className="w-full h-1 bg-gray-600 rounded-full cursor-pointer mb-3"
+            onClick={handleProgressClick}
+          >
+            <div
+              className="h-full bg-white rounded-full transition-all"
+              style={{ width: `${progress}%` }}
+            />
+          </div>
+
+          {/* Controls */}
+          <div className="flex items-center justify-between text-white">
+            <div className="flex items-center gap-3">
+              <button
+                onClick={togglePlayPause}
+                className="hover:bg-white/20 p-2 rounded-full transition-colors"
+                aria-label={isPlaying ? 'Pause' : 'Play'}
+              >
+                {isPlaying ? <Pause size={20} /> : <Play size={20} />}
+              </button>
+
+              <button
+                onClick={toggleMute}
+                className="hover:bg-white/20 p-2 rounded-full transition-colors"
+                aria-label={isMuted ? 'Unmute' : 'Mute'}
+              >
+                {isMuted ? <VolumeX size={20} /> : <Volume2 size={20} />}
+              </button>
+
+              <span className="text-sm">
+                {formatTime(currentTime)} / {formatTime(duration)}
+              </span>
+            </div>
+
+            <button
+              onClick={toggleFullscreen}
+              className="hover:bg-white/20 p-2 rounded-full transition-colors"
+              aria-label={isFullscreen ? 'Exit fullscreen' : 'Fullscreen'}
+            >
+              {isFullscreen ? <Minimize size={20} /> : <Maximize size={20} />}
+            </button>
+          </div>
+        </div>
+      )}
+
+      {/* Play button overlay when paused */}
+      {!isPlaying && showControls && (
+        <div className="absolute inset-0 flex items-center justify-center">
+          <button
+            onClick={togglePlayPause}
+            className="bg-black/50 hover:bg-black/70 text-white rounded-full p-6 transition-colors"
+            aria-label="Play"
+          >
+            <Play size={48} fill="white" />
+          </button>
+        </div>
+      )}
+    </div>
+  );
+};
+
+export default VideoPlayer;

frontend/src/components/gallery/layouts/GridGalleryLayout.tsx

@@ -1,5 +1,5 @@
 import React from 'react';
-import { Download, Maximize2, Check, MessageSquare, Star, Heart } from 'lucide-react';
+import { Download, Maximize2, Check, MessageSquare, Star, Heart, Video } from 'lucide-react';
 import { useInView } from 'react-intersection-observer';
 import { useTheme } from '../../../contexts/ThemeContext';
 import { AuthenticatedImage } from '../../common';
@@ -155,6 +155,10 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
       ? 'opacity-100 md:opacity-100'
       : 'opacity-0 md:opacity-0';
 
+  const isVideo = (photo.media_type === 'video') ||
+    (photo.mime_type && photo.mime_type.startsWith('video/')) ||
+    photo.type === 'video';
+
   const handlePhotoClick = (e: React.MouseEvent<HTMLDivElement>) => {
     if (isTouchDevice && !overlayVisible && !isSelectionMode) {
       e.preventDefault();
@@ -231,7 +235,7 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
                     <Download className="w-5 h-5 text-neutral-800" />
                   </button>
                 )}
-                {showFeedbackActions && onQuickComment && (
+                {showFeedbackActions && feedbackOptions?.allowComments && onQuickComment && (
                   <button
                     className="p-2 bg-white/90 rounded-full hover:bg-white transition-colors"
                     onClick={(e) => {
@@ -318,6 +322,15 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
             </div>
           )}
 
+          {isVideo && (
+            <div className="absolute bottom-2 right-2">
+              <span className="px-2 py-1 bg-black/60 text-white text-xs rounded flex items-center gap-1">
+                <Video className="w-3 h-3" />
+                {t('common.video', 'Video')}
+              </span>
+            </div>
+          )}
+
           {photo.type === 'collage' && (
             <div className="absolute bottom-2 right-2">
               <span className="px-2 py-1 bg-black/60 text-white text-xs rounded">

frontend/src/components/gallery/layouts/HeroGalleryLayout.tsx

@@ -168,23 +168,26 @@ export const HeroGalleryLayout: React.FC<HeroGalleryLayoutProps> = ({
         </div>
         
         {/* Scroll Indicator */}
-        <div className="absolute bottom-8 left-1/2 transform -translate-x-1/2 animate-bounce">
-          <button
-            type="button"
-            onClick={handleScrollToGrid}
-            className="rounded-full border border-white/30 bg-white/10 p-3 text-white transition focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-white focus-visible:ring-offset-2 hover:bg-white/20"
-            aria-label={t('gallery.scrollToGallery', 'Scroll to gallery')}
-          >
-            <ChevronDown className="w-8 h-8 drop-shadow-lg" />
-          </button>
-        </div>
+        <button
+          onClick={() => {
+            // Scroll to the grid section
+            const gridSection = document.getElementById('gallery-grid-section');
+            if (gridSection) {
+              gridSection.scrollIntoView({ behavior: 'smooth', block: 'start' });
+            } else {
+              // Fallback: scroll down by hero section height
+              window.scrollBy({ top: window.innerHeight * 0.9, behavior: 'smooth' });
+            }
+          }}
+          className="absolute bottom-8 left-1/2 transform -translate-x-1/2 animate-bounce cursor-pointer hover:scale-110 transition-transform focus:outline-none focus:ring-2 focus:ring-white focus:ring-opacity-50 rounded-full p-2"
+          aria-label="Scroll to gallery"
+        >
+          <ChevronDown className="w-8 h-8 text-white drop-shadow-lg" />
+        </button>
       </div>
 
       {/* Grid Section */}
-      <div
-        ref={gridRef}
-        className="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-5 gap-4"
-      >
+      <div id="gallery-grid-section" className="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-5 gap-4">
         {remainingPhotos.map((photo) => {
           const actualIndex = photos.findIndex(p => p.id === photo.id);
           return (

frontend/src/components/gallery/layouts/MasonryGalleryLayout.tsx

@@ -117,7 +117,7 @@ const MasonryPhoto: React.FC<MasonryPhotoProps> = ({
                 <Download className="w-5 h-5 text-neutral-800" />
               </button>
             )}
-            {onQuickComment && (
+            {feedbackEnabled && feedbackOptions?.allowComments && onQuickComment && (
               <button
                 className="p-2 bg-white/90 rounded-full hover:bg-white transition-colors"
                 onClick={(e) => { e.stopPropagation(); onQuickComment(); }}
@@ -127,7 +127,7 @@ const MasonryPhoto: React.FC<MasonryPhotoProps> = ({
                 <MessageSquare className="w-5 h-5 text-neutral-800" />
               </button>
             )}
-            {feedbackOptions?.allowLikes && (
+            {feedbackEnabled && feedbackOptions?.allowLikes && (
               <button
                 className="p-2 bg-white/90 rounded-full hover:bg-white transition-colors"
                 onClick={async (e) => {

frontend/src/contexts/AdminAuthContext.tsx

@@ -13,7 +13,7 @@ interface AdminAuthContextType {
   error: string | null;
   mustChangePassword: boolean;
   updatePasswordChanged: () => void;
-  updateProfile: (user: AdminUser) => void;
+  updateUserProfile: (updates: Partial<AdminUser>) => void;
 }
 
 const AdminAuthContext = createContext<AdminAuthContextType | undefined>(undefined);
@@ -105,9 +105,15 @@ export const AdminAuthProvider: React.FC<AdminAuthProviderProps> = ({ children }
     }
   };
 
-  const updateProfile = (updatedUser: AdminUser) => {
-    setUser(updatedUser);
-    sessionStorage.setItem('admin_user', JSON.stringify(updatedUser));
+  const updateUserProfile = (updates: Partial<AdminUser>) => {
+    setUser((prev) => {
+      if (!prev) {
+        return prev;
+      }
+      const nextUser = { ...prev, ...updates };
+      sessionStorage.setItem('admin_user', JSON.stringify(nextUser));
+      return nextUser;
+    });
   };
 
   return (
@@ -121,7 +127,7 @@ export const AdminAuthProvider: React.FC<AdminAuthProviderProps> = ({ children }
         error,
         mustChangePassword,
         updatePasswordChanged,
-        updateProfile,
+        updateUserProfile,
       }}
     >
       {children}

frontend/src/contexts/GalleryAuthContext.tsx

@@ -1,5 +1,6 @@
-import React, { createContext, useContext, useState, useEffect } from 'react';
+import React, { createContext, useContext, useState, useEffect, useRef } from 'react';
 import type { ReactNode } from 'react';
+import { useLocation } from 'react-router-dom';
 import { api } from '../config/api';
 import { authService, galleryService } from '../services';
 import { cleanupOldGalleryAuth } from '../utils/cleanupGalleryAuth';
@@ -61,52 +62,133 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
   const [event, setEvent] = useState<GalleryEvent | null>(null);
   const [isLoading, setIsLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
-
-  // Get current gallery slug from URL
-  const getCurrentGallerySlug = () => {
-    const pathParts = window.location.pathname.split('/');
-    if (pathParts[1] === 'gallery' && pathParts[2]) {
-      return pathParts[2];
-    }
-    return null;
-  };
+  const [routeError, setRouteError] = useState<string | null>(null);
+  const location = useLocation();
+  const [routeInfo, setRouteInfo] = useState<{ slug: string | null; token?: string; identifier: string | null; ready: boolean }>({
+    slug: null,
+    token: undefined,
+    identifier: null,
+    ready: false,
+  });
+  const lastResolvedIdentifier = useRef<string | null>(null);
 
   useEffect(() => {
     cleanupOldGalleryAuth();
+  }, []);
 
-    const slugAtMount = getCurrentGallerySlug();
-    if (slugAtMount) {
-      setActiveGallerySlug(slugAtMount);
-    } else {
-      clearActiveGallerySlug();
-    }
+  useEffect(() => {
+    let cancelled = false;
 
-    const initialise = async () => {
-      const currentSlug = getCurrentGallerySlug();
+    const parseRoute = async () => {
+      const segments = location.pathname.split('/').filter(Boolean);
 
-      if (!currentSlug) {
-        setIsLoading(false);
+      if (segments[0] !== 'gallery') {
+        if (!cancelled) {
+          setRouteInfo({ slug: null, token: undefined, identifier: null, ready: true });
+          setRouteError(null);
+        }
         return;
       }
 
-      setActiveGallerySlug(currentSlug);
+      const identifier = segments[1] || null;
+      const tokenSegment = segments[2];
 
-      const storedEvent = sessionStorage.getItem(`gallery_event_${currentSlug}`);
-      if (storedEvent) {
-        try {
-          const parsed = JSON.parse(storedEvent);
-          if (parsed && parsed.id) {
-            const normalizedStored = normalizeEvent(parsed);
-            setEvent(normalizedStored);
-            if (normalizedStored) {
-              sessionStorage.setItem(`gallery_event_${currentSlug}`, JSON.stringify(normalizedStored));
-            }
-          }
-        } catch (err) {
-          sessionStorage.removeItem(`gallery_event_${currentSlug}`);
+      if (!identifier) {
+        if (!cancelled) {
+          setRouteInfo({ slug: null, token: undefined, identifier: null, ready: true });
         }
+        return;
       }
 
+      const looksLikeToken = /^[0-9a-fA-F]{32}$/.test(identifier) && !tokenSegment;
+
+      if (looksLikeToken) {
+        if (lastResolvedIdentifier.current === identifier) {
+          setRouteInfo(prev => ({
+            slug: prev.slug,
+            token: prev.token,
+            identifier,
+            ready: true,
+          }));
+          setRouteError(null);
+          return;
+        }
+
+        try {
+          const resolved = await galleryService.resolveIdentifier(identifier);
+          if (cancelled) return;
+          lastResolvedIdentifier.current = identifier;
+          setRouteInfo({
+            slug: resolved.slug,
+            token: resolved.token,
+            identifier,
+            ready: true,
+          });
+          setRouteError(null);
+        } catch (err: any) {
+          if (cancelled) return;
+          lastResolvedIdentifier.current = identifier;
+          setRouteInfo({
+            slug: null,
+            token: undefined,
+            identifier,
+            ready: true,
+          });
+          setRouteError(err?.response?.data?.error || 'Unable to resolve gallery link');
+        }
+      } else {
+        lastResolvedIdentifier.current = null;
+        setRouteInfo({
+          slug: identifier,
+          token: tokenSegment,
+          identifier,
+          ready: true,
+        });
+        setRouteError(null);
+      }
+    };
+
+    setRouteInfo(prev => ({ ...prev, ready: false }));
+    parseRoute();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [location.pathname]);
+
+  useEffect(() => {
+    if (!routeInfo.ready) {
+      return;
+    }
+
+    if (!routeInfo.slug) {
+      clearActiveGallerySlug();
+      setIsAuthenticated(false);
+      setEvent(null);
+      setIsLoading(false);
+      return;
+    }
+
+    const currentSlug = routeInfo.slug;
+    setActiveGallerySlug(currentSlug);
+
+    const storedEvent = sessionStorage.getItem(`gallery_event_${currentSlug}`);
+    if (storedEvent) {
+      try {
+        const parsed = JSON.parse(storedEvent);
+        if (parsed && parsed.id) {
+          const normalizedStored = normalizeEvent(parsed);
+          setEvent(normalizedStored);
+          if (normalizedStored) {
+            sessionStorage.setItem(`gallery_event_${currentSlug}`, JSON.stringify(normalizedStored));
+          }
+        }
+      } catch {
+        sessionStorage.removeItem(`gallery_event_${currentSlug}`);
+      }
+    }
+
+    const initialise = async () => {
       try {
         setIsLoading(true);
         const sessionResponse = await api.get<{ valid: boolean; type: string; eventSlug?: string }>(
@@ -118,7 +200,6 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
           setIsAuthenticated(true);
 
           if (!storedEvent) {
-            // Fetch gallery details to hydrate context
             const galleryData = await galleryService.getGalleryPhotos(currentSlug);
             if (galleryData?.event) {
               const normalizedEvent = normalizeEvent(galleryData.event);
@@ -132,14 +213,10 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
           return;
         }
 
-        // If no active session, check for share token in URL
-        const parts = window.location.pathname.split('/');
-        const urlToken = parts.length >= 5 ? parts[4] : (parts.length >= 4 ? parts[3] : undefined);
-
-        if (urlToken) {
-          const verify = await galleryService.verifyToken(currentSlug, urlToken);
+        if (routeInfo.token) {
+          const verify = await galleryService.verifyToken(currentSlug, routeInfo.token);
           if (verify?.valid) {
-            const response = await authService.shareLinkLogin(currentSlug, urlToken);
+            const response = await authService.shareLinkLogin(currentSlug, routeInfo.token);
             if (response?.event) {
               const normalizedEvent = normalizeEvent(response.event);
               setEvent(normalizedEvent);
@@ -156,29 +233,33 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
           }
         }
 
-        // No valid session found
         setIsAuthenticated(false);
         sessionStorage.removeItem(`gallery_event_${currentSlug}`);
         setEvent(null);
         clearGalleryToken(currentSlug);
-      } catch (error) {
+      } catch (initialiseError: any) {
         setIsAuthenticated(false);
         sessionStorage.removeItem(`gallery_event_${currentSlug}`);
         setEvent(null);
         clearGalleryToken(currentSlug);
+        if (initialiseError?.response?.data?.error) {
+          setError(initialiseError.response.data.error);
+        }
       } finally {
         setIsLoading(false);
       }
     };
 
     initialise();
+
     return () => {
       clearActiveGallerySlug();
     };
-  }, []);
+  }, [routeInfo]);
 
   const login = async (slug: string, password?: string, recaptchaToken?: string | null) => {
     try {
+      setRouteError(null);
       setError(null);
       setIsLoading(true);
       const response = await authService.verifyGalleryPassword(slug, password, recaptchaToken);
@@ -190,7 +271,6 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
       }
       setActiveGallerySlug(slug);
 
-      // Store event data for quick reloads (non-sensitive)
       if (normalizedEvent) {
         sessionStorage.setItem(`gallery_event_${slug}`, JSON.stringify(normalizedEvent));
       }
@@ -203,7 +283,7 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
   };
 
   const logout = () => {
-    const currentSlug = getCurrentGallerySlug();
+    const currentSlug = routeInfo.slug;
     if (currentSlug) {
       sessionStorage.removeItem(`gallery_event_${currentSlug}`);
       clearGalleryToken(currentSlug);
@@ -222,7 +302,7 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
         login,
         logout,
         isLoading,
-        error,
+        error: routeError ?? error,
       }}
     >
       {children}

frontend/src/hooks/useGallery.ts

@@ -2,12 +2,18 @@ import { useQuery, useMutation } from '@tanstack/react-query';
 import { galleryService } from '../services';
 import { toast } from 'react-toastify';
 
-export const useGalleryInfo = (slug: string, token?: string) => {
+export const useGalleryInfo = (slug?: string, token?: string, enabled: boolean = true) => {
   return useQuery({
     queryKey: ['gallery-info', slug, token],
-    queryFn: () => galleryService.getGalleryInfo(slug, token),
+    queryFn: () => {
+      if (!slug) {
+        throw new Error('Gallery slug is required');
+      }
+      return galleryService.getGalleryInfo(slug, token);
+    },
     retry: 1,
     staleTime: 5 * 60 * 1000, // 5 minutes
+    enabled: Boolean(slug) && enabled,
   });
 };
 

frontend/src/i18n/locales/de.json

@@ -26,6 +26,9 @@
     "uploaded": "Hochgeladen",
     "photo": "Foto",
     "photos": "Fotos",
+    "video": "Video",
+    "videos": "Videos",
+    "media": "Medien",
     "restore": "Wiederherstellen",
     "actions": "Aktionen",
     "refresh": "Aktualisieren",
@@ -48,21 +51,28 @@
     "noCategory": "Keine Kategorie",
     "eventSpecific": "(Veranstaltungsspezifisch)",
     "clickToUpload": "Klicken zum Hochladen oder per Drag & Drop",
-    "fileRequirements": "JPEG, PNG oder WebP (max. 50MB pro Datei)",
+    "fileRequirements": "JPEG, PNG oder WebP (max. 50MB pro Datei, {{limit}} Dateien pro Upload)",
+    "fileRequirementsMedia": "JPEG-, PNG- oder WebP-Bilder sowie MP4/MOV/WEBM-Videos (max. 50MB pro Datei, {{limit}} Dateien pro Upload)",
+    "unsupportedFiles": "Einige Dateien wurden übersprungen, da das Format nicht unterstützt wird (JPEG/PNG/WebP/MP4/MOV/WEBM verwenden).",
     "selectedFiles": "Ausgewählte Dateien",
     "uploading": "Wird hochgeladen...",
     "uploadComplete": "Upload abgeschlossen!",
     "uploadFailed": "Upload fehlgeschlagen",
     "someFilesFailed": "Einige Dateien konnten nicht hochgeladen werden",
     "uploadPhotos": "Fotos hochladen",
+    "uploadMedia": "Fotos & Videos hochladen",
     "importExternal": "Aus externem Ordner importieren",
     "externalImportInfo": "Alle Bilder aus dem ausgewählten Ordner werden importiert.",
     "selectExternalFolder": "Externen Ordner unter /external-media auswählen",
     "importFromSelectedFolder": "Ausgewählten Ordner importieren",
-    "maxFilesReached": "Maximal 500 Dateien erlaubt",
-    "someFilesSkipped": "Einige Dateien wurden übersprungen (500 Dateien Limit)",
-    "tooManyFiles": "Maximal 500 Dateien können gleichzeitig hochgeladen werden",
-    "uploadingChunks": "Lade {{count}} Dateien in {{total}} Teilen hoch..."
+    "maxFilesReached": "Maximal {{limit}} Dateien erlaubt",
+    "someFilesSkipped": "Nur {{allowed}} weitere Dateien erlaubt (Limit {{limit}})",
+    "tooManyFiles": "Maximal {{limit}} Dateien können gleichzeitig hochgeladen werden",
+    "limitInfo": "{{selected}} von {{limit}} Dateien ausgewählt ({{remaining}} verbleibend)",
+    "limitReached": "Upload-Limit erreicht ({{limit}} Dateien pro Vorgang)",
+    "uploadingChunks": "Lade {{count}} Dateien in {{total}} Teilen hoch...",
+    "mediaCategory": "Medienkategorie",
+    "uploadAction": "{{count}} Dateien hochladen"
   },
   "navigation": {
     "dashboard": "Dashboard",
@@ -511,6 +521,13 @@
     "selectAll": "Alle auswählen",
     "deselectAll": "Auswahl aufheben",
     "downloadSelected": "{{count}} ausgewählte herunterladen",
+    "deleteSelected": "Ausgewählte löschen",
+    "photosCount": "{{count}} Foto",
+    "photosCount_plural": "{{count}} Fotos",
+    "searchByFilename": "Nach Dateinamen suchen...",
+    "uncategorized": "Ohne Kategorie",
+    "sortAscending": "Aufsteigend sortieren",
+    "sortDescending": "Absteigend sortieren",
     "remaining": "verbleibend",
     "selectPhotosHint": "Tipp: Verwenden Sie Strg+Klick (Cmd+Klick auf Mac), um schnell mehrere Fotos auszuwählen",
     "filters": "Filter",
@@ -519,7 +536,12 @@
     "toggleMenu": "Menü umschalten",
     "allCategories": "Alle Kategorien",
     "categories": "Kategorien",
+    "mediaType": "Medien",
+    "allMedia": "Alle Medien",
+    "photosOnly": "Fotos",
+    "videosOnly": "Videos",
     "download": "Herunterladen",
+    "noMedia": "Noch keine Medien hochgeladen",
     "searchPlaceholder": "Fotos suchen...",
     "sortBy": "Sortieren nach",
     "sortByDate": "Nach Datum sortieren",
@@ -566,8 +588,8 @@
     "eventName": "Veranstaltungsname",
     "eventType": "Veranstaltungstyp",
     "eventDate": "Veranstaltungsdatum",
-    "hostEmail": "Gastgeber-E-Mail",
-    "hostName": "Name des Gastgebers",
+    "hostEmail": "E-Mail des Kunden",
+    "hostName": "Name des Kunden",
     "hostNamePlaceholder": "Max Mustermann",
     "adminEmail": "Admin-E-Mail",
     "expirationDate": "Ablaufdatum",
@@ -589,8 +611,8 @@
     "eventExpired": "Diese Veranstaltung ist abgelaufen",
     "eventExpiresIn": "Diese Veranstaltung läuft in {{days}} Tagen ab",
     "guestsNoAccess": "Gäste können nicht mehr auf die Galerie zugreifen. Erwägen Sie, diese Veranstaltung zu archivieren.",
-    "warningEmailsSent": "Warn-E-Mails wurden an den Gastgeber gesendet.",
-    "warningEmailsHaveBeenSent": "Warn-E-Mails wurden an den Gastgeber gesendet.",
+    "warningEmailsSent": "Warn-E-Mails wurden an den Kunden gesendet.",
+    "warningEmailsHaveBeenSent": "Warn-E-Mails wurden an den Kunden gesendet.",
     "extendSevenDays": "Um 7 Tage verlängern",
     "overview": "Übersicht",
     "photos": "Fotos",
@@ -631,7 +653,7 @@
     "organizeCategoriesInfo": "Organisieren Sie Ihre Fotos in Kategorien. Kategorien helfen Gästen, bestimmte Fototypen zu navigieren und zu finden.",
     "categoriesTip": "Tipp: Kategorien sind spezifisch für jede Veranstaltung. Sie können auch globale Kategorien in den Einstellungen erstellen.",
     "contactInformation": "Kontaktinformationen",
-    "hostEmailHelp": "Erhält Benachrichtigungen zur Galerie-Erstellung und zum Ablauf",
+    "hostEmailHelp": "Der Kunde erhält Benachrichtigungen zur Galerie-Erstellung und zum Ablauf",
     "adminEmailHelp": "Erhält Systembenachrichtigungen und Archivbestätigungen",
     "securityAccess": "Sicherheit & Zugriff",
     "galleryPassword": "Galerie-Passwort",
@@ -686,7 +708,7 @@
     "eventNamePlaceholder": "z.B. Max & Maria's Hochzeit",
     "welcomeMessageOptional": "Willkommensnachricht (Optional)",
     "welcomeMessagePlaceholder": "Willkommen zu unserem besonderen Tag! Laden Sie diese Erinnerungen gerne herunter und teilen Sie sie...",
-    "hostEmailPlaceholder": "gastgeber@beispiel.de",
+    "hostEmailPlaceholder": "kunde@beispiel.de",
     "adminEmailPlaceholder": "admin@beispiel.de",
     "securityAndAccess": "Sicherheit & Zugriff",
     "accessAndSecurity": "Zugriff & Sicherheit",
@@ -773,12 +795,16 @@
       "defaultExpirationHelp": "Wie lange Galerien standardmäßig aktiv bleiben",
       "maxFileSize": "Max. Dateigröße (MB)",
       "maxFileSizeHelp": "Maximale Größe pro hochgeladenem Foto",
+      "maxFilesPerUpload": "Max. Dateien pro Upload",
+      "maxFilesPerUploadHelp": "Maximale Anzahl an Fotos pro Upload-Vorgang (1-{{max}}).",
       "allowedFileTypes": "Erlaubte Dateitypen",
       "allowedFileTypesHelp": "Kommagetrennte Liste von Dateierweiterungen",
       "featureToggles": "Funktionsschalter",
       "enableWatermark": "Wasserzeichen auf Fotos aktivieren",
       "enableAnalytics": "Analytics-Tracking aktivieren",
       "enableRegistration": "Selbstregistrierung für Admins erlauben",
+      "enableShortGalleryUrls": "Kurze Galerie-Links verwenden",
+      "enableShortGalleryUrlsHelp": "Entfernt den Veranstaltungs-Slug aus neuen Freigabelinks und lässt bestehende Links weiterhin funktionieren.",
       "maintenanceMode": "Wartungsmodus aktivieren",
       "language": "Sprache",
       "defaultLanguage": "Standardsprache",
@@ -791,7 +817,18 @@
       "saveGeneralSettings": "Allgemeine Einstellungen speichern",
       "dateTimeFormat": "Datums- & Zeitformat",
       "dateFormat": "Datumsformat",
-      "dateFormatHelp": "Wie Daten in E-Mails und in der gesamten Anwendung angezeigt werden"
+      "dateFormatHelp": "Wie Daten in E-Mails und in der gesamten Anwendung angezeigt werden",
+      "accountSection": "Admin-Konto",
+      "accountUsername": "Admin-Benutzername",
+      "accountUsernameHelp": "Wird im Admin-Bereich angezeigt und in Aktivitätsprotokollen verwendet.",
+      "accountUsernameRequired": "Benutzername ist erforderlich",
+      "accountUsernameLength": "Benutzername muss mindestens 3 Zeichen lang sein",
+      "accountEmail": "Admin-E-Mail",
+      "accountEmailHelp": "Wird für die Anmeldung und für Sicherheitsbenachrichtigungen verwendet.",
+      "accountEmailRequired": "E-Mail-Adresse ist erforderlich",
+      "accountEmailInvalid": "Bitte eine gültige E-Mail-Adresse eingeben",
+      "accountSaveButton": "Kontodaten speichern",
+      "accountSaveSuccess": "Kontodaten aktualisiert"
     },
     "publicSite": {
       "tabLabel": "Öffentliche Seite",
@@ -875,7 +912,11 @@
       "sessionTimeout": "Sitzungs-Timeout (Minuten)",
       "sessionTimeoutHelp": "Admin-Sitzungs-Timeout in Minuten",
       "maxLoginAttempts": "Max. Anmeldeversuche",
-      "maxLoginAttemptsHelp": "Maximale fehlgeschlagene Anmeldeversuche vor Sperrung",
+      "maxLoginAttemptsHelp": "Maximale fehlgeschlagene Anmeldeversuche pro IP vor Sperrung",
+      "attemptWindowMinutes": "Versuchsfenster (Minuten)",
+      "attemptWindowMinutesHelp": "Zeitraum, in dem fehlgeschlagene Anmeldeversuche gezählt werden",
+      "lockoutDurationMinutes": "Sperrdauer (Minuten)",
+      "lockoutDurationMinutesHelp": "Wie lange Galerie oder Konto nach zu vielen Fehlern gesperrt bleiben",
       "enable2FA": "Zwei-Faktor-Authentifizierung für Admins aktivieren",
       "recaptchaSettings": "reCAPTCHA-Einstellungen",
       "enableRecaptcha": "reCAPTCHA für Anmeldeformulare aktivieren",
@@ -1318,7 +1359,34 @@
     "saveConfiguration": "Konfiguration speichern",
     "emailTemplates": "E-Mail-Vorlagen",
     "templateVariables": "Verfügbare Variablen",
-    "previewTemplate": "Vorlage anzeigen"
+    "previewTemplate": "Vorlage anzeigen",
+    "smtpSettings": "SMTP-Einstellungen",
+    "testEmailSuccess": "Test-E-Mail erfolgreich gesendet",
+    "saveSmtpSettings": "SMTP-Einstellungen speichern",
+    "testEmailSection": "E-Mail testen",
+    "beforeTesting": "Vor dem Testen:",
+    "saveSmtpFirst": "Speichern Sie zuerst Ihre SMTP-Einstellungen",
+    "ensureFirewall": "Stellen Sie sicher, dass Ihre Firewall ausgehende SMTP-Verbindungen erlaubt",
+    "gmailAppPassword": "Für Gmail verwenden Sie ein App-spezifisches Passwort",
+    "testEmailAddressLabel": "Test-E-Mail-Adresse",
+    "sendTestEmailButton": "Test-E-Mail senden",
+    "commonSmtpSettings": "Häufige SMTP-Einstellungen:",
+    "editTemplate": "Vorlage bearbeiten",
+    "templateName": "Vorlagenname",
+    "subjectLine": "Betreffzeile",
+    "emailBody": "E-Mail-Text",
+    "preview": "Vorschau",
+    "saveChanges": "Änderungen speichern",
+    "templates": "Vorlagen",
+    "variableHelp": "Verwenden Sie diese Variablen in Ihrer Vorlage. Sie werden beim Senden durch tatsächliche Werte ersetzt.",
+    "port": "Port",
+    "security": "Sicherheit",
+    "username": "Benutzername",
+    "password": "Passwort",
+    "enterPassword": "Passwort eingeben",
+    "required": "erforderlich",
+    "ignoreSslErrors": "SSL/TLS-Zertifikatfehler ignorieren",
+    "ignoreSslWarning": "Warnung: Das Deaktivieren der Zertifikatüberprüfung macht die Verbindung anfällig für Man-in-the-Middle-Angriffe. Aktivieren Sie dies nur, wenn Sie dem SMTP-Server vertrauen und die Sicherheitsrisiken verstehen."
   },
   "cms": {
     "title": "CMS-Seiten",
@@ -1362,8 +1430,8 @@
   },
   "validation": {
     "eventNameRequired": "Veranstaltungsname ist erforderlich",
-    "hostEmailRequired": "Gastgeber-E-Mail ist erforderlich",
-    "hostNameRequired": "Der Name des Gastgebers ist erforderlich",
+    "hostEmailRequired": "Die E-Mail des Kunden ist erforderlich",
+    "hostNameRequired": "Der Name des Kunden ist erforderlich",
     "adminEmailRequired": "Admin-E-Mail ist erforderlich",
     "invalidEmailFormat": "Ungültiges E-Mail-Format",
     "passwordRequired": "Passwort ist erforderlich",

frontend/src/i18n/locales/en.json

@@ -26,6 +26,9 @@
     "uploaded": "Uploaded",
     "photo": "photo",
     "photos": "photos",
+    "video": "video",
+    "videos": "videos",
+    "media": "media",
     "restore": "Restore",
     "actions": "Actions",
     "refresh": "Refresh",
@@ -48,21 +51,28 @@
     "noCategory": "No category",
     "eventSpecific": "(Event specific)",
     "clickToUpload": "Click to upload or drag and drop",
-    "fileRequirements": "JPEG, PNG or WebP (max 50MB per file)",
+    "fileRequirements": "JPEG, PNG or WebP (max 50MB per file, {{limit}} files per upload)",
+    "fileRequirementsMedia": "JPEG, PNG or WebP images, plus MP4/MOV/WEBM videos (max 50MB per file, {{limit}} files per upload)",
+    "unsupportedFiles": "Some files were skipped because the format is not supported (use JPEG/PNG/WebP/MP4/MOV/WEBM).",
     "selectedFiles": "Selected files",
     "uploading": "Uploading...",
     "uploadComplete": "Upload complete!",
     "uploadFailed": "Upload failed",
     "someFilesFailed": "Some files failed to upload",
     "uploadPhotos": "Upload Photos",
+    "uploadMedia": "Upload Photos & Videos",
     "importExternal": "Import from External Folder",
     "externalImportInfo": "All pictures from the selected folder will be imported.",
     "selectExternalFolder": "Select external folder under /external-media",
     "importFromSelectedFolder": "Import from selected folder",
-    "maxFilesReached": "Maximum 500 files allowed",
-    "someFilesSkipped": "Some files were skipped (500 file limit)",
-    "tooManyFiles": "Maximum 500 files can be uploaded at once",
-    "uploadingChunks": "Uploading {{count}} files in {{total}} batches..."
+    "maxFilesReached": "Maximum {{limit}} files allowed",
+    "someFilesSkipped": "Only {{allowed}} more files can be added (limit {{limit}})",
+    "tooManyFiles": "Maximum {{limit}} files can be uploaded at once",
+    "limitInfo": "{{selected}} of {{limit}} files selected ({{remaining}} remaining)",
+    "limitReached": "Upload limit reached ({{limit}} files per batch)",
+    "uploadingChunks": "Uploading {{count}} files in {{total}} batches...",
+    "mediaCategory": "Media category",
+    "uploadAction": "Upload {{count}} files"
   },
   "navigation": {
     "dashboard": "Dashboard",
@@ -176,6 +186,13 @@
     "selectAll": "Select All",
     "deselectAll": "Deselect All",
     "downloadSelected": "Download {{count}} Selected",
+    "deleteSelected": "Delete Selected",
+    "photosCount": "{{count}} photo",
+    "photosCount_plural": "{{count}} photos",
+    "searchByFilename": "Search by filename...",
+    "uncategorized": "Uncategorized",
+    "sortAscending": "Sort ascending",
+    "sortDescending": "Sort descending",
     "remaining": "remaining",
     "selectPhotosHint": "Tip: Use Ctrl+Click (Cmd+Click on Mac) to quickly select multiple photos",
     "filters": "Filters",
@@ -184,7 +201,12 @@
     "toggleMenu": "Toggle menu",
     "allCategories": "All Categories",
     "categories": "Categories",
+    "mediaType": "Media",
+    "allMedia": "All media",
+    "photosOnly": "Photos",
+    "videosOnly": "Videos",
     "download": "Download",
+    "noMedia": "No media uploaded yet",
     "searchPlaceholder": "Search photos...",
     "sortBy": "Sort By",
     "sortByDate": "Sort by Date",
@@ -225,7 +247,7 @@
     "eventNamePlaceholder": "e.g., John & Jane's Wedding",
     "welcomeMessageOptional": "Welcome Message (Optional)",
     "welcomeMessagePlaceholder": "Welcome to our special day! Feel free to download and share these memories...",
-    "hostEmailPlaceholder": "host@example.com",
+    "hostEmailPlaceholder": "customer@example.com",
     "adminEmailPlaceholder": "admin@example.com",
     "securityAndAccess": "Security & Access",
     "accessAndSecurity": "Access & Security",
@@ -251,8 +273,8 @@
     "eventName": "Event Name",
     "eventType": "Event Type",
     "eventDate": "Event Date",
-    "hostEmail": "Host Email",
-    "hostName": "Host Name",
+    "hostEmail": "Customer Email",
+    "hostName": "Customer Name",
     "hostNamePlaceholder": "John Smith",
     "adminEmail": "Admin Email",
     "adminNotificationEmail": "Admin Notification Email",
@@ -275,7 +297,7 @@
     "eventExpired": "This event has expired",
     "eventExpiresIn": "This event expires in {{days}} days",
     "guestsNoAccess": "Guests can no longer access the gallery. Consider archiving this event.",
-    "warningEmailsSent": "Warning emails have been sent to the host.",
+    "warningEmailsSent": "Warning emails have been sent to the customer.",
     "overview": "Overview",
     "photos": "Photos",
     "categories": "Categories",
@@ -315,7 +337,7 @@
     "organizeCategoriesInfo": "Organize your photos into categories. Categories help guests navigate and find specific types of photos.",
     "categoriesTip": "Tip: Categories are specific to each event. You can also create global categories in Settings.",
     "contactInformation": "Contact Information",
-    "hostEmailHelp": "Will receive gallery creation and expiration notifications",
+    "hostEmailHelp": "Customer will receive gallery creation and expiration notifications",
     "adminEmailHelp": "Will receive system notifications and archive confirmations",
     "securityAccess": "Security & Access",
     "galleryPassword": "Gallery Password",
@@ -406,13 +428,13 @@
     "tryAgain": "Try Again",
     "eventExpiredMessage": "This event has expired",
     "guestsCannotAccessGallery": "Guests can no longer access the gallery. Consider archiving this event.",
-    "warningEmailsHaveBeenSent": "Warning emails have been sent to the host.",
+    "warningEmailsHaveBeenSent": "Warning emails have been sent to the customer.",
     "extendSevenDays": "Extend 7 Days",
     "overview": "Overview",
     "eventInformation": "Event Information",
     "welcomeMessageLabel": "Welcome Message",
     "noWelcomeMessageSet": "No welcome message set",
-    "hostEmail": "Host Email",
+    "hostEmail": "Customer Email",
     "adminEmail": "Admin Email",
     "createdOn": "Created",
     "expires": "Expires",
@@ -453,12 +475,16 @@
       "defaultExpirationHelp": "How long galleries remain active by default",
       "maxFileSize": "Max File Size (MB)",
       "maxFileSizeHelp": "Maximum size per uploaded photo",
+      "maxFilesPerUpload": "Max Files per Upload",
+      "maxFilesPerUploadHelp": "Maximum number of photos allowed in a single upload batch (1-{{max}}).",
       "allowedFileTypes": "Allowed File Types",
       "allowedFileTypesHelp": "Comma-separated list of file extensions",
       "featureToggles": "Feature Toggles",
       "enableWatermark": "Enable watermark on photos",
       "enableAnalytics": "Enable analytics tracking",
       "enableRegistration": "Allow self-registration for admins",
+      "enableShortGalleryUrls": "Use short gallery URLs",
+      "enableShortGalleryUrlsHelp": "Removes the event slug from new share links while keeping existing links working.",
       "maintenanceMode": "Enable maintenance mode",
       "language": "Language",
       "defaultLanguage": "Default Language",
@@ -471,7 +497,18 @@
       "saveGeneralSettings": "Save General Settings",
       "dateTimeFormat": "Date & Time Format",
       "dateFormat": "Date Format",
-      "dateFormatHelp": "How dates are displayed in emails and throughout the application"
+      "dateFormatHelp": "How dates are displayed in emails and throughout the application",
+      "accountSection": "Admin Account",
+      "accountUsername": "Admin Username",
+      "accountUsernameHelp": "Displayed in the admin interface and used in activity logs.",
+      "accountUsernameRequired": "Username is required",
+      "accountUsernameLength": "Username must be at least 3 characters",
+      "accountEmail": "Admin Email",
+      "accountEmailHelp": "Used for login and receiving security notifications.",
+      "accountEmailRequired": "Email address is required",
+      "accountEmailInvalid": "Enter a valid email address",
+      "accountSaveButton": "Save account details",
+      "accountSaveSuccess": "Account details updated"
     },
     "publicSite": {
       "tabLabel": "Public Site",
@@ -555,7 +592,11 @@
       "sessionTimeout": "Session Timeout (minutes)",
       "sessionTimeoutHelp": "Admin session timeout in minutes",
       "maxLoginAttempts": "Max Login Attempts",
-      "maxLoginAttemptsHelp": "Maximum failed login attempts before lockout",
+      "maxLoginAttemptsHelp": "Maximum failed login attempts per IP before lockout",
+      "attemptWindowMinutes": "Attempt Window (minutes)",
+      "attemptWindowMinutesHelp": "How long to look back when counting failed login attempts",
+      "lockoutDurationMinutes": "Lockout Duration (minutes)",
+      "lockoutDurationMinutesHelp": "How long the gallery or account stays locked after too many failures",
       "enable2FA": "Enable two-factor authentication for admins",
       "recaptchaSettings": "reCAPTCHA Settings",
       "enableRecaptcha": "Enable reCAPTCHA for login forms",
@@ -967,8 +1008,8 @@
   },
   "validation": {
     "eventNameRequired": "Event name is required",
-    "hostEmailRequired": "Host email is required",
-    "hostNameRequired": "Host name is required",
+    "hostEmailRequired": "Customer email is required",
+    "hostNameRequired": "Customer name is required",
     "adminEmailRequired": "Admin email is required",
     "invalidEmailFormat": "Invalid email format",
     "passwordRequired": "Password is required",
@@ -1063,7 +1104,9 @@
     "enterPassword": "Enter password",
     "fromEmail": "From Email",
     "fromName": "From Name",
-    "required": "required"
+    "required": "required",
+    "ignoreSslErrors": "Ignore SSL/TLS certificate errors",
+    "ignoreSslWarning": "Warning: Disabling certificate verification makes the connection vulnerable to man-in-the-middle attacks. Only enable this if you trust the SMTP server and understand the security implications."
   },
   "cms": {
     "title": "CMS Pages",

frontend/src/pages/GalleryPage.tsx

@@ -11,13 +11,14 @@ import { useGalleryAuth, useTheme } from '../contexts';
 import { useGalleryInfo } from '../hooks/useGallery';
 import { GalleryView } from '../components/gallery';
 import { analyticsService } from '../services/analytics.service';
+import { galleryService } from '../services';
 import { api } from '../config/api';
 import { GALLERY_THEME_PRESETS } from '../types/theme.types';
 import { buildResourceUrl } from '../utils/url';
 import { isGalleryPublic, normalizeRequirePassword } from '../utils/accessControl';
 
 export const GalleryPage: React.FC = () => {
-  const { slug, token } = useParams<{ slug: string; token?: string }>();
+  const { slug: rawSlug, token: rawToken } = useParams<{ slug: string; token?: string }>();
   const { isAuthenticated, login, event } = useGalleryAuth();
   const { t, i18n } = useTranslation();
   const { format } = useLocalizedDate();
@@ -27,10 +28,82 @@ export const GalleryPage: React.FC = () => {
   const [loginError, setLoginError] = useState<string | null>(null);
   const [recaptchaToken, setRecaptchaToken] = useState<string | null>(null);
   const [autoLoginAttempted, setAutoLoginAttempted] = useState(false);
+  const [resolvedSlug, setResolvedSlug] = useState<string | null>(() => {
+    if (rawSlug && !rawToken && /^[0-9a-fA-F]{32}$/.test(rawSlug)) {
+      return null;
+    }
+    return rawSlug || null;
+  });
+  const [resolvedToken, setResolvedToken] = useState<string | undefined>(rawToken);
+  const [isResolvingIdentifier, setIsResolvingIdentifier] = useState<boolean>(() =>
+    Boolean(rawSlug && !rawToken && /^[0-9a-fA-F]{32}$/.test(rawSlug))
+  );
+  const [identifierError, setIdentifierError] = useState<string | null>(null);
+  const lastResolvedIdentifier = React.useRef<string | null>(null);
 
-  // Fetch gallery info (public data)
-  const { data: galleryInfo, isLoading: isLoadingInfo, error: infoError } = useGalleryInfo(slug!, token);
+  React.useEffect(() => {
+    let cancelled = false;
+
+    const looksLikeToken = Boolean(rawSlug && !rawToken && /^[0-9a-fA-F]{32}$/.test(rawSlug));
+
+    if (!rawSlug) {
+      lastResolvedIdentifier.current = null;
+      setResolvedSlug(null);
+      setResolvedToken(rawToken);
+      setIsResolvingIdentifier(false);
+      setIdentifierError(null);
+    } else if (!looksLikeToken) {
+      lastResolvedIdentifier.current = null;
+      setResolvedSlug(rawSlug);
+      setResolvedToken(rawToken);
+      setIsResolvingIdentifier(false);
+      setIdentifierError(null);
+    } else if (lastResolvedIdentifier.current !== rawSlug) {
+      setIsResolvingIdentifier(true);
+      setIdentifierError(null);
+
+      galleryService.resolveIdentifier(rawSlug)
+        .then((data) => {
+          if (cancelled) return;
+          lastResolvedIdentifier.current = rawSlug;
+          setResolvedSlug(data.slug);
+          setResolvedToken(data.token);
+          setIdentifierError(null);
+        })
+        .catch((error: any) => {
+          if (cancelled) return;
+          lastResolvedIdentifier.current = rawSlug;
+          setResolvedSlug(null);
+          setResolvedToken(undefined);
+          const message = error?.response?.data?.error || 'Unable to resolve gallery link';
+          setIdentifierError(message);
+        })
+        .finally(() => {
+          if (!cancelled) {
+            setIsResolvingIdentifier(false);
+          }
+        });
+    } else {
+      setIsResolvingIdentifier(false);
+    }
+
+    return () => {
+      cancelled = true;
+    };
+  }, [rawSlug, rawToken]);
+
+  const canFetchGalleryInfo = Boolean(resolvedSlug) && !isResolvingIdentifier;
+  const {
+    data: galleryInfo,
+    isLoading: isLoadingInfoQuery,
+    error: infoError
+  } = useGalleryInfo(canFetchGalleryInfo ? resolvedSlug ?? undefined : undefined, resolvedToken, canFetchGalleryInfo);
+  const isLoadingInfo = isLoadingInfoQuery || isResolvingIdentifier;
   const requiresPassword = normalizeRequirePassword(galleryInfo?.requires_password, true);
+
+  React.useEffect(() => {
+    setAutoLoginAttempted(false);
+  }, [resolvedSlug]);
   
   // Fetch branding settings
   const { data: settingsData } = useQuery({
@@ -91,14 +164,14 @@ export const GalleryPage: React.FC = () => {
   }, [galleryInfo, settingsData, isAuthenticated, setTheme]);
 
   React.useEffect(() => {
-    if (!slug) {
+    if (!resolvedSlug || isResolvingIdentifier) {
       return;
     }
 
     if (galleryInfo && isGalleryPublic(galleryInfo.requires_password) && !isAuthenticated && !autoLoginAttempted) {
       setAutoLoginAttempted(true);
       setIsLoggingIn(true);
-      login(slug, '')
+      login(resolvedSlug, '')
         .then(() => {
           setLoginError(null);
         })
@@ -112,7 +185,7 @@ export const GalleryPage: React.FC = () => {
           setIsLoggingIn(false);
         });
     }
-  }, [galleryInfo, isAuthenticated, autoLoginAttempted, login, slug]);
+  }, [galleryInfo, isAuthenticated, autoLoginAttempted, login, resolvedSlug, isResolvingIdentifier]);
 
   // Calculate days until expiration
   const daysUntilExpiration = galleryInfo
@@ -131,11 +204,16 @@ export const GalleryPage: React.FC = () => {
     try {
       setIsLoggingIn(true);
       setLoginError(null);
-      await login(slug!, requiresPassword ? password : '', recaptchaToken);
+      if (!resolvedSlug) {
+        setLoginError(t('errors.galleryNotFound'));
+        return;
+      }
+
+      await login(resolvedSlug, requiresPassword ? password : '', recaptchaToken);
       
       if (requiresPassword) {
         analyticsService.trackGalleryEvent('password_entry', {
-          gallery: slug,
+          gallery: resolvedSlug,
           success: true
         });
       }
@@ -158,7 +236,7 @@ export const GalleryPage: React.FC = () => {
       // Track failed password entry
       if (requiresPassword) {
         analyticsService.trackGalleryEvent('password_entry', {
-          gallery: slug,
+          gallery: resolvedSlug ?? rawSlug ?? 'unknown',
           success: false,
           statusCode
         });
@@ -182,6 +260,59 @@ export const GalleryPage: React.FC = () => {
     );
   }
 
+  if (identifierError && !resolvedSlug && !isResolvingIdentifier) {
+    return (
+      <div className="min-h-screen" style={{ backgroundColor: 'var(--color-background, #fafafa)' }}>
+        <div className="min-h-screen flex flex-col">
+          {settingsData?.branding_logo_url && (
+            <div className="p-8 text-center">
+              <img
+                src={buildResourceUrl(settingsData.branding_logo_url)}
+                alt={settingsData.branding_company_name || 'Company Logo'}
+                className="h-16 w-auto object-contain mx-auto"
+              />
+            </div>
+          )}
+
+          <div className="flex-1 flex items-center justify-center">
+            <Card className="max-w-md w-full mx-4">
+              <CardContent className="text-center py-12">
+                <AlertCircle className="w-16 h-16 text-red-500 mx-auto mb-4" />
+                <h2 className="text-xl font-semibold mb-2">
+                  {t('errors.galleryNotFound')}
+                </h2>
+                <p className="text-neutral-600">
+                  {identifierError}
+                </p>
+              </CardContent>
+            </Card>
+          </div>
+
+          <div className="p-8 text-center">
+            <div className="flex items-center justify-center gap-4">
+              <Link
+                to="/impressum"
+                className="text-xs text-neutral-500 hover:text-neutral-700 transition-colors"
+              >
+                {t('legal.impressum')}
+              </Link>
+              <span className="text-xs text-neutral-400">|</span>
+              <Link
+                to="/datenschutz"
+                className="text-xs text-neutral-500 hover:text-neutral-700 transition-colors"
+              >
+                {t('legal.datenschutz')}
+              </Link>
+            </div>
+            <p className="text-xs mt-2 text-neutral-500">
+              Powered by <span className="font-semibold">PicPeak</span>
+            </p>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
   // Show error state
   if (infoError) {
     // Check if it's an archived gallery error
@@ -299,9 +430,11 @@ export const GalleryPage: React.FC = () => {
     );
   }
 
+  const gallerySlugForView = resolvedSlug ?? rawSlug ?? '';
+
   // Show gallery view if authenticated
   if (isAuthenticated && event) {
-    return <GalleryView slug={slug!} event={event} />;
+    return <GalleryView slug={gallerySlugForView} event={event} />;
   }
 
   // Show login form

frontend/src/pages/admin/AdminLoginPage.tsx

@@ -68,6 +68,7 @@ export const AdminLoginPage: React.FC = () => {
 
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
+    toast.dismiss();
     
     if (!validateForm()) {
       return;

frontend/src/pages/admin/BrandingPage.tsx

@@ -23,6 +23,14 @@ export const BrandingPage: React.FC = () => {
     watermark_size: 15,
     watermark_logo_url: '',
     favicon_url: '',
+    logo_url: '',
+    logo_size: 'medium',
+    logo_max_height: 48,
+    logo_position: 'left',
+    logo_display_header: true,
+    logo_display_hero: true,
+    logo_display_mode: 'logo_and_text',
+    hide_powered_by: false,
   });
 
   const [currentTheme, setCurrentTheme] = useState<ThemeConfig>(theme);
@@ -508,6 +516,27 @@ export const BrandingPage: React.FC = () => {
             </div>
           </div>
 
+          {/* White Label Settings */}
+          <div className="mt-6 pt-6 border-t border-neutral-200">
+            <h3 className="text-md font-semibold text-neutral-900 mb-4">{t('branding.whiteLabel', 'White Label')}</h3>
+            <label className="flex items-center gap-3 cursor-pointer">
+              <input
+                type="checkbox"
+                checked={brandingSettings.hide_powered_by === true}
+                onChange={(e) => handleBrandingChange('hide_powered_by', e.target.checked)}
+                className="rounded border-neutral-300 text-primary-600 focus:ring-primary-500"
+              />
+              <div>
+                <span className="text-sm font-medium text-neutral-900">
+                  {t('branding.hidePoweredBy', 'Hide "Powered by PicPeak" branding')}
+                </span>
+                <p className="text-xs text-neutral-600">
+                  {t('branding.hidePoweredByHelp', 'Remove the PicPeak attribution from gallery footers for a fully white-labeled experience')}
+                </p>
+              </div>
+            </label>
+          </div>
+
           <div className="mt-6 pt-6 border-t border-neutral-200">
             <label className="flex items-center gap-3 cursor-pointer">
               <input

frontend/src/pages/admin/CreateEventPage.tsx

@@ -25,7 +25,7 @@ interface FormData {
   event_type: string;
   event_name: string;
   event_date: string;
-  host_email: string;
+  customer_email: string;
   admin_email: string;
   require_password: boolean;
   password: string;
@@ -122,7 +122,7 @@ export const CreateEventPage: React.FC = () => {
     event_type: 'wedding',
     event_name: '',
     event_date: format(new Date(), 'yyyy-MM-dd'),
-    host_email: '',
+    customer_email: '',
     admin_email: '',
     require_password: true,
     password: '',
@@ -198,10 +198,10 @@ export const CreateEventPage: React.FC = () => {
       newErrors.event_name = t('validation.eventNameRequired');
     }
 
-    if (!formData.host_email) {
-      newErrors.host_email = t('validation.hostEmailRequired');
-    } else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(formData.host_email)) {
-      newErrors.host_email = t('validation.invalidEmailFormat');
+    if (!formData.customer_email) {
+      newErrors.customer_email = t('validation.hostEmailRequired');
+    } else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(formData.customer_email)) {
+      newErrors.customer_email = t('validation.invalidEmailFormat');
     }
 
     if (!formData.admin_email) {
@@ -245,7 +245,8 @@ export const CreateEventPage: React.FC = () => {
       event_type: formData.event_type,
       event_name: formData.event_name,
       event_date: formData.event_date,
-      host_email: formData.host_email,
+      customer_name: formData.customer_email.split('@')[0],
+      customer_email: formData.customer_email,
       admin_email: formData.admin_email,
       require_password: formData.require_password,
       password: formData.require_password ? formData.password : undefined,
@@ -388,17 +389,17 @@ export const CreateEventPage: React.FC = () => {
           <h2 className="text-lg font-semibold text-neutral-900 mb-4">{t('events.contactInformation')}</h2>
           
           <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-            {/* Host Email */}
+            {/* Customer Email */}
             <div>
-              <label htmlFor="host_email" className="block text-sm font-medium text-neutral-700 mb-1">
+              <label htmlFor="customer_email" className="block text-sm font-medium text-neutral-700 mb-1">
                 {t('events.hostEmail')}
               </label>
               <Input
-                id="host_email"
+                id="customer_email"
                 type="email"
-                value={formData.host_email}
-                onChange={handleInputChange('host_email')}
-                error={errors.host_email}
+                value={formData.customer_email}
+                onChange={handleInputChange('customer_email')}
+                error={errors.customer_email}
                 placeholder={t('events.hostEmailPlaceholder')}
                 leftIcon={<Mail className="w-5 h-5 text-neutral-400" />}
               />

frontend/src/pages/admin/CreateEventPageEnhanced.tsx

@@ -27,8 +27,8 @@ interface FormData {
   event_type: string;
   event_name: string;
   event_date: string;
-  host_name: string;
-  host_email: string;
+  customer_name: string;
+  customer_email: string;
   admin_email: string;
   require_password: boolean;
   password: string;
@@ -86,8 +86,8 @@ export const CreateEventPageEnhanced: React.FC = () => {
     event_type: 'wedding',
     event_name: '',
     event_date: new Date().toISOString().split('T')[0], // Initialize with ISO date format
-    host_name: '',
-    host_email: '',
+    customer_name: '',
+    customer_email: '',
     admin_email: '',
     require_password: true,
     password: '',
@@ -184,14 +184,14 @@ export const CreateEventPageEnhanced: React.FC = () => {
       newErrors.event_date = t('validation.eventDateRequired');
     }
 
-    if (!formData.host_name) {
-      newErrors.host_name = t('validation.hostNameRequired');
+    if (!formData.customer_name) {
+      newErrors.customer_name = t('validation.hostNameRequired');
     }
 
-    if (!formData.host_email) {
-      newErrors.host_email = t('validation.hostEmailRequired');
-    } else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(formData.host_email)) {
-      newErrors.host_email = t('validation.invalidEmailFormat');
+    if (!formData.customer_email) {
+      newErrors.customer_email = t('validation.hostEmailRequired');
+    } else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(formData.customer_email)) {
+      newErrors.customer_email = t('validation.invalidEmailFormat');
     }
 
     if (!formData.admin_email) {
@@ -236,8 +236,8 @@ export const CreateEventPageEnhanced: React.FC = () => {
       event_type: formData.event_type,
       event_name: formData.event_name,
       event_date: formData.event_date,
-      host_name: formData.host_name,
-      host_email: formData.host_email,
+      customer_name: formData.customer_name,
+      customer_email: formData.customer_email,
       admin_email: formData.admin_email,
       require_password: formData.require_password,
       password: formData.require_password ? formData.password : undefined,
@@ -472,9 +472,9 @@ export const CreateEventPageEnhanced: React.FC = () => {
                 <Input
                   label={t('events.hostName')}
                   placeholder={t('events.hostNamePlaceholder')}
-                  value={formData.host_name}
-                  onChange={handleInputChange('host_name')}
-                  error={errors.host_name}
+                  value={formData.customer_name}
+                  onChange={handleInputChange('customer_name')}
+                  error={errors.customer_name}
                   leftIcon={<Calendar className="w-5 h-5" />}
                 />
 
@@ -482,9 +482,9 @@ export const CreateEventPageEnhanced: React.FC = () => {
                   type="email"
                   label={t('events.hostEmail')}
                   placeholder={t('events.hostEmailPlaceholder')}
-                  value={formData.host_email}
-                  onChange={handleInputChange('host_email')}
-                  error={errors.host_email}
+                  value={formData.customer_email}
+                  onChange={handleInputChange('customer_email')}
+                  error={errors.customer_email}
                   leftIcon={<Mail className="w-5 h-5" />}
                 />
               </div>

frontend/src/pages/admin/EmailConfigPage.tsx

@@ -1,8 +1,8 @@
 import React, { useState } from 'react';
-import { 
-  Mail, 
-  Save, 
-  Send, 
+import {
+  Mail,
+  Save,
+  Send,
   Server,
   Lock,
   User,
@@ -10,6 +10,7 @@ import {
   CheckCircle,
   Eye,
   EyeOff,
+  ShieldAlert,
 } from 'lucide-react';
 import { toast } from 'react-toastify';
 
@@ -107,7 +108,8 @@ export const EmailConfigPage: React.FC = () => {
     smtp_user: '',
     smtp_pass: '',
     from_email: '',
-    from_name: 'Photo Sharing'
+    from_name: 'Photo Sharing',
+    tls_reject_unauthorized: true
   });
 
   // Fetch SMTP config
@@ -342,7 +344,7 @@ export const EmailConfigPage: React.FC = () => {
                     placeholder="587"
                   />
                 </div>
-                
+
                 <div>
                   <label className="block text-sm font-medium text-neutral-700 mb-1">
                     {t('email.security')}
@@ -358,6 +360,30 @@ export const EmailConfigPage: React.FC = () => {
                 </div>
               </div>
 
+              {/* Ignore SSL Certificate Errors */}
+              <div className="mt-2">
+                <label className="flex items-center gap-3 cursor-pointer">
+                  <input
+                    type="checkbox"
+                    checked={!smtpConfig.tls_reject_unauthorized}
+                    onChange={(e) => setSmtpConfig(prev => ({ ...prev, tls_reject_unauthorized: !e.target.checked }))}
+                    className="w-4 h-4 text-primary-600 border-neutral-300 rounded focus:ring-primary-500"
+                  />
+                  <span className="text-sm font-medium text-neutral-700">
+                    {t('email.ignoreSslErrors')}
+                  </span>
+                </label>
+                {!smtpConfig.tls_reject_unauthorized && (
+                  <div className="mt-2 p-3 bg-amber-50 border border-amber-200 rounded-lg">
+                    <div className="flex items-start gap-2">
+                      <ShieldAlert className="w-4 h-4 text-amber-600 flex-shrink-0 mt-0.5" />
+                      <p className="text-xs text-amber-800">
+                        {t('email.ignoreSslWarning')}
+                      </p>
+                    </div>
+                  </div>
+                )}</div>
+
               <div>
                 <label className="block text-sm font-medium text-neutral-700 mb-1">
                   {t('email.username')}

frontend/src/pages/admin/EventDetailsPage.tsx

@@ -1,4 +1,4 @@
-import React, { useState, useEffect } from 'react';
+import React, { useState, useEffect, useMemo } from 'react';
 import { useParams, useNavigate } from 'react-router-dom';
 import { useTranslation } from 'react-i18next';
 import { 
@@ -122,7 +122,7 @@ export const EventDetailsPage: React.FC = () => {
     allow_user_uploads: boolean;
     upload_category_id: number | null;
     hero_photo_id: number | null;
-    host_name: string;
+    customer_name: string;
     source_mode: 'managed' | 'reference';
     external_path: string;
     require_password: boolean;
@@ -138,7 +138,7 @@ export const EventDetailsPage: React.FC = () => {
     allow_user_uploads: false,
     upload_category_id: null,
     hero_photo_id: null,
-    host_name: '',
+    customer_name: '',
     source_mode: 'managed',
     external_path: '',
     require_password: true,
@@ -208,6 +208,26 @@ export const EventDetailsPage: React.FC = () => {
     enabled: !!id && (activeTab === 'photos' || isEditing),
   });
 
+  const mediaTypes = useMemo(() => {
+    const types = new Set<'photo' | 'video'>();
+    photos.forEach((p: any) => {
+      const mediaType = (p.media_type as 'photo' | 'video' | undefined)
+        || ((p.mime_type && String(p.mime_type).startsWith('video/')) || p.type === 'video' ? 'video' : 'photo');
+      if (mediaType === 'video' || mediaType === 'photo') {
+        types.add(mediaType);
+      }
+    });
+    return types;
+  }, [photos]);
+
+  const showMediaFilter = mediaTypes.has('photo') && mediaTypes.has('video');
+
+  useEffect(() => {
+    if (!showMediaFilter && photoFilters.media_type) {
+      setPhotoFilters(prev => ({ ...prev, media_type: undefined }));
+    }
+  }, [showMediaFilter, photoFilters.media_type]);
+
   // Fetch categories for the event
   const { data: categories = [] } = useQuery({
     queryKey: ['admin-event-categories', id],
@@ -304,7 +324,7 @@ export const EventDetailsPage: React.FC = () => {
       allow_user_uploads: event.allow_user_uploads || false,
       upload_category_id: event.upload_category_id || null,
       hero_photo_id: event.hero_photo_id || null,
-      host_name: event.host_name || '',
+      customer_name: event.customer_name || '',
       source_mode: event.source_mode === 'reference' ? 'reference' : 'managed',
       external_path: event.external_path || '',
       require_password: normalizeRequirePassword(event.require_password),
@@ -411,8 +431,8 @@ export const EventDetailsPage: React.FC = () => {
     updateData.external_path = editForm.source_mode === 'reference'
       ? externalPathToSave
       : null;
-    if (editForm.host_name !== undefined && editForm.host_name !== null) {
-      updateData.host_name = editForm.host_name;
+    if (editForm.customer_name !== undefined && editForm.customer_name !== null) {
+      updateData.customer_name = editForm.customer_name;
     }
 
     if (editForm.new_password) {
@@ -687,8 +707,8 @@ export const EventDetailsPage: React.FC = () => {
                   </label>
                   <Input
                     type="text"
-                    value={editForm.host_name}
-                    onChange={(e) => setEditForm(prev => ({ ...prev, host_name: e.target.value }))}
+                    value={editForm.customer_name}
+                    onChange={(e) => setEditForm(prev => ({ ...prev, customer_name: e.target.value }))}
                     placeholder={t('events.hostNamePlaceholder')}
                   />
                 </div>
@@ -903,14 +923,14 @@ export const EventDetailsPage: React.FC = () => {
                 <div>
                   <dt className="text-sm font-medium text-neutral-500">{t('events.hostName')}</dt>
                   <dd className="mt-1 text-sm text-neutral-900">
-                    {event.host_name || <span className="text-neutral-400">{t('common.notSet')}</span>}
+                    {event.customer_name || <span className="text-neutral-400">{t('common.notSet')}</span>}
                   </dd>
                 </div>
                 
                 <div className="grid grid-cols-2 gap-4">
                   <div>
                     <dt className="text-sm font-medium text-neutral-500">{t('events.hostEmail')}</dt>
-                    <dd className="mt-1 text-sm text-neutral-900">{event.host_email}</dd>
+                  <dd className="mt-1 text-sm text-neutral-900">{event.customer_email}</dd>
                   </div>
                   
                   <div>
@@ -1144,22 +1164,9 @@ export const EventDetailsPage: React.FC = () => {
                     }
                   }
                 }}
-                isPreviewMode={false}
+                isPreviewMode={true}
                 showGalleryLayouts={true}
-                onApply={async (theme, { presetName }) => {
-                  const resolvedPreset = presetName || 'custom';
-                  setCurrentTheme(theme);
-                  setCurrentPresetName(resolvedPreset);
-
-                  const themeValue = resolvedPreset !== 'custom'
-                    ? resolvedPreset
-                    : JSON.stringify(theme);
-
-                  setEditForm(prev => ({ ...prev, color_theme: themeValue }));
-
-                  await applyThemeMutation.mutateAsync({ theme, presetName: resolvedPreset });
-                }}
-                isApplying={applyThemeMutation.isPending}
+                hideActions={true}
               />
             </Card>
           )}
@@ -1250,6 +1257,12 @@ export const EventDetailsPage: React.FC = () => {
             onCategoryChange={(categoryId) => setPhotoFilters(prev => ({ ...prev, category_id: categoryId }))}
             onSearchChange={(search) => setPhotoFilters(prev => ({ ...prev, search }))}
             onSortChange={(sort, order) => setPhotoFilters(prev => ({ ...prev, sort, order }))}
+            mediaType={photoFilters.media_type || 'all'}
+            onMediaTypeChange={(mediaType) => setPhotoFilters(prev => ({
+              ...prev,
+              media_type: mediaType === 'all' ? undefined : mediaType
+            }))}
+            showMediaFilter={showMediaFilter}
           />
 
           {/* Actions Bar */}

frontend/src/pages/admin/EventsListPage.tsx

@@ -159,7 +159,7 @@ export const EventsListPage: React.FC = () => {
       events = events.filter(e => 
         e.event_name.toLowerCase().includes(term) ||
         e.event_type.toLowerCase().includes(term) ||
-        e.host_email.toLowerCase().includes(term)
+        (e.customer_email || '').toLowerCase().includes(term)
       );
     }
     
@@ -428,7 +428,7 @@ export const EventsListPage: React.FC = () => {
                       <td className="px-6 py-4">
                         <div>
                           <p className="text-sm font-medium text-neutral-900">{event.event_name}</p>
-                          <p className="text-xs text-neutral-500">{event.host_email}</p>
+                          <p className="text-xs text-neutral-500">{event.customer_email}</p>
                           <div className="mt-1">
                             <span
                               className={`inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium ${

frontend/src/pages/admin/SettingsPage.tsx

@@ -1,6 +1,6 @@
-import React, { useEffect, useState } from 'react';
-import { 
-  Save, 
+import React, { useState } from 'react';
+import {
+  Save,
   Database,
   Globe,
   Key,
@@ -10,7 +10,9 @@ import {
   CheckCircle,
   Clock,
   HardDrive,
-  Activity
+  Activity,
+  Mail,
+  User
 } from 'lucide-react';
 import { toast } from 'react-toastify';
 
@@ -19,11 +21,12 @@ import { CategoryManager } from '../../components/admin/CategoryManager';
 import { WordFilterManager } from '../../components/admin/WordFilterManager';
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import { settingsService } from '../../services/settings.service';
-import { authService } from '../../services/auth.service';
+import { adminService } from '../../services/admin.service';
 import { useTranslation } from 'react-i18next';
 import { useAdminAuth } from '../../contexts';
 
 const BYTES_PER_GB = 1024 * 1024 * 1024;
+const MAX_FILES_PER_UPLOAD_LIMIT = 2000;
 
 const toBoolean = (value: unknown, defaultValue = false): boolean => {
   if (value === undefined || value === null) {
@@ -58,23 +61,7 @@ export const SettingsPage: React.FC = () => {
   const [activeTab, setActiveTab] = useState<'general' | 'status' | 'security' | 'categories' | 'analytics' | 'moderation'>('general');
   const queryClient = useQueryClient();
   const { t, i18n } = useTranslation();
-  const { user, updateProfile: updateAuthProfile } = useAdminAuth();
-
-  const [profileForm, setProfileForm] = useState({
-    username: user?.username ?? '',
-    email: user?.email ?? '',
-  });
-  const [profileError, setProfileError] = useState<string | null>(null);
-
-  useEffect(() => {
-    if (user) {
-      setProfileForm({ username: user.username, email: user.email });
-    }
-  }, [user]);
-
-  const isProfileDirty = user
-    ? (profileForm.username !== user.username || profileForm.email !== user.email)
-    : Boolean(profileForm.username.trim() || profileForm.email.trim());
+  const { updateUserProfile } = useAdminAuth();
 
   // Fetch settings
   const { data: settings, isLoading } = useQuery({
@@ -82,6 +69,11 @@ export const SettingsPage: React.FC = () => {
     queryFn: () => settingsService.getAllSettings(),
   });
 
+  const { data: adminProfile, isLoading: adminProfileLoading } = useQuery({
+    queryKey: ['admin-profile'],
+    queryFn: () => adminService.getAdminProfile(),
+  });
+
   // Fetch storage info
   const { data: storageInfo } = useQuery({
     queryKey: ['admin-storage-info'],
@@ -116,11 +108,13 @@ export const SettingsPage: React.FC = () => {
     site_url: '',
     default_expiration_days: 30,
     max_file_size_mb: 50,
+    max_files_per_upload: 500,
     allowed_file_types: 'jpg,jpeg,png,gif,webp',
     enable_watermark: false,
     enable_analytics: true,
     enable_registration: false,
     maintenance_mode: false,
+    short_gallery_urls: false,
     default_language: 'en',
     date_format: { format: 'dd/MM/yyyy', locale: 'en-GB' }
   });
@@ -132,6 +126,8 @@ export const SettingsPage: React.FC = () => {
     enable_2fa: false,
     session_timeout_minutes: 60,
     max_login_attempts: 5,
+    attempt_window_minutes: 15,
+    lockout_duration_minutes: 30,
     enable_recaptcha: false,
     recaptcha_site_key: '',
     recaptcha_secret_key: ''
@@ -150,6 +146,11 @@ export const SettingsPage: React.FC = () => {
   const [capacityOverrideGb, setCapacityOverrideGb] = useState<number | ''>('');
   const [availableOverrideGb, setAvailableOverrideGb] = useState<number | ''>('');
   const [overrideDirty, setOverrideDirty] = useState(false);
+  const [accountForm, setAccountForm] = useState({
+    username: '',
+    email: ''
+  });
+  const [accountErrors, setAccountErrors] = useState<Record<string, string>>({});
 
   React.useEffect(() => {
     if (settings) {
@@ -163,11 +164,16 @@ export const SettingsPage: React.FC = () => {
         site_url: settings.general_site_url || '',
         default_expiration_days: toNumber(settings.general_default_expiration_days, 30),
         max_file_size_mb: toNumber(settings.general_max_file_size_mb, 50),
+        max_files_per_upload: Math.min(
+          MAX_FILES_PER_UPLOAD_LIMIT,
+          Math.max(1, toNumber(settings.general_max_files_per_upload, 500))
+        ),
         allowed_file_types: settings.general_allowed_file_types || 'jpg,jpeg,png,gif,webp',
         enable_watermark: toBoolean(settings.general_enable_watermark, false),
         enable_analytics: toBoolean(settings.general_enable_analytics, true),
         enable_registration: toBoolean(settings.general_enable_registration, false),
         maintenance_mode: toBoolean(settings.general_maintenance_mode, false),
+        short_gallery_urls: toBoolean(settings.general_short_gallery_urls, false),
         default_language: settings.general_default_language || 'en',
         date_format: settings.general_date_format 
           ? (typeof settings.general_date_format === 'string'
@@ -183,6 +189,8 @@ export const SettingsPage: React.FC = () => {
         enable_2fa: toBoolean(settings.security_enable_2fa, false),
         session_timeout_minutes: toNumber(settings.security_session_timeout_minutes, 60),
         max_login_attempts: toNumber(settings.security_max_login_attempts, 5),
+        attempt_window_minutes: toNumber(settings.security_attempt_window_minutes, 15),
+        lockout_duration_minutes: toNumber(settings.security_lockout_duration_minutes, 30),
         enable_recaptcha: toBoolean(settings.security_enable_recaptcha, false),
         recaptcha_site_key: settings.security_recaptcha_site_key ?? '',
         recaptcha_secret_key: settings.security_recaptcha_secret_key ?? ''
@@ -198,6 +206,15 @@ export const SettingsPage: React.FC = () => {
     }
   }, [settings, i18n]);
 
+  React.useEffect(() => {
+    if (adminProfile) {
+      setAccountForm({
+        username: adminProfile.username || '',
+        email: adminProfile.email || ''
+      });
+    }
+  }, [adminProfile]);
+
   React.useEffect(() => {
     if (!settings || overrideDirty) {
       return;
@@ -318,6 +335,83 @@ export const SettingsPage: React.FC = () => {
     }
   });
 
+  const updateAdminProfileMutation = useMutation({
+    mutationFn: (payload: { username: string; email: string }) => adminService.updateAdminProfile(payload),
+    onSuccess: (updatedUser) => {
+      toast.success(t('settings.general.accountSaveSuccess'));
+      setAccountErrors({});
+      setAccountForm({
+        username: updatedUser.username,
+        email: updatedUser.email
+      });
+      updateUserProfile(updatedUser);
+      queryClient.invalidateQueries({ queryKey: ['admin-profile'] });
+    },
+    onError: (error: any) => {
+      if (error.response?.data?.errors) {
+        const fieldErrors: Record<string, string> = {};
+        for (const err of error.response.data.errors) {
+          if (err.path === 'username') {
+            fieldErrors.username = err.msg;
+          }
+          if (err.path === 'email') {
+            fieldErrors.email = err.msg;
+          }
+        }
+        setAccountErrors(fieldErrors);
+        return;
+      }
+
+      if (error.response?.data?.error) {
+        toast.error(error.response.data.error);
+      } else {
+        toast.error(t('toast.saveError'));
+      }
+    }
+  });
+
+  const handleAccountChange = (field: 'username' | 'email') => (event: React.ChangeEvent<HTMLInputElement>) => {
+    const value = event.target.value;
+    setAccountForm((prev) => ({ ...prev, [field]: value }));
+    if (accountErrors[field]) {
+      setAccountErrors((prev) => ({ ...prev, [field]: '' }));
+    }
+  };
+
+  const handleAccountSubmit = (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+
+    if (updateAdminProfileMutation.isPending) {
+      return;
+    }
+
+    const trimmedUsername = accountForm.username.trim();
+    const trimmedEmail = accountForm.email.trim();
+    const errors: Record<string, string> = {};
+
+    if (!trimmedUsername) {
+      errors.username = t('settings.general.accountUsernameRequired');
+    } else if (trimmedUsername.length < 3) {
+      errors.username = t('settings.general.accountUsernameLength');
+    }
+
+    if (!trimmedEmail) {
+      errors.email = t('settings.general.accountEmailRequired');
+    } else if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(trimmedEmail)) {
+      errors.email = t('settings.general.accountEmailInvalid');
+    }
+
+    if (Object.keys(errors).length > 0) {
+      setAccountErrors(errors);
+      return;
+    }
+
+    updateAdminProfileMutation.mutate({
+      username: trimmedUsername,
+      email: trimmedEmail
+    });
+  };
+
   const saveSoftLimitMutation = useMutation({
     mutationFn: async (limitBytes: number | null) => {
       return settingsService.updateSettings({
@@ -513,43 +607,61 @@ export const SettingsPage: React.FC = () => {
       {activeTab === 'general' && (
         <div className="space-y-6">
           <Card padding="md">
-            <h2 className="text-lg font-semibold text-neutral-900 mb-2">{t('admin.accountSettings.title')}</h2>
-            <p className="text-sm text-neutral-500 mb-4">{t('admin.accountSettings.description')}</p>
-            <form className="space-y-4" onSubmit={handleProfileSubmit}>
-              <div>
-                <label className="block text-sm font-medium text-neutral-700 mb-1">
-                  {t('admin.accountSettings.username')}
-                </label>
-                <Input
-                  value={profileForm.username}
-                  onChange={(e) => setProfileForm(prev => ({ ...prev, username: e.target.value }))}
-                  placeholder={t('admin.accountSettings.usernamePlaceholder')}
-                  maxLength={120}
-                />
+            <h2 className="text-lg font-semibold text-neutral-900 mb-4">{t('settings.general.accountSection')}</h2>
+            {adminProfileLoading ? (
+              <div className="py-8 flex justify-center">
+                <Loading size="md" />
               </div>
-              <div>
-                <label className="block text-sm font-medium text-neutral-700 mb-1">
-                  {t('admin.accountSettings.email')}
-                </label>
-                <Input
-                  type="email"
-                  value={profileForm.email}
-                  onChange={(e) => setProfileForm(prev => ({ ...prev, email: e.target.value }))}
-                  placeholder={t('admin.accountSettings.emailPlaceholder')}
-                />
-              </div>
-              {profileError && (
-                <p className="text-sm text-red-600">{profileError}</p>
-              )}
-              <div className="flex justify-end">
-                <Button
-                  type="submit"
-                  disabled={!isProfileDirty || updateProfileMutation.isPending}
-                >
-                  {updateProfileMutation.isPending ? t('common.saving') : t('admin.accountSettings.updateButton')}
-                </Button>
-              </div>
-            </form>
+            ) : (
+              <form className="space-y-4" onSubmit={handleAccountSubmit}>
+                <div>
+                  <label htmlFor="admin-account-username" className="block text-sm font-medium text-neutral-700 mb-1">
+                    {t('settings.general.accountUsername')}
+                  </label>
+                  <Input
+                    id="admin-account-username"
+                    type="text"
+                    value={accountForm.username}
+                    onChange={handleAccountChange('username')}
+                    placeholder="admin"
+                    leftIcon={<User className="w-5 h-5 text-neutral-400" />}
+                    error={accountErrors.username}
+                  />
+                  <p className="text-xs text-neutral-500 mt-1">
+                    {t('settings.general.accountUsernameHelp')}
+                  </p>
+                </div>
+
+                <div>
+                  <label htmlFor="admin-account-email" className="block text-sm font-medium text-neutral-700 mb-1">
+                    {t('settings.general.accountEmail')}
+                  </label>
+                  <Input
+                    id="admin-account-email"
+                    type="email"
+                    value={accountForm.email}
+                    onChange={handleAccountChange('email')}
+                    placeholder="admin@example.com"
+                    leftIcon={<Mail className="w-5 h-5 text-neutral-400" />}
+                    error={accountErrors.email}
+                  />
+                  <p className="text-xs text-neutral-500 mt-1">
+                    {t('settings.general.accountEmailHelp')}
+                  </p>
+                </div>
+
+                <div className="pt-2">
+                  <Button
+                    type="submit"
+                    variant="primary"
+                    leftIcon={<Save className="w-5 h-5" />}
+                    isLoading={updateAdminProfileMutation.isPending}
+                  >
+                    {t('settings.general.accountSaveButton')}
+                  </Button>
+                </div>
+              </form>
+            )}
           </Card>
 
           <Card padding="md">
@@ -572,7 +684,7 @@ export const SettingsPage: React.FC = () => {
                 </p>
               </div>
 
-              <div className="grid grid-cols-2 gap-4">
+              <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
                 <div>
                   <label className="block text-sm font-medium text-neutral-700 mb-1">
                     {t('settings.general.defaultExpiration')}
@@ -597,6 +709,29 @@ export const SettingsPage: React.FC = () => {
                     max="500"
                   />
                 </div>
+                <div>
+                  <label className="block text-sm font-medium text-neutral-700 mb-1">
+                    {t('settings.general.maxFilesPerUpload')}
+                  </label>
+                  <Input
+                    type="number"
+                    value={generalSettings.max_files_per_upload}
+                    onChange={(e) => {
+                      const parsed = parseInt(e.target.value, 10);
+                      setGeneralSettings(prev => ({
+                        ...prev,
+                        max_files_per_upload: Number.isFinite(parsed)
+                          ? Math.min(MAX_FILES_PER_UPLOAD_LIMIT, Math.max(1, parsed))
+                          : prev.max_files_per_upload
+                      }));
+                    }}
+                    min="1"
+                    max={MAX_FILES_PER_UPLOAD_LIMIT}
+                  />
+                  <p className="text-xs text-neutral-500 mt-1">
+                    {t('settings.general.maxFilesPerUploadHelp', { max: MAX_FILES_PER_UPLOAD_LIMIT })}
+                  </p>
+                </div>
               </div>
 
               <div>
@@ -659,6 +794,21 @@ export const SettingsPage: React.FC = () => {
                 />
                 <span className="ml-2 text-sm text-neutral-700">{t('settings.general.maintenanceMode')}</span>
               </label>
+
+              <div>
+                <label className="flex items-center">
+                  <input
+                    type="checkbox"
+                    checked={generalSettings.short_gallery_urls}
+                    onChange={(e) => setGeneralSettings(prev => ({ ...prev, short_gallery_urls: e.target.checked }))}
+                    className="w-4 h-4 text-primary-600 rounded focus:ring-primary-500"
+                  />
+                  <span className="ml-2 text-sm text-neutral-700">{t('settings.general.enableShortGalleryUrls')}</span>
+                </label>
+                <p className="text-xs text-neutral-500 ml-6 mt-1">
+                  {t('settings.general.enableShortGalleryUrlsHelp')}
+                </p>
+              </div>
             </div>
           </Card>
 
@@ -1227,7 +1377,7 @@ export const SettingsPage: React.FC = () => {
             <h2 className="text-lg font-semibold text-neutral-900 mb-4">{t('settings.security.sessionAuth')}</h2>
             
             <div className="space-y-4">
-              <div className="grid grid-cols-2 gap-4">
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
                 <div>
                   <label className="block text-sm font-medium text-neutral-700 mb-1">
                     {t('settings.security.sessionTimeout')}
@@ -1235,11 +1385,41 @@ export const SettingsPage: React.FC = () => {
                   <Input
                     type="number"
                     value={securitySettings.session_timeout_minutes}
-                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, session_timeout_minutes: parseInt(e.target.value) || 60 }))}
+                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, session_timeout_minutes: parseInt(e.target.value, 10) || 60 }))}
                     min="5"
                     max="1440"
                   />
                 </div>
+                <div>
+                  <label className="block text-sm font-medium text-neutral-700 mb-1">
+                    {t('settings.security.attemptWindowMinutes')}
+                  </label>
+                  <Input
+                    type="number"
+                    value={securitySettings.attempt_window_minutes}
+                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, attempt_window_minutes: parseInt(e.target.value, 10) || 15 }))}
+                    min="1"
+                    max="1440"
+                  />
+                  <p className="mt-1 text-sm text-neutral-600">
+                    {t('settings.security.attemptWindowMinutesHelp')}
+                  </p>
+                </div>
+                <div>
+                  <label className="block text-sm font-medium text-neutral-700 mb-1">
+                    {t('settings.security.lockoutDurationMinutes')}
+                  </label>
+                  <Input
+                    type="number"
+                    value={securitySettings.lockout_duration_minutes}
+                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, lockout_duration_minutes: parseInt(e.target.value, 10) || 30 }))}
+                    min="1"
+                    max="1440"
+                  />
+                  <p className="mt-1 text-sm text-neutral-600">
+                    {t('settings.security.lockoutDurationMinutesHelp')}
+                  </p>
+                </div>
                 <div>
                   <label className="block text-sm font-medium text-neutral-700 mb-1">
                     {t('settings.security.maxLoginAttempts')}
@@ -1247,10 +1427,13 @@ export const SettingsPage: React.FC = () => {
                   <Input
                     type="number"
                     value={securitySettings.max_login_attempts}
-                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, max_login_attempts: parseInt(e.target.value) || 5 }))}
-                    min="3"
-                    max="10"
+                    onChange={(e) => setSecuritySettings(prev => ({ ...prev, max_login_attempts: parseInt(e.target.value, 10) || 5 }))}
+                    min="1"
+                    max="50"
                   />
+                  <p className="mt-1 text-sm text-neutral-600">
+                    {t('settings.security.maxLoginAttemptsHelp')}
+                  </p>
                 </div>
               </div>
 

frontend/src/services/admin.service.ts

@@ -47,6 +47,17 @@ export interface Activity {
   createdAt: string;
 }
 
+export interface AdminProfile {
+  id: number;
+  username: string;
+  email: string;
+  mustChangePassword?: boolean;
+  last_login?: string | null;
+  last_login_ip?: string | null;
+  created_at?: string;
+  updated_at?: string;
+}
+
 export interface AnalyticsData {
   chartData: Array<{
     date: string;
@@ -130,5 +141,15 @@ export const adminService = {
   // Change password
   async changePassword(data: { currentPassword: string; newPassword: string }): Promise<void> {
     await api.post('/admin/auth/change-password', data);
+  },
+
+  async getAdminProfile(): Promise<AdminProfile> {
+    const response = await api.get<AdminProfile>('/admin/auth/profile');
+    return response.data;
+  },
+
+  async updateAdminProfile(data: { username: string; email: string }): Promise<AdminProfile> {
+    const response = await api.put<{ user: AdminProfile }>('/admin/auth/profile', data);
+    return response.data.user;
   }
 };