chore: bump version to 1.0.78 (backend + frontend)

Gallery Feedback Features:
- Add feedback system allowing ratings, likes, comments, and favorites on photos
- Implement admin controls for enabling/disabling feedback per event
- Add content moderation with word filters and spam detection
- Implement rate limiting to prevent abuse (10 requests/15min per type)
- Create comprehensive admin interface for feedback management
- Add analytics dashboard for feedback insights
- Export feedback data when archiving events

Frontend Components:
- PhotoRating: 5-star rating system with optimistic updates
- PhotoLikes: Like/unlike with animation
- PhotoComments: Threaded comments with moderation
- PhotoFavorites: Bookmark functionality
- FeedbackSettings: Admin configuration panel
- EventFeedbackPage: Complete management interface

Backend Implementation:
- Database migration 033: 4 new tables for feedback system
- RESTful API with proper authorization
- Guest identification via SHA256(IP+UserAgent)
- Automatic backup integration
- Email notification support

Backup Version Tracking:
- Migration 034: Add version columns to backup tables
- Track app version, Node.js version, and DB schema version
- Create restore_history table for tracking restore attempts
- Add version compatibility checking for safe restores
- Configurable version matching requirements

Security & Performance:
- Input validation and sanitization
- Rate limiting per feedback type
- Content moderation system
- Optimistic UI updates
- Efficient database queries with proper indexes

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.drone.yml

@@ -72,6 +72,89 @@ steps:
       context: frontend/
       registry: registry.local.nothaft.cloud
 
+  # -------- NEW: Publish Docker images to GitHub Container Registry --------
+  - name: push-backend-ghcr
+    image: plugins/docker
+    settings:
+      repo: ghcr.io/the-luap/picpeak-backend
+      tags:
+        - ${DRONE_TAG}
+        - latest
+      dockerfile: backend/Dockerfile
+      context: backend/
+      registry: ghcr.io
+      username:
+        from_secret: GITHUB_USERNAME
+      password:
+        from_secret: GITHUB_TOKEN
+      build_args:
+        - VERSION=${DRONE_TAG}
+
+  - name: push-frontend-ghcr
+    image: plugins/docker
+    settings:
+      repo: ghcr.io/the-luap/picpeak-frontend
+      tags:
+        - ${DRONE_TAG}
+        - latest
+      dockerfile: frontend/Dockerfile
+      context: frontend/
+      registry: ghcr.io
+      username:
+        from_secret: GITHUB_USERNAME
+      password:
+        from_secret: GITHUB_TOKEN
+      build_args:
+        - VERSION=${DRONE_TAG}
+        - VITE_API_URL=${VITE_API_URL:-/api}
+
+  # -------- NEW: Create GitHub Release --------
+  - name: github-release
+    image: plugins/github-release
+    settings:
+      api_key:
+        from_secret: GITHUB_TOKEN
+      base_url: https://api.github.com/
+      upload_url: https://uploads.github.com/
+      repo: the-luap/picpeak
+      owner: the-luap
+      title: "PicPeak ${DRONE_TAG}"
+      note: |
+        # PicPeak ${DRONE_TAG}
+        
+        ## 🐳 Docker Images
+        
+        This release includes Docker images published to GitHub Container Registry:
+        
+        ```bash
+        # Backend
+        docker pull ghcr.io/the-luap/picpeak-backend:${DRONE_TAG}
+        docker pull ghcr.io/the-luap/picpeak-backend:latest
+        
+        # Frontend
+        docker pull ghcr.io/the-luap/picpeak-frontend:${DRONE_TAG}
+        docker pull ghcr.io/the-luap/picpeak-frontend:latest
+        ```
+        
+        ## 📦 What's New
+        
+        See the [README](https://github.com/the-luap/picpeak#readme) for features and documentation.
+        
+        ## 🚀 Quick Start
+        
+        ```bash
+        # Clone and deploy
+        git clone https://github.com/the-luap/picpeak.git
+        cd picpeak
+        
+        # Use the tagged version
+        docker-compose -f docker-compose.prod.yml up -d
+        ```
+        
+        ---
+        
+        For detailed deployment instructions, see the [Deployment Guide](https://github.com/the-luap/picpeak/blob/main/DEPLOYMENT.md).
+
 trigger:
   event:
     - tag

.drone.yml.full

@@ -1,280 +0,0 @@
-kind: pipeline
-type: docker
-name: default
-
-trigger:
-  branch:
-    - main
-    - develop
-    - feature/*
-  event:
-    - push
-    - pull_request
-    - tag
-
-volumes:
-  - name: docker
-    host:
-      path: /var/run/docker.sock
-
-steps:
-  # Frontend Tests
-  - name: frontend-test
-    image: node:18-alpine
-    commands:
-      - cd frontend
-      - npm ci --legacy-peer-deps
-      - npm run lint
-      - npm run build
-    when:
-      event:
-        - push
-        - pull_request
-
-  # Backend Tests
-  - name: backend-test
-    image: node:18-alpine
-    commands:
-      - cd backend
-      - npm ci
-      - npm run lint
-      - npm test
-    environment:
-      NODE_ENV: test
-      JWT_SECRET: test-secret
-    when:
-      event:
-        - push
-        - pull_request
-
-  # Build Frontend Docker Image
-  - name: build-frontend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/wedding-photo-sharing-frontend
-      tags:
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_TAG}
-      dockerfile: frontend/Dockerfile
-      context: frontend
-      registry: registry.local.nothaft.cloud
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Build Backend Docker Image
-  - name: build-backend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/wedding-photo-sharing-backend
-      tags:
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_TAG}
-      dockerfile: backend/Dockerfile
-      context: backend
-      registry: registry.local.nothaft.cloud
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Security Scan
-  - name: security-scan
-    image: aquasec/trivy:latest
-    commands:
-      - trivy image --exit-code 0 --no-progress registry.local.nothaft.cloud/wedding-photo-sharing-frontend:${DRONE_COMMIT_SHA:0:8}
-      - trivy image --exit-code 0 --no-progress registry.local.nothaft.cloud/wedding-photo-sharing-backend:${DRONE_COMMIT_SHA:0:8}
-    environment:
-      DOCKER_HOST: tcp://docker:2375
-    volumes:
-      - name: docker
-        path: /var/run/docker.sock
-    when:
-      branch:
-        - main
-      event:
-        - push
-
-  # Deploy to Staging
-  - name: deploy-staging
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: staging_swarm_host
-      SWARM_USER:
-        from_secret: staging_swarm_user
-      SWARM_KEY:
-        from_secret: staging_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-      VERSION: ${DRONE_COMMIT_SHA:0:8}
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=$VERSION
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing
-        EOF
-    when:
-      branch:
-        - develop
-      event:
-        - push
-
-  # Deploy to Production
-  - name: deploy-production
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: prod_swarm_host
-      SWARM_USER:
-        from_secret: prod_swarm_user
-      SWARM_KEY:
-        from_secret: prod_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-      VERSION: ${DRONE_TAG:-latest}
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=$VERSION
-          
-          # Backup database before deployment
-          docker exec \$(docker ps -q -f name=wedding-photo-sharing_db) pg_dump -U postgres wedding_photo_sharing > /backup/db-backup-\$(date +%Y%m%d-%H%M%S).sql
-          
-          # Deploy stack
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing --with-registry-auth
-          
-          # Wait for services to be ready
-          sleep 30
-          
-          # Run migrations if needed
-          docker exec \$(docker ps -q -f name=wedding-photo-sharing_backend) npm run migrate
-        EOF
-    when:
-      event:
-        - tag
-
-  # Health Check
-  - name: health-check
-    image: alpine:latest
-    commands:
-      - apk add --no-cache curl
-      - sleep 30
-      - curl -f https://${FRONTEND_HOST}/health || exit 1
-      - curl -f https://${BACKEND_HOST}/api/health || exit 1
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Notification - Success
-  - name: notify-success
-    image: plugins/slack
-    settings:
-      webhook:
-        from_secret: slack_webhook
-      channel: deployments
-      template: |
-        ✅ *Build {{build.number}} succeeded* for {{repo.name}}
-        
-        Branch: {{build.branch}}
-        Commit: {{build.commit}}
-        Author: {{build.author}}
-        
-        {{#if build.tag}}
-        🏷️ Tag: {{build.tag}}
-        🚀 Deployed to *PRODUCTION*
-        {{else}}
-        📦 Deployed to *{{build.branch}}*
-        {{/if}}
-        
-        🔗 {{build.link}}
-    when:
-      status:
-        - success
-
-  # Notification - Failure
-  - name: notify-failure
-    image: plugins/slack
-    settings:
-      webhook:
-        from_secret: slack_webhook
-      channel: deployments
-      template: |
-        ❌ *Build {{build.number}} failed* for {{repo.name}}
-        
-        Branch: {{build.branch}}
-        Commit: {{build.commit}}
-        Author: {{build.author}}
-        
-        🔗 {{build.link}}
-    when:
-      status:
-        - failure
-
----
-kind: pipeline
-type: docker
-name: rollback
-
-trigger:
-  event:
-    - rollback
-
-steps:
-  - name: rollback-production
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: prod_swarm_host
-      SWARM_USER:
-        from_secret: prod_swarm_user
-      SWARM_KEY:
-        from_secret: prod_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=${DRONE_ROLLBACK_TO}
-          
-          # Deploy previous version
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing --with-registry-auth
-        EOF
-
----
-kind: secret
-name: slack_webhook
-get:
-  path: drone/slack
-  name: webhook

.env.example

@@ -1,26 +1,24 @@
-# Environment Configuration Template
-# Copy this file to .env and adjust values for your environment
+# PicPeak Development Environment Configuration
+# Copy this file to .env for local development
 
-# Development: Use docker-compose.dev.yml
-# Production: Use docker-compose.prod.yml with .env.production.example
+# SECURITY WARNING: This configuration is for development only!
+# For production, use .env.production.example
 
-# JWT Secret (CRITICAL for production)
-# Generate with: openssl rand -base64 32
-JWT_SECRET=dev-secret-change-in-production
+# JWT Secret (Change in production!)
+# Generate secure secret with: openssl rand -base64 32
+JWT_SECRET=dev-secret-DO-NOT-USE-IN-PRODUCTION
 
-# Application URLs
+# Application URLs (Docker Compose development setup)
 ADMIN_URL=http://localhost:3005
 FRONTEND_URL=http://localhost:3005
+BACKEND_URL=http://localhost:3001
 
-# Database Configuration
-# SQLite is used for development by default
-# For production PostgreSQL config, see .env.production.example
+# Database Configuration (SQLite for development)
 DATABASE_CLIENT=sqlite3
 DATABASE_PATH=./data/photo_sharing.db
 
-# Email Configuration
-# Development: Uses Mailhog (included in docker-compose.dev.yml)
-# Production: Configure real SMTP server
+# Email Configuration (Mailhog for development)
+# Access Mailhog UI at: http://localhost:8025
 SMTP_HOST=mailhog
 SMTP_PORT=1025
 SMTP_SECURE=false
@@ -28,7 +26,22 @@ SMTP_USER=
 SMTP_PASS=
 EMAIL_FROM=noreply@localhost
 
-# Optional: Umami Analytics
-UMAMI_URL=
-UMAMI_WEBSITE_ID=
-UMAMI_HASH_SALT=
+# Backend Port Configuration
+PORT=3001
+
+# Optional: Umami Analytics Backend Config
+# NOTE: Primary configuration through Admin UI > Settings > Analytics
+# These are fallback values for server-side tracking
+# UMAMI_URL=https://analytics.example.com
+# UMAMI_WEBSITE_ID=your-website-id
+# UMAMI_HASH_SALT=your-hash-salt
+
+# Development Features
+NODE_ENV=development
+LOG_LEVEL=debug
+
+# Admin Setup Notes:
+# 1. Run 'npm run migrate' in backend folder
+# 2. Admin credentials will be auto-generated
+# 3. Check ADMIN_CREDENTIALS.txt for login details
+# 4. Change password on first login (required)

.env.production.example

@@ -1,32 +1,100 @@
-# Production Environment Configuration Template
-# Copy this file to .env and fill in your values
+# PicPeak Production Configuration
+# Copy this file to .env and update with your production values
 
-# Application URLs
-ADMIN_URL=https://yourdomain.com
-FRONTEND_URL=https://yourdomain.com
+# ============================================
+# CRITICAL SECURITY - MUST CHANGE ALL VALUES!
+# ============================================
 
-# Security - CRITICAL: Generate a secure random JWT secret
-# You can generate one with: openssl rand -base64 32
-JWT_SECRET=your-secure-random-jwt-secret-here
+# JWT Secret - REQUIRED (minimum 32 characters)
+# Generate with: openssl rand -base64 32
+JWT_SECRET=CHANGE-THIS-PRODUCTION-SECRET-USE-OPENSSL-COMMAND
 
-# Database Configuration (PostgreSQL)
-DB_USER=picpeak
-DB_PASSWORD=your-secure-database-password
+# Application URLs - REQUIRED (your actual domain)
+FRONTEND_URL=https://your-domain.com
+BACKEND_URL=https://your-domain.com
+ADMIN_URL=https://your-domain.com
+
+# ============================================
+# DATABASE CONFIGURATION - REQUIRED
+# ============================================
+
+# PostgreSQL Configuration (Recommended for production)
+DATABASE_CLIENT=pg
+DB_HOST=postgres  # or your database host
+DB_PORT=5432
 DB_NAME=picpeak
+DB_USER=picpeak
+DB_PASSWORD=CHANGE-THIS-SECURE-DATABASE-PASSWORD
 
-# Email Configuration
-SMTP_HOST=smtp.gmail.com
+# ============================================
+# EMAIL CONFIGURATION - REQUIRED
+# ============================================
+
+# Example: Gmail with App Password
+# SMTP_HOST=smtp.gmail.com
+# SMTP_PORT=587
+# SMTP_SECURE=false
+# SMTP_USER=your-email@gmail.com
+# SMTP_PASS=your-16-char-app-password
+# EMAIL_FROM=Your Name <your-email@gmail.com>
+
+# Example: SendGrid
+SMTP_HOST=smtp.sendgrid.net
 SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-password
-EMAIL_FROM=noreply@yourdomain.com
+SMTP_SECURE=false
+SMTP_USER=apikey
+SMTP_PASS=YOUR-SENDGRID-API-KEY
+EMAIL_FROM=PicPeak <noreply@your-domain.com>
 
-# Umami Analytics (Optional)
-UMAMI_URL=https://analytics.yourdomain.com
-UMAMI_WEBSITE_ID=your-website-id
-UMAMI_HASH_SALT=your-random-hash-salt
+# ============================================
+# ADMIN SETUP - AUTO-GENERATED
+# ============================================
+# NOTE: Admin credentials are automatically generated during setup
+# DO NOT set ADMIN_EMAIL or ADMIN_PASSWORD anymore!
+# Run 'npm run migrate' and check ADMIN_CREDENTIALS.txt
 
-# First Admin User (for initial setup)
-# Run: docker-compose exec backend node scripts/create-admin.js --email admin@yourdomain.com
-ADMIN_EMAIL=admin@yourdomain.com
+# ============================================
+# OPTIONAL CONFIGURATION
+# ============================================
+
+# Umami Analytics (Optional - Fallback values)
+# Primary config via Admin UI > Settings > Analytics
+# UMAMI_URL=https://analytics.your-domain.com
+# UMAMI_WEBSITE_ID=your-website-id
+# UMAMI_HASH_SALT=your-hash-salt
+
+# Frontend Analytics (Optional - Fallback values)
+# VITE_UMAMI_URL=https://analytics.your-domain.com
+# VITE_UMAMI_WEBSITE_ID=your-website-id
+# VITE_UMAMI_SHARE_URL=https://analytics.your-domain.com/share/xyz/gallery
+
+# ============================================
+# PERFORMANCE & SECURITY TUNING
+# ============================================
+
+NODE_ENV=production
+PORT=3001
+LOG_LEVEL=info
+
+# Security Settings (Defaults are secure)
+BCRYPT_ROUNDS=12
+SESSION_TIMEOUT_MINUTES=60
+RATE_LIMIT_WINDOW_MS=900000     # 15 minutes
+RATE_LIMIT_MAX_REQUESTS=100      # per window
+
+# Connection Pool (Adjust based on load)
+DB_POOL_MIN=5
+DB_POOL_MAX=25
+
+# ============================================
+# DOCKER COMPOSE SPECIFIC
+# ============================================
+
+# Traefik Configuration (if using Traefik)
+DOMAIN=your-domain.com
+LETSENCRYPT_EMAIL=admin@your-domain.com
+
+# Volume Paths (Docker)
+STORAGE_PATH=/app/storage
+EVENTS_PATH=/app/storage/events
+ARCHIVE_PATH=/app/storage/events/archived

.gitattributes-github

@@ -0,0 +1,12 @@
+# Files to exclude from GitHub mirror
+.env* export-ignore
+docker-compose.prod.yml export-ignore
+.claudedocs/ export-ignore
+backend/data/ export-ignore
+backend/storage/ export-ignore
+backend/.env* export-ignore
+frontend/.env* export-ignore
+secrets/ export-ignore
+*.key export-ignore
+*.pem export-ignore
+.gitea/ export-ignore

.gitea/workflows/mirror-to-github.yml

@@ -0,0 +1,220 @@
+name: Mirror to GitHub
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:  # Allow manual triggering
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository with full history
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0  # Full history needed for finding the commit
+
+      - name: Setup Git
+        run: |
+          git config --global user.name "the-luap"
+          git config --global user.email "paul-nothaft@hotmail.de"
+
+      - name: Debug - Show current branch and status
+        run: |
+          echo "Current branch:"
+          git branch -a
+          echo "Git status:"
+          git status
+          echo "Remote info:"
+          git remote -v
+          echo "Checking target commit exists:"
+          git show --oneline 7aca927937 || echo "Target commit not found!"
+
+      - name: Create completely new history from specific commit
+        run: |
+          TARGET_COMMIT="7aca927937"
+          
+          # Verify the target commit exists
+          if ! git cat-file -e $TARGET_COMMIT^{commit}; then
+            echo "ERROR: Target commit $TARGET_COMMIT does not exist!"
+            exit 1
+          fi
+          
+          echo "✅ Target commit found: $(git log --oneline -1 $TARGET_COMMIT)"
+          
+          # Clean up any existing github-mirror branch
+          git branch -D github-mirror || true
+          
+          # Create a completely new orphan branch (no history)
+          git checkout --orphan github-mirror
+          
+          # Clear the staging area completely
+          git rm -rf . || true
+          
+          # Get the file tree from the target commit and create initial commit
+          echo "Creating new history starting from $TARGET_COMMIT..."
+          git read-tree $TARGET_COMMIT
+          git commit -m "Initial commit - imported from $(git log --oneline -1 $TARGET_COMMIT)"
+          
+          echo "✅ Created new initial commit: $(git log --oneline -1)"
+          
+          # Now get all commits after the target commit and apply their changes
+          COMMITS_AFTER_TARGET=$(git rev-list --reverse --no-merges $TARGET_COMMIT..main)
+          
+          if [ -n "$COMMITS_AFTER_TARGET" ]; then
+            echo "📋 Applying changes from commits after $TARGET_COMMIT (excluding Claude commits):"
+            
+            for commit in $COMMITS_AFTER_TARGET; do
+              # Get the commit author name
+              COMMIT_AUTHOR_NAME=$(git log --format="%an" -n 1 $commit)
+              
+              # Skip commits by Claude
+              if [ "$COMMIT_AUTHOR_NAME" = "Claude" ]; then
+                echo "⚠️ Skipping commit by Claude: $(git log --oneline -1 $commit)"
+                continue
+              fi
+              
+              echo "Processing: $(git log --oneline -1 $commit)"
+              
+              # Get the commit message and author info
+              COMMIT_MSG=$(git log --format="%B" -n 1 $commit)
+              COMMIT_AUTHOR=$(git log --format="%an <%ae>" -n 1 $commit)
+              COMMIT_DATE=$(git log --format="%ad" -n 1 $commit)
+              
+              # Apply the changes from this commit
+              if git diff-tree --no-commit-id --name-only -r $commit | xargs -I {} git show $commit:{} > /dev/null 2>&1; then
+                # Apply file changes
+                git checkout $commit -- . || true
+                
+                # Stage all changes
+                git add -A
+                
+                # Only commit if there are changes
+                if ! git diff --cached --quiet; then
+                  # Create new commit with original metadata but new SHA
+                  GIT_AUTHOR_NAME=$(echo "$COMMIT_AUTHOR" | cut -d'<' -f1 | xargs)
+                  GIT_AUTHOR_EMAIL=$(echo "$COMMIT_AUTHOR" | cut -d'<' -f2 | cut -d'>' -f1)
+                  GIT_AUTHOR_DATE="$COMMIT_DATE"
+                  
+                  export GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL GIT_AUTHOR_DATE
+                  git commit -m "$COMMIT_MSG"
+                  echo "✅ Applied changes as new commit: $(git log --oneline -1)"
+                else
+                  echo "⚠️ No changes to commit for $commit"
+                fi
+              else
+                echo "⚠️ Skipping problematic commit $commit"
+              fi
+            done
+            
+            echo "✅ Finished creating new history"
+          else
+            echo "✅ No commits after target commit - history starts fresh"
+          fi
+          
+          echo ""
+          echo "=== New History Summary ==="
+          echo "Total commits in new history: $(git rev-list --count github-mirror)"
+          echo "History starts with: $(git log --oneline --reverse | head -1)"
+          echo "Latest commit: $(git log --oneline -1)"
+
+      - name: Remove sensitive files and directories
+        run: |
+          # Switch to the github-mirror branch
+          git checkout github-mirror
+          
+          echo "Current files before cleanup:"
+          ls -la | head -10 || true
+          echo "..."
+          
+          # Remove sensitive files/directories if they exist
+          echo "Removing sensitive files..."
+          rm -rf .env || true
+          rm -rf backend/.env* || true
+          rm -rf frontend/.env* || true
+          rm -rf docker-compose.prod.yml || true
+          rm -rf .claudedocs/ || true
+          rm -rf backend/data/ || true
+          rm -rf backend/storage/ || true
+          rm -rf .gitea/ || true
+          rm -rf scripts/install-gitea-runner.sh || true
+          rm -rf .drone* || true
+          rm -rf .github-mirror-exclude || true
+          rm -rf .gitattributes-github || true
+          rm -rf photo-sharing-prd.md || true
+          rm -rf CLAUDE.md || true
+          rm -rf PRODUCTION_DEPLOYMENT_GUIDE.md || true
+          rm -rf logs/ || true
+          rm -rf frontend/.claudedocs/ || true
+          rm -rf test-maintenance.sh || true
+          rm -rf storage/ || true
+          
+          echo "Sensitive files removal completed"
+          
+          # Add and commit the cleanup if there are changes
+          git add -A
+          if ! git diff --cached --quiet; then
+            git commit -m "chore: remove sensitive files for GitHub mirror"
+            echo "✅ Committed cleanup of sensitive files"
+          else
+            echo "✅ No sensitive files to remove"
+          fi
+          
+          echo "Final file structure (top level):"
+          ls -la | head -10 || true
+
+      - name: Verify completely new history
+        run: |
+          git checkout github-mirror
+          echo "=== Final History Verification ==="
+          echo "Total commits in new github-mirror branch: $(git rev-list --count github-mirror)"
+          echo ""
+          echo "Complete commit history (should start from target commit content):"
+          git log --oneline --reverse
+          echo ""
+          echo "⚠️ Note: This is a completely NEW history with new commit SHAs"
+          echo "🔍 Original target commit content preserved but with new commit ID"
+
+      - name: Check GitHub token
+        env:
+          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
+        run: |
+          if [ -z "$GITHUBTOKEN" ]; then
+            echo "ERROR: GITHUBTOKEN secret is not set!"
+            exit 1
+          else
+            echo "GitHub token is available (length: ${#GITHUBTOKEN})"
+          fi
+
+      - name: Force push completely new history to GitHub
+        env:
+          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
+        run: |
+          # Switch to github-mirror branch
+          git checkout github-mirror
+          
+          # Remove existing github remote if it exists
+          git remote remove github || true
+          
+          # Add GitHub remote
+          git remote add github https://x-access-token:${GITHUBTOKEN}@github.com/the-luap/picpeak.git
+          
+          # Verify remote was added
+          echo "GitHub remote added:"
+          git remote -v
+          
+          # Force push the completely new history to GitHub main
+          echo "🔥 FORCE PUSHING completely new history to GitHub..."
+          echo "⚠️ This will COMPLETELY REPLACE all history on GitHub!"
+          git push github github-mirror:main --force
+          echo "✅ Force push completed - GitHub now has completely new history!"
+
+      - name: Workflow completed
+        run: |
+          echo "✅ Mirror to GitHub workflow completed successfully!"
+          echo "🔥 COMPLETE HISTORY REPLACEMENT: GitHub now has entirely new history"
+          echo "📊 History starts from commit content: 7aca927937"
+          echo "🔍 Check https://github.com/the-luap/picpeak to verify the new history"
+          echo "📈 Total commits pushed: $(git rev-list --count github-mirror)"
+          echo "🆕 All commit SHAs are NEW - no connection to previous history"

.gitea/workflows/version-and-release.yml

@@ -14,6 +14,7 @@ jobs:
     outputs:
       new_version: ${{ steps.version.outputs.new_version }}
       version_changed: ${{ steps.version.outputs.version_changed }}
+      component_changed: ${{ steps.version.outputs.component_changed }}
     steps:
       - uses: actions/checkout@v3
         with:
@@ -30,15 +31,104 @@ jobs:
           git config --global user.name 'Gitea Actions Bot'
           git config --global user.email 'actions@gitea.local'
       
-      - name: Bump version
+      - name: Detect changes and bump version
         id: version
         run: |
-          # Get current version from backend package.json
-          CURRENT_VERSION=$(node -p "require('./backend/package.json').version")
-          echo "Current version: $CURRENT_VERSION"
+          set -e  # Exit on error
           
-          # Split version into parts
-          IFS='.' read -r -a version_parts <<< "$CURRENT_VERSION"
+          echo "=== Debug Info ==="
+          echo "GitHub event before: ${{ github.event.before }}"
+          echo "GitHub SHA: ${{ github.sha }}"
+          echo "Current directory: $(pwd)"
+          echo "Git log (last 5): $(git log --oneline -5)"
+          
+          # Get the commit range for changed files
+          if [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ] && [ "${{ github.event.before }}" != "" ]; then
+            COMMIT_RANGE="${{ github.event.before }}..${{ github.sha }}"
+            echo "Using commit range: $COMMIT_RANGE"
+            CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
+          else
+            # First commit or no previous commit, check against HEAD~1 if it exists
+            if git rev-parse HEAD~1 >/dev/null 2>&1; then
+              COMMIT_RANGE="HEAD~1..HEAD"
+              echo "Using commit range: $COMMIT_RANGE"
+              CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
+            else
+              echo "First commit detected, checking all files"
+              CHANGED_FILES=$(git ls-files)
+            fi
+          fi
+          
+          echo "Changed files:"
+          echo "$CHANGED_FILES"
+          
+          # Check what changed (using echo to pipe to grep to avoid grep exit codes)
+          BACKEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^backend/' || echo "0")
+          FRONTEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^frontend/' || echo "0")
+          ROOT_CHANGED=$(echo "$CHANGED_FILES" | grep -c -E '^(package\.json|docker-compose|Dockerfile|scripts/)' || echo "0")
+          
+          echo "Backend files changed: $BACKEND_CHANGED"
+          echo "Frontend files changed: $FRONTEND_CHANGED"
+          echo "Root files changed: $ROOT_CHANGED"
+          
+          # Get current versions
+          BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "1.0.0")
+          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "1.0.0")
+          
+          echo "Current backend version: $BACKEND_VERSION"
+          echo "Current frontend version: $FRONTEND_VERSION"
+          
+          # Determine what to update based on changes
+          BACKEND_UPDATE=false
+          FRONTEND_UPDATE=false
+          COMPONENT_CHANGED="none"
+          
+          if [ "$ROOT_CHANGED" -gt 0 ]; then
+            # Root changes affect both components
+            BACKEND_UPDATE=true
+            FRONTEND_UPDATE=true
+            COMPONENT_CHANGED="both"
+            SOURCE_VERSION=$BACKEND_VERSION
+            echo "Root changes detected - updating both components"
+          elif [ "$BACKEND_CHANGED" -gt 0 ] && [ "$FRONTEND_CHANGED" -gt 0 ]; then
+            # Both components changed
+            BACKEND_UPDATE=true
+            FRONTEND_UPDATE=true
+            COMPONENT_CHANGED="both"
+            # Use the higher version as source
+            if [ "$(printf '%s\n' "$BACKEND_VERSION" "$FRONTEND_VERSION" | sort -V | tail -n1)" = "$BACKEND_VERSION" ]; then
+              SOURCE_VERSION=$BACKEND_VERSION
+            else
+              SOURCE_VERSION=$FRONTEND_VERSION
+            fi
+            echo "Both backend and frontend changed - updating both"
+          elif [ "$BACKEND_CHANGED" -gt 0 ]; then
+            # Only backend changed
+            BACKEND_UPDATE=true
+            COMPONENT_CHANGED="backend"
+            SOURCE_VERSION=$BACKEND_VERSION
+            echo "Only backend changed - updating backend"
+          elif [ "$FRONTEND_CHANGED" -gt 0 ]; then
+            # Only frontend changed
+            FRONTEND_UPDATE=true
+            COMPONENT_CHANGED="frontend"
+            SOURCE_VERSION=$FRONTEND_VERSION
+            echo "Only frontend changed - updating frontend"
+          else
+            echo "No relevant changes detected"
+            echo "version_changed=false" >> $GITHUB_OUTPUT
+            echo "component_changed=none" >> $GITHUB_OUTPUT
+            echo "new_version=" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          
+          echo "Component changed: $COMPONENT_CHANGED"
+          echo "Source version: $SOURCE_VERSION"
+          echo "Backend update: $BACKEND_UPDATE"
+          echo "Frontend update: $FRONTEND_UPDATE"
+          
+          # Calculate new version
+          IFS='.' read -r -a version_parts <<< "$SOURCE_VERSION"
           MAJOR="${version_parts[0]}"
           MINOR="${version_parts[1]}"
           PATCH="${version_parts[2]}"
@@ -49,14 +139,23 @@ jobs:
           
           echo "New version: $NEW_VERSION"
           echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "component_changed=$COMPONENT_CHANGED" >> $GITHUB_OUTPUT
           
-          # Update version in package.json files
-          cd backend && npm version $NEW_VERSION --no-git-tag-version
-          cd ../frontend && npm version $NEW_VERSION --no-git-tag-version
-          cd ..
+          # Update versions in package.json files
+          if [ "$BACKEND_UPDATE" = true ]; then
+            echo "Updating backend version to $NEW_VERSION"
+            cd backend && npm version $NEW_VERSION --no-git-tag-version
+            cd ..
+          fi
           
-          # Check if there are changes
-          if [[ -n $(git status -s) ]]; then
+          if [ "$FRONTEND_UPDATE" = true ]; then
+            echo "Updating frontend version to $NEW_VERSION"
+            cd frontend && npm version $NEW_VERSION --no-git-tag-version
+            cd ..
+          fi
+          
+          # Check if there are changes to commit
+          if [[ -n $(git status --porcelain) ]]; then
             echo "version_changed=true" >> $GITHUB_OUTPUT
           else
             echo "version_changed=false" >> $GITHUB_OUTPUT
@@ -65,15 +164,94 @@ jobs:
       - name: Commit version bump
         if: steps.version.outputs.version_changed == 'true'
         run: |
-          git add backend/package.json backend/package-lock.json
-          git add frontend/package.json frontend/package-lock.json
-          git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }}"
-          git push
+          set -e  # Exit on any error
+          
+          # First, ensure we have the latest changes
+          echo "Fetching latest changes..."
+          git fetch origin main
+          
+          # Check if we're behind and need to update
+          LOCAL=$(git rev-parse HEAD)
+          REMOTE=$(git rev-parse origin/main)
+          
+          if [ "$LOCAL" != "$REMOTE" ]; then
+            echo "Local is behind remote, pulling changes..."
+            git pull origin main --no-rebase
+          fi
+          
+          COMPONENT="${{ steps.version.outputs.component_changed }}"
+          
+          if [ "$COMPONENT" = "both" ]; then
+            git add backend/package.json backend/package-lock.json frontend/package.json frontend/package-lock.json
+            git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }} (backend + frontend)"
+          elif [ "$COMPONENT" = "backend" ]; then
+            git add backend/package.json backend/package-lock.json
+            git commit -m "chore: bump backend version to ${{ steps.version.outputs.new_version }}"
+          elif [ "$COMPONENT" = "frontend" ]; then
+            git add frontend/package.json frontend/package-lock.json
+            git commit -m "chore: bump frontend version to ${{ steps.version.outputs.new_version }}"
+          fi
+          
+          # Pull latest changes before pushing to avoid conflicts
+          echo "Pulling latest changes from origin/main..."
+          if ! git pull --rebase origin main; then
+            echo "Rebase failed, attempting to resolve..."
+            # If rebase fails, abort and try a regular merge
+            git rebase --abort || true
+            git pull origin main --no-rebase
+          fi
+          
+          # Push the changes with retry logic
+          echo "Pushing version bump..."
+          PUSH_SUCCESS=false
+          
+          for i in 1 2 3; do
+            echo "Push attempt $i of 3..."
+            
+            # Try to push
+            if git push origin main 2>&1; then
+              echo "Successfully pushed version bump on attempt $i"
+              PUSH_SUCCESS=true
+              break
+            else
+              echo "Push failed on attempt $i"
+              
+              if [ $i -lt 3 ]; then
+                echo "Waiting 5 seconds before retry..."
+                sleep 5
+                
+                echo "Pulling latest changes..."
+                git fetch origin main
+                
+                # Try rebase first, fall back to merge
+                if ! git rebase origin/main; then
+                  echo "Rebase failed, trying merge..."
+                  git rebase --abort 2>/dev/null || true
+                  git pull origin main --no-rebase
+                fi
+              fi
+            fi
+          done
+          
+          if [ "$PUSH_SUCCESS" = "false" ]; then
+            echo "ERROR: Failed to push after 3 attempts"
+            exit 1
+          fi
       
       - name: Create Git tag
         if: steps.version.outputs.version_changed == 'true'
         run: |
-          git tag -a "v${{ steps.version.outputs.new_version }}" -m "Release v${{ steps.version.outputs.new_version }}"
+          COMPONENT="${{ steps.version.outputs.component_changed }}"
+          
+          if [ "$COMPONENT" = "both" ]; then
+            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend + frontend)"
+          elif [ "$COMPONENT" = "backend" ]; then
+            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend)"
+          elif [ "$COMPONENT" = "frontend" ]; then
+            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (frontend)"
+          fi
+          
+          git tag -a "v${{ steps.version.outputs.new_version }}" -m "$TAG_MESSAGE"
           git push origin "v${{ steps.version.outputs.new_version }}"
   
   trigger-drone:
@@ -84,5 +262,6 @@ jobs:
       - name: Trigger Drone Build
         run: |
           echo "Version bumped to ${{ needs.version-bump.outputs.new_version }}"
+          echo "Component(s) changed: ${{ needs.version-bump.outputs.component_changed }}"
           echo "Drone will automatically trigger on the new tag"
           # Drone CI will automatically trigger on the tag push event

.github-mirror-exclude

@@ -0,0 +1,24 @@
+# Exclude patterns for GitHub mirror
+.env
+.env.*
+.env*
+docker-compose.prod.yml
+docker-compose.traefik.yml
+.claudedocs/
+backend/data/
+backend/storage/
+backend/.env*
+frontend/.env*
+secrets/
+*.key
+*.pem
+.gitea/
+node_modules/
+dist/
+build/
+*.log
+.DS_Store
+deploy/
+certbot/
+nginx/
+photo-sharing-prd.md

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,47 @@
+---
+name: Bug report
+about: Create a report to help us improve PicPeak
+title: '[BUG] '
+labels: 'bug'
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Environment (please complete the following information):**
+ - OS: [e.g. Ubuntu 22.04]
+ - Browser: [e.g. Chrome 120, Safari 17]
+ - PicPeak Version: [e.g. 1.0.22]
+ - Deployment Method: [e.g. Docker Compose, Manual]
+ - Database: [e.g. PostgreSQL 15, SQLite]
+
+**Logs**
+Please include relevant logs:
+```
+# Backend logs
+docker-compose logs backend | tail -50
+
+# Frontend console errors
+[paste any browser console errors]
+```
+
+**Additional context**
+Add any other context about the problem here.
+
+**Possible Solution**
+If you have an idea how to fix the issue, please describe it here.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 📚 Documentation
+    url: https://github.com/the-luap/picpeak/blob/main/DEPLOYMENT.md
+    about: Please read the documentation before opening an issue
+  - name: 💬 Discussions
+    url: https://github.com/the-luap/picpeak/discussions
+    about: Ask questions and discuss with the community
+  - name: 🔒 Security Issues
+    url: https://github.com/the-luap/picpeak/blob/main/SECURITY.md
+    about: Please review our security policy for reporting vulnerabilities

.github/ISSUE_TEMPLATE/documentation.md

@@ -0,0 +1,33 @@
+---
+name: Documentation
+about: Report issues or improvements needed in documentation
+title: '[DOCS] '
+labels: 'documentation'
+assignees: ''
+
+---
+
+**What documentation needs improvement?**
+Please specify which document or section needs attention:
+- [ ] README.md
+- [ ] DEPLOYMENT.md
+- [ ] CONTRIBUTING.md
+- [ ] API Documentation
+- [ ] Code Comments
+- [ ] Other: ___________
+
+**Describe the issue**
+What's wrong or missing in the documentation?
+
+**Suggested improvement**
+How would you improve this documentation?
+
+**Target audience**
+Who is this documentation for?
+- [ ] New users setting up PicPeak
+- [ ] Developers contributing to the project
+- [ ] System administrators
+- [ ] End users (photographers/clients)
+
+**Additional context**
+Add any other context, examples, or references here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,38 @@
+---
+name: Feature request
+about: Suggest an idea for PicPeak
+title: '[FEATURE] '
+labels: 'enhancement'
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Use Case**
+Please describe how this feature would be used:
+- Who would use it? (photographers, clients, admins)
+- When would they use it?
+- Why is it important?
+
+**Similar Features**
+Are there similar features in:
+- PicDrop
+- Scrapbook.de
+- Other photo sharing platforms
+
+**Mockups or Examples**
+If applicable, add mockups, diagrams, or links to similar implementations.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.
+
+**Implementation Ideas**
+If you have technical ideas about how this could be implemented, please share them.

.github/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,26 @@
+---
+name: Question
+about: Ask a question about PicPeak
+title: '[QUESTION] '
+labels: 'question'
+assignees: ''
+
+---
+
+**Question**
+What would you like to know about PicPeak?
+
+**Context**
+Please provide context to help us answer your question better:
+- What are you trying to achieve?
+- What have you already tried?
+- Which documentation have you consulted?
+
+**Environment**
+If relevant to your question:
+- PicPeak Version:
+- Deployment Method:
+- Operating System:
+
+**Related Issues or Discussions**
+Link to any related issues, discussions, or documentation.

.github/ISSUE_TEMPLATE/security_vulnerability.md

@@ -0,0 +1,37 @@
+---
+name: Security Vulnerability
+about: Report security issues privately
+title: '[SECURITY] '
+labels: 'security'
+assignees: ''
+
+---
+
+⚠️ **IMPORTANT: For serious security vulnerabilities, please DO NOT create a public issue.**
+
+Instead, please email security@example.com with the details.
+
+For minor security improvements or questions, you can use this template:
+
+**Type of Security Issue**
+- [ ] Authentication/Authorization
+- [ ] Data Exposure
+- [ ] Input Validation
+- [ ] Configuration Issue
+- [ ] Dependency Vulnerability
+- [ ] Other: ___________
+
+**Description**
+Brief description of the security concern.
+
+**Impact**
+What could an attacker potentially do?
+
+**Steps to Reproduce**
+If applicable, how can this be reproduced?
+
+**Suggested Fix**
+If you have ideas on how to fix this issue.
+
+**References**
+Any relevant security advisories, CVEs, or documentation.

.github/pull_request_template.md

@@ -0,0 +1,49 @@
+## Description
+
+Please include a summary of the changes and which issue is fixed. Include relevant motivation and context.
+
+Fixes # (issue)
+
+## Type of change
+
+Please delete options that are not relevant.
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Documentation update
+- [ ] Performance improvement
+- [ ] Code refactoring
+
+## How Has This Been Tested?
+
+Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce.
+
+- [ ] Unit tests pass (`npm test`)
+- [ ] Manual testing completed
+- [ ] Tested on Docker deployment
+- [ ] Tested on production-like environment
+
+**Test Configuration**:
+* PicPeak Version:
+* Node.js Version:
+* Database: PostgreSQL / SQLite
+* Browser:
+
+## Checklist:
+
+- [ ] My code follows the style guidelines of this project
+- [ ] I have performed a self-review of my code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation
+- [ ] My changes generate no new warnings
+- [ ] I have added tests that prove my fix is effective or that my feature works
+- [ ] New and existing unit tests pass locally with my changes
+- [ ] Any dependent changes have been merged and published
+- [ ] I have updated the CHANGELOG.md file
+
+## Screenshots (if appropriate):
+
+## Additional Notes:
+
+Add any additional notes, concerns, or discussion points here.

.github/workflows/release.yml

@@ -1,108 +0,0 @@
-name: Create Release
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'frontend/package.json'
-      - 'backend/package.json'
-
-jobs:
-  check-version-change:
-    runs-on: ubuntu-latest
-    outputs:
-      version_changed: ${{ steps.check.outputs.changed }}
-      new_version: ${{ steps.check.outputs.version }}
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Check if version changed
-        id: check
-        run: |
-          # Get current versions
-          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version")
-          BACKEND_VERSION=$(node -p "require('./backend/package.json').version")
-          
-          # Get previous versions
-          git checkout HEAD~1
-          PREV_FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "0.0.0")
-          PREV_BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "0.0.0")
-          
-          # Check if versions changed
-          if [[ "$FRONTEND_VERSION" != "$PREV_FRONTEND_VERSION" ]] || [[ "$BACKEND_VERSION" != "$PREV_BACKEND_VERSION" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-            echo "version=$FRONTEND_VERSION" >> $GITHUB_OUTPUT
-          else
-            echo "changed=false" >> $GITHUB_OUTPUT
-          fi
-
-  create-release:
-    needs: check-version-change
-    if: needs.check-version-change.outputs.version_changed == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Generate Changelog
-        id: changelog
-        run: |
-          # Get commits since last tag
-          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
-          if [[ -z "$LAST_TAG" ]]; then
-            COMMITS=$(git log --oneline)
-          else
-            COMMITS=$(git log ${LAST_TAG}..HEAD --oneline)
-          fi
-          
-          # Format changelog
-          echo "## What's Changed" > changelog.md
-          echo "" >> changelog.md
-          
-          # Group commits by type
-          echo "### Features" >> changelog.md
-          echo "$COMMITS" | grep -E "^[a-f0-9]+ feat:" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No new features*" >> changelog.md
-          
-          echo "" >> changelog.md
-          echo "### Bug Fixes" >> changelog.md
-          echo "$COMMITS" | grep -E "^[a-f0-9]+ fix:" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No bug fixes*" >> changelog.md
-          
-          echo "" >> changelog.md
-          echo "### Other Changes" >> changelog.md
-          echo "$COMMITS" | grep -vE "^[a-f0-9]+ (feat|fix):" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No other changes*" >> changelog.md
-          
-          # Save changelog
-          echo "changelog<<EOF" >> $GITHUB_OUTPUT
-          cat changelog.md >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-      - name: Create Release
-        uses: softprops/action-gh-release@v1
-        with:
-          tag_name: v${{ needs.check-version-change.outputs.new_version }}
-          name: Release v${{ needs.check-version-change.outputs.new_version }}
-          body: |
-            ## PicPeak v${{ needs.check-version-change.outputs.new_version }}
-            
-            ${{ steps.changelog.outputs.changelog }}
-            
-            ### Docker Images
-            
-            To use this release with Docker:
-            ```bash
-            docker pull ghcr.io/${{ github.repository }}/frontend:v${{ needs.check-version-change.outputs.new_version }}
-            docker pull ghcr.io/${{ github.repository }}/backend:v${{ needs.check-version-change.outputs.new_version }}
-            ```
-            
-            Or use the `latest` tag for the most recent version.
-          draft: false
-          prerelease: false
-          generate_release_notes: true

.github/workflows/version-bump.yml

@@ -1,107 +0,0 @@
-name: Automatic Version Bump
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-    inputs:
-      version_type:
-        description: 'Version bump type'
-        required: true
-        default: 'patch'
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  version-bump:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          
-      - name: Configure Git
-        run: |
-          git config --global user.name "GitHub Actions Bot"
-          git config --global user.email "actions@github.com"
-
-      - name: Determine version type
-        id: version_type
-        run: |
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            echo "type=${{ github.event.inputs.version_type }}" >> $GITHUB_OUTPUT
-          else
-            # Auto-detect version type based on commit message
-            COMMIT_MSG="${{ github.event.head_commit.message }}"
-            if [[ "$COMMIT_MSG" == *"BREAKING CHANGE"* ]] || [[ "$COMMIT_MSG" == *"!"* ]]; then
-              echo "type=major" >> $GITHUB_OUTPUT
-            elif [[ "$COMMIT_MSG" == *"feat:"* ]] || [[ "$COMMIT_MSG" == *"feat("* ]]; then
-              echo "type=minor" >> $GITHUB_OUTPUT
-            else
-              echo "type=patch" >> $GITHUB_OUTPUT
-            fi
-          fi
-
-      - name: Bump Frontend Version
-        id: frontend_version
-        working-directory: ./frontend
-        run: |
-          npm version ${{ steps.version_type.outputs.type }} --no-git-tag-version
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
-          
-      - name: Bump Backend Version
-        id: backend_version
-        working-directory: ./backend
-        run: |
-          npm version ${{ steps.version_type.outputs.type }} --no-git-tag-version
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
-
-      - name: Update Frontend VersionInfo component
-        run: |
-          VERSION=${{ steps.frontend_version.outputs.version }}
-          sed -i "s/const FRONTEND_VERSION = '[^']*'/const FRONTEND_VERSION = '$VERSION'/" frontend/src/components/admin/VersionInfo.tsx
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v5
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "chore: bump version to ${{ steps.frontend_version.outputs.version }}"
-          title: "chore: bump version to ${{ steps.frontend_version.outputs.version }}"
-          body: |
-            ## Version Bump
-            
-            This PR automatically bumps the version numbers:
-            - Frontend: `${{ steps.frontend_version.outputs.version }}`
-            - Backend: `${{ steps.backend_version.outputs.version }}`
-            
-            ### Version Type: ${{ steps.version_type.outputs.type }}
-            
-            ### Files Changed:
-            - `frontend/package.json`
-            - `backend/package.json`
-            - `frontend/src/components/admin/VersionInfo.tsx`
-            
-            ---
-            *This PR was automatically created by the version bump workflow.*
-          branch: version-bump-${{ steps.frontend_version.outputs.version }}
-          delete-branch: true
-          labels: |
-            version-bump
-            automated

.gitignore

@@ -54,3 +54,5 @@ coverage/
 !storage/thumbnails/.gitkeep
 !data/.gitkeep
 !logs/.gitkeep
+
+PRODUCTION_DEPLOYMENT_GUIDE.md

BACKUP_VERSION_TRACKING.md

@@ -0,0 +1,152 @@
+# Backup Version Tracking Implementation
+
+## Overview
+Version tracking has been added to the backup system to ensure safe restoration by tracking application versions, Node.js versions, and database schema versions at the time of backup.
+
+## Implementation Details
+
+### 1. Database Schema Changes (Migration 034)
+
+Added version tracking columns to backup tables:
+
+#### `database_backup_runs` table:
+- `app_version` - Application version from package.json
+- `node_version` - Node.js runtime version
+- `db_schema_version` - Latest migration name
+- `environment_info` - JSON with additional environment details
+
+#### `backup_runs` table:
+- `app_version` - Application version
+- `node_version` - Node.js version
+- `db_schema_version` - Database schema version
+- `manifest_info` - Summary of manifest information
+
+#### New `restore_history` table:
+Tracks all restore attempts with comprehensive version information:
+- Backup versions vs current versions
+- Compatibility check results
+- Warnings and errors
+- Restore outcome
+
+### 2. Version Information Captured
+
+During each backup, the system now records:
+- **Application Version**: From `package.json` (e.g., "1.0.77")
+- **Node.js Version**: Runtime version (e.g., "v18.17.0")
+- **Database Schema**: Latest migration file (e.g., "034_add_version_to_backups.js")
+- **Environment Info**: Platform, architecture, environment mode
+
+### 3. Backup Services Updated
+
+#### Database Backup Service (`databaseBackup.js`):
+- Records version info when creating backups
+- Includes versions in statistics JSON
+- New method: `checkVersionCompatibility()` for restore safety
+- New method: `getCurrentSchemaVersion()` to track migrations
+
+#### File Backup Service (`backupService.js`):
+- Records version info in backup_runs table
+- Integrates with manifest system
+- Stores manifest summary with version details
+
+### 4. Existing Manifest System
+
+The `backupManifest.js` already provides comprehensive version tracking:
+- Application version and Node.js version
+- System information (OS, platform, architecture)
+- Database schema version
+- Detailed file and database metadata
+
+### 5. Version Compatibility Checking
+
+When restoring, the system can now:
+- Compare backup version vs current version
+- Detect major/minor version differences
+- Identify schema mismatches
+- Provide warnings and recommendations
+
+### 6. Configuration Settings
+
+New backup settings for version control:
+- `backup_require_version_match` - Enforce exact version matching
+- `backup_allow_minor_version_mismatch` - Allow same major version
+- `backup_warn_on_version_mismatch` - Show warnings on mismatch
+- `backup_check_schema_compatibility` - Validate schema versions
+
+## Usage
+
+### Creating Backups
+Backups automatically capture version information - no changes needed to existing backup workflows.
+
+### Checking Version Before Restore
+
+1. **For Database Backups**:
+```javascript
+const compatibility = await databaseBackupService.checkVersionCompatibility({
+  app_version: '1.0.75',
+  node_version: 'v16.14.0',
+  db_schema_version: '032_add_feedback.js'
+});
+
+if (!compatibility.compatible) {
+  console.error('Version mismatch:', compatibility.errors);
+}
+```
+
+2. **For File Backups**:
+Check the manifest file which contains all version information:
+```bash
+cat /backup/path/manifest-backup-20250122-123456.json | jq '.application'
+```
+
+### Restore History
+All restore attempts are logged in the `restore_history` table with:
+- Version compatibility results
+- Warnings encountered
+- Success/failure status
+- Who performed the restore
+
+## Best Practices
+
+1. **Always Check Compatibility**: Before restoring, verify version compatibility
+2. **Document Version Changes**: Keep changelog updated with breaking changes
+3. **Test Restores**: Regularly test restore procedures in staging
+4. **Monitor Warnings**: Even if compatible, review warnings before proceeding
+5. **Keep Backups Organized**: Label backups with version info in filename
+
+## Migration Instructions
+
+1. Run the new migration:
+```bash
+cd backend
+npm run migrate
+```
+
+2. Existing backups will show "unknown" for version fields
+3. New backups will automatically include version information
+4. The system remains backward compatible with old backups
+
+## Troubleshooting
+
+### Version Mismatch Errors
+- Check current app version: `cat backend/package.json | grep version`
+- Check Node version: `node --version`
+- Check latest migration: `SELECT name FROM knex_migrations ORDER BY id DESC LIMIT 1`
+
+### Restore Failures
+- Review `restore_history` table for detailed error messages
+- Check version compatibility warnings
+- Consider using same version environment for critical restores
+
+## Future Enhancements
+
+1. **Automated Version Matching**: Docker containers with specific versions
+2. **Migration Rollback**: Support for downgrading schema safely
+3. **Version Matrix**: Compatibility matrix for different version combinations
+4. **Restore Wizard**: UI for guided restore with compatibility checks
+
+---
+
+**Implementation Date**: January 2025
+**Current Version**: 1.0.77
+**Status**: Production Ready

CI_CD_STRATEGY.md

@@ -1,118 +0,0 @@
-# CI/CD Strategy for PicPeak
-
-## Overview
-
-This document outlines the CI/CD strategy using both Gitea Actions and Drone CI to avoid conflicts and ensure proper versioning.
-
-## Pipeline Flow
-
-### 1. Development & Testing (Gitea Actions)
-- **Trigger**: Every push to `main` or `develop` branches
-- **File**: `.gitea/workflows/test.yml`
-- **Purpose**: Run tests, linting, and basic validation
-- **Actions**:
-  - Backend linting and tests
-  - Frontend linting and build
-  - Does NOT build Docker images
-
-### 2. Version Management (Gitea Actions)
-- **Trigger**: Push to `main` branch (excluding markdown files)
-- **File**: `.gitea/workflows/version-and-release.yml`
-- **Purpose**: Automatic version incrementing
-- **Actions**:
-  1. Reads current version from `package.json`
-  2. Increments patch version (e.g., 1.0.0 → 1.0.1)
-  3. Updates both backend and frontend `package.json`
-  4. Commits the version change
-  5. Creates a git tag (e.g., `v1.0.1`)
-  6. Pushes changes and tag
-
-### 3. Docker Image Building (Drone CI)
-- **Trigger**: 
-  - Push to `main` or `develop` (builds with commit SHA)
-  - New git tags (builds release versions)
-- **File**: `.drone.yml`
-- **Purpose**: Build and push Docker images
-- **Tags Created**:
-  - `latest` - Always points to newest build
-  - `{commit-sha}` - Specific commit version
-  - `{branch}-latest` - Latest for specific branch
-  - `v1.0.1` - Specific version (on tag trigger)
-
-## Why This Strategy?
-
-1. **Separation of Concerns**:
-   - Gitea Actions handles code quality and versioning
-   - Drone CI handles Docker image building
-   - No overlap or race conditions
-
-2. **Sequential Execution**:
-   - Version bump happens first
-   - Tag creation triggers Drone
-   - Docker images are built with correct version
-
-3. **Version Consistency**:
-   - Version in `package.json` matches git tag
-   - Docker images are tagged with same version
-   - No manual version management needed
-
-## Setup Requirements
-
-1. **Gitea Actions Runner**: Must be configured and running
-2. **Drone CI**: Must be connected to your Gitea instance
-3. **Secrets**: 
-   - `GITEA_TOKEN` (optional, for pushing version commits)
-   - Docker registry credentials in Drone
-
-## Version Numbering
-
-- Format: `MAJOR.MINOR.PATCH` (e.g., 1.0.0)
-- Automatic increments: PATCH version only
-- Manual increments: Edit `package.json` for MAJOR/MINOR changes
-
-## Usage
-
-1. **Regular Development**:
-   ```bash
-   git add .
-   git commit -m "feat: add new feature"
-   git push origin main
-   ```
-   - Tests run automatically
-   - Version bumps to 1.0.1
-   - Docker images built with v1.0.1 tag
-
-2. **Major/Minor Version Change**:
-   ```bash
-   # Manually edit package.json files to 2.0.0
-   git add .
-   git commit -m "feat!: major release"
-   git push origin main
-   ```
-
-3. **Skip Version Bump**:
-   - Add `[skip ci]` to commit message
-   - Or only change markdown files
-
-## Monitoring
-
-- **Gitea Actions**: Check Actions tab in Gitea
-- **Drone CI**: Check Drone dashboard
-- **Docker Registry**: Verify images are pushed with correct tags
-
-## Troubleshooting
-
-1. **Version not incrementing**:
-   - Check Gitea Actions logs
-   - Ensure runner has push permissions
-   - Verify no `[skip ci]` in commit message
-
-2. **Docker images not building**:
-   - Check Drone CI webhook configuration
-   - Verify Drone can see the repository
-   - Check Docker registry credentials
-
-3. **Conflicts**:
-   - Never run both pipelines for same task
-   - Use branch protection to prevent direct pushes
-   - Always let automation handle versioning

CLAUDE.md

@@ -39,6 +39,12 @@ docker-compose -f docker-compose.prod.yml up -d  # Production deployment
 pm2 start ecosystem.config.js                     # Alternative: PM2 deployment
 ```
 
+**⚠️ CRITICAL PRODUCTION NOTICE:**
+- Production runs on a SEPARATE SERVER - never assume local changes affect production
+- ALWAYS request production server details before any troubleshooting
+- NO trial-and-error approaches in production - data loss is unacceptable
+- Every change must be thoroughly analyzed and tested locally first
+
 ## Key Product Requirements (from PRD)
 
 ### Core Features
@@ -111,6 +117,7 @@ Background services run as separate processes:
 - **archiveService**: Creates ZIP archives of expired events
 - **expirationChecker**: Cron job for expiration warnings
 - **fileWatcher**: Monitors for new photo uploads
+- **backupService**: Scheduled backups with checksum-based change detection
 
 ### API Structure
 - `/api/admin/*` - Admin panel endpoints (requires adminAuth)
@@ -127,6 +134,41 @@ Background services run as separate processes:
 5. **Frontend Status**: Only skeleton exists - requires full implementation based on PRD
 6. **Umami Analytics**: Track password entries, downloads, views, expiration warnings
 
+## Troubleshooting Guidelines
+
+### Before ANY Production Troubleshooting:
+1. **ALWAYS request specific details**:
+   - Production server URL/IP
+   - Current error messages/logs
+   - Recent changes or deployments
+   - Affected users/galleries
+   - Time of issue occurrence
+
+2. **Thorough Analysis Required**:
+   - Use detailed thinking/analysis for EVERY troubleshooting task
+   - Review all related code before suggesting changes
+   - Consider all potential side effects
+   - Never make assumptions about production environment
+
+3. **Safe Troubleshooting Steps**:
+   - First, reproduce issue in local/dev environment
+   - Analyze logs without modifying production
+   - Create detailed action plan before any changes
+   - Always have rollback strategy ready
+   - Document every step taken
+
+### Common Issues & Safe Approaches:
+- **Email not sending**: Check email_queue table, SMTP settings, service status
+- **Photos not loading**: Verify file permissions, storage paths, nginx config
+- **Gallery access issues**: Check JWT tokens, expiration dates, access_logs
+- **Performance problems**: Analyze with monitoring tools first, never experiment
+
+### Data Safety Rules:
+- NEVER delete or modify production data without explicit backup confirmation
+- ALWAYS verify backups exist before any data operations
+- NO direct database modifications without transaction safety
+- Log all actions for audit trail
+
 ## Environment Variables
 
 ### Backend (.env)
@@ -253,9 +295,71 @@ const { theme, setTheme, setThemeByName } = useTheme();
 --border-radius: 0.5rem;
 ```
 
+## Backup Service
+
+### Overview
+The backup service provides automated, scheduled backups of all photo data with checksum-based change detection to minimize transfer overhead.
+
+### Features
+- **Multiple Destinations**: Local directory, remote server (rsync), S3-compatible storage
+- **Change Detection**: SHA256 checksums track file changes, only modified files are backed up
+- **Scheduled Execution**: Configurable cron-based scheduling (default: 2 AM daily)
+- **Email Notifications**: Alerts on backup failure, optional success notifications
+- **Retention Management**: Automatic cleanup of old backup runs based on retention policy
+- **Progress Tracking**: Database storage of backup history, file states, and statistics
+
+### Configuration
+Backup settings are stored in `app_settings` table with `backup_` prefix:
+- `backup_enabled`: Enable/disable the service
+- `backup_schedule`: Cron expression (e.g., '0 2 * * *')
+- `backup_destination_type`: 'local', 'rsync', or 's3'
+- `backup_retention_days`: How long to keep backup history
+- `backup_include_archived`: Whether to backup archived events
+- `backup_exclude_patterns`: File patterns to exclude
+
+### API Endpoints
+- `GET /api/admin/backup/config` - Get current configuration
+- `PUT /api/admin/backup/config` - Update configuration
+- `GET /api/admin/backup/status` - Get backup status and history
+- `POST /api/admin/backup/run` - Trigger manual backup
+- `POST /api/admin/backup/test-connection` - Test destination connectivity
+
+### Testing
+Run backup service test: `npm run test-backup`
+
+### Database Tables
+- `backup_runs`: Tracks each backup execution with statistics
+- `backup_file_states`: Stores file checksums for change detection
+
 ## Success Metrics (from PRD)
 - Time to generate gallery: <2 minutes
 - Guest satisfaction: >90%
 - System uptime: 99.9%
 - Email delivery rate: >98%
-- Successful archiving: 100%
+- Successful archiving: 100%
+
+## Documentation & Development Practices
+
+### Documentation Guidelines:
+- **NEVER create new documentation files for simple tasks**
+- **ALWAYS update existing documentation (like this CLAUDE.md)**
+- Only create new .md files when explicitly requested
+- Avoid creating temporary scripts for one-off tasks
+
+### Development Best Practices:
+- Test all changes thoroughly in local environment first
+- Use version control for all changes
+- Keep commits atomic and well-described
+- Review impact on all integrated services
+- Consider backward compatibility
+- Update tests when changing functionality
+
+### Production Deployment Checklist:
+- [ ] All tests passing locally
+- [ ] Linting and type checks pass
+- [ ] Database migrations tested with rollback plan
+- [ ] Environment variables documented
+- [ ] Backup strategy confirmed
+- [ ] Monitoring alerts configured
+- [ ] Rollback procedure documented
+- [ ] Stakeholders notified of maintenance window

CODE_OF_CONDUCT.md

@@ -0,0 +1,27 @@
+# PicPeak Community Guidelines
+
+## Our Commitment
+
+We are committed to providing a welcoming and inspiring community for all photographers and developers.
+
+## Expected Behavior
+
+* Be respectful and considerate
+* Welcome newcomers and help them get started
+* Focus on what is best for the community
+* Show empathy towards other community members
+
+## Unacceptable Behavior
+
+* Trolling or insulting comments
+* Personal attacks
+* Public or private harassment
+* Publishing others' private information
+
+## Enforcement
+
+Instances of unacceptable behavior may be reported to the project team at conduct@example.com. All complaints will be reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from contributor-covenant.org, version 2.0.

CONTRIBUTING.md

@@ -0,0 +1,160 @@
+# Contributing to PicPeak
+
+First off, thank you for considering contributing to PicPeak! It's people like you that make PicPeak such a great tool for photographers worldwide.
+
+## 🤝 Code of Conduct
+
+This project and everyone participating in it is governed by the [PicPeak Code of Conduct](CODE_OF_CONDUCT.md). By participating, you are expected to uphold this code.
+
+## 🎯 How Can I Contribute?
+
+### Reporting Bugs
+
+Before creating bug reports, please check the existing issues as you might find out that you don't need to create one. When you are creating a bug report, please include as many details as possible:
+
+* **Use a clear and descriptive title**
+* **Describe the exact steps to reproduce the problem**
+* **Provide specific examples to demonstrate the steps**
+* **Describe the behavior you observed and what you expected**
+* **Include screenshots if possible**
+* **Include your environment details** (OS, browser, Docker version, etc.)
+
+### Suggesting Enhancements
+
+Enhancement suggestions are tracked as GitHub issues. When creating an enhancement suggestion, please include:
+
+* **Use a clear and descriptive title**
+* **Provide a detailed description of the suggested enhancement**
+* **Provide specific examples to demonstrate the enhancement**
+* **Describe the current behavior and expected behavior**
+* **Explain why this enhancement would be useful**
+
+### Your First Code Contribution
+
+Unsure where to begin? You can start by looking through these issues:
+
+* [Good first issues](https://github.com/the-luap/picpeak/labels/good%20first%20issue) - issues which should only require a few lines of code
+* [Help wanted issues](https://github.com/the-luap/picpeak/labels/help%20wanted) - issues which need extra attention
+
+### Pull Requests
+
+1. **Fork the repo** and create your branch from `main`
+2. **Install dependencies**:
+   ```bash
+   cd backend && npm install
+   cd ../frontend && npm install
+   ```
+3. **Make your changes** and ensure:
+   - Code follows the existing style
+   - Tests pass: `npm test`
+   - Linting passes: `npm run lint`
+4. **Write tests** if you've added code
+5. **Update documentation** if needed
+6. **Create a Pull Request**
+
+## 💻 Development Setup
+
+### Prerequisites
+
+- Node.js 18+
+- Docker & Docker Compose
+- Git
+
+### Local Development
+
+```bash
+# Clone your fork
+git clone https://github.com/your-username/picpeak.git
+cd picpeak
+
+# Install dependencies
+cd backend && npm install
+cd ../frontend && npm install
+
+# Set up environment
+cp .env.example .env
+# Edit .env with your settings
+
+# Start development servers
+docker-compose -f docker-compose.dev.yml up
+```
+
+### Running Tests
+
+```bash
+# Backend tests
+cd backend && npm test
+
+# Frontend tests
+cd frontend && npm test
+
+# E2E tests
+npm run test:e2e
+```
+
+## 📝 Styleguides
+
+### Git Commit Messages
+
+* Use the present tense ("Add feature" not "Added feature")
+* Use the imperative mood ("Move cursor to..." not "Moves cursor to...")
+* Limit the first line to 72 characters or less
+* Reference issues and pull requests liberally after the first line
+* Consider starting the commit message with an applicable emoji:
+  * 🎨 `:art:` when improving the format/structure of the code
+  * 🐛 `:bug:` when fixing a bug
+  * 🔥 `:fire:` when removing code or files
+  * 📝 `:memo:` when writing docs
+  * 🚀 `:rocket:` when improving performance
+  * ✨ `:sparkles:` when adding a new feature
+
+### JavaScript/TypeScript Styleguide
+
+* Use ES6+ features
+* Prefer async/await over promises
+* Use meaningful variable names
+* Add JSDoc comments for functions
+* Follow ESLint rules
+
+### React Styleguide
+
+* Use functional components with hooks
+* Keep components small and focused
+* Use TypeScript for type safety
+* Follow the existing folder structure
+* Write tests for new components
+
+## 📦 Project Structure
+
+```
+picpeak/
+├── backend/
+│   ├── src/
+│   │   ├── routes/      # API endpoints
+│   │   ├── services/    # Business logic
+│   │   ├── middleware/  # Express middleware
+│   │   └── utils/       # Utilities
+│   └── migrations/      # Database migrations
+├── frontend/
+│   ├── src/
+│   │   ├── components/  # Reusable components
+│   │   ├── pages/       # Page components
+│   │   ├── services/    # API services
+│   │   └── hooks/       # Custom hooks
+│   └── public/          # Static assets
+```
+
+## 🔄 Release Process
+
+1. Update version numbers in package.json files
+2. Update CHANGELOG.md
+3. Create a new release on GitHub
+4. Docker images are automatically built and published
+
+## 📮 Contact
+
+- Create an issue for bugs or features
+- Join discussions for questions
+- Email: picpeak@example.com for security issues
+
+Thank you for contributing! 🎉

DEPLOYMENT-TRAEFIK.md

@@ -1,92 +0,0 @@
-# Deployment Guide - Traefik Production Setup
-
-## Overview
-
-This guide explains how to deploy PicPeak with an external Traefik reverse proxy for production use.
-
-## Fixed Issues
-
-1. **Database Migration**: Added missing `created_at` column to `email_queue` table
-2. **502 Bad Gateway**: Properly configured Traefik routing and backend accessibility
-3. **Health Checks**: Fixed health check endpoint imports and paths
-
-## Deployment Steps
-
-### 1. Update Environment Variables
-
-Ensure your `.env` file has the correct URLs:
-```bash
-ADMIN_URL=https://picpeak.nothaft.cloud
-FRONTEND_URL=https://picpeak.nothaft.cloud
-```
-
-### 2. Build Images
-
-```bash
-# Build backend image
-docker build -t picpeak-backend:latest ./backend
-
-# Build frontend image  
-docker build -t picpeak-frontend:latest ./frontend \
-  --build-arg VITE_API_URL=/api \
-  --build-arg VITE_UMAMI_URL=${VITE_UMAMI_URL} \
-  --build-arg VITE_UMAMI_WEBSITE_ID=${VITE_UMAMI_WEBSITE_ID}
-```
-
-### 3. Deploy with Traefik
-
-Use the new Traefik-specific compose file:
-```bash
-docker-compose -f docker-compose.traefik.yml up -d
-```
-
-### 4. Verify Deployment
-
-Check that all services are healthy:
-```bash
-# Check container status
-docker-compose -f docker-compose.traefik.yml ps
-
-# Check backend health
-curl https://picpeak.nothaft.cloud/api/health
-
-# Check logs
-docker-compose -f docker-compose.traefik.yml logs -f backend
-```
-
-## Key Differences from Standard Deployment
-
-1. **No Internal Nginx**: Traefik handles all routing externally
-2. **API Path Stripping**: Traefik strips `/api` prefix when forwarding to backend
-3. **Network Configuration**: Services join external `traefik` network
-4. **Health Checks**: Backend exposes `/health` endpoint (not `/api/health`)
-
-## Why CI/CD Tests Pass But Production Fails
-
-CI/CD tests typically:
-- Use in-memory or temporary databases with fresh migrations
-- Don't test through reverse proxy (direct API calls)
-- Don't run background services (email processor, etc.)
-- Have different network configurations
-
-Production environment has:
-- Persistent database that may have migration state issues
-- Reverse proxy routing complexity
-- All background services running
-- Different security and network constraints
-
-## Troubleshooting
-
-### 502 Bad Gateway
-- Check Traefik network connectivity: `docker network ls`
-- Verify backend is in traefik network: `docker inspect picpeak-backend`
-- Check Traefik logs: `docker logs traefik`
-
-### Database Issues
-- Connect to database: `docker exec -it picpeak-db psql -U picpeak`
-- Check migration status: `SELECT * FROM migrations;`
-- Run migrations manually: `docker exec -it picpeak-backend npm run migrate:safe`
-
-### Email Service Errors
-- Check email queue: `SELECT * FROM email_queue ORDER BY created_at DESC LIMIT 10;`
-- Monitor email processor: `docker logs picpeak-backend | grep "email"`

DEPLOYMENT.md

@@ -1,346 +1,220 @@
-# PicPeak Deployment Guide
+# 🚀 PicPeak Deployment Guide
 
-This guide covers deploying PicPeak for development and production environments.
+This guide will help you deploy PicPeak in production. The entire process takes about 10-15 minutes.
 
-## Table of Contents
-- [Quick Start (Development)](#quick-start-development)
-- [Production Deployment](#production-deployment)
-- [Admin User Setup](#admin-user-setup)
-- [Configuration Reference](#configuration-reference)
-- [Troubleshooting](#troubleshooting)
+## 📋 Prerequisites
 
-## Quick Start (Development)
+- A server with Docker and Docker Compose installed
+- A domain name (for SSL certificates)
+- SMTP credentials for sending emails
+- Basic command line knowledge
 
-### 1. Clone and Setup
+## 🏃 Quick Deploy (Recommended)
+
+### 1. Clone and Configure
 
 ```bash
-git clone https://github.com/yourusername/picpeak.git
+# Clone the repository
+git clone https://github.com/the-luap/picpeak.git
 cd picpeak
 
 # Copy environment template
-cp .env.example .env
-
-# Start development environment
-docker-compose -f docker-compose.dev.yml up -d
-```
-
-### 2. Access Services
-
-- Frontend: http://localhost:3005
-- Backend API: http://localhost:3001
-- MailHog (email testing): http://localhost:8025
-
-### 3. Create Admin User
-
-```bash
-docker-compose -f docker-compose.dev.yml exec backend node scripts/create-admin.js \
-  --email admin@localhost \
-  --username admin \
-  --password admin123
-```
-
-## Production Deployment
-
-### Prerequisites
-
-- Docker and Docker Compose installed
-- Domain with DNS configured
-- SSL/TLS handled by reverse proxy (Traefik, Nginx, etc.)
-
-### 1. Environment Setup
-
-```bash
-# Copy production template
 cp .env.production.example .env
 
-# Generate secure secrets
+# Generate a secure JWT secret
 echo "JWT_SECRET=$(openssl rand -base64 32)" >> .env
-echo "DB_PASSWORD=$(openssl rand -base64 24)" >> .env
+
+# Edit configuration
+nano .env
 ```
 
-Edit `.env` with your configuration:
+### 2. Required Environment Variables
+
+Edit your `.env` file with these essential settings:
 
 ```env
-# Your domain
-ADMIN_URL=https://yourdomain.com
-FRONTEND_URL=https://yourdomain.com
+# Application URLs
+FRONTEND_URL=https://your-domain.com
+BACKEND_URL=https://your-domain.com
 
-# Database (PostgreSQL)
-DB_USER=picpeak
-DB_NAME=picpeak
-# DB_PASSWORD already generated above
-
-# Email
+# Email Configuration (Required for notifications)
 SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
-SMTP_SECURE=true
 SMTP_USER=your-email@gmail.com
 SMTP_PASS=your-app-password
-EMAIL_FROM=noreply@yourdomain.com
-```
+SMTP_FROM=your-email@gmail.com
 
-### 2. Frontend Configuration
+# Admin Configuration
+ADMIN_EMAIL=admin@your-domain.com
+ADMIN_PASSWORD=your-secure-password
 
-```bash
-# Configure frontend for production
-echo "VITE_API_URL=/api" > frontend/.env.production
+# Database (PostgreSQL for production)
+DATABASE_CLIENT=pg
+DB_HOST=postgres
+DB_NAME=picpeak
+DB_USER=picpeak
+DB_PASSWORD=secure-db-password
 ```
 
 ### 3. Deploy with Docker Compose
 
 ```bash
-# Build and start services
+# Start all services
 docker-compose -f docker-compose.prod.yml up -d
 
-# Check status
-docker-compose -f docker-compose.prod.yml ps
+# Check logs
+docker-compose logs -f
 
-# View logs
-docker-compose -f docker-compose.prod.yml logs -f
+# Access your site at https://your-domain.com
 ```
 
-### 4. Deploy with Traefik
+## 🔧 Configuration Options
 
-If using Traefik, create `docker-compose.override.yml`:
+### Storage Settings
 
-```yaml
-version: '3.8'
+```env
+# Storage paths (default: ./storage)
+STORAGE_PATH=./storage
+ARCHIVE_PATH=./storage/archives
 
-services:
-  frontend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
-      - "traefik.http.routers.picpeak.entrypoints=websecure"
-      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
-    networks:
-      - traefik
-      - picpeak
-
-networks:
-  traefik:
-    external: true
+# Gallery expiration (days)
+DEFAULT_EXPIRATION_DAYS=30
+WARNING_DAYS_BEFORE_EXPIRY=7
 ```
 
-## Admin User Setup
+### Security Settings
 
-### Create First Admin
+```env
+# Session timeout (minutes)
+SESSION_TIMEOUT=60
 
-After deployment, create your admin user:
+# Rate limiting
+RATE_LIMIT_WINDOW_MS=900000  # 15 minutes
+RATE_LIMIT_MAX_REQUESTS=100
+```
+
+### Analytics (Optional)
+
+```env
+# Umami Analytics
+VITE_UMAMI_URL=https://analytics.your-domain.com
+VITE_UMAMI_WEBSITE_ID=your-website-id
+```
+
+## 🔒 SSL/TLS Setup
+
+The production Docker Compose includes automatic SSL via Let's Encrypt:
+
+1. **Ensure your domain points to your server**
+2. **Update nginx configuration**:
+   ```bash
+   nano nginx/nginx.conf
+   # Replace your-domain.com with your actual domain
+   ```
+3. **Start services** - Certbot will automatically obtain certificates
+
+## 📁 Directory Structure
+
+After deployment, your directory structure will be:
+
+```
+picpeak/
+├── backend/          # API server
+├── frontend/         # React app
+├── storage/          # Photo storage
+│   ├── events/       # Active galleries
+│   │   ├── active/   # Current photos
+│   │   └── archived/ # Expired galleries
+│   ├── thumbnails/   # Generated thumbnails
+│   └── uploads/      # User uploads
+├── data/            # Database files
+└── logs/            # Application logs
+```
+
+## 🔄 Maintenance
+
+### Backup
 
 ```bash
-# Production
-docker-compose -f docker-compose.prod.yml exec backend node scripts/create-admin.js \
-  --email admin@yourdomain.com \
-  --username admin \
-  --password yourSecurePassword
+# Backup database and photos
+./scripts/backup.sh
 
-# Auto-generate password
-docker-compose -f docker-compose.prod.yml exec backend node scripts/create-admin.js \
-  --email admin@yourdomain.com
+# Backups are stored in ./backups/
 ```
 
-The script will display:
-- ✅ Admin user created successfully!
-- Email: admin@yourdomain.com
-- Username: admin
-- Login URL: https://yourdomain.com/admin/login
-- Password: (save this if auto-generated!)
-
-### Managing Admin Users
-
-```bash
-# List admin users
-docker-compose -f docker-compose.prod.yml exec backend \
-  psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-  -c "SELECT id, username, email, is_active, last_login FROM admin_users;"
-
-# Deactivate user
-docker-compose -f docker-compose.prod.yml exec backend \
-  psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-  -c "UPDATE admin_users SET is_active = false WHERE email = 'user@example.com';"
-```
-
-## Configuration Reference
-
-### Database Configuration
-
-PicPeak automatically detects the environment and uses:
-- **Development**: SQLite (`./data/photo_sharing.db`)
-- **Production**: PostgreSQL (configured via environment variables)
-
-### Environment Variables
-
-#### Required for Production
-
-| Variable | Description | Example |
-|----------|-------------|---------|
-| `JWT_SECRET` | JWT signing key | `openssl rand -base64 32` |
-| `DB_PASSWORD` | PostgreSQL password | `openssl rand -base64 24` |
-| `ADMIN_URL` | Admin panel URL | `https://yourdomain.com` |
-| `FRONTEND_URL` | Frontend URL | `https://yourdomain.com` |
-| `EMAIL_FROM` | Sender email | `noreply@yourdomain.com` |
-
-#### Email Configuration
-
-| Variable | Description | Example |
-|----------|-------------|---------|
-| `SMTP_HOST` | SMTP server | `smtp.gmail.com` |
-| `SMTP_PORT` | SMTP port | `587` |
-| `SMTP_SECURE` | Use TLS | `true` |
-| `SMTP_USER` | SMTP username | `your-email@gmail.com` |
-| `SMTP_PASS` | SMTP password | App-specific password |
-
-### Storage Paths
-
-- Photos: `./storage/events/active/`
-- Archives: `./storage/events/archived/`
-- Thumbnails: `./storage/thumbnails/`
-- Uploads: `./storage/uploads/`
-
-## Backup and Restore
-
-### Backup Database
-
-```bash
-# PostgreSQL backup
-docker-compose -f docker-compose.prod.yml exec db \
-  pg_dump -U picpeak picpeak > backup-$(date +%Y%m%d).sql
-
-# Backup storage
-tar -czf storage-backup-$(date +%Y%m%d).tar.gz ./storage
-```
-
-### Restore Database
-
-```bash
-# PostgreSQL restore
-docker-compose -f docker-compose.prod.yml exec -T db \
-  psql -U picpeak picpeak < backup-20240115.sql
-
-# Restore storage
-tar -xzf storage-backup-20240115.tar.gz
-```
-
-## Monitoring
-
-### Health Checks
-
-```bash
-# Backend health
-curl https://yourdomain.com/api/health
-
-# Frontend health
-curl https://yourdomain.com/health
-```
-
-### Logs
-
-```bash
-# All services
-docker-compose -f docker-compose.prod.yml logs -f
-
-# Specific service
-docker-compose -f docker-compose.prod.yml logs -f backend
-
-# Last 100 lines
-docker-compose -f docker-compose.prod.yml logs --tail=100 backend
-```
-
-## Troubleshooting
-
-### Backend Won't Start
-
-1. Check database connection:
-   ```bash
-   docker-compose -f docker-compose.prod.yml logs db
-   ```
-
-2. Verify environment variables:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend env | grep DB_
-   ```
-
-### Can't Login as Admin
-
-1. Verify admin user exists:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend \
-     psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-     -c "SELECT * FROM admin_users;"
-   ```
-
-2. Reset admin password:
-   ```bash
-   # Create new admin with different email
-   docker-compose -f docker-compose.prod.yml exec backend \
-     node scripts/create-admin.js --email newadmin@yourdomain.com
-   ```
-
-### Photos Not Loading
-
-1. Check file permissions:
-   ```bash
-   ls -la ./storage/events/active/
-   ```
-
-2. Verify nginx proxy configuration:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec frontend \
-     cat /etc/nginx/conf.d/default.conf
-   ```
-
-### Email Not Sending
-
-1. Check email configuration:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend env | grep SMTP_
-   ```
-
-2. View email queue:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend \
-     psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-     -c "SELECT * FROM email_queue WHERE status = 'failed';"
-   ```
-
-## Maintenance
-
-### Update Application
+### Update
 
 ```bash
 # Pull latest changes
 git pull
 
-# Rebuild images
-docker-compose -f docker-compose.prod.yml build
-
-# Restart services
-docker-compose -f docker-compose.prod.yml up -d
+# Rebuild and restart
+docker-compose -f docker-compose.prod.yml up -d --build
 ```
 
-### Clean Up
+### Logs
 
 ```bash
-# Remove unused images
-docker image prune -a
+# View all logs
+docker-compose logs
 
-# Clean up logs
-docker-compose -f docker-compose.prod.yml logs --tail=0 -f
-
-# Remove old archives
-find ./storage/events/archived -name "*.zip" -mtime +90 -delete
+# View specific service
+docker-compose logs backend
+docker-compose logs frontend
 ```
 
-## Security Checklist
+## 🚨 Troubleshooting
 
-- [ ] Generated secure `JWT_SECRET`
-- [ ] Generated secure `DB_PASSWORD`
-- [ ] HTTPS enabled via reverse proxy
-- [ ] Changed default admin credentials
-- [ ] Configured real SMTP server
-- [ ] Set file permissions: `chmod 600 .env`
-- [ ] Firewall configured
-- [ ] Regular backups scheduled
-- [ ] Monitoring enabled
+### Common Issues
+
+**Photos not appearing:**
+- Check storage permissions: `chmod -R 755 storage/`
+- Verify file watcher is running: `docker-compose logs backend | grep watcher`
+
+**Email not sending:**
+- Test SMTP settings: Admin Panel → Settings → Email → Send Test
+- Check email queue: Admin Panel → System → Email Queue
+
+**Can't access admin panel:**
+- Default login: Use email/password from `.env`
+- Reset password: `docker exec picpeak-backend npm run reset-admin`
+
+### Health Check
+
+```bash
+# Check service status
+docker-compose ps
+
+# Test backend API
+curl https://your-domain.com/api/health
+
+# Check disk space
+df -h storage/
+```
+
+## 🐳 Alternative Deployment Methods
+
+### Using Docker Swarm
+
+For high availability deployments, see [Docker Swarm Setup](deploy/README.md).
+
+### Manual Installation
+
+If you prefer not to use Docker:
+
+1. Install Node.js 18+
+2. Install PostgreSQL
+3. Clone repository
+4. Install dependencies: `npm install` in both `/backend` and `/frontend`
+5. Build frontend: `cd frontend && npm run build`
+6. Start services with PM2
+
+## 📞 Support
+
+- 📘 [Documentation](https://github.com/the-luap/picpeak)
+- 🐛 [Report Issues](https://github.com/the-luap/picpeak/issues)
+- 💬 [Discussions](https://github.com/the-luap/picpeak/discussions)
+
+---
+
+**Need help?** Open an issue on GitHub and we'll assist you!

MIGRATION_ERROR_FIX.md

@@ -1,111 +0,0 @@
-# Quick Fix for Migration Error
-
-## Immediate Fix
-
-The error "relation photo_categories already exists" occurs because the database already has tables but the migration tracking doesn't know they were applied.
-
-### Option 1: Use Safe Migration Runner (Recommended)
-
-Update your `docker-compose.prod.yml` to use the safe migration command:
-
-```yaml
-backend:
-  environment:
-    - NODE_ENV=production
-  # ... other config ...
-```
-
-Then update the `wait-for-db.sh` (already done) to use `npm run migrate:safe` in production.
-
-### Option 2: Quick Manual Fix
-
-If you need to fix the running system immediately:
-
-```bash
-# 1. Enter the backend container
-docker-compose -f docker-compose.prod.yml exec backend sh
-
-# 2. Run the safe migration script
-npm run migrate:safe
-
-# 3. If that fails, manually mark migrations as applied:
-docker-compose -f docker-compose.prod.yml exec db psql -U picpeak -d picpeak
-
-# In PostgreSQL:
-CREATE TABLE IF NOT EXISTS migrations (
-  id SERIAL PRIMARY KEY,
-  filename VARCHAR(255) UNIQUE NOT NULL,
-  applied_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-);
-
--- Mark existing migrations as applied
-INSERT INTO migrations (filename) VALUES 
-  ('init.js'),
-  ('004_add_categories_and_cms.js'),
-  ('006_add_photo_counter_to_categories.js'),
-  ('007_add_read_at_to_activity_logs.js'),
-  ('008_add_language_support_to_email_templates.js'),
-  ('009_update_german_email_templates.js'),
-  ('010_add_missing_email_templates.js'),
-  ('011_add_user_upload_settings.js'),
-  ('012_add_hero_photo_id.js'),
-  ('013_fix_email_links_and_date_format.js'),
-  ('014_add_default_welcome_message.js'),
-  ('014_add_host_name_to_events.js'),
-  ('015_add_login_attempts_table.js'),
-  ('016_add_auth_security_columns.js'),
-  ('017_add_token_revocation_tables.js')
-ON CONFLICT (filename) DO NOTHING;
-
-\q
-```
-
-### Option 3: Fresh Start (Nuclear Option)
-
-If you don't have important data yet:
-
-```bash
-# Stop everything
-docker-compose -f docker-compose.prod.yml down
-
-# Remove database volume
-docker volume rm wedding-photo-sharing_postgres_data
-
-# Start fresh
-docker-compose -f docker-compose.prod.yml up -d
-```
-
-## Root Cause
-
-The issue happens when:
-1. Database volume persists between deployments
-2. Migration tracking table gets out of sync
-3. The original migration runner doesn't check for existing tables
-
-## Permanent Solution
-
-The new safe migration runner (`migrate:safe`) handles this by:
-1. Checking if tables exist before creating them
-2. Catching "already exists" errors gracefully
-3. Auto-detecting existing schema and marking migrations as applied
-
-## Next Steps
-
-After fixing the migration issue:
-
-1. Create admin user:
-```bash
-docker-compose -f docker-compose.prod.yml exec backend node scripts/create-admin.js \
-  --username admin \
-  --email admin@yourdomain.com
-```
-
-2. Check health:
-```bash
-curl http://yourdomain.com/api/health
-```
-
-3. Monitor logs:
-```bash
-docker-compose -f docker-compose.prod.yml logs -f backend
-```

PRODUCTION_DEPLOYMENT.md

@@ -1,98 +0,0 @@
-# Production Deployment Guide
-
-This guide explains how to deploy PicPeak in production behind a reverse proxy like Traefik.
-
-## Environment Configuration
-
-### Frontend Configuration
-
-For production deployment behind a reverse proxy (Traefik, Nginx, etc.), the frontend should use relative URLs to automatically inherit the protocol (HTTPS) and domain.
-
-1. Copy the production environment template:
-   ```bash
-   cp frontend/.env.production.example frontend/.env.production
-   ```
-
-2. Set the API URL to use relative path:
-   ```env
-   # frontend/.env.production
-   VITE_API_URL=/api
-   ```
-
-   This ensures all API calls will use the same domain and protocol as the frontend.
-
-### Backend Configuration
-
-Ensure your backend `.env` file has the correct URLs:
-```env
-# backend/.env
-FRONTEND_URL=https://yourdomain.com
-ADMIN_URL=https://yourdomain.com
-```
-
-## Docker Compose Production
-
-When using Docker Compose in production:
-
-1. Build with production environment:
-   ```bash
-   docker-compose -f docker-compose.prod.yml build --build-arg NODE_ENV=production
-   ```
-
-2. The frontend nginx configuration already includes proper proxy settings for:
-   - `/api` → Backend API
-   - `/photos` → Protected photo access
-   - `/thumbnails` → Thumbnail images
-   - `/uploads` → Public uploads (logos, favicons)
-
-## Traefik Configuration
-
-Example Traefik labels for docker-compose:
-
-```yaml
-services:
-  frontend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
-      - "traefik.http.routers.picpeak.entrypoints=websecure"
-      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
-```
-
-## Important Notes
-
-1. **No Hardcoded URLs**: The application uses environment variables with relative URL fallbacks, making it production-ready.
-
-2. **HTTPS Only**: When `VITE_API_URL=/api`, all requests will use the same protocol as the page (HTTPS in production).
-
-3. **CORS Configuration**: The backend CORS is configured to accept requests from the URLs specified in `FRONTEND_URL` and `ADMIN_URL`.
-
-4. **Static Assets**: All static assets (photos, thumbnails, uploads) are served through the nginx proxy, inheriting authentication headers.
-
-## Verification
-
-After deployment, verify:
-
-1. Check browser console for any localhost URLs (there should be none)
-2. Verify all API calls use HTTPS
-3. Check that images load correctly with authentication
-4. Test favicon and logo display
-
-## Troubleshooting
-
-If you see console errors about localhost:
-
-1. Ensure `VITE_API_URL=/api` in frontend environment
-2. Clear browser cache
-3. Rebuild frontend with production environment:
-   ```bash
-   cd frontend
-   npm run build
-   ```
-
-If images don't load:
-
-1. Check that nginx proxy locations are configured
-2. Verify authentication tokens are being sent
-3. Check backend logs for authentication errors

PRODUCTION_DEPLOYMENT_FIXES.md

@@ -1,100 +0,0 @@
-# Production Deployment Fixes
-
-This document describes the fixes applied to resolve production deployment issues in Docker.
-
-## Issues Fixed
-
-### 1. Database Connection Error: "getaddrinfo ENOTFOUND postgres"
-**Problem**: The backend was trying to connect to hostname "postgres" but the database service is named "db" in docker-compose.
-**Solution**: 
-- Updated `knexfile.js` to use correct default host "db" instead of "postgres"
-- Added `depends_on: db` to backend service in docker-compose.prod.yml
-
-### 2. Backend Starting Before Database Ready
-**Problem**: Backend service started before PostgreSQL was ready, causing connection failures.
-**Solution**:
-- Created `wait-for-db.sh` script that waits for PostgreSQL to be ready
-- Updated Dockerfile to install postgresql-client and use the wait script
-- Script also runs migrations automatically on startup
-
-### 3. Email Processor Initialization Failure
-**Problem**: Email processor tried to initialize on module load before database was available.
-**Solution**:
-- Modified `emailProcessor.js` to export initialization functions
-- Updated `server.js` to call initialization after database is ready
-- Added proper error handling for email service initialization
-
-### 4. Missing Environment Variables
-**Problem**: Critical storage path environment variables were missing.
-**Solution**:
-- Added STORAGE_PATH, EVENTS_PATH, and ARCHIVE_PATH to docker-compose.prod.yml
-- Created `.env.example` documenting all required environment variables
-
-### 5. Enhanced Health Check
-**Problem**: Basic health check didn't verify database connectivity.
-**Solution**:
-- Updated `/api/health` endpoint to check database connection
-- Returns proper HTTP 503 status when unhealthy
-
-## Files Modified
-
-1. **backend/knexfile.js** - Fixed production database defaults
-2. **backend/wait-for-db.sh** - Created database wait script
-3. **backend/Dockerfile** - Added postgresql-client and wait script
-4. **docker-compose.prod.yml** - Added dependencies and environment variables
-5. **backend/src/services/emailProcessor.js** - Disabled auto-initialization
-6. **backend/server.js** - Added email initialization and improved health check
-7. **backend/.env.example** - Created environment variable documentation
-
-## Deployment Steps
-
-1. Ensure all environment variables are set according to `.env.example`
-2. Build and deploy with docker-compose:
-   ```bash
-   docker-compose -f docker-compose.prod.yml build
-   docker-compose -f docker-compose.prod.yml up -d
-   ```
-3. The backend will now:
-   - Wait for PostgreSQL to be ready
-   - Run migrations automatically
-   - Initialize all services in proper order
-   - Provide health status at `/api/health`
-
-## Verification
-
-Check deployment health:
-```bash
-curl http://localhost/api/health
-```
-
-Expected response:
-```json
-{
-  "status": "ok",
-  "database": "connected",
-  "timestamp": "2025-07-13T20:30:00.000Z"
-}
-```
-
-## Email Configuration
-
-Email service requires configuration in the database. If email is not configured:
-- The service will log a warning but continue running
-- Emails will be queued but not sent
-- Configure email settings in the admin panel after deployment
-
-## PostgreSQL Connection Fix
-
-### Issue: "no pg_hba.conf entry for host"
-This error occurs when PostgreSQL requires SSL but the client connects without encryption.
-
-### Solution:
-- Disabled SSL requirement for PostgreSQL in Docker environment (`ssl=off`)
-- Added proper authentication method (`scram-sha-256`)
-- This is acceptable for internal Docker networks where all traffic is isolated
-
-### Security Note:
-For production deployments exposed to the internet:
-1. Use SSL certificates for PostgreSQL
-2. Or ensure the database is only accessible within the Docker network
-3. Never expose PostgreSQL port (5432) directly to the internet

PRODUCTION_DEPLOYMENT_GUIDE.md

@@ -1,6 +1,6 @@
 # Production Deployment Guide
 
-This guide addresses all known production deployment issues and provides solutions.
+This comprehensive guide addresses all production deployment scenarios and common issues.
 
 ## Pre-Deployment Checklist
 
@@ -8,50 +8,87 @@ This guide addresses all known production deployment issues and provides solutio
 Create a `.env` file with ALL required variables:
 
 ```bash
-# Required
+# CRITICAL - Must change these!
 JWT_SECRET=<generate-with-openssl-rand-base64-32>
 DB_PASSWORD=<strong-password>
+
+# Application URLs (your actual domain)
 ADMIN_URL=https://yourdomain.com
 FRONTEND_URL=https://yourdomain.com
+BACKEND_URL=https://yourdomain.com
 
-# Database
+# Database (PostgreSQL)
+DATABASE_CLIENT=pg
+DB_HOST=postgres  # or external host
+DB_PORT=5432
 DB_USER=picpeak
 DB_NAME=picpeak
 
-# Email (Optional but recommended)
+# Email Configuration (required for notifications)
 SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
 SMTP_SECURE=false
 SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-password
-EMAIL_FROM=noreply@yourdomain.com
+SMTP_PASS=your-app-password  # Use app-specific password
+EMAIL_FROM=PicPeak <noreply@yourdomain.com>
 
-# Umami Analytics (Optional)
-UMAMI_URL=https://analytics.yourdomain.com
-UMAMI_WEBSITE_ID=your-website-id
-UMAMI_HASH_SALT=<generate-random-string>
+# Port Configuration
+PORT=3001
+
+# Performance Tuning
+DB_POOL_MIN=5
+DB_POOL_MAX=25
+NODE_ENV=production
+LOG_LEVEL=info
+
+# Optional: Umami Analytics (configured via Admin UI)
+# UMAMI_URL=https://analytics.yourdomain.com
+# UMAMI_WEBSITE_ID=your-website-id
 ```
 
 ### 2. Generate Secrets
 
 ```bash
-# Generate JWT Secret
+# Generate JWT Secret (REQUIRED)
 openssl rand -base64 32
 
 # Generate Database Password
 openssl rand -base64 24
-
-# Generate Umami Hash Salt
-openssl rand -hex 32
 ```
 
+## Frontend Configuration
+
+For production deployment behind a reverse proxy:
+
+### Frontend Environment
+```bash
+# frontend/.env.production
+VITE_API_URL=/api  # Uses relative path for reverse proxy
+
+# Optional: Umami fallback (primary config via Admin UI)
+# VITE_UMAMI_URL=https://analytics.yourdomain.com
+# VITE_UMAMI_WEBSITE_ID=your-website-id
+```
+
+This ensures all API calls use the same domain/protocol as the frontend.
+
+### Nginx Proxy Configuration
+
+The frontend nginx configuration already includes proper proxy settings for:
+- `/api` → Backend API
+- `/photos` → Protected photo access
+- `/thumbnails` → Thumbnail images
+- `/uploads` → Public uploads (logos, favicons)
+
+All static assets are served through the nginx proxy, inheriting authentication headers.
+
 ## Deployment Steps
 
 ### 1. Initial Setup
 
 ```bash
 # Clone repository
-git clone https://github.com/yourusername/wedding-photo-sharing.git
+git clone https://github.com/the-luap/wedding-photo-sharing.git
 cd wedding-photo-sharing
 
 # Create required directories
@@ -96,24 +133,31 @@ docker-compose -f docker-compose.prod.yml up -d
 docker-compose -f docker-compose.prod.yml logs -f backend
 ```
 
-### 4. Create Admin User
+### 4. Initial Admin Setup
 
-After deployment, create the first admin user:
+The admin user is automatically created during database migration:
 
 ```bash
-# Enter backend container
-docker-compose -f docker-compose.prod.yml exec backend sh
+# Run migrations (this creates admin user)
+docker-compose -f docker-compose.prod.yml exec backend npm run migrate
 
-# Create admin
-node scripts/create-admin.js \
-  --username admin \
-  --email admin@yourdomain.com \
-  --password <your-secure-password>
+# Admin credentials will be displayed in console and saved to ADMIN_CREDENTIALS.txt
+# Example output:
+# ========================================
+# ✅ Admin user created successfully!
+# ========================================
+# Username: admin
+# Password: SwiftEagle3847!
+# 
+# ⚠️  IMPORTANT: Change password on first login
+# ========================================
 
-# Exit container
-exit
+# Retrieve credentials if needed
+docker-compose -f docker-compose.prod.yml exec backend cat ADMIN_CREDENTIALS.txt
 ```
 
+**Important**: You MUST change the auto-generated password on first login.
+
 ### 5. Configure Email (if using database config)
 
 1. Login to admin panel: https://yourdomain.com/admin
@@ -189,6 +233,23 @@ docker-compose -f docker-compose.prod.yml logs backend | grep email
 
 ## SSL/HTTPS Setup
 
+### Option 1: Using Traefik (Recommended)
+
+Add these labels to your docker-compose override:
+
+```yaml
+services:
+  frontend:
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
+      - "traefik.http.routers.picpeak.entrypoints=websecure"
+      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
+      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
+```
+
+### Option 2: Using Certbot
+
 1. Update `nginx/sites-enabled/default` with your domain
 2. Run certbot:
 
@@ -294,13 +355,18 @@ docker-compose -f docker-compose.prod.yml up -d
 
 - [ ] Strong JWT_SECRET (min 32 chars)
 - [ ] Strong database password
+- [ ] Admin password changed from auto-generated one
 - [ ] SSL/HTTPS enabled
 - [ ] Firewall configured (only 80/443 open)
 - [ ] Regular security updates
 - [ ] Backup encryption
 - [ ] Access logs monitored
-- [ ] Rate limiting enabled
+- [ ] Rate limiting enabled (built-in)
 - [ ] File upload restrictions configured
+- [ ] Password complexity requirements configured (Admin > Settings)
+- [ ] Session timeout configured (default 60 min)
+- [ ] Umami analytics configured (if using)
+- [ ] SMTP credentials secured with app-specific password
 
 ## Support
 

README-LOCAL.md

@@ -1,130 +0,0 @@
-# 🚀 Quick Local Development Setup
-
-Get the photo sharing platform running locally in under 2 minutes!
-
-## Prerequisites
-- Docker Desktop installed and running
-- Git
-- 4GB RAM available
-
-## Quick Start
-
-```bash
-# 1. Clone the repository
-git clone <your-repo-url>
-cd picpeak
-
-# 2. Start everything
-./start-local.sh
-```
-
-That's it! 🎉
-
-## What You Get
-
-| Service | URL | Description |
-|---------|-----|-------------|
-| Frontend (Dev) | http://localhost:3002 | React app with hot reload |
-| Frontend (Prod) | http://localhost:3000 | Production build |
-| Backend API | http://localhost:3001 | Express API |
-| Mailhog | http://localhost:8025 | Email testing UI |
-
-## Default Credentials
-
-- **Admin Login**: Check `ADMIN_CREDENTIALS.txt` after first setup
-- **Test Gallery**: 
-  - Create via Admin Panel
-  - Set your own secure password
-
-## Common Tasks
-
-### View Logs
-```bash
-docker-compose -f docker-compose.local.yml logs -f
-```
-
-### Stop Everything
-```bash
-./stop-local.sh
-```
-
-### Reset Database
-```bash
-docker-compose -f docker-compose.local.yml exec backend npm run migrate
-```
-
-### Add Test Photos
-1. Create a gallery in the admin panel
-2. Get the gallery slug (e.g., `wedding-smith-2024`)
-3. Add photos to: `./storage/events/active/wedding-smith-2024/`
-4. Photos appear automatically!
-
-### Access Backend Shell
-```bash
-docker-compose -f docker-compose.local.yml exec backend sh
-```
-
-## Development Workflow
-
-1. **Frontend Development** (Port 3002)
-   - Hot reload enabled
-   - Edit files in `./frontend/src`
-   - Changes appear instantly
-
-2. **Backend Development** (Port 3001)
-   - Nodemon watches for changes
-   - Edit files in `./backend/src`
-   - Server restarts automatically
-
-3. **Email Testing**
-   - All emails go to Mailhog
-   - View at http://localhost:8025
-   - No real emails sent!
-
-## Troubleshooting
-
-### Backend won't start
-```bash
-# Check logs
-docker-compose -f docker-compose.local.yml logs backend
-
-# Rebuild
-docker-compose -f docker-compose.local.yml build backend
-```
-
-### Frontend build issues
-```bash
-# Clear cache and rebuild
-docker-compose -f docker-compose.local.yml exec frontend-dev npm run build
-```
-
-### Port conflicts
-Edit `docker-compose.local.yml` and change the port mappings:
-- Backend: Change `3001:3000` to `XXXX:3000`
-- Frontend: Change `3002:5173` to `YYYY:5173`
-
-### Reset everything
-```bash
-# Stop and remove all data
-docker-compose -f docker-compose.local.yml down -v
-rm -rf data storage logs
-./start-local.sh
-```
-
-## Tips
-
-- 📧 Check Mailhog for all emails
-- 🔄 Frontend auto-refreshes on save
-- 📁 SQLite DB at `./data/photo_sharing.db`
-- 🖼️ Photos in `./storage/events/active/`
-- 📝 Logs in `./logs/`
-
-## Next Steps
-
-1. Create your first gallery via Admin Panel
-2. Upload some test photos
-3. Test the gallery with password
-4. Check expiration warnings
-5. View emails in Mailhog
-
-Happy coding! 🎨

README.md

@@ -1,32 +1,199 @@
-# Photo Sharing Platform
+# 📸 PicPeak - Open Source Photo Sharing for Events
 
-A secure, self-hosted photo sharing platform designed for weddings and events. Features automatic expiration, email notifications, and simple file-based management.
+<div align="center">
+  <img src="docs/picpeak-logo.png" alt="PicPeak Logo" width="300" />
+  
+  [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+  [![Docker](https://img.shields.io/badge/docker-%230db7ed.svg?style=flat&logo=docker&logoColor=white)](https://www.docker.com/)
+  [![Node.js](https://img.shields.io/badge/node.js-6DA55F?style=flat&logo=node.js&logoColor=white)](https://nodejs.org/)
+  [![React](https://img.shields.io/badge/react-%2320232a.svg?style=flat&logo=react&logoColor=%2361DAFB)](https://reactjs.org/)
+</div>
 
-## Features
+**PicPeak** is a powerful, self-hosted open-source alternative to commercial photo-sharing platforms like PicDrop.com and Scrapbook.de. Designed specifically for photographers and event organizers, PicPeak makes it simple to share beautiful, time-limited photo galleries with clients while maintaining full control over your data and branding.
 
-- 🔒 Password Protected Galleries
-- ⏰ Automatic Expiration
-- 📧 Email Notifications
-- 📁 Simple File Management
-- 📊 Analytics Integration
-- 🎨 Customizable Themes
-- 📱 Mobile Responsive
-- ⚡ Docker Ready
+![PicPeak Gallery Preview](docs/screenshot-gallery.png)
 
-## Quick Start
+## 🌟 Why Choose PicPeak?
 
-1. Clone the repository
-2. Run `./scripts/install.sh`
-3. Configure `.env` file
-4. Setup SSL: `./scripts/setup-ssl.sh`
-5. Start: `docker-compose -f docker-compose.prod.yml up -d`
+Unlike expensive SaaS solutions, PicPeak gives you:
 
-Default credentials: Check ADMIN_CREDENTIALS.txt after first setup
+- **💰 No Monthly Fees** - One-time setup, unlimited galleries
+- **🔒 Complete Data Control** - Your photos stay on your server
+- **🎨 White-Label Ready** - Full branding customization
+- **📱 Mobile-First Design** - Beautiful on all devices
+- **🚀 Lightning Fast** - Optimized performance and caching
+- **🌍 Multi-Language** - Built-in i18n support (EN, DE)
 
-## Documentation
+## ✨ Key Features
 
-See DEPLOYMENT.md for detailed deployment instructions.
+### For Photographers
+- 📁 **Drag & Drop Upload** - Simply drop photos into folders
+- ⏰ **Auto-Expiring Galleries** - Set expiration dates (default: 30 days)
+- 🔐 **Password Protection** - Secure client galleries
+- 📧 **Automated Emails** - Creation confirmations and expiration warnings
+- 📊 **Analytics Dashboard** - Track views, downloads, and engagement
+- 🎨 **Custom Themes** - Match your brand perfectly
 
-## License
+### For Clients
+- 🖼️ **Beautiful Galleries** - Clean, modern interface
+- 📱 **Mobile Optimized** - Swipe through photos on any device
+- ⬇️ **Bulk Downloads** - Download all photos with one click
+- 🔍 **Smart Search** - Find photos quickly
+- 📤 **Guest Uploads** - Optional client photo uploads
 
-MIT License
+### Technical Excellence
+- 🐳 **Docker Ready** - Deploy in minutes
+- 🔄 **Auto-Processing** - Automatic thumbnail generation
+- 💾 **Smart Storage** - Automatic archiving of expired galleries
+- 🛡️ **Security First** - JWT auth, rate limiting, CORS protection
+- 📈 **Scalable** - From small studios to large agencies
+
+## 🚀 Quick Start
+
+Get PicPeak running in under 5 minutes:
+
+```bash
+# Clone the repository
+git clone https://github.com/the-luap/picpeak.git
+cd picpeak
+
+# Copy environment template
+cp .env.example .env
+
+# Edit configuration (required: JWT_SECRET)
+nano .env
+
+# Start with Docker Compose
+docker-compose up -d
+
+# Access at http://localhost:3005
+```
+
+## 📖 Documentation
+
+- 📘 [**Deployment Guide**](DEPLOYMENT.md) - Detailed installation instructions
+- 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
+- 📜 [**License**](LICENSE) - MIT License
+- 🔒 [**Security**](SECURITY.md) - Security policies
+- 📋 [**Code of Conduct**](CODE_OF_CONDUCT.md) - Community guidelines
+
+## 🎯 Use Cases
+
+Perfect for:
+- 💒 **Wedding Photographers** - Share ceremony photos securely
+- 🎂 **Event Photography** - Birthday parties, corporate events
+- 📸 **Portrait Studios** - Client galleries with download limits
+- 🏢 **Corporate Events** - Internal photo sharing with branding
+- 🎓 **School Photography** - Secure parent access with expiration
+
+## 🏗️ Tech Stack
+
+- **Backend**: Node.js, Express, SQLite/PostgreSQL
+- **Frontend**: React, Tailwind CSS, Framer Motion
+- **Storage**: File-based with automatic archiving
+- **Email**: SMTP with customizable templates
+- **Analytics**: Privacy-focused with Umami integration
+
+## 🤝 Contributing
+
+We love contributions! PicPeak is built by photographers, for photographers. Whether you're fixing bugs, adding features, or improving documentation, your help is welcome.
+
+See our [Contributing Guide](CONTRIBUTING.md) for details.
+
+## 📊 Comparison with Alternatives
+
+| Feature | PicPeak | PicDrop | Scrapbook.de |
+|---------|---------|---------|--------------|
+| Self-Hosted | ✅ | ❌ | ❌ |
+| Custom Branding | ✅ Full | Limited | Limited |
+| Monthly Cost | $0 | $29-199 | €19-99 |
+| Storage Limit | Unlimited* | 50-500GB | 100-1000GB |
+| Client Uploads | ✅ | ✅ | ✅ |
+| API Access | ✅ | Paid | ❌ |
+| Open Source | ✅ | ❌ | ❌ |
+
+*Limited only by your server storage
+
+## 🛡️ Security
+
+PicPeak takes security seriously:
+- 🔐 Password hashing with bcrypt
+- 🎫 JWT-based authentication
+- 🚦 Rate limiting on all endpoints
+- 🛡️ CORS protection
+- 📝 Activity logging
+- 🔒 Secure file access
+
+Found a security issue? Please email security@example.com
+
+## 📸 Screenshots
+
+### 🎛️ **Admin Dashboard**
+Get a complete overview of your photo galleries, analytics, and system status.
+
+<img src="docs/screenshot-dashboard.png" alt="PicPeak Admin Dashboard" width="800" />
+
+### 📊 **Analytics & Insights**
+Track gallery performance, view statistics, and monitor user engagement.
+
+<img src="docs/screenshot-analytics.png" alt="PicPeak Analytics Dashboard" width="800" />
+
+### 📁 **Event Management**
+Organize and manage your photo galleries with intuitive event management tools.
+
+<img src="docs/screenshots-events.png" alt="PicPeak Events Management" width="800" />
+
+### ✨ **Key Interface Highlights**
+
+<details>
+<summary>👆 Click to see more interface details</summary>
+
+#### What makes PicPeak's interface special:
+
+- **🎨 Clean Design**: Modern, photographer-friendly interface
+- **📱 Responsive**: Perfect on desktop, tablet, and mobile
+- **⚡ Fast Loading**: Optimized for quick photo browsing
+- **🔒 Secure Access**: Password-protected galleries with expiration
+- **📤 Easy Uploads**: Drag & drop functionality for effortless photo management
+- **🎯 Client-Focused**: Intuitive gallery experience for your clients
+
+</details>
+
+## 🗺️ Roadmap
+
+We're constantly improving PicPeak and welcome contributions from our community! If you have ideas for new features or want to help implement existing ones, please open an issue or submit a pull request. Your contributions help make PicPeak better for everyone.
+
+| Feature | Description | Priority | Status |
+|---------|-------------|----------|---------|
+| **Backup & Restore** | Comprehensive backup system with S3/MinIO support, automated scheduling, and safe restore functionality | High | ✅ Implemented |
+| **Gallery Templates** | Additional gallery layouts and themes (masonry, slideshow, story-style) for different event types | Medium | 🔄 Open |
+| **Face Recognition** | AI-powered face detection to help guests find their photos and create automatic person-based albums | Low | 🔄 Open |
+| **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | 🔄 Open |
+| **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | 🔄 Open |
+
+**Status Legend:** ✅ Implemented | 🚧 In Progress | 🔄 Open | 📋 Planned
+
+## 🙏 Acknowledgments
+
+PicPeak is inspired by the best features of commercial platforms while remaining completely open source. Special thanks to all contributors who make this project possible.
+
+## 📄 License
+
+PicPeak is released under the [MIT License](LICENSE). Use it freely for personal or commercial projects.
+
+## 🚀 Ready to Get Started?
+
+1. ⭐ **Star this repository** to show your support
+2. 📖 Read the [Deployment Guide](DEPLOYMENT.md)
+3. 🐛 Report issues or request features
+4. 🤝 Join our community and contribute!
+
+---
+
+<p align="center">
+  Made with ❤️ by photographers, for photographers
+  <br>
+  <a href="https://github.com/the-luap/picpeak">GitHub</a> •
+  <a href="DEPLOYMENT.md">Documentation</a> •
+  <a href="https://github.com/the-luap/picpeak/issues">Support</a>
+</p>

SECURITY.md

@@ -0,0 +1,85 @@
+# Security Policy
+
+## Supported Versions
+
+We release patches for security vulnerabilities. Currently supported versions:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.x.x   | :white_check_mark: |
+| < 1.0   | :x:                |
+
+## Reporting a Vulnerability
+
+We take the security of PicPeak seriously. If you have discovered a security vulnerability, please follow these steps:
+
+### 1. **Do NOT create a public GitHub issue**
+
+### 2. Email us at security@example.com with:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### 3. You can expect:
+- Acknowledgment within 48 hours
+- Regular updates on our progress
+- Credit in the fix announcement (unless you prefer to remain anonymous)
+
+## Security Measures
+
+PicPeak implements several security measures:
+
+### Authentication & Authorization
+- JWT-based authentication with secure token storage
+- bcrypt password hashing with configurable rounds
+- Role-based access control for admin functions
+- Session timeout management
+
+### Input Validation
+- All user inputs are validated and sanitized
+- SQL injection prevention through parameterized queries
+- XSS protection via Content Security Policy
+- File upload restrictions and validation
+
+### Rate Limiting
+- API rate limiting to prevent abuse
+- Brute force protection on authentication endpoints
+- Configurable limits per endpoint
+
+### Data Protection
+- HTTPS enforcement in production
+- Secure cookie settings
+- CORS configuration
+- Sensitive data encryption
+
+### Infrastructure
+- Regular dependency updates
+- Security headers (HSTS, X-Frame-Options, etc.)
+- Activity logging for audit trails
+- Automated backups
+
+## Best Practices for Deployment
+
+1. **Always use HTTPS** in production
+2. **Change default passwords** immediately
+3. **Keep dependencies updated** regularly
+4. **Configure firewall rules** appropriately
+5. **Monitor logs** for suspicious activity
+6. **Backup regularly** and test restoration
+
+## Vulnerability Disclosure
+
+We believe in responsible disclosure. Once a vulnerability is fixed:
+
+1. We'll publish a security advisory
+2. Credit researchers (with permission)
+3. Detail the impact and mitigation steps
+4. Release patches for all supported versions
+
+## Contact
+
+- Security issues: security@example.com
+- General support: https://github.com/the-luap/picpeak/issues
+
+Thank you for helping keep PicPeak and its users safe!

SETUP_GUIDE.md

@@ -1,252 +0,0 @@
-# PicPeak - Complete Setup Guide
-
-## Repository Created Successfully! 🎉
-
-Your PicPeak repository has been created at:
-**https://gitea.nothaft.cloud/paul/picpeak**
-
-## What's Been Created
-
-I've uploaded the core files needed to run the application:
-
-### ✅ Created Files:
-- `.gitignore` - Git ignore rules
-- `.dockerignore` - Docker ignore rules
-- `.env.example` - Environment configuration template
-- `docker-compose.yml` - Development Docker setup
-- `docker-compose.prod.yml` - Production Docker setup
-- `backend/` - Core backend files including:
-  - `package.json` - Dependencies
-  - `server.js` - Main server file
-  - `Dockerfile` - Backend container config
-  - Core routes and services
-- `setup-remaining-files.sh` - Script to create remaining files
-
-## Next Steps to Complete Setup
-
-### 1. Clone the Repository
-```bash
-git clone https://gitea.local.nothaft.cloud/paul/picpeak.git
-cd picpeak
-```
-
-### 2. Run the Setup Script
-```bash
-chmod +x setup-remaining-files.sh
-./setup-remaining-files.sh
-```
-
-This will create all remaining directories and files needed.
-
-### 3. Create Critical Service Files
-
-Due to the large number of files, I've created the most important ones. You'll need to add these remaining backend services:
-
-#### backend/src/services/expirationChecker.js
-```javascript
-const cron = require('node-cron');
-const { db } = require('../database/db');
-const { archiveEvent } = require('./archiveService');
-const logger = require('../utils/logger');
-
-function startExpirationChecker() {
-  // Check every hour for expired events
-  cron.schedule('0 * * * *', async () => {
-    await checkExpirations();
-  });
-  
-  logger.info('Expiration checker started');
-}
-
-async function checkExpirations() {
-  try {
-    const now = new Date();
-    const warningDate = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
-    
-    // Check for events needing warning emails
-    const eventsNeedingWarning = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', warningDate)
-      .where('expires_at', '>', now);
-    
-    for (const event of eventsNeedingWarning) {
-      const existingWarning = await db('email_queue')
-        .where('event_id', event.id)
-        .where('email_type', 'warning')
-        .first();
-      
-      if (!existingWarning) {
-        await queueExpirationWarning(event);
-      }
-    }
-    
-    // Check for expired events
-    const expiredEvents = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', now);
-    
-    for (const event of expiredEvents) {
-      await handleExpiredEvent(event);
-    }
-    
-  } catch (error) {
-    logger.error('Error checking expirations:', error);
-  }
-}
-
-async function queueExpirationWarning(event) {
-  const daysRemaining = Math.ceil((new Date(event.expires_at) - new Date()) / (1000 * 60 * 60 * 24));
-  
-  await db('email_queue').insert({
-    event_id: event.id,
-    recipient_email: event.host_email,
-    email_type: 'warning',
-    email_data: JSON.stringify({
-      event_name: event.event_name,
-      days_remaining: daysRemaining,
-      share_link: event.share_link
-    })
-  });
-  
-  logger.info(`Queued expiration warning for event ${event.slug}`);
-}
-
-async function handleExpiredEvent(event) {
-  try {
-    await db('events').where('id', event.id).update({ is_active: false });
-    
-    await db('email_queue').insert([
-      {
-        event_id: event.id,
-        recipient_email: event.host_email,
-        email_type: 'expiration',
-        email_data: JSON.stringify({
-          event_name: event.event_name
-        })
-      },
-      {
-        event_id: event.id,
-        recipient_email: event.admin_email,
-        email_type: 'expiration',
-        email_data: JSON.stringify({
-          event_name: event.event_name,
-          event_slug: event.slug
-        })
-      }
-    ]);
-    
-    await archiveEvent(event);
-    
-    logger.info(`Handled expiration for event ${event.slug}`);
-  } catch (error) {
-    logger.error(`Error handling expired event ${event.slug}:`, error);
-  }
-}
-
-module.exports = { startExpirationChecker };
-```
-
-### 4. Create Frontend Files
-
-The frontend needs these key files in `frontend/src/`:
-
-#### App.js
-```javascript
-import React from 'react';
-import { Routes, Route, Navigate } from 'react-router-dom';
-import { AuthProvider } from './contexts/AuthContext';
-import ProtectedRoute from './components/ProtectedRoute';
-
-// Pages
-import Login from './pages/Login';
-import Gallery from './pages/Gallery';
-import AdminLogin from './pages/admin/Login';
-import AdminDashboard from './pages/admin/Dashboard';
-
-function App() {
-  return (
-    <AuthProvider>
-      <Routes>
-        <Route path="/" element={<Navigate to="/gallery" />} />
-        <Route path="/gallery/:slug/:token?" element={<Gallery />} />
-        <Route path="/login/:slug" element={<Login />} />
-        <Route path="/admin/login" element={<AdminLogin />} />
-        <Route path="/admin" element={
-          <ProtectedRoute>
-            <AdminDashboard />
-          </ProtectedRoute>
-        } />
-      </Routes>
-    </AuthProvider>
-  );
-}
-
-export default App;
-```
-
-### 5. Install Dependencies
-
-```bash
-# Backend
-cd backend
-npm install
-
-# Frontend
-cd ../frontend
-npm install
-```
-
-### 6. Configure Environment
-
-Copy `.env.example` to `.env` and update with your settings:
-```bash
-cp .env.example .env
-nano .env
-```
-
-### 7. Start Development Environment
-
-```bash
-# From root directory
-docker-compose up
-```
-
-- Backend: http://localhost:3000
-- Frontend: http://localhost:3001
-- MailHog: http://localhost:8025
-
-## Key Features Implemented
-
-- ✅ Password-protected galleries
-- ✅ Automatic expiration with email warnings
-- ✅ File-based photo management
-- ✅ ZIP archiving on expiration
-- ✅ Separate admin and public interfaces
-- ✅ Email notifications at all stages
-- ✅ Mobile-responsive design
-- ✅ Docker deployment ready
-
-## Production Deployment
-
-1. Update `.env` with production values
-2. Run `./scripts/install.sh` on your server
-3. Configure SSL with `./scripts/setup-ssl.sh`
-4. Start with `docker-compose -f docker-compose.prod.yml up -d`
-
-## Need Help?
-
-The complete implementation includes:
-- Backend API with all routes
-- React frontend with admin panel
-- Email service with templates
-- Automatic file watching
-- Expiration checking
-- Archive service
-- Docker configuration
-- Deployment scripts
-
-All core functionality from your PRD has been implemented. You may need to create some additional UI components based on your specific design preferences.
-
-Default admin credentials: **admin / admin123** (change immediately!)

TODO.md

@@ -1,47 +0,0 @@
-# TODO - Open Items Before Release
-
-## Priority Items
-
-- [ ] **Gallery Mobile View** 
-  - Logout button should only show logo icon (no text)
-  - If photo upload is enabled, move upload button inside menu (not on top bar)
-  - Top bar should show: logo (left), gallery title (center), event date + expiration date
-
-- [ ] **Gallery Preview** 
-  - Preview should correctly reflect the selected grid layout style
-  - Add grid style selector above current top bar
-  - Selector should match the style of event template settings grid selector
-
-- [ ] **Hero Grid Layout** 
-  - Top bar: only menu and logout buttons
-  - Title + logo displayed centered on hero photo
-  - Event date and expiration date also on hero photo
-  - No logo/title in top bar
-
-- [ ] **Logo Testing** - Test new PicPeak logos across all grid styles
-
-- [ ] **Welcome Message** 
-  - Add welcome message to email template when creating new event
-  - Use as personal message in the email
-
-- [ ] **Gallery Upload Function**
-  - Fix scrolling in upload popup when multiple images selected
-  - Save/Cancel buttons unreachable due to incorrect scroll formatting
-
-- [ ] **Watermarks** - Test watermark functionality, styling, and image application
-
-- [ ] **Dashboard Activities** - Remove "show all" link from latest activities widget
-
-- [ ] **Security Audit** - Perform security review and code audit
-
-- [ ] **Drone CI/CD** - Update drone.yaml configuration
-
-- [ ] **Version Management** - Implement automatic version updates on commits/builds
-
-## Completed Items
-
-_(Move completed items here with date)_
-
----
-
-Last updated: 2025-07-10

TRAEFIK_DEPLOYMENT.md

@@ -1,280 +0,0 @@
-# Traefik Deployment Guide
-
-This guide explains how to deploy the PicPeak application with Traefik as the reverse proxy.
-
-## Overview
-
-The application consists of:
-- **Frontend**: React app served by nginx (port 80)
-- **Backend**: Node.js API (port 3000)
-- **Database**: PostgreSQL (port 5432, internal only)
-
-## Traefik Configuration
-
-### 1. Docker Labels for Traefik
-
-Add these labels to your `docker-compose.prod.yml` services:
-
-```yaml
-services:
-  frontend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak-frontend.rule=Host(`picpeak.yourdomain.com`)"
-      - "traefik.http.routers.picpeak-frontend.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-frontend.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak-frontend.loadbalancer.server.port=80"
-      # Priority for catch-all route
-      - "traefik.http.routers.picpeak-frontend.priority=1"
-
-  backend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak-api.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/api`)"
-      - "traefik.http.routers.picpeak-api.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-api.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak-api.loadbalancer.server.port=3000"
-      # Higher priority for API routes
-      - "traefik.http.routers.picpeak-api.priority=10"
-      
-      # Additional routes for backend static files
-      - "traefik.http.routers.picpeak-uploads.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/uploads`)"
-      - "traefik.http.routers.picpeak-uploads.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-uploads.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.picpeak-uploads.service=picpeak-api"
-      - "traefik.http.routers.picpeak-uploads.priority=10"
-      
-      - "traefik.http.routers.picpeak-images.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/images`)"
-      - "traefik.http.routers.picpeak-images.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-images.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.picpeak-images.service=picpeak-api"
-      - "traefik.http.routers.picpeak-images.priority=10"
-```
-
-### 2. Network Configuration
-
-Ensure your services are on the Traefik network:
-
-```yaml
-networks:
-  picpeak:
-    external: false
-  traefik:
-    external: true
-
-services:
-  frontend:
-    networks:
-      - picpeak
-      - traefik
-      
-  backend:
-    networks:
-      - picpeak
-      - traefik
-      
-  db:
-    networks:
-      - picpeak  # Don't expose to traefik
-```
-
-### 3. Remove Nginx Service
-
-Since you're using Traefik, remove the nginx service from `docker-compose.prod.yml`:
-
-```yaml
-# Remove this entire service:
-# nginx:
-#   image: nginx:alpine
-#   ...
-```
-
-## Frontend Configuration
-
-The frontend is built with the API URL set to `/api`. This is important because:
-
-1. All API calls will be relative to the same domain
-2. Traefik will route `/api/*` to the backend service
-3. No CORS issues since everything is on the same domain
-
-## Environment Variables
-
-Ensure these are set correctly:
-
-```bash
-# Backend needs to know the public URLs
-ADMIN_URL=https://picpeak.yourdomain.com
-FRONTEND_URL=https://picpeak.yourdomain.com
-
-# Backend API is accessed via /api path
-API_URL=https://picpeak.yourdomain.com/api
-```
-
-## Complete Example
-
-Here's a complete `docker-compose.prod.yml` for Traefik:
-
-```yaml
-version: '3.8'
-
-networks:
-  picpeak:
-    external: false
-  traefik:
-    external: true
-
-services:
-  backend:
-    image: picpeak-backend:latest
-    build:
-      context: ./backend
-      dockerfile: Dockerfile
-    restart: unless-stopped
-    depends_on:
-      - db
-    environment:
-      - NODE_ENV=production
-      - PORT=3000
-      - JWT_SECRET=${JWT_SECRET}
-      - ADMIN_URL=https://picpeak.yourdomain.com
-      - FRONTEND_URL=https://picpeak.yourdomain.com
-      - DATABASE_CLIENT=pg
-      - DB_HOST=db
-      - DB_PORT=5432
-      - DB_USER=${DB_USER:-picpeak}
-      - DB_PASSWORD=${DB_PASSWORD}
-      - DB_NAME=${DB_NAME:-picpeak}
-      - SMTP_HOST=${SMTP_HOST}
-      - SMTP_PORT=${SMTP_PORT}
-      - SMTP_SECURE=${SMTP_SECURE}
-      - SMTP_USER=${SMTP_USER}
-      - SMTP_PASS=${SMTP_PASS}
-      - EMAIL_FROM=${EMAIL_FROM}
-      - STORAGE_PATH=/app/storage
-      - EVENTS_PATH=/app/storage/events
-      - ARCHIVE_PATH=/app/storage/events/archived
-    volumes:
-      - ./storage:/app/storage
-      - ./data:/app/data
-      - ./logs:/app/logs
-    networks:
-      - picpeak
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak-api.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/api`)"
-      - "traefik.http.routers.picpeak-api.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-api.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak-api.loadbalancer.server.port=3000"
-      - "traefik.http.routers.picpeak-api.priority=10"
-      
-      - "traefik.http.routers.picpeak-uploads.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/uploads`)"
-      - "traefik.http.routers.picpeak-uploads.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-uploads.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.picpeak-uploads.service=picpeak-api"
-      - "traefik.http.routers.picpeak-uploads.priority=10"
-      
-      - "traefik.http.routers.picpeak-images.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/images`)"
-      - "traefik.http.routers.picpeak-images.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-images.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.picpeak-images.service=picpeak-api"
-      - "traefik.http.routers.picpeak-images.priority=10"
-
-  frontend:
-    image: picpeak-frontend:latest
-    build:
-      context: ./frontend
-      dockerfile: Dockerfile
-      args:
-        - VITE_API_URL=/api
-    restart: unless-stopped
-    depends_on:
-      - backend
-    networks:
-      - picpeak
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak-frontend.rule=Host(`picpeak.yourdomain.com`)"
-      - "traefik.http.routers.picpeak-frontend.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-frontend.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak-frontend.loadbalancer.server.port=80"
-      - "traefik.http.routers.picpeak-frontend.priority=1"
-
-  db:
-    image: postgres:14-alpine
-    restart: unless-stopped
-    environment:
-      - POSTGRES_USER=${DB_USER:-picpeak}
-      - POSTGRES_PASSWORD=${DB_PASSWORD}
-      - POSTGRES_DB=${DB_NAME:-picpeak}
-      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
-      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 --auth-local=trust
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    networks:
-      - picpeak
-    command: postgres -c ssl=off
-
-volumes:
-  postgres_data:
-```
-
-## Troubleshooting
-
-### 502 Bad Gateway Errors
-
-1. **Check if backend is running**:
-   ```bash
-   docker-compose -f docker-compose.prod.yml ps
-   docker-compose -f docker-compose.prod.yml logs backend
-   ```
-
-2. **Verify Traefik can reach the backend**:
-   - Ensure both services are on the same Docker network
-   - Check Traefik logs: `docker logs traefik`
-
-3. **Check backend health**:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend curl http://localhost:3000/api/health
-   ```
-
-### Frontend Can't Reach API
-
-1. **Verify API paths don't have double `/api`**:
-   - Frontend should call `/auth/admin/login`, not `/api/auth/admin/login`
-   - The base URL in axios should be `/api`
-
-2. **Check browser console for actual URLs being called**
-
-3. **Ensure Traefik routing rules are correct**:
-   - API routes should have higher priority than frontend catch-all
-
-### CORS Issues
-
-Should not occur since everything is on the same domain. If you see CORS errors:
-1. Check that `FRONTEND_URL` and `ADMIN_URL` match your actual domain
-2. Ensure you're not mixing HTTP and HTTPS
-
-## Testing the Setup
-
-1. **Test API directly**:
-   ```bash
-   curl https://picpeak.yourdomain.com/api/health
-   ```
-
-2. **Test frontend**:
-   ```bash
-   curl https://picpeak.yourdomain.com/
-   ```
-
-3. **Test admin login**:
-   - Navigate to https://picpeak.yourdomain.com/admin/login
-   - Check browser console for any errors
-
-## Important Notes
-
-1. **SSL/TLS**: Traefik handles SSL termination, so the backend doesn't need SSL
-2. **Port Exposure**: Don't expose backend ports directly - let Traefik handle routing
-3. **Health Checks**: Configure Traefik health checks for better reliability
-4. **Rate Limiting**: Consider adding Traefik rate limiting middleware for API routes

TROUBLESHOOTING-TRAEFIK.md

@@ -1,134 +0,0 @@
-# Traefik Troubleshooting Guide
-
-## Common Issues and Solutions
-
-### 1. 404 Errors on API Routes
-
-**Problem**: Getting 404 errors when accessing `/api/*` routes
-
-**Causes**:
-- Traefik routing rules not properly configured
-- Backend container not healthy
-- Path stripping not working correctly
-
-**Solutions**:
-
-1. **Check container health**:
-```bash
-docker ps # Check if backend is running
-docker logs picpeak-backend # Check for startup errors
-```
-
-2. **Test backend directly**:
-```bash
-# Access backend container
-docker exec -it picpeak-backend sh
-
-# Test health endpoint
-wget -O- http://localhost:3000/health
-
-# Test public settings endpoint
-wget -O- http://localhost:3000/public/settings
-```
-
-3. **Check Traefik routing**:
-```bash
-# Check if routes are registered in Traefik
-curl https://traefik.yourdomain.com/api/http/routers | jq '.[] | select(.rule | contains("picpeak"))'
-```
-
-### 2. Backend Not Accessible Through Traefik
-
-**Key Configuration Points**:
-
-1. **Traefik Labels** (in deploy section):
-   - `traefik.enable=true` - Enable Traefik for this container
-   - `traefik.docker.network=proxy` - Specify which network Traefik should use
-   - `traefik.http.routers.picpeak-backend.priority=100` - Higher priority for API routes
-
-2. **Path Stripping**:
-   - Frontend expects `/api/*` but backend serves routes without `/api` prefix
-   - Middleware strips `/api` before forwarding to backend
-
-3. **Network Configuration**:
-   - Backend must be in both `picpeak` (internal) and `proxy` (Traefik) networks
-
-### 3. Environment Variable Issues
-
-**Critical Variables**:
-- `ADMIN_URL` and `FRONTEND_URL` must match your actual domain
-- These affect CORS configuration
-
-**Example .env**:
-```env
-# URLs
-ADMIN_URL=https://picpeak.local.nothaft.cloud
-FRONTEND_URL=https://picpeak.local.nothaft.cloud
-
-# Database
-DB_USER=picpeak
-DB_PASSWORD=your_secure_password
-DB_NAME=picpeak
-
-# JWT
-JWT_SECRET=your_secure_jwt_secret
-
-# Email (optional)
-SMTP_HOST=smtp.example.com
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_USER=noreply@example.com
-SMTP_PASS=smtp_password
-EMAIL_FROM=noreply@example.com
-```
-
-### 4. Debugging Steps
-
-1. **Check if backend is receiving requests**:
-```bash
-# Watch backend logs
-docker logs -f picpeak-backend
-
-# Look for incoming requests when you try to access the admin page
-```
-
-2. **Test API routes directly**:
-```bash
-# From outside
-curl -v https://picpeak.local.nothaft.cloud/api/public/settings
-
-# Should see backend logs if request reaches container
-```
-
-3. **Verify Traefik middleware**:
-```bash
-# Check if stripprefix middleware exists
-curl https://traefik.yourdomain.com/api/http/middlewares | jq '.[] | select(.name | contains("picpeak"))'
-```
-
-### 5. Quick Fix Checklist
-
-- [ ] Backend container is healthy (`docker ps`)
-- [ ] Backend is in both networks (`docker inspect picpeak-backend | grep -A 20 Networks`)
-- [ ] Traefik labels use correct network (`traefik.docker.network=proxy`)
-- [ ] Priority is set correctly (backend: 100, frontend: 10)
-- [ ] ADMIN_URL and FRONTEND_URL match your domain
-- [ ] Database is accessible from backend
-- [ ] Migrations have run successfully
-
-### 6. Alternative Testing
-
-If Traefik routing is problematic, test backend directly:
-
-```bash
-# Port forward to test backend directly
-docker run --rm -it --network picpeak alpine/curl curl http://backend:3000/health
-
-# Or expose backend port temporarily
-docker run -d --name picpeak-backend-test \
-  --network picpeak \
-  -p 3001:3000 \
-  registry.local.nothaft.cloud/picpeak-backend:latest
-```
-
-Then access http://localhost:3001/health to verify backend is working.

backend/.env.example

@@ -3,39 +3,56 @@
 
 # Application
 NODE_ENV=production
-PORT=3000
+PORT=3001
 
 # Security
-JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long
+# Generate with: openssl rand -base64 32
+JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long-example123456
 
-# URLs
-ADMIN_URL=https://yourdomain.com
-FRONTEND_URL=https://yourdomain.com
+# URLs (adjust for your domain)
+ADMIN_URL=https://photos.example.com
+FRONTEND_URL=https://photos.example.com
 
 # Database Configuration
 DATABASE_CLIENT=pg
-DB_HOST=db
+DB_HOST=localhost
 DB_PORT=5432
 DB_USER=picpeak
-DB_PASSWORD=your-secure-database-password
+DB_PASSWORD=your-secure-database-password-change-this
 DB_NAME=picpeak
 
-# Email Configuration
-SMTP_HOST=smtp.example.com
+# Email Configuration (Examples for common providers)
+# Gmail example:
+# SMTP_HOST=smtp.gmail.com
+# SMTP_PORT=587
+# SMTP_SECURE=false
+# SMTP_USER=your-email@gmail.com
+# SMTP_PASS=your-app-specific-password
+
+# SendGrid example:
+SMTP_HOST=smtp.sendgrid.net
 SMTP_PORT=587
 SMTP_SECURE=false
-SMTP_USER=your-smtp-username
-SMTP_PASS=your-smtp-password
-EMAIL_FROM=noreply@yourdomain.com
+SMTP_USER=apikey
+SMTP_PASS=your-sendgrid-api-key
+EMAIL_FROM=noreply@example.com
 
-# Storage Paths (Docker)
+# Storage Paths
+# Docker deployment:
 STORAGE_PATH=/app/storage
 EVENTS_PATH=/app/storage/events
 ARCHIVE_PATH=/app/storage/events/archived
 
-# Analytics (Optional)
-UMAMI_URL=https://analytics.yourdomain.com
-UMAMI_WEBSITE_ID=your-website-id
+# Local development:
+# STORAGE_PATH=./storage
+# EVENTS_PATH=./storage/events
+# ARCHIVE_PATH=./storage/events/archived
+
+# Analytics Backend Configuration (OPTIONAL)
+# Used for server-side tracking only
+# Primary configuration should be done through Admin UI > Settings > Analytics
+# UMAMI_URL=https://analytics.example.com
+# UMAMI_WEBSITE_ID=b4d3c2a1-5678-90ab-cdef-1234567890ab
 
 # Logging
 LOG_LEVEL=info

backend/Dockerfile

@@ -1,5 +1,8 @@
 FROM node:18-alpine AS builder
 
+# Add build argument for cache busting
+ARG CACHEBUST=1
+
 WORKDIR /app
 
 # Copy package files

backend/__tests__/README.md

@@ -0,0 +1,229 @@
+# Enhanced Backup System Test Suite
+
+This directory contains comprehensive tests for the enhanced backup system with S3 support.
+
+## Test Structure
+
+### Unit Tests
+- `services/backupService.enhanced.test.js` - Unit tests for the enhanced backup service
+  - Configuration management
+  - S3 backup functionality
+  - Manifest generation
+  - Error handling and recovery
+  - Backward compatibility (local and rsync)
+  - Service lifecycle management
+
+### Integration Tests
+- `integration/backup-s3.test.js` - Integration tests for S3 backups
+  - Real S3/MinIO connection tests
+  - Full backup process with actual files
+  - Incremental backup verification
+  - Manifest storage and retrieval
+  - Error recovery scenarios
+
+### Manual Integration Test Script
+- `../scripts/test-backup-integration.js` - Comprehensive manual testing script
+  - Can test against MinIO, AWS S3, or any S3-compatible service
+  - Tests all backup types (S3, local, rsync)
+  - Performance testing with large files
+  - Detailed progress reporting
+
+## Running Tests
+
+### Prerequisites
+
+1. **For Unit Tests**: No special setup required, all dependencies are mocked.
+
+2. **For Integration Tests**: Requires a running S3-compatible service (MinIO recommended)
+   ```bash
+   # Start MinIO using Docker
+   docker run -d \
+     -p 9000:9000 \
+     -p 9001:9001 \
+     --name minio-test \
+     -e MINIO_ROOT_USER=minioadmin \
+     -e MINIO_ROOT_PASSWORD=minioadmin \
+     minio/minio server /data --console-address ":9001"
+   ```
+
+3. **Environment Variables** (for integration tests):
+   ```bash
+   # Optional - defaults work with local MinIO
+   export TEST_S3_ENDPOINT=http://localhost:9000
+   export TEST_S3_ACCESS_KEY=minioadmin
+   export TEST_S3_SECRET_KEY=minioadmin
+   
+   # Skip S3 tests if no S3 service available
+   export SKIP_S3_TESTS=true
+   ```
+
+### Running Unit Tests
+
+```bash
+# Run all backup service tests
+npm test -- __tests__/services/backupService.enhanced.test.js
+
+# Run specific test suite
+npm test -- __tests__/services/backupService.enhanced.test.js -t "S3 Backup Functionality"
+
+# Run with coverage
+npm test -- --coverage __tests__/services/backupService.enhanced.test.js
+```
+
+### Running Integration Tests
+
+```bash
+# Ensure MinIO is running first!
+
+# Run S3 integration tests
+npm test -- __tests__/integration/backup-s3.test.js
+
+# Run with verbose output
+npm test -- __tests__/integration/backup-s3.test.js --verbose
+
+# Skip S3 tests if needed
+SKIP_S3_TESTS=true npm test -- __tests__/integration/backup-s3.test.js
+```
+
+### Running Manual Integration Tests
+
+```bash
+# Test with local MinIO (default)
+node scripts/test-backup-integration.js
+
+# Test with AWS S3
+node scripts/test-backup-integration.js \
+  --endpoint https://s3.amazonaws.com \
+  --access-key YOUR_ACCESS_KEY \
+  --secret-key YOUR_SECRET_KEY \
+  --bucket your-test-bucket
+
+# Test local backup
+node scripts/test-backup-integration.js --type local
+
+# Test with cleanup after completion
+node scripts/test-backup-integration.js --cleanup
+
+# Verbose output
+node scripts/test-backup-integration.js --verbose
+```
+
+## Test Coverage
+
+The test suite covers:
+
+### Configuration
+- ✅ Database configuration retrieval
+- ✅ JSON parsing and error handling
+- ✅ Configuration validation
+- ✅ Required field validation
+
+### S3 Functionality
+- ✅ S3 client initialization
+- ✅ Connection testing
+- ✅ File upload with progress tracking
+- ✅ Large file handling (multipart upload)
+- ✅ Metadata and custom headers
+- ✅ Error handling and retries
+
+### Backup Process
+- ✅ Full backup execution
+- ✅ Incremental backup (changed files only)
+- ✅ File checksum calculation and comparison
+- ✅ Database backup inclusion
+- ✅ Archive inclusion toggle
+- ✅ File size limits
+
+### Manifest Generation
+- ✅ Full manifest generation
+- ✅ Incremental manifest with parent reference
+- ✅ JSON and YAML format support
+- ✅ Manifest validation
+- ✅ S3 manifest storage and retrieval
+- ✅ Checksum verification
+
+### Error Handling
+- ✅ S3 connection failures
+- ✅ File read errors
+- ✅ Individual file failure recovery
+- ✅ Retry logic with exponential backoff
+- ✅ Email notifications on failure
+- ✅ Concurrent backup prevention
+
+### Backward Compatibility
+- ✅ Local directory backup
+- ✅ Rsync backup
+- ✅ Existing manifest format support
+
+### Service Management
+- ✅ Cron job scheduling
+- ✅ Service start/stop
+- ✅ Manual backup triggering
+- ✅ Backup history and status
+
+## Mock Setup
+
+The unit tests use comprehensive mocking:
+
+```javascript
+// Database mocking
+jest.mock('../../src/database/db');
+
+// S3 client mocking
+jest.mock('../../src/services/storage/s3Storage');
+
+// File system mocking
+const mockFs = require('mock-fs');
+
+// Cron job mocking
+jest.mock('node-cron');
+```
+
+## CI/CD Integration
+
+To run tests in CI/CD pipeline:
+
+```yaml
+# Example GitHub Actions
+- name: Run Unit Tests
+  run: npm test -- __tests__/services/backupService.enhanced.test.js
+
+- name: Start MinIO
+  run: |
+    docker run -d \
+      -p 9000:9000 \
+      --name minio-test \
+      -e MINIO_ROOT_USER=minioadmin \
+      -e MINIO_ROOT_PASSWORD=minioadmin \
+      minio/minio server /data
+
+- name: Run Integration Tests
+  run: npm test -- __tests__/integration/backup-s3.test.js
+```
+
+## Debugging Tests
+
+```bash
+# Run tests in debug mode
+node --inspect-brk ./node_modules/.bin/jest __tests__/services/backupService.enhanced.test.js
+
+# Run single test with console output
+npm test -- __tests__/services/backupService.enhanced.test.js -t "should perform S3 backup" --verbose
+```
+
+## Performance Considerations
+
+- Integration tests create real files and S3 objects
+- Each test run creates a unique S3 bucket to avoid conflicts
+- Cleanup is automatic but can be disabled for debugging
+- Large file tests (10MB+) are included but can be slow
+
+## Adding New Tests
+
+When adding new backup features:
+
+1. Add unit tests to `backupService.enhanced.test.js`
+2. Add integration tests to `backup-s3.test.js` if S3-specific
+3. Update manual test script for comprehensive testing
+4. Ensure mocks are properly configured
+5. Document any new environment requirements

backend/__tests__/integration/backup-s3.test.js

@@ -0,0 +1,506 @@
+const { describe, it, expect, jest, beforeAll, afterAll, beforeEach, afterEach } = require('@jest/globals');
+const { S3Client, CreateBucketCommand, DeleteBucketCommand, ListObjectsV2Command, DeleteObjectsCommand } = require('@aws-sdk/client-s3');
+const path = require('path');
+const fs = require('fs').promises;
+const crypto = require('crypto');
+
+// Load services
+const backupService = require('../../src/services/backupService');
+const S3StorageAdapter = require('../../src/services/storage/s3Storage');
+const { db, initialize: initDb } = require('../../src/database/db');
+const logger = require('../../src/utils/logger');
+
+// Test configuration
+const TEST_CONFIG = {
+  endpoint: process.env.TEST_S3_ENDPOINT || 'http://localhost:9000',
+  accessKeyId: process.env.TEST_S3_ACCESS_KEY || 'minioadmin',
+  secretAccessKey: process.env.TEST_S3_SECRET_KEY || 'minioadmin',
+  bucket: 'test-backup-bucket-' + Date.now(),
+  region: 'us-east-1'
+};
+
+describe('S3 Backup Integration Tests', () => {
+  let s3Client;
+  let testStoragePath;
+  let originalEnv;
+
+  beforeAll(async () => {
+    // Skip if no S3 endpoint configured
+    if (process.env.SKIP_S3_TESTS === 'true') {
+      console.log('Skipping S3 integration tests (SKIP_S3_TESTS=true)');
+      return;
+    }
+
+    // Save original environment
+    originalEnv = { ...process.env };
+
+    // Initialize S3 client for test setup
+    s3Client = new S3Client({
+      endpoint: TEST_CONFIG.endpoint,
+      region: TEST_CONFIG.region,
+      credentials: {
+        accessKeyId: TEST_CONFIG.accessKeyId,
+        secretAccessKey: TEST_CONFIG.secretAccessKey
+      },
+      forcePathStyle: true
+    });
+
+    // Create test bucket
+    try {
+      await s3Client.send(new CreateBucketCommand({ Bucket: TEST_CONFIG.bucket }));
+      console.log(`Created test bucket: ${TEST_CONFIG.bucket}`);
+    } catch (error) {
+      if (error.name !== 'BucketAlreadyOwnedByYou') {
+        console.error('Failed to create test bucket:', error);
+        throw error;
+      }
+    }
+
+    // Initialize database
+    await initDb();
+    await db.migrate.latest();
+
+    // Create test storage directory
+    testStoragePath = path.join(__dirname, '../fixtures/test-storage');
+    await fs.mkdir(testStoragePath, { recursive: true });
+    process.env.STORAGE_PATH = testStoragePath;
+
+    // Set up test data
+    await setupTestData();
+
+    // Mock logger to reduce noise
+    logger.info = jest.fn();
+    logger.debug = jest.fn();
+    logger.warn = jest.fn();
+    logger.error = jest.fn();
+  });
+
+  afterAll(async () => {
+    if (process.env.SKIP_S3_TESTS === 'true') return;
+
+    try {
+      // Clean up S3 bucket
+      await cleanupS3Bucket();
+      await s3Client.send(new DeleteBucketCommand({ Bucket: TEST_CONFIG.bucket }));
+      console.log(`Deleted test bucket: ${TEST_CONFIG.bucket}`);
+    } catch (error) {
+      console.error('Failed to cleanup S3 bucket:', error);
+    }
+
+    // Clean up test storage
+    await fs.rm(testStoragePath, { recursive: true, force: true });
+
+    // Restore environment
+    process.env = originalEnv;
+
+    // Close database
+    await db.destroy();
+  });
+
+  beforeEach(async () => {
+    if (process.env.SKIP_S3_TESTS === 'true') {
+      return;
+    }
+
+    // Clean backup tables
+    await db('backup_runs').del();
+    await db('backup_file_states').del();
+    await db('database_backup_runs').del();
+
+    // Configure S3 backup settings
+    await configureS3Backup();
+  });
+
+  afterEach(async () => {
+    if (process.env.SKIP_S3_TESTS === 'true') return;
+
+    // Clean up S3 objects created during test
+    await cleanupS3Bucket();
+  });
+
+  describe('S3 Connection and Configuration', () => {
+    it('should successfully connect to S3-compatible storage', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      const s3Adapter = new S3StorageAdapter({
+        ...TEST_CONFIG,
+        bucket: TEST_CONFIG.bucket,
+        forcePathStyle: true,
+        sslEnabled: false
+      });
+
+      const connected = await s3Adapter.testConnection();
+      expect(connected).toBe(true);
+    });
+
+    it('should validate S3 configuration before backup', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Remove required configuration
+      await db('app_settings')
+        .where('setting_key', 'backup_s3_secret_key')
+        .del();
+
+      await backupService.runBackup();
+
+      const lastRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      expect(lastRun.status).toBe('failed');
+      expect(lastRun.error_message).toContain('S3 backup configuration incomplete');
+    });
+  });
+
+  describe('Full S3 Backup Process', () => {
+    it('should perform complete S3 backup with all file types', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Run backup
+      await backupService.runBackup();
+
+      // Verify backup run completed
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      expect(backupRun.status).toBe('completed');
+      expect(backupRun.files_backed_up).toBeGreaterThan(0);
+      expect(backupRun.total_size_bytes).toBeGreaterThan(0);
+
+      // Verify files in S3
+      const s3Objects = await listS3Objects();
+      expect(s3Objects.length).toBeGreaterThan(0);
+
+      // Check for expected file types
+      const hasPhotos = s3Objects.some(obj => obj.Key.includes('events/active'));
+      const hasThumbnails = s3Objects.some(obj => obj.Key.includes('thumbnails'));
+      const hasManifest = s3Objects.some(obj => obj.Key.includes('backup-manifest'));
+      const hasSummary = s3Objects.some(obj => obj.Key.includes('backup-summary.json'));
+
+      expect(hasPhotos).toBe(true);
+      expect(hasThumbnails).toBe(true);
+      expect(hasManifest).toBe(true);
+      expect(hasSummary).toBe(true);
+    });
+
+    it('should handle large file uploads with multipart', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Create a large test file (15MB)
+      const largeFilePath = path.join(testStoragePath, 'events/active/large-photo.jpg');
+      const largeFileSize = 15 * 1024 * 1024; // 15MB
+      const largeFileContent = Buffer.alloc(largeFileSize, 'x');
+      await fs.writeFile(largeFilePath, largeFileContent);
+
+      // Run backup
+      await backupService.runBackup();
+
+      // Verify large file was uploaded
+      const s3Objects = await listS3Objects();
+      const largeFileUploaded = s3Objects.some(obj => 
+        obj.Key.includes('large-photo.jpg') && obj.Size === largeFileSize
+      );
+
+      expect(largeFileUploaded).toBe(true);
+    });
+
+    it('should include database backup when available', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Create a mock database backup
+      const dbBackupPath = path.join(testStoragePath, 'backups/db-backup.sql');
+      await fs.mkdir(path.dirname(dbBackupPath), { recursive: true });
+      await fs.writeFile(dbBackupPath, 'CREATE TABLE test (id INT);');
+
+      // Record database backup
+      await db('database_backup_runs').insert({
+        started_at: new Date(),
+        completed_at: new Date(),
+        status: 'completed',
+        backup_type: 'sqlite',
+        file_path: dbBackupPath,
+        file_size_bytes: 100,
+        checksum: 'test123',
+        statistics: JSON.stringify({ tables: {} }),
+        table_checksums: JSON.stringify({})
+      });
+
+      // Configure to include database
+      await db('app_settings')
+        .where('setting_key', 'backup_include_database')
+        .update({ setting_value: 'true' });
+
+      // Run backup
+      await backupService.runBackup();
+
+      // Verify database backup in S3
+      const s3Objects = await listS3Objects();
+      const hasDbBackup = s3Objects.some(obj => obj.Key.includes('database/db-backup.sql'));
+      expect(hasDbBackup).toBe(true);
+    });
+  });
+
+  describe('Incremental Backup', () => {
+    it('should only upload changed files in incremental backup', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // First backup - full
+      await backupService.runBackup();
+
+      const firstRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      const firstObjectCount = (await listS3Objects()).length;
+
+      // Wait a moment to ensure different timestamps
+      await new Promise(resolve => setTimeout(resolve, 100));
+
+      // Modify one file
+      const modifiedFile = path.join(testStoragePath, 'events/active/event1/photo1.jpg');
+      await fs.writeFile(modifiedFile, 'modified content');
+
+      // Second backup - incremental
+      await backupService.runBackup();
+
+      const secondRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      expect(secondRun.id).not.toBe(firstRun.id);
+      expect(secondRun.files_backed_up).toBe(1); // Only modified file
+
+      // Check manifest indicates incremental
+      if (secondRun.manifest_path) {
+        const manifest = await backupService.getBackupManifest(secondRun.id);
+        expect(manifest.manifest.incremental).toBeDefined();
+        expect(manifest.manifest.incremental.modified_files_count).toBe(1);
+      }
+    });
+
+    it('should track file states across backups', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      await backupService.runBackup();
+
+      // Check file states are recorded
+      const fileStates = await db('backup_file_states').select('*');
+      expect(fileStates.length).toBeGreaterThan(0);
+
+      // Verify checksums are stored
+      const hasChecksums = fileStates.every(state => state.checksum !== null);
+      expect(hasChecksums).toBe(true);
+    });
+  });
+
+  describe('S3 Manifest Storage', () => {
+    it('should upload manifest to S3 and retrieve it', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Configure YAML manifest format
+      await db('app_settings')
+        .where('setting_key', 'backup_manifest_format')
+        .update({ setting_value: '"yaml"' });
+
+      await backupService.runBackup();
+
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      expect(backupRun.manifest_path).toMatch(/^s3:\/\//);
+
+      // Retrieve manifest
+      const { manifest, summary } = await backupService.getBackupManifest(backupRun.id);
+
+      expect(manifest).toBeDefined();
+      expect(manifest.backup.id).toBeDefined();
+      expect(summary).toContain('BACKUP MANIFEST SUMMARY');
+    });
+
+    it('should validate manifest integrity', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      await backupService.runBackup();
+
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      const validationResult = await backupService.validateBackupManifest(backupRun.manifest_path);
+
+      expect(validationResult.valid).toBe(true);
+      expect(validationResult.manifest).toBeDefined();
+    });
+  });
+
+  describe('Error Recovery', () => {
+    it('should handle S3 connection failures gracefully', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Configure with invalid endpoint
+      await db('app_settings')
+        .where('setting_key', 'backup_s3_endpoint')
+        .update({ setting_value: '"http://invalid-endpoint:9999"' });
+
+      await backupService.runBackup();
+
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      expect(backupRun.status).toBe('failed');
+      expect(backupRun.error_message).toBeDefined();
+    });
+
+    it('should continue backup despite individual file failures', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Create a file that will be deleted during backup
+      const tempFile = path.join(testStoragePath, 'events/active/temp.jpg');
+      await fs.writeFile(tempFile, 'temporary');
+
+      // Mock file deletion during backup
+      const originalUpload = S3StorageAdapter.prototype.upload;
+      let callCount = 0;
+      S3StorageAdapter.prototype.upload = jest.fn(async function(localPath, s3Key, options) {
+        callCount++;
+        if (callCount === 2) {
+          // Delete the temp file to cause an error
+          await fs.unlink(tempFile).catch(() => {});
+        }
+        return originalUpload.call(this, localPath, s3Key, options);
+      });
+
+      await backupService.runBackup();
+
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      // Should complete despite one file error
+      expect(backupRun.status).toBe('completed');
+      expect(backupRun.files_backed_up).toBeGreaterThan(0);
+
+      // Restore original method
+      S3StorageAdapter.prototype.upload = originalUpload;
+    });
+
+    it('should retry failed uploads with exponential backoff', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Mock S3 upload to fail twice then succeed
+      const originalUpload = S3StorageAdapter.prototype.upload;
+      let attemptCount = 0;
+      S3StorageAdapter.prototype.upload = jest.fn(async function(localPath, s3Key, options) {
+        attemptCount++;
+        if (attemptCount <= 2) {
+          const error = new Error('Network timeout');
+          error.code = 'ETIMEDOUT';
+          throw error;
+        }
+        return originalUpload.call(this, localPath, s3Key, options);
+      });
+
+      await backupService.runBackup();
+
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      // Should succeed after retries
+      expect(backupRun.status).toBe('completed');
+      expect(attemptCount).toBeGreaterThan(2);
+
+      // Restore original method
+      S3StorageAdapter.prototype.upload = originalUpload;
+    });
+  });
+
+  // Helper functions
+
+  async function setupTestData() {
+    // Create test directory structure
+    const dirs = [
+      'events/active/event1',
+      'events/active/event2',
+      'events/archived',
+      'thumbnails',
+      'uploads'
+    ];
+
+    for (const dir of dirs) {
+      await fs.mkdir(path.join(testStoragePath, dir), { recursive: true });
+    }
+
+    // Create test files
+    const files = [
+      { path: 'events/active/event1/photo1.jpg', content: 'photo1 content' },
+      { path: 'events/active/event1/photo2.jpg', content: 'photo2 content' },
+      { path: 'events/active/event2/photo3.jpg', content: 'photo3 content' },
+      { path: 'events/archived/old-event.zip', content: 'archived content' },
+      { path: 'thumbnails/thumb1.jpg', content: 'thumbnail content' },
+      { path: 'uploads/logo.png', content: 'logo content' }
+    ];
+
+    for (const file of files) {
+      await fs.writeFile(
+        path.join(testStoragePath, file.path),
+        file.content
+      );
+    }
+  }
+
+  async function configureS3Backup() {
+    const settings = [
+      { setting_key: 'backup_enabled', setting_value: 'true' },
+      { setting_key: 'backup_destination_type', setting_value: '"s3"' },
+      { setting_key: 'backup_s3_bucket', setting_value: `"${TEST_CONFIG.bucket}"` },
+      { setting_key: 'backup_s3_region', setting_value: `"${TEST_CONFIG.region}"` },
+      { setting_key: 'backup_s3_endpoint', setting_value: `"${TEST_CONFIG.endpoint}"` },
+      { setting_key: 'backup_s3_access_key', setting_value: `"${TEST_CONFIG.accessKeyId}"` },
+      { setting_key: 'backup_s3_secret_key', setting_value: `"${TEST_CONFIG.secretAccessKey}"` },
+      { setting_key: 'backup_s3_force_path_style', setting_value: 'true' },
+      { setting_key: 'backup_s3_ssl_enabled', setting_value: 'false' },
+      { setting_key: 'backup_include_archived', setting_value: 'true' },
+      { setting_key: 'backup_incremental', setting_value: 'true' },
+      { setting_key: 'backup_max_file_size_mb', setting_value: '100' }
+    ];
+
+    for (const setting of settings) {
+      await db('app_settings')
+        .insert({
+          setting_type: 'backup',
+          ...setting,
+          created_at: new Date(),
+          updated_at: new Date()
+        })
+        .onConflict(['setting_type', 'setting_key'])
+        .merge();
+    }
+  }
+
+  async function listS3Objects() {
+    const response = await s3Client.send(new ListObjectsV2Command({
+      Bucket: TEST_CONFIG.bucket
+    }));
+    return response.Contents || [];
+  }
+
+  async function cleanupS3Bucket() {
+    try {
+      const objects = await listS3Objects();
+      if (objects.length > 0) {
+        await s3Client.send(new DeleteObjectsCommand({
+          Bucket: TEST_CONFIG.bucket,
+          Delete: {
+            Objects: objects.map(obj => ({ Key: obj.Key }))
+          }
+        }));
+      }
+    } catch (error) {
+      console.error('Failed to cleanup S3 objects:', error);
+    }
+  }
+});

backend/__tests__/services/backupService.enhanced.test.js

@@ -0,0 +1,751 @@
+const { describe, it, expect, jest, beforeEach, afterEach } = require('@jest/globals');
+const mockFs = require('mock-fs');
+const path = require('path');
+const crypto = require('crypto');
+const { EventEmitter } = require('events');
+
+// Mock dependencies before requiring the module
+jest.mock('../../src/database/db');
+jest.mock('../../src/utils/logger');
+jest.mock('../../src/services/emailProcessor');
+jest.mock('node-cron');
+jest.mock('../../src/services/backupManifest');
+jest.mock('../../src/services/storage/s3Storage');
+
+const backupService = require('../../src/services/backupService');
+const { db } = require('../../src/database/db');
+const logger = require('../../src/utils/logger');
+const { queueEmail } = require('../../src/services/emailProcessor');
+const cron = require('node-cron');
+const backupManifest = require('../../src/services/backupManifest');
+const S3StorageAdapter = require('../../src/services/storage/s3Storage');
+
+describe('Enhanced Backup Service Tests', () => {
+  let mockDb;
+  let mockS3Client;
+  let mockCronJob;
+
+  beforeEach(() => {
+    // Reset all mocks
+    jest.clearAllMocks();
+    
+    // Mock database
+    mockDb = {
+      select: jest.fn().mockReturnThis(),
+      where: jest.fn().mockReturnThis(),
+      orderBy: jest.fn().mockReturnThis(),
+      limit: jest.fn().mockReturnThis(),
+      first: jest.fn(),
+      insert: jest.fn(),
+      update: jest.fn(),
+      delete: jest.fn()
+    };
+    db.mockReturnValue(mockDb);
+    
+    // Mock cron job
+    mockCronJob = {
+      stop: jest.fn()
+    };
+    cron.schedule.mockReturnValue(mockCronJob);
+    
+    // Mock S3 client
+    mockS3Client = {
+      testConnection: jest.fn().mockResolvedValue(true),
+      upload: jest.fn().mockResolvedValue({ Location: 's3://bucket/key' }),
+      uploadStream: jest.fn().mockResolvedValue({ Location: 's3://bucket/key' }),
+      download: jest.fn().mockResolvedValue(),
+      exists: jest.fn().mockResolvedValue(false),
+      delete: jest.fn().mockResolvedValue(),
+      list: jest.fn().mockResolvedValue({ Contents: [] })
+    };
+    S3StorageAdapter.mockImplementation(() => mockS3Client);
+    
+    // Mock backup manifest
+    backupManifest.generateManifest = jest.fn().mockResolvedValue({
+      backup: { id: 'test-backup-123' },
+      version: '2.0'
+    });
+    backupManifest.saveManifest = jest.fn().mockResolvedValue('/path/to/manifest.json');
+    backupManifest.loadManifest = jest.fn().mockResolvedValue({});
+    backupManifest.validateManifest = jest.fn();
+    backupManifest.generateSummaryReport = jest.fn().mockReturnValue('Summary report');
+    
+    // Mock logger
+    logger.info = jest.fn();
+    logger.error = jest.fn();
+    logger.warn = jest.fn();
+    logger.debug = jest.fn();
+  });
+
+  afterEach(() => {
+    mockFs.restore();
+  });
+
+  describe('getBackupConfig', () => {
+    it('should retrieve and parse backup configuration from database', async () => {
+      const mockSettings = [
+        { setting_key: 'backup_enabled', setting_value: 'true' },
+        { setting_key: 'backup_destination_type', setting_value: '"s3"' },
+        { setting_key: 'backup_s3_bucket', setting_value: '"test-bucket"' },
+        { setting_key: 'backup_retention_days', setting_value: '30' }
+      ];
+      
+      mockDb.select.mockResolvedValue(mockSettings);
+      
+      const config = await backupService.getBackupConfig();
+      
+      expect(config).toEqual({
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_retention_days: 30
+      });
+      
+      expect(db).toHaveBeenCalledWith('app_settings');
+      expect(mockDb.where).toHaveBeenCalledWith('setting_type', 'backup');
+    });
+
+    it('should handle JSON parse errors gracefully', async () => {
+      const mockSettings = [
+        { setting_key: 'backup_enabled', setting_value: 'invalid-json' }
+      ];
+      
+      mockDb.select.mockResolvedValue(mockSettings);
+      
+      const config = await backupService.getBackupConfig();
+      
+      expect(config).toEqual({
+        backup_enabled: 'invalid-json'
+      });
+    });
+
+    it('should return null on database error', async () => {
+      mockDb.select.mockRejectedValue(new Error('Database error'));
+      
+      const config = await backupService.getBackupConfig();
+      
+      expect(config).toBeNull();
+      expect(logger.error).toHaveBeenCalled();
+    });
+  });
+
+  describe('S3 Backup Functionality', () => {
+    beforeEach(() => {
+      // Mock file system
+      mockFs({
+        '/storage/events/active/event1': {
+          'photo1.jpg': Buffer.from('photo1 content'),
+          'photo2.jpg': Buffer.from('photo2 content')
+        },
+        '/storage/events/archived/event2.zip': Buffer.from('archived content'),
+        '/storage/thumbnails': {
+          'thumb1.jpg': Buffer.from('thumb1 content')
+        },
+        '/storage/uploads': {
+          'logo.png': Buffer.from('logo content')
+        }
+      });
+      
+      process.env.STORAGE_PATH = '/storage';
+    });
+
+    it('should perform S3 backup with correct configuration', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_region: 'us-east-1',
+        backup_s3_endpoint: 'https://s3.amazonaws.com',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret',
+        backup_include_archived: true,
+        backup_max_file_size_mb: 100
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.where.mockReturnThis();
+      mockDb.first.mockResolvedValue(null);
+      mockDb.insert.mockResolvedValue([1]);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      jest.spyOn(backupService, 'getDatabaseBackupInfo').mockResolvedValue({
+        type: 'sqlite',
+        backupFile: null,
+        hasChanged: true
+      });
+      
+      await backupService.runBackup();
+      
+      expect(S3StorageAdapter).toHaveBeenCalledWith({
+        bucket: 'test-bucket',
+        region: 'us-east-1',
+        endpoint: 'https://s3.amazonaws.com',
+        accessKeyId: 'test-key',
+        secretAccessKey: 'test-secret',
+        forcePathStyle: false,
+        sslEnabled: true,
+        maxRetries: 3,
+        retryDelay: 1000
+      });
+      
+      expect(mockS3Client.testConnection).toHaveBeenCalled();
+      expect(mockS3Client.upload).toHaveBeenCalled();
+    });
+
+    it('should handle S3 upload failures gracefully', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      mockS3Client.testConnection.mockRejectedValue(new Error('Connection failed'));
+      
+      await backupService.runBackup();
+      
+      expect(logger.error).toHaveBeenCalledWith('S3 backup failed:', expect.any(Error));
+      expect(mockDb.update).toHaveBeenCalledWith(expect.objectContaining({
+        status: 'failed',
+        error_message: expect.stringContaining('Connection failed')
+      }));
+    });
+
+    it('should skip unchanged files in incremental backup', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret',
+        backup_incremental: true
+      };
+      
+      // Mock existing file state
+      mockDb.first.mockImplementation((query) => {
+        if (query === undefined) {
+          return Promise.resolve({
+            file_path: 'events/active/event1/photo1.jpg',
+            checksum: crypto.createHash('sha256').update('photo1 content').digest('hex')
+          });
+        }
+        return Promise.resolve(null);
+      });
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      await backupService.runBackup();
+      
+      // Should skip unchanged file
+      const uploadCalls = mockS3Client.upload.mock.calls;
+      const photo1Uploaded = uploadCalls.some(call => 
+        call[1].includes('photo1.jpg')
+      );
+      expect(photo1Uploaded).toBe(false);
+    });
+
+    it('should include database backup when configured', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret',
+        backup_include_database: true
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      jest.spyOn(backupService, 'getDatabaseBackupInfo').mockResolvedValue({
+        type: 'sqlite',
+        backupFile: '/backup/db-backup.sql',
+        size: 1024000,
+        checksum: 'abc123',
+        hasChanged: false
+      });
+      
+      // Mock database backup file
+      mockFs({
+        '/storage/events/active': {},
+        '/backup/db-backup.sql': Buffer.from('database backup content')
+      });
+      
+      await backupService.runBackup();
+      
+      // Verify database backup was uploaded
+      const uploadCalls = mockS3Client.upload.mock.calls;
+      const dbBackupUploaded = uploadCalls.some(call => 
+        call[1].includes('database/db-backup.sql')
+      );
+      expect(dbBackupUploaded).toBe(true);
+    });
+
+    it('should validate required S3 configuration', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket'
+        // Missing access key and secret key
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      await backupService.runBackup();
+      
+      expect(logger.error).toHaveBeenCalledWith(
+        'S3 backup failed:',
+        expect.objectContaining({
+          message: expect.stringContaining('S3 backup configuration incomplete')
+        })
+      );
+    });
+  });
+
+  describe('Manifest Generation', () => {
+    it('should generate and save manifest for successful backup', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 'local',
+        backup_destination_path: '/backup',
+        backup_manifest_format: 'json'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      mockFs({
+        '/storage/events/active/event1': {
+          'photo1.jpg': Buffer.from('photo1 content')
+        },
+        '/backup': {}
+      });
+      
+      await backupService.runBackup();
+      
+      expect(backupManifest.generateManifest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          backupType: 'full',
+          backupPath: '/backup',
+          format: 'json'
+        })
+      );
+      
+      expect(backupManifest.saveManifest).toHaveBeenCalled();
+    });
+
+    it('should generate incremental manifest when parent exists', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 'local',
+        backup_destination_path: '/backup'
+      };
+      
+      const lastBackup = {
+        id: 1,
+        manifest_path: '/backup/manifests/previous.json',
+        manifest_id: 'previous-backup-123'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([2]);
+      mockDb.first.mockImplementation(() => Promise.resolve(lastBackup));
+      mockDb.orderBy.mockReturnThis();
+      mockDb.where.mockReturnThis();
+      mockDb.whereNot = jest.fn().mockReturnThis();
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      mockFs({
+        '/storage/events/active': {},
+        '/backup': {}
+      });
+      
+      await backupService.runBackup();
+      
+      expect(backupManifest.loadManifest).toHaveBeenCalledWith('/backup/manifests/previous.json');
+      expect(backupManifest.generateIncrementalManifest).toHaveBeenCalled();
+    });
+
+    it('should upload manifest to S3 for S3 backups', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret',
+        backup_manifest_format: 'yaml'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      const manifest = {
+        backup: { id: 'backup-123' },
+        version: '2.0'
+      };
+      backupManifest.generateManifest.mockResolvedValue(manifest);
+      
+      mockFs({
+        '/storage/events/active': {},
+        '/storage/temp': {}
+      });
+      
+      await backupService.runBackup();
+      
+      // Verify manifest was uploaded to S3
+      const uploadCalls = mockS3Client.upload.mock.calls;
+      const manifestUploaded = uploadCalls.some(call => 
+        call[1].includes('manifests/backup-manifest-backup-123.yaml')
+      );
+      expect(manifestUploaded).toBe(true);
+    });
+  });
+
+  describe('Backward Compatibility', () => {
+    it('should support local backup destination', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 'local',
+        backup_destination_path: '/backup/local'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      mockFs({
+        '/storage/events/active/event1': {
+          'photo1.jpg': Buffer.from('photo1 content')
+        },
+        '/backup/local': {}
+      });
+      
+      await backupService.runBackup();
+      
+      // Verify files were copied to local destination
+      const fs = require('fs');
+      const destPath = '/backup/local/events/active/event1/photo1.jpg';
+      expect(fs.existsSync(destPath)).toBe(true);
+    });
+
+    it('should support rsync backup destination', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 'rsync',
+        backup_rsync_host: 'backup.example.com',
+        backup_rsync_user: 'backup',
+        backup_rsync_path: '/remote/backup'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      // Mock exec for rsync
+      const { exec } = require('child_process');
+      const mockExec = jest.fn((cmd, callback) => {
+        callback(null, { stdout: 'Number of files transferred: 1\nTotal file size: 1024 bytes' });
+      });
+      exec.mockImplementation(mockExec);
+      
+      mockFs({
+        '/storage/events/active': {}
+      });
+      
+      await backupService.runBackup();
+      
+      expect(mockExec).toHaveBeenCalledWith(
+        expect.stringContaining('rsync'),
+        expect.any(Function)
+      );
+    });
+  });
+
+  describe('Error Handling and Recovery', () => {
+    it('should handle file read errors gracefully', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      // Mock file that throws error on read
+      const fs = require('fs');
+      const originalCreateReadStream = fs.createReadStream;
+      fs.createReadStream = jest.fn((path) => {
+        if (path.includes('error.jpg')) {
+          const stream = new EventEmitter();
+          process.nextTick(() => stream.emit('error', new Error('File read error')));
+          return stream;
+        }
+        return originalCreateReadStream(path);
+      });
+      
+      mockFs({
+        '/storage/events/active': {
+          'error.jpg': Buffer.from('content'),
+          'good.jpg': Buffer.from('content')
+        }
+      });
+      
+      await backupService.runBackup();
+      
+      // Should continue with other files despite error
+      expect(logger.error).toHaveBeenCalledWith(
+        expect.stringContaining('Failed to backup file'),
+        expect.any(Error)
+      );
+      
+      fs.createReadStream = originalCreateReadStream;
+    });
+
+    it('should send failure email on backup error', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_email_on_failure: true
+      };
+      
+      const admins = [
+        { email: 'admin1@example.com', is_active: true },
+        { email: 'admin2@example.com', is_active: true }
+      ];
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.where.mockReturnThis();
+      
+      jest.spyOn(backupService, 'getBackupConfig')
+        .mockResolvedValueOnce(config)
+        .mockResolvedValueOnce(config);
+      
+      // Force an error
+      jest.spyOn(backupService, 'getFilesToBackup').mockRejectedValue(new Error('Storage error'));
+      
+      // Mock admin users query
+      db.mockImplementation((table) => {
+        if (table === 'admin_users') {
+          return {
+            where: jest.fn().mockResolvedValue(admins)
+          };
+        }
+        return mockDb;
+      });
+      
+      await backupService.runBackup();
+      
+      expect(queueEmail).toHaveBeenCalledTimes(2);
+      expect(queueEmail).toHaveBeenCalledWith(
+        null,
+        'admin1@example.com',
+        'backup_failed',
+        expect.objectContaining({
+          error_message: 'Storage error'
+        })
+      );
+    });
+
+    it('should handle concurrent backup attempts', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 'local',
+        backup_destination_path: '/backup'
+      };
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      mockFs({
+        '/storage/events/active': {},
+        '/backup': {}
+      });
+      
+      // Start two backups concurrently
+      const backup1 = backupService.runBackup();
+      const backup2 = backupService.runBackup();
+      
+      await Promise.all([backup1, backup2]);
+      
+      // Second backup should be skipped
+      expect(logger.warn).toHaveBeenCalledWith('Backup already running, skipping');
+    });
+  });
+
+  describe('Service Lifecycle', () => {
+    it('should start backup service with cron schedule', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_schedule: '0 3 * * *' // 3 AM daily
+      };
+      
+      mockDb.select.mockResolvedValue(
+        Object.entries(config).map(([key, value]) => ({
+          setting_key: key,
+          setting_value: value.toString()
+        }))
+      );
+      
+      await backupService.startBackupService();
+      
+      expect(cron.schedule).toHaveBeenCalledWith('0 3 * * *', expect.any(Function));
+      expect(logger.info).toHaveBeenCalledWith('Backup service started with schedule: 0 3 * * *');
+    });
+
+    it('should stop existing job when restarting service', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_schedule: '0 2 * * *'
+      };
+      
+      mockDb.select.mockResolvedValue(
+        Object.entries(config).map(([key, value]) => ({
+          setting_key: key,
+          setting_value: value.toString()
+        }))
+      );
+      
+      // Start service twice
+      await backupService.startBackupService();
+      await backupService.startBackupService();
+      
+      expect(mockCronJob.stop).toHaveBeenCalled();
+    });
+
+    it('should not start service when backup is disabled', async () => {
+      const config = {
+        backup_enabled: false
+      };
+      
+      mockDb.select.mockResolvedValue([
+        { setting_key: 'backup_enabled', setting_value: 'false' }
+      ]);
+      
+      await backupService.startBackupService();
+      
+      expect(cron.schedule).not.toHaveBeenCalled();
+      expect(logger.info).toHaveBeenCalledWith('Backup service is disabled');
+    });
+  });
+
+  describe('Backup Status and History', () => {
+    it('should return backup status with recent runs', async () => {
+      const recentRuns = [
+        {
+          id: 1,
+          started_at: new Date(),
+          completed_at: new Date(),
+          status: 'completed',
+          files_backed_up: 100,
+          total_size_bytes: 1024000,
+          manifest_path: '/backup/manifest.json'
+        }
+      ];
+      
+      mockDb.limit.mockResolvedValue(recentRuns);
+      
+      backupManifest.validateManifest.mockImplementation(() => true);
+      
+      const status = await backupService.getBackupStatus();
+      
+      expect(status).toEqual({
+        isRunning: false,
+        isHealthy: true,
+        lastRun: expect.objectContaining({
+          ...recentRuns[0],
+          manifestValid: true
+        }),
+        recentRuns: recentRuns,
+        nextScheduledRun: expect.any(String)
+      });
+    });
+
+    it('should clean up old backup runs', async () => {
+      mockDb.delete.mockResolvedValue(5);
+      
+      await backupService.cleanupOldBackupRuns(30);
+      
+      expect(mockDb.where).toHaveBeenCalledWith('started_at', '<', expect.any(Date));
+      expect(mockDb.delete).toHaveBeenCalled();
+      expect(logger.info).toHaveBeenCalledWith('Cleaned up 5 old backup runs');
+    });
+  });
+
+  describe('getBackupManifest', () => {
+    it('should retrieve manifest from local filesystem', async () => {
+      const backupRun = {
+        id: 1,
+        manifest_path: '/backup/manifests/backup-123.json'
+      };
+      
+      mockDb.first.mockResolvedValue(backupRun);
+      
+      const manifest = { backup: { id: 'backup-123' } };
+      backupManifest.loadManifest.mockResolvedValue(manifest);
+      backupManifest.generateSummaryReport.mockReturnValue('Summary');
+      
+      const result = await backupService.getBackupManifest(1);
+      
+      expect(result).toEqual({
+        manifest: manifest,
+        summary: 'Summary'
+      });
+    });
+
+    it('should retrieve manifest from S3', async () => {
+      const backupRun = {
+        id: 1,
+        manifest_path: 's3://test-bucket/backups/manifests/backup-123.json'
+      };
+      
+      mockDb.first.mockResolvedValue(backupRun);
+      mockDb.select.mockResolvedValue([
+        { setting_key: 'backup_s3_access_key', setting_value: '"test-key"' },
+        { setting_key: 'backup_s3_secret_key', setting_value: '"test-secret"' }
+      ]);
+      
+      const manifest = { backup: { id: 'backup-123' } };
+      backupManifest.loadManifest.mockResolvedValue(manifest);
+      
+      await backupService.getBackupManifest(1);
+      
+      expect(S3StorageAdapter).toHaveBeenCalled();
+      expect(mockS3Client.download).toHaveBeenCalledWith(
+        'backups/manifests/backup-123.json',
+        expect.any(String)
+      );
+    });
+  });
+});

backend/docs/SECURITY_LOGGING.md

@@ -0,0 +1,161 @@
+# Security Logging Documentation
+
+## Overview
+This document describes the comprehensive security logging implemented in the PicPeak application to track authentication failures, rate limiting, and suspicious activities.
+
+## Log Files
+
+### 1. **security.log**
+- Location: `logs/security.log`
+- Contains: All security-related events (authentication, rate limiting, suspicious activity)
+- Max Size: 20MB with rotation (keeps 10 files)
+- Format: JSON with timestamp
+
+### 2. **error.log**
+- Location: `logs/error.log`
+- Contains: All error-level logs including auth failures
+- Max Size: 10MB with rotation (keeps 5 files)
+
+### 3. **combined.log**
+- Location: `logs/combined.log`
+- Contains: All logs (info, warn, error)
+- Max Size: 50MB with rotation (keeps 10 files)
+
+## Security Events Logged
+
+### Rate Limiting
+When rate limits are exceeded, the following is logged:
+```json
+{
+  "timestamp": "2024-01-18 14:23:45.123",
+  "level": "warn",
+  "message": "Rate limit exceeded",
+  "security": true,
+  "ip": "192.168.1.1",
+  "path": "/api/admin/login",
+  "method": "POST",
+  "authenticated": false,
+  "userAgent": "Mozilla/5.0...",
+  "referer": "https://app.example.com",
+  "origin": "https://app.example.com",
+  "headers": {
+    "x-forwarded-for": "192.168.1.1",
+    "x-real-ip": "192.168.1.1"
+  },
+  "requestUrl": "/api/admin/login",
+  "rateLimitInfo": {
+    "limit": 5,
+    "current": 6,
+    "remaining": 0,
+    "resetTime": "2024-01-18T14:38:45.123Z"
+  }
+}
+```
+
+### Authentication Failures
+
+#### Admin Login Failures
+- Tracked in `login_attempts` table
+- Logged with: IP address, username, user agent, timestamp
+- Account lockout after 5 failures in 15 minutes
+
+#### Gallery Password Failures
+- Tracked in `access_logs` table with action='login_fail'
+- Logged with: event_id, IP address, user agent
+- Gallery lockout after 5 failures in 15 minutes
+
+### JWT Validation Failures
+```json
+{
+  "timestamp": "2024-01-18 14:23:45.123",
+  "level": "warn",
+  "message": "JWT validation failed",
+  "ip": "192.168.1.1",
+  "path": "/api/admin/events",
+  "method": "GET",
+  "userAgent": "Mozilla/5.0...",
+  "error": "TokenExpiredError",
+  "message": "jwt expired"
+}
+```
+
+### Suspicious Activity
+- Multiple IPs attempting login for same account
+- Token usage from different IP than issued
+- Token usage after password change
+- Revoked token usage attempts
+
+## Configuration Settings
+
+All rate limiting settings are configurable via the admin panel:
+
+| Setting | Default | Range | Description |
+|---------|---------|-------|-------------|
+| rate_limit_enabled | true | - | Enable/disable rate limiting |
+| rate_limit_window_minutes | 15 | 1-60 | Time window for rate limit |
+| rate_limit_max_requests | 1000 | 10-10000 | Max requests for general endpoints |
+| rate_limit_auth_max_requests | 5 | 1-100 | Max requests for auth endpoints |
+| rate_limit_skip_authenticated | true | - | Skip rate limit for authenticated requests |
+| rate_limit_public_endpoints_only | false | - | Only rate limit public endpoints |
+
+## Database Tables
+
+### login_attempts
+```sql
+- id
+- username
+- ip_address
+- user_agent
+- success (boolean)
+- created_at
+```
+
+### access_logs
+```sql
+- id
+- event_id
+- ip_address
+- user_agent
+- action ('view', 'download', 'login_success', 'login_fail')
+- photo_id (nullable)
+- created_at
+```
+
+## Environment Variables
+
+- `LOG_LEVEL`: Set logging level (default: 'info')
+- `LOG_TO_CONSOLE`: Enable console logging in production (default: false)
+
+## Monitoring Recommendations
+
+1. **Set up alerts for:**
+   - Rate limit exceeded events (possible DDoS)
+   - Multiple failed login attempts from same IP
+   - Account lockout events
+   - JWT validation failures spike
+
+2. **Regular review:**
+   - Check security.log for patterns
+   - Review login_attempts table for brute force attempts
+   - Monitor access_logs for suspicious gallery access patterns
+
+3. **Log analysis tools:**
+   - Use log aggregation tools (ELK stack, Splunk)
+   - Set up dashboards for security metrics
+   - Configure alerts for threshold breaches
+
+## Production Deployment Notes
+
+1. Ensure logs directory has proper permissions
+2. Set up log rotation outside of application if needed
+3. Consider shipping logs to centralized logging service
+4. Monitor disk space for log files
+5. Set `LOG_TO_CONSOLE=true` for container deployments
+
+## Security Best Practices
+
+1. Never log sensitive data (passwords, tokens)
+2. Use generic error messages to prevent user enumeration
+3. Clean up old login attempts regularly (7 days retention)
+4. Monitor for unusual patterns in real-time
+5. Keep rate limit settings appropriate for your usage

backend/knexfile.js

@@ -40,10 +40,10 @@ const config = {
       keepAliveInitialDelayMillis: 0
     },
     pool: {
-      min: 2,
-      max: 10,
-      acquireTimeoutMillis: 30000,
-      createTimeoutMillis: 30000,
+      min: 5,
+      max: 25,
+      acquireTimeoutMillis: 60000,
+      createTimeoutMillis: 60000,
       idleTimeoutMillis: 30000,
       reapIntervalMillis: 1000,
       createRetryIntervalMillis: 200,

backend/migrations/021_add_default_cms_pages.js

@@ -0,0 +1,121 @@
+exports.up = async function(knex) {
+  // Check if CMS pages already exist
+  const impressumExists = await knex('cms_pages')
+    .where('slug', 'impressum')
+    .first();
+    
+  const datenschutzExists = await knex('cms_pages')
+    .where('slug', 'datenschutz')
+    .first();
+  
+  const pagesToInsert = [];
+  
+  // Add Impressum page if it doesn't exist
+  if (!impressumExists) {
+    pagesToInsert.push({
+      slug: 'impressum',
+      title_en: 'Legal Notice',
+      title_de: 'Impressum',
+      content_en: `<h1>Legal Notice</h1>
+<p>Information according to § 5 TMG</p>
+
+<h2>Responsible for content</h2>
+<p>[Your Name]<br>
+[Your Address]<br>
+[Postal Code City]</p>
+
+<h2>Contact</h2>
+<p>Email: [Your Email Address]<br>
+Phone: [Your Phone Number]</p>
+
+<h2>Disclaimer</h2>
+<h3>Liability for content</h3>
+<p>The contents of our pages were created with great care. However, we cannot guarantee the accuracy, completeness and timeliness of the content.</p>
+
+<h3>Liability for links</h3>
+<p>Our website contains links to external third-party websites over whose content we have no influence. Therefore, we cannot accept any liability for this third-party content.</p>`,
+      content_de: `<h1>Impressum</h1>
+<p>Angaben gemäß § 5 TMG</p>
+
+<h2>Verantwortlich für den Inhalt</h2>
+<p>[Ihr Name]<br>
+[Ihre Adresse]<br>
+[PLZ Ort]</p>
+
+<h2>Kontakt</h2>
+<p>E-Mail: [Ihre E-Mail-Adresse]<br>
+Telefon: [Ihre Telefonnummer]</p>
+
+<h2>Haftungsausschluss</h2>
+<h3>Haftung für Inhalte</h3>
+<p>Die Inhalte unserer Seiten wurden mit größter Sorgfalt erstellt. Für die Richtigkeit, Vollständigkeit und Aktualität der Inhalte können wir jedoch keine Gewähr übernehmen.</p>
+
+<h3>Haftung für Links</h3>
+<p>Unser Angebot enthält Links zu externen Webseiten Dritter, auf deren Inhalte wir keinen Einfluss haben. Deshalb können wir für diese fremden Inhalte auch keine Gewähr übernehmen.</p>`,
+      updated_at: new Date()
+    });
+  }
+  
+  // Add Datenschutz page if it doesn't exist
+  if (!datenschutzExists) {
+    pagesToInsert.push({
+      slug: 'datenschutz',
+      title_en: 'Privacy Policy',
+      title_de: 'Datenschutzerklärung',
+      content_en: `<h1>Privacy Policy</h1>
+
+<h2>1. Privacy at a Glance</h2>
+<h3>General Information</h3>
+<p>The following information provides a simple overview of what happens to your personal data when you visit this website.</p>
+
+<h3>Data Collection on This Website</h3>
+<p><strong>Who is responsible for data collection on this website?</strong></p>
+<p>Data processing on this website is carried out by the website operator. Their contact details can be found in the legal notice of this website.</p>
+
+<p><strong>How do we collect your data?</strong></p>
+<p>Your data is collected when you provide it to us. This could be data that you enter into a contact form, for example.</p>
+
+<p><strong>What do we use your data for?</strong></p>
+<p>Some of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior.</p>
+
+<h2>2. Hosting</h2>
+<p>This website is hosted externally. The personal data collected on this website is stored on the servers of the host.</p>
+
+<h2>3. General Information and Mandatory Information</h2>
+<h3>Data Protection</h3>
+<p>The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.</p>`,
+      content_de: `<h1>Datenschutzerklärung</h1>
+
+<h2>1. Datenschutz auf einen Blick</h2>
+<h3>Allgemeine Hinweise</h3>
+<p>Die folgenden Hinweise geben einen einfachen Überblick darüber, was mit Ihren personenbezogenen Daten passiert, wenn Sie diese Website besuchen.</p>
+
+<h3>Datenerfassung auf dieser Website</h3>
+<p><strong>Wer ist verantwortlich für die Datenerfassung auf dieser Website?</strong></p>
+<p>Die Datenverarbeitung auf dieser Website erfolgt durch den Websitebetreiber. Dessen Kontaktdaten können Sie dem Impressum dieser Website entnehmen.</p>
+
+<p><strong>Wie erfassen wir Ihre Daten?</strong></p>
+<p>Ihre Daten werden zum einen dadurch erhoben, dass Sie uns diese mitteilen. Hierbei kann es sich z.B. um Daten handeln, die Sie in ein Kontaktformular eingeben.</p>
+
+<p><strong>Wofür nutzen wir Ihre Daten?</strong></p>
+<p>Ein Teil der Daten wird erhoben, um eine fehlerfreie Bereitstellung der Website zu gewährleisten. Andere Daten können zur Analyse Ihres Nutzerverhaltens verwendet werden.</p>
+
+<h2>2. Hosting</h2>
+<p>Diese Website wird extern gehostet. Die personenbezogenen Daten, die auf dieser Website erfasst werden, werden auf den Servern des Hosters gespeichert.</p>
+
+<h2>3. Allgemeine Hinweise und Pflichtinformationen</h2>
+<h3>Datenschutz</h3>
+<p>Die Betreiber dieser Seiten nehmen den Schutz Ihrer persönlichen Daten sehr ernst. Wir behandeln Ihre personenbezogenen Daten vertraulich und entsprechend der gesetzlichen Datenschutzvorschriften sowie dieser Datenschutzerklärung.</p>`,
+      updated_at: new Date()
+    });
+  }
+  
+  // Insert pages if any need to be added
+  if (pagesToInsert.length > 0) {
+    await knex('cms_pages').insert(pagesToInsert);
+  }
+};
+
+exports.down = async function(knex) {
+  // Don't remove CMS pages on rollback as they might have been customized
+};

backend/migrations/022_fix_json_columns.js

@@ -0,0 +1,68 @@
+exports.up = async function(knex) {
+  console.log('Fixing JSON columns in database...');
+  
+  // Fix email_templates variables column
+  const templates = await knex('email_templates').select('id', 'template_key', 'variables');
+  
+  for (const template of templates) {
+    if (template.variables && typeof template.variables === 'string') {
+      try {
+        // Check if it's already valid JSON
+        JSON.parse(template.variables);
+      } catch (e) {
+        console.log(`Fixing invalid JSON in email template ${template.template_key}`);
+        // Attempt to fix common issues
+        let fixed = template.variables;
+        
+        // If it looks like an array but isn't valid JSON, try to fix it
+        if (fixed.startsWith('[') && fixed.endsWith(']')) {
+          // Extract the content and properly format it
+          const content = fixed.slice(1, -1);
+          const items = content.split(',').map(item => item.trim().replace(/['"]/g, ''));
+          fixed = JSON.stringify(items);
+        } else {
+          // Default to empty array if we can't fix it
+          fixed = JSON.stringify([]);
+        }
+        
+        await knex('email_templates')
+          .where('id', template.id)
+          .update({ variables: fixed });
+      }
+    } else if (!template.variables) {
+      // Set default empty array for null values
+      await knex('email_templates')
+        .where('id', template.id)
+        .update({ variables: JSON.stringify([]) });
+    }
+  }
+  
+  // Fix activity_logs metadata column
+  const activities = await knex('activity_logs').select('id', 'metadata');
+  
+  for (const activity of activities) {
+    if (activity.metadata && typeof activity.metadata === 'string') {
+      try {
+        // Check if it's already valid JSON
+        JSON.parse(activity.metadata);
+      } catch (e) {
+        console.log(`Fixing invalid JSON in activity log ${activity.id}`);
+        // Default to empty object if we can't parse it
+        await knex('activity_logs')
+          .where('id', activity.id)
+          .update({ metadata: JSON.stringify({}) });
+      }
+    } else if (!activity.metadata) {
+      // Set default empty object for null values
+      await knex('activity_logs')
+        .where('id', activity.id)
+        .update({ metadata: JSON.stringify({}) });
+    }
+  }
+  
+  console.log('JSON columns fixed successfully');
+};
+
+exports.down = async function(knex) {
+  // No rollback needed - data fixes only
+};

backend/migrations/023_ensure_postgres_compatibility.js

@@ -0,0 +1,22 @@
+/**
+ * Ensure PostgreSQL compatibility for all insert operations
+ * This migration doesn't change the schema but ensures all tables
+ * are compatible with .returning() syntax
+ */
+
+exports.up = async function(knex) {
+  // This migration is informational only
+  // All insert operations should use .returning('id') going forward
+  
+  console.log('PostgreSQL compatibility check:');
+  console.log('- All INSERT operations should use .returning("id")');
+  console.log('- All date operations should use ISO strings');
+  console.log('- Boolean values are handled automatically by Knex');
+  
+  return Promise.resolve();
+};
+
+exports.down = async function(knex) {
+  // No rollback needed
+  return Promise.resolve();
+};

backend/migrations/024_fix_boolean_compatibility.js

@@ -0,0 +1,29 @@
+/**
+ * Fix boolean compatibility issues between PostgreSQL and SQLite
+ * This migration updates the database configuration and existing data
+ */
+
+exports.up = async function(knex) {
+  const isPostgres = knex.client.config.client === 'pg';
+  
+  if (!isPostgres) {
+    // Enable foreign keys for SQLite
+    await knex.raw('PRAGMA foreign_keys = ON');
+    
+    // Note: SQLite stores booleans as 0/1
+    // No data migration needed as Knex handles this automatically
+    // But queries must use formatBoolean() helper
+    
+    console.log('SQLite boolean compatibility check:');
+    console.log('- SQLite stores booleans as 0/1');
+    console.log('- All boolean comparisons should use formatBoolean() helper');
+    console.log('- Foreign keys enabled');
+  }
+  
+  return Promise.resolve();
+};
+
+exports.down = async function(knex) {
+  // No rollback needed
+  return Promise.resolve();
+};

backend/migrations/025_fix_email_queue_updated_at.js

@@ -0,0 +1,33 @@
+/**
+ * Fix email_queue table by ensuring it doesn't have updated_at column
+ * This migration addresses the PostgreSQL error where queries are trying to update
+ * a non-existent updated_at column
+ */
+
+exports.up = async function(knex) {
+  // First, check if the column exists
+  const hasUpdatedAt = await knex.schema.hasColumn('email_queue', 'updated_at');
+  
+  if (hasUpdatedAt) {
+    console.log('Found updated_at column in email_queue table, removing it...');
+    await knex.schema.table('email_queue', (table) => {
+      table.dropColumn('updated_at');
+    });
+  }
+  
+  // Also ensure the table has all required columns
+  const hasCreatedAt = await knex.schema.hasColumn('email_queue', 'created_at');
+  if (!hasCreatedAt) {
+    console.log('Adding missing created_at column to email_queue table...');
+    await knex.schema.table('email_queue', (table) => {
+      table.datetime('created_at').defaultTo(knex.fn.now());
+    });
+  }
+  
+  console.log('email_queue table schema fixed');
+};
+
+exports.down = async function(knex) {
+  // In the down migration, we don't add back updated_at since it shouldn't exist
+  // This is intentionally left minimal
+};

backend/migrations/026_fix_german_email_templates.js

@@ -0,0 +1,234 @@
+exports.up = async function(knex) {
+  // Update gallery_created template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_de: 'Ihre Fotogalerie ist bereit!',
+      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
+{{#if welcome_message}}
+<div style="background-color: #f3f4f6; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0 0 10px 0; font-weight: 600; color: #374151;">Persönliche Nachricht:</p>
+  <p style="margin: 0; color: #4b5563;">{{welcome_message}}</p>
+</div>
+{{/if}}
+<p><strong>Galerie-Details:</strong></p>
+<ul>
+  <li>Veranstaltungsdatum: {{event_date}}</li>
+  <li>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+  <li>Passwort: {{gallery_password}}</li>
+  <li>Ablaufdatum: {{expiry_date}}</li>
+</ul>
+<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit diese die Fotos ansehen und herunterladen können.</p>
+<p style="background-color: #FEF3C7; padding: 15px; border-radius: 5px; border-left: 4px solid #F59E0B;">
+  <strong>Wichtig:</strong> Diese Galerie läuft am {{expiry_date}} ab. Nach diesem Datum werden die Fotos archiviert und sind nicht mehr zugänglich.
+</p>
+<a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500; margin: 20px 0;">Galerie anzeigen</a>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie erfolgreich erstellt
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!
+
+{{#if welcome_message}}
+Persönliche Nachricht:
+{{welcome_message}}
+
+{{/if}}
+Galerie-Details:
+- Veranstaltungsdatum: {{event_date}}
+- Galerie-Link: {{gallery_link}}
+- Passwort: {{gallery_password}}
+- Ablaufdatum: {{expiry_date}}
+
+Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit diese die Fotos ansehen und herunterladen können.
+
+WICHTIG: Diese Galerie läuft am {{expiry_date}} ab. Nach diesem Datum werden die Fotos archiviert und sind nicht mehr zugänglich.
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update expiration_warning template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_de: 'Ihre Fotogalerie läuft bald ab',
+      body_html_de: `<h2>Galerie läuft bald ab</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" läuft in <strong>{{days_remaining}} Tagen</strong> ab.</p>
+<p>Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich. Bitte stellen Sie sicher, dass alle gewünschten Fotos heruntergeladen wurden.</p>
+<p><strong>Ablaufdatum:</strong> {{expiry_date}}</p>
+<a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500; margin: 20px 0;">Galerie jetzt besuchen</a>
+<p style="background-color: #FEE2E2; padding: 15px; border-radius: 5px; border-left: 4px solid #EF4444;">
+  <strong>Erinnerung:</strong> Nach dem {{expiry_date}} können Ihre Gäste nicht mehr auf die Galerie zugreifen.
+</p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie läuft bald ab
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" läuft in {{days_remaining}} Tagen ab.
+
+Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich. Bitte stellen Sie sicher, dass alle gewünschten Fotos heruntergeladen wurden.
+
+Ablaufdatum: {{expiry_date}}
+
+Galerie-Link: {{gallery_link}}
+
+ERINNERUNG: Nach dem {{expiry_date}} können Ihre Gäste nicht mehr auf die Galerie zugreifen.
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update gallery_expired template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_de: 'Ihre Fotogalerie {{event_name}} ist abgelaufen',
+      body_html_de: `<h2>Galerie abgelaufen</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" ist am {{expiry_date}} abgelaufen und wurde archiviert.</p>
+<p>Die Galerie ist nicht mehr für Gäste zugänglich. Alle Fotos wurden sicher in unserem Archivsystem gespeichert.</p>
+<p>Wenn Sie wieder Zugriff auf die archivierten Fotos benötigen, wenden Sie sich bitte an unseren Support:</p>
+<p style="background-color: #F3F4F6; padding: 15px; border-radius: 5px;">
+  <strong>Kontakt:</strong><br>
+  E-Mail: <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a><br>
+  {{#if support_phone}}Telefon: {{support_phone}}{{/if}}
+</p>
+<p>Vielen Dank für die Nutzung unseres Foto-Sharing-Services!</p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie abgelaufen
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" ist am {{expiry_date}} abgelaufen und wurde archiviert.
+
+Die Galerie ist nicht mehr für Gäste zugänglich. Alle Fotos wurden sicher in unserem Archivsystem gespeichert.
+
+Wenn Sie wieder Zugriff auf die archivierten Fotos benötigen, wenden Sie sich bitte an unseren Support:
+
+E-Mail: {{admin_email}}
+{{#if support_phone}}Telefon: {{support_phone}}{{/if}}
+
+Vielen Dank für die Nutzung unseres Foto-Sharing-Services!
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update archive_complete template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_de: 'Archivierung abgeschlossen: {{event_name}}',
+      body_html_de: `<h2>Archivierung abgeschlossen</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.</p>
+<p><strong>Archiv-Details:</strong></p>
+<ul>
+  <li>Archivgröße: {{archive_size}}</li>
+  <li>Archivierungsdatum: {{archive_date}}</li>
+  <li>Anzahl der Fotos: {{photo_count}}</li>
+</ul>
+<p>Das Archiv wird sicher in unserem System aufbewahrt. Bei Bedarf können Sie sich an unseren Support wenden, um Zugriff auf die archivierten Fotos zu erhalten.</p>
+<p style="background-color: #F0FDF4; padding: 15px; border-radius: 5px; border-left: 4px solid #22C55E;">
+  <strong>✓ Erfolgreich archiviert:</strong> Ihre Fotos sind sicher gespeichert und können bei Bedarf wiederhergestellt werden.
+</p>
+<p>Kontakt für Archivzugriff:<br>
+E-Mail: <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a></p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Archivierung abgeschlossen
+
+Liebe(r) {{host_name}},
+
+Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.
+
+Archiv-Details:
+- Archivgröße: {{archive_size}}
+- Archivierungsdatum: {{archive_date}}
+- Anzahl der Fotos: {{photo_count}}
+
+Das Archiv wird sicher in unserem System aufbewahrt. Bei Bedarf können Sie sich an unseren Support wenden, um Zugriff auf die archivierten Fotos zu erhalten.
+
+✓ ERFOLGREICH ARCHIVIERT: Ihre Fotos sind sicher gespeichert und können bei Bedarf wiederhergestellt werden.
+
+Kontakt für Archivzugriff:
+E-Mail: {{admin_email}}
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Also update the non-language-specific fields to match German for consistency
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+};
+
+exports.down = async function(knex) {
+  // Revert to previous German translations
+  // This is a simplified rollback - in production you might want to store the old values
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+};

backend/migrations/027_add_language_preferences.js

@@ -0,0 +1,41 @@
+exports.up = async function(knex) {
+  // Add language column to events table if it doesn't exist
+  const hasLanguageInEvents = await knex.schema.hasColumn('events', 'language');
+  if (!hasLanguageInEvents) {
+    await knex.schema.alterTable('events', function(table) {
+      table.string('language', 5).defaultTo('en');
+    });
+  }
+  
+  // Add default_language to email_configs if it doesn't exist
+  const hasDefaultLanguage = await knex.schema.hasColumn('email_configs', 'default_language');
+  if (!hasDefaultLanguage) {
+    await knex.schema.alterTable('email_configs', function(table) {
+      table.string('default_language', 5).defaultTo('en');
+    });
+  }
+  
+  // Set default language to German for the existing email config
+  await knex('email_configs')
+    .update({
+      default_language: 'de'
+    });
+};
+
+exports.down = async function(knex) {
+  // Remove language column from events table
+  const hasLanguageInEvents = await knex.schema.hasColumn('events', 'language');
+  if (hasLanguageInEvents) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('language');
+    });
+  }
+  
+  // Remove default_language from email_configs
+  const hasDefaultLanguage = await knex.schema.hasColumn('email_configs', 'default_language');
+  if (hasDefaultLanguage) {
+    await knex.schema.alterTable('email_configs', function(table) {
+      table.dropColumn('default_language');
+    });
+  }
+};

backend/migrations/027_add_rate_limit_settings.js

@@ -0,0 +1,63 @@
+exports.up = async function(knex) {
+  // Add rate limit settings to app_settings
+  const rateLimitSettings = [
+    {
+      setting_key: 'rate_limit_enabled',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_window_minutes',
+      setting_value: JSON.stringify(15),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_max_requests',
+      setting_value: JSON.stringify(1000),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_auth_max_requests',
+      setting_value: JSON.stringify(5),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_skip_authenticated',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_public_endpoints_only',
+      setting_value: JSON.stringify(false),
+      setting_type: 'security'
+    }
+  ];
+
+  // Insert settings if they don't exist
+  for (const setting of rateLimitSettings) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await knex('app_settings').insert({
+        ...setting,
+        updated_at: knex.fn.now()
+      });
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  // Remove rate limit settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'rate_limit_enabled',
+      'rate_limit_window_minutes',
+      'rate_limit_max_requests',
+      'rate_limit_auth_max_requests',
+      'rate_limit_skip_authenticated',
+      'rate_limit_public_endpoints_only'
+    ])
+    .del();
+};

backend/migrations/028_update_english_templates_to_match_german.js

@@ -0,0 +1,307 @@
+exports.up = async function(knex) {
+  // Update English templates to match the quality and content of German templates
+  
+  // 1. Gallery Created - Match German version with proper styling and conditionals
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_en: 'Your photo gallery is ready',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> for {{event_date}} has been successfully created and is now online!</p>
+
+{{#if welcome_message}}
+<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 15px; margin: 20px 0; border-radius: 4px;">
+  <p style="margin: 0;"><strong>Personal message from your photographer:</strong></p>
+  <p style="margin: 10px 0 0 0;">{{welcome_message}}</p>
+</div>
+{{/if}}
+
+<div style="background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <h3 style="margin-top: 0;">Your access data:</h3>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 10px;"><strong>Gallery link:</strong> <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+    <li style="margin-bottom: 10px;"><strong>Password:</strong> {{gallery_password}}</li>
+  </ul>
+</div>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500;">View Gallery</a>
+</div>
+
+<div style="background-color: #fff3cd; border: 1px solid #ffeaa7; color: #856404; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Important:</strong> Your gallery will be available until <strong>{{expiry_date}}</strong>. After this date, the photos will be archived and will only be available upon request.</p>
+</div>
+
+<p>We hope you enjoy your photos!</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" for {{event_date}} has been successfully created and is now online!
+
+{{#if welcome_message}}
+Personal message from your photographer:
+{{welcome_message}}
+{{/if}}
+
+Your access data:
+- Gallery link: {{gallery_link}}
+- Password: {{gallery_password}}
+
+Important: Your gallery will be available until {{expiry_date}}. After this date, the photos will be archived and will only be available upon request.
+
+We hope you enjoy your photos!
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 2. Expiration Warning - Match German version with urgency and styling
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_en: 'Your photo gallery expires soon',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> will expire in <strong style="color: #e74c3c; font-size: 18px;">{{days_remaining}} days</strong>!</p>
+
+<div style="background-color: #fee; border: 1px solid #fcc; color: #c33; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0; font-weight: bold; font-size: 16px;">⚠️ Important Notice</p>
+  <p style="margin: 10px 0 0 0;">After {{expiry_date}}, your gallery will no longer be accessible online. The photos will be archived and will only be available upon special request.</p>
+</div>
+
+<p><strong>Don't miss out – download your photos now!</strong></p>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{gallery_link}}" style="display: inline-block; padding: 14px 35px; background-color: #e74c3c; color: white; text-decoration: none; border-radius: 5px; font-weight: 600; font-size: 16px;">Visit Gallery Now</a>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 15px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Quick reminder of your access data:</strong></p>
+  <ul style="list-style: none; padding: 0; margin: 10px 0 0 0;">
+    <li>Gallery link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+    <li>Password: {{gallery_password}}</li>
+  </ul>
+</div>
+
+<p>If you have any questions, please don't hesitate to contact us.</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days!
+
+⚠️ Important Notice
+After {{expiry_date}}, your gallery will no longer be accessible online. The photos will be archived and will only be available upon special request.
+
+Don't miss out – download your photos now!
+
+Quick reminder of your access data:
+- Gallery link: {{gallery_link}}
+- Password: {{gallery_password}}
+
+If you have any questions, please don't hesitate to contact us.
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 3. Gallery Expired - Match German version with contact information
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_en: 'Your photo gallery has expired',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> expired on {{expiry_date}} and is no longer accessible online.</p>
+
+<div style="background-color: #f9f9f9; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
+  <h3 style="margin-top: 0;">Your photos are safely archived</h3>
+  <p>Don't worry – your photos have been securely archived and are not lost. If you need access to your photos, please contact us:</p>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 8px;">📧 Email: <a href="mailto:{{support_email}}" style="color: #5C8762;">{{support_email}}</a></li>
+    {{#if support_phone}}
+    <li>📞 Phone: {{support_phone}}</li>
+    {{/if}}
+  </ul>
+</div>
+
+<p>Please have the following information ready when contacting us:</p>
+<ul>
+  <li>Event name: {{event_name}}</li>
+  <li>Event date: {{event_date}}</li>
+  <li>Expiry date: {{expiry_date}}</li>
+</ul>
+
+<p>We'll be happy to help you access your archived photos.</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" expired on {{expiry_date}} and is no longer accessible online.
+
+Your photos are safely archived
+Don't worry – your photos have been securely archived and are not lost. If you need access to your photos, please contact us:
+
+📧 Email: {{support_email}}
+{{#if support_phone}}📞 Phone: {{support_phone}}{{/if}}
+
+Please have the following information ready when contacting us:
+- Event name: {{event_name}}
+- Event date: {{event_date}}
+- Expiry date: {{expiry_date}}
+
+We'll be happy to help you access your archived photos.
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 4. Archive Complete - Match German version with success message and details
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_en: 'Your photo gallery has been successfully archived',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> has been successfully archived.</p>
+
+<div style="background-color: #d4edda; border: 1px solid #c3e6cb; color: #155724; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0; font-weight: bold;">✅ Archive successfully created</p>
+  <p style="margin: 10px 0 0 0;">Your photos are now safely stored in our archive.</p>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <h3 style="margin-top: 0;">Archive details:</h3>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 8px;"><strong>Event:</strong> {{event_name}}</li>
+    <li style="margin-bottom: 8px;"><strong>Archive date:</strong> {{archive_date}}</li>
+    <li style="margin-bottom: 8px;"><strong>Number of photos:</strong> {{photo_count}}</li>
+    <li><strong>Archive size:</strong> {{archive_size}}</li>
+  </ul>
+</div>
+
+<p>If you need access to your archived photos in the future, please contact us at:</p>
+<p style="margin-left: 20px;">
+  📧 <a href="mailto:{{support_email}}" style="color: #5C8762;">{{support_email}}</a><br>
+  {{#if support_phone}}📞 {{support_phone}}{{/if}}
+</p>
+
+<p>Thank you for using our photo sharing service!</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" has been successfully archived.
+
+✅ Archive successfully created
+Your photos are now safely stored in our archive.
+
+Archive details:
+- Event: {{event_name}}
+- Archive date: {{archive_date}}
+- Number of photos: {{photo_count}}
+- Archive size: {{archive_size}}
+
+If you need access to your archived photos in the future, please contact us at:
+📧 {{support_email}}
+{{#if support_phone}}📞 {{support_phone}}{{/if}}
+
+Thank you for using our photo sharing service!
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 5. Test Email - Update to match German style
+  await knex('email_templates')
+    .where('template_key', 'test_email')
+    .update({
+      subject_en: 'Test Email - Photo Sharing Platform',
+      body_html_en: `
+<h2>Test Email</h2>
+
+<p>This is a test email from your photo sharing platform.</p>
+
+<div style="background-color: #d4edda; border: 1px solid #c3e6cb; color: #155724; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>✅ Email configuration successful!</strong></p>
+  <p style="margin: 10px 0 0 0;">Your email settings have been configured correctly and emails can be sent.</p>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 15px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Configuration details:</strong></p>
+  <ul style="margin: 10px 0 0 0;">
+    <li>Timestamp: {{timestamp}}</li>
+    <li>Sender: {{from_email}}</li>
+  </ul>
+</div>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Test Email
+
+This is a test email from your photo sharing platform.
+
+✅ Email configuration successful!
+Your email settings have been configured correctly and emails can be sent.
+
+Configuration details:
+- Timestamp: {{timestamp}}
+- Sender: {{from_email}}
+
+Best regards,
+Your Photo Sharing Team`
+    });
+};
+
+exports.down = async function(knex) {
+  // Revert to previous simpler English templates
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_en: 'Your Photo Gallery is Ready',
+      body_html_en: '<h2>Hello,</h2><p>Your photo gallery "{{event_name}}" has been created.</p><p><strong>Access Link:</strong> <a href="{{gallery_link}}">{{gallery_link}}</a></p><p><strong>Password:</strong> {{gallery_password}}</p><p>The gallery will be available until {{expiry_date}}.</p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" has been created. Access Link: {{gallery_link}} Password: {{gallery_password}} The gallery will be available until {{expiry_date}}.'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_en: 'Gallery Expires in {{days_remaining}} Days',
+      body_html_en: '<h2>Reminder</h2><p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p><p>Please download your photos before {{expiry_date}}.</p><p><a href="{{gallery_link}}">Access Gallery</a></p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days. Please download your photos before {{expiry_date}}. Access Gallery: {{gallery_link}}'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_en: 'Gallery Expired',
+      body_html_en: '<h2>Gallery Expired</h2><p>Your photo gallery "{{event_name}}" has expired and is no longer accessible.</p><p>If you need access to your photos, please contact support.</p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" has expired and is no longer accessible. If you need access to your photos, please contact support.'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_en: 'Gallery Archived',
+      body_html_en: '<h2>Archive Complete</h2><p>Your gallery "{{event_name}}" has been archived.</p><p>Archive size: {{archive_size}}</p>',
+      body_text_en: 'Your gallery "{{event_name}}" has been archived. Archive size: {{archive_size}}'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'test_email')
+    .update({
+      subject_en: 'Test Email',
+      body_html_en: '<p>This is a test email sent at {{timestamp}}.</p>',
+      body_text_en: 'This is a test email sent at {{timestamp}}.'
+    });
+};

backend/migrations/029_add_backup_service_tables.js

@@ -0,0 +1,243 @@
+const { db } = require('../src/database/db');
+
+async function up() {
+  console.log('Adding backup service tables and settings...');
+  
+  // Create backup_runs table to track backup history
+  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
+  if (!hasBackupRunsTable) {
+    await db.schema.createTable('backup_runs', (table) => {
+      table.increments('id').primary();
+      table.datetime('started_at').notNullable();
+      table.datetime('completed_at');
+      table.string('status').defaultTo('running'); // running, completed, failed
+      table.string('backup_type'); // full, incremental
+      table.integer('files_backed_up').defaultTo(0);
+      table.bigInteger('total_size_bytes').defaultTo(0);
+      table.integer('duration_seconds');
+      table.text('error_message');
+      table.json('statistics'); // Detailed stats about the backup
+      table.json('file_checksums'); // Store checksums for change detection
+    });
+  }
+
+  // Create backup_file_states table to track individual file states
+  const hasBackupFileStatesTable = await db.schema.hasTable('backup_file_states');
+  if (!hasBackupFileStatesTable) {
+    await db.schema.createTable('backup_file_states', (table) => {
+      table.increments('id').primary();
+      table.string('file_path').notNullable();
+      table.string('checksum').notNullable();
+      table.bigInteger('size_bytes');
+      table.datetime('last_modified');
+      table.datetime('last_backed_up');
+      table.boolean('is_archived').defaultTo(false);
+      table.index(['file_path'], 'idx_backup_file_path');
+      table.index(['checksum'], 'idx_backup_checksum');
+    });
+  }
+
+  // Add backup-related settings to app_settings
+  const backupSettings = [
+    {
+      setting_key: 'backup_enabled',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_schedule',
+      setting_value: JSON.stringify('0 2 * * *'), // Default: 2 AM daily
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_destination_type',
+      setting_value: JSON.stringify('local'), // local, rsync, s3
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_destination_path',
+      setting_value: JSON.stringify('/backup/picpeak'),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_rsync_host',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_rsync_user',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_rsync_path',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_rsync_ssh_key',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_s3_endpoint',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_s3_bucket',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_s3_access_key',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_s3_secret_key',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_s3_region',
+      setting_value: JSON.stringify('us-east-1'),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_retention_days',
+      setting_value: JSON.stringify(30),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_include_archived',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_compression',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_email_on_failure',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_email_on_success',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_max_file_size_mb',
+      setting_value: JSON.stringify(5000), // Skip files larger than 5GB
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_exclude_patterns',
+      setting_value: JSON.stringify(['*.tmp', '.DS_Store', 'Thumbs.db']),
+      setting_type: 'backup'
+    }
+  ];
+
+  // Insert backup settings if they don't exist
+  for (const setting of backupSettings) {
+    const exists = await db('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await db('app_settings').insert(setting);
+    }
+  }
+
+  // Add backup-related email templates
+  const backupEmailTemplates = [
+    {
+      template_key: 'backup_failed',
+      subject_en: 'Backup Failed - Immediate Attention Required',
+      subject_de: 'Backup fehlgeschlagen - Sofortige Aufmerksamkeit erforderlich',
+      body_html_en: `<h2>Backup Failed</h2>
+<p>The scheduled backup has failed and requires immediate attention.</p>
+<p><strong>Error Details:</strong></p>
+<ul>
+  <li>Start Time: {{start_time}}</li>
+  <li>Backup Type: {{backup_type}}</li>
+  <li>Error: {{error_message}}</li>
+</ul>
+<p>Please check the system logs for more details and resolve the issue as soon as possible.</p>`,
+      body_html_de: `<h2>Backup fehlgeschlagen</h2>
+<p>Das geplante Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.</p>
+<p><strong>Fehlerdetails:</strong></p>
+<ul>
+  <li>Startzeit: {{start_time}}</li>
+  <li>Backup-Typ: {{backup_type}}</li>
+  <li>Fehler: {{error_message}}</li>
+</ul>
+<p>Bitte überprüfen Sie die Systemprotokolle für weitere Details und beheben Sie das Problem so schnell wie möglich.</p>`,
+      body_text_en: 'Backup Failed\n\nThe scheduled backup has failed and requires immediate attention.\n\nStart Time: {{start_time}}\nBackup Type: {{backup_type}}\nError: {{error_message}}\n\nPlease check the system logs for more details.',
+      body_text_de: 'Backup fehlgeschlagen\n\nDas geplante Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.\n\nStartzeit: {{start_time}}\nBackup-Typ: {{backup_type}}\nFehler: {{error_message}}\n\nBitte überprüfen Sie die Systemprotokolle für weitere Details.',
+      variables: JSON.stringify(['start_time', 'backup_type', 'error_message'])
+    },
+    {
+      template_key: 'backup_completed',
+      subject_en: 'Backup Completed Successfully',
+      subject_de: 'Backup erfolgreich abgeschlossen',
+      body_html_en: `<h2>Backup Completed</h2>
+<p>The scheduled backup has been completed successfully.</p>
+<p><strong>Backup Summary:</strong></p>
+<ul>
+  <li>Start Time: {{start_time}}</li>
+  <li>Duration: {{duration}}</li>
+  <li>Files Backed Up: {{files_count}}</li>
+  <li>Total Size: {{total_size}}</li>
+  <li>Backup Type: {{backup_type}}</li>
+</ul>`,
+      body_html_de: `<h2>Backup abgeschlossen</h2>
+<p>Das geplante Backup wurde erfolgreich abgeschlossen.</p>
+<p><strong>Backup-Zusammenfassung:</strong></p>
+<ul>
+  <li>Startzeit: {{start_time}}</li>
+  <li>Dauer: {{duration}}</li>
+  <li>Gesicherte Dateien: {{files_count}}</li>
+  <li>Gesamtgröße: {{total_size}}</li>
+  <li>Backup-Typ: {{backup_type}}</li>
+</ul>`,
+      body_text_en: 'Backup Completed\n\nThe scheduled backup has been completed successfully.\n\nStart Time: {{start_time}}\nDuration: {{duration}}\nFiles Backed Up: {{files_count}}\nTotal Size: {{total_size}}\nBackup Type: {{backup_type}}',
+      body_text_de: 'Backup abgeschlossen\n\nDas geplante Backup wurde erfolgreich abgeschlossen.\n\nStartzeit: {{start_time}}\nDauer: {{duration}}\nGesicherte Dateien: {{files_count}}\nGesamtgröße: {{total_size}}\nBackup-Typ: {{backup_type}}',
+      variables: JSON.stringify(['start_time', 'duration', 'files_count', 'total_size', 'backup_type'])
+    }
+  ];
+
+  // Insert backup email templates if they don't exist
+  for (const template of backupEmailTemplates) {
+    const exists = await db('email_templates')
+      .where('template_key', template.template_key)
+      .first();
+    
+    if (!exists) {
+      await db('email_templates').insert(template);
+    }
+  }
+
+  console.log('Backup service tables and settings added successfully');
+}
+
+async function down() {
+  // Remove backup tables
+  await db.schema.dropTableIfExists('backup_file_states');
+  await db.schema.dropTableIfExists('backup_runs');
+  
+  // Remove backup settings
+  await db('app_settings')
+    .where('setting_type', 'backup')
+    .delete();
+  
+  // Remove backup email templates
+  await db('email_templates')
+    .whereIn('template_key', ['backup_failed', 'backup_completed'])
+    .delete();
+}
+
+module.exports = { up, down };

backend/migrations/030_add_database_backup_tables.js

@@ -0,0 +1,182 @@
+const { db } = require('../src/database/db');
+
+async function up() {
+  console.log('Adding database backup tables and settings...');
+  
+  // Create database_backup_runs table to track database backup history
+  const hasDatabaseBackupRunsTable = await db.schema.hasTable('database_backup_runs');
+  if (!hasDatabaseBackupRunsTable) {
+    await db.schema.createTable('database_backup_runs', (table) => {
+      table.increments('id').primary();
+      table.datetime('started_at').notNullable();
+      table.datetime('completed_at');
+      table.string('status').defaultTo('running'); // running, completed, failed
+      table.string('backup_type'); // sqlite, postgresql
+      table.string('destination_path');
+      table.string('file_path');
+      table.bigInteger('file_size_bytes').defaultTo(0);
+      table.bigInteger('original_size_bytes').defaultTo(0);
+      table.integer('duration_seconds');
+      table.string('checksum'); // SHA256 checksum of backup file
+      table.float('compression_ratio'); // Compression percentage
+      table.json('table_checksums'); // Individual table checksums
+      table.text('error_message');
+      table.json('statistics'); // Detailed stats about the backup
+      table.index(['started_at'], 'idx_db_backup_started');
+      table.index(['status'], 'idx_db_backup_status');
+    });
+  }
+
+  // Add database backup-related settings to app_settings
+  const databaseBackupSettings = [
+    {
+      setting_key: 'database_backup_enabled',
+      setting_value: JSON.stringify(false),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_schedule',
+      setting_value: JSON.stringify('0 3 * * *'), // Default: 3 AM daily
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_destination_path',
+      setting_value: JSON.stringify('/backup/database'),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_compress',
+      setting_value: JSON.stringify(true),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_validate_integrity',
+      setting_value: JSON.stringify(true),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_include_checksums',
+      setting_value: JSON.stringify(true),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_retention_days',
+      setting_value: JSON.stringify(30),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_email_on_failure',
+      setting_value: JSON.stringify(true),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_email_on_success',
+      setting_value: JSON.stringify(false),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_max_retries',
+      setting_value: JSON.stringify(3),
+      setting_type: 'database_backup'
+    }
+  ];
+
+  // Insert database backup settings if they don't exist
+  for (const setting of databaseBackupSettings) {
+    const exists = await db('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await db('app_settings').insert(setting);
+    }
+  }
+
+  // Add database backup-related email templates
+  const databaseBackupEmailTemplates = [
+    {
+      template_key: 'database_backup_failed',
+      subject_en: 'Database Backup Failed - Critical Alert',
+      subject_de: 'Datenbank-Backup fehlgeschlagen - Kritische Warnung',
+      body_html_en: `<h2>Database Backup Failed</h2>
+<p>The scheduled database backup has failed and requires immediate attention.</p>
+<p><strong>Error Details:</strong></p>
+<ul>
+  <li>Backup Type: {{backup_type}}</li>
+  <li>Timestamp: {{timestamp}}</li>
+  <li>Error: {{error_message}}</li>
+</ul>
+<p>This is a critical issue that could affect disaster recovery. Please investigate immediately.</p>`,
+      body_html_de: `<h2>Datenbank-Backup fehlgeschlagen</h2>
+<p>Das geplante Datenbank-Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.</p>
+<p><strong>Fehlerdetails:</strong></p>
+<ul>
+  <li>Backup-Typ: {{backup_type}}</li>
+  <li>Zeitstempel: {{timestamp}}</li>
+  <li>Fehler: {{error_message}}</li>
+</ul>
+<p>Dies ist ein kritisches Problem, das die Disaster-Recovery beeinträchtigen könnte. Bitte untersuchen Sie es sofort.</p>`,
+      body_text_en: 'Database Backup Failed\n\nThe scheduled database backup has failed.\n\nBackup Type: {{backup_type}}\nTimestamp: {{timestamp}}\nError: {{error_message}}\n\nThis is critical - please investigate immediately.',
+      body_text_de: 'Datenbank-Backup fehlgeschlagen\n\nDas geplante Datenbank-Backup ist fehlgeschlagen.\n\nBackup-Typ: {{backup_type}}\nZeitstempel: {{timestamp}}\nFehler: {{error_message}}\n\nDies ist kritisch - bitte sofort untersuchen.',
+      variables: JSON.stringify(['backup_type', 'timestamp', 'error_message'])
+    },
+    {
+      template_key: 'database_backup_completed',
+      subject_en: 'Database Backup Completed Successfully',
+      subject_de: 'Datenbank-Backup erfolgreich abgeschlossen',
+      body_html_en: `<h2>Database Backup Completed</h2>
+<p>The scheduled database backup has been completed successfully.</p>
+<p><strong>Backup Summary:</strong></p>
+<ul>
+  <li>Backup Type: {{backup_type}}</li>
+  <li>Duration: {{duration}}</li>
+  <li>File Size: {{file_size}}</li>
+  <li>Compression Ratio: {{compression_ratio}}</li>
+  <li>File Path: {{file_path}}</li>
+</ul>`,
+      body_html_de: `<h2>Datenbank-Backup abgeschlossen</h2>
+<p>Das geplante Datenbank-Backup wurde erfolgreich abgeschlossen.</p>
+<p><strong>Backup-Zusammenfassung:</strong></p>
+<ul>
+  <li>Backup-Typ: {{backup_type}}</li>
+  <li>Dauer: {{duration}}</li>
+  <li>Dateigröße: {{file_size}}</li>
+  <li>Komprimierungsverhältnis: {{compression_ratio}}</li>
+  <li>Dateipfad: {{file_path}}</li>
+</ul>`,
+      body_text_en: 'Database Backup Completed\n\nThe scheduled database backup has been completed successfully.\n\nBackup Type: {{backup_type}}\nDuration: {{duration}}\nFile Size: {{file_size}}\nCompression Ratio: {{compression_ratio}}\nFile Path: {{file_path}}',
+      body_text_de: 'Datenbank-Backup abgeschlossen\n\nDas geplante Datenbank-Backup wurde erfolgreich abgeschlossen.\n\nBackup-Typ: {{backup_type}}\nDauer: {{duration}}\nDateigröße: {{file_size}}\nKomprimierungsverhältnis: {{compression_ratio}}\nDateipfad: {{file_path}}',
+      variables: JSON.stringify(['backup_type', 'duration', 'file_size', 'compression_ratio', 'file_path'])
+    }
+  ];
+
+  // Insert database backup email templates if they don't exist
+  for (const template of databaseBackupEmailTemplates) {
+    const exists = await db('email_templates')
+      .where('template_key', template.template_key)
+      .first();
+    
+    if (!exists) {
+      await db('email_templates').insert(template);
+    }
+  }
+
+  console.log('Database backup tables and settings added successfully');
+}
+
+async function down() {
+  // Remove database backup tables
+  await db.schema.dropTableIfExists('database_backup_runs');
+  
+  // Remove database backup settings
+  await db('app_settings')
+    .where('setting_type', 'database_backup')
+    .delete();
+  
+  // Remove database backup email templates
+  await db('email_templates')
+    .whereIn('template_key', ['database_backup_failed', 'database_backup_completed'])
+    .delete();
+}
+
+module.exports = { up, down };

backend/migrations/031_add_backup_manifest_columns.js

@@ -0,0 +1,86 @@
+const { db } = require('../src/database/db');
+const logger = require('../src/utils/logger');
+
+async function up() {
+  console.log('Adding backup manifest columns...');
+  
+  // Add manifest columns to backup_runs table
+  const hasManifestPath = await db.schema.hasColumn('backup_runs', 'manifest_path');
+  if (!hasManifestPath) {
+    await db.schema.alterTable('backup_runs', (table) => {
+      table.string('manifest_path'); // Path to the manifest file
+      table.string('manifest_id'); // Unique manifest ID
+      table.string('manifest_format').defaultTo('json'); // json or yaml
+    });
+  }
+
+  // Add backup manifest-related settings to app_settings
+  const manifestSettings = [
+    {
+      setting_key: 'backup_manifest_enabled',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_manifest_format',
+      setting_value: JSON.stringify('json'), // json or yaml
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_manifest_path',
+      setting_value: JSON.stringify('/backup/manifests'),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_manifest_validate',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_manifest_include_checksums',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    }
+  ];
+
+  // Insert manifest settings if they don't exist
+  for (const setting of manifestSettings) {
+    const exists = await db('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await db('app_settings').insert(setting);
+    }
+  }
+
+  console.log('✓ Backup manifest columns and settings added');
+}
+
+async function down() {
+  // Remove manifest columns from backup_runs table
+  const hasManifestPath = await db.schema.hasColumn('backup_runs', 'manifest_path');
+  if (hasManifestPath) {
+    await db.schema.alterTable('backup_runs', (table) => {
+      table.dropColumn('manifest_path');
+      table.dropColumn('manifest_id');
+      table.dropColumn('manifest_format');
+    });
+  }
+
+  // Remove manifest settings
+  await db('app_settings')
+    .where('setting_type', 'backup')
+    .whereIn('setting_key', [
+      'backup_manifest_enabled',
+      'backup_manifest_format',
+      'backup_manifest_path',
+      'backup_manifest_validate',
+      'backup_manifest_include_checksums'
+    ])
+    .delete();
+
+  console.log('✓ Backup manifest columns and settings removed');
+}
+
+module.exports = { up, down };

backend/migrations/031_enhance_backup_system.js

@@ -0,0 +1,131 @@
+exports.up = function(knex) {
+  return knex.schema
+    // Add new settings to app_settings table
+    .table('app_settings', table => {
+      // S3 configuration enhancements
+      table.boolean('backup_s3_force_path_style').defaultTo(false).comment('Force path-style S3 URLs (for MinIO/self-hosted)');
+      table.boolean('backup_s3_ssl_enabled').defaultTo(true).comment('Enable SSL/TLS for S3 connections');
+      table.string('backup_s3_prefix', 255).comment('S3 key prefix for organizing backups');
+      
+      // Backup features
+      table.boolean('backup_incremental').defaultTo(false).comment('Enable incremental backups');
+      table.boolean('backup_include_database').defaultTo(true).comment('Include database dumps in backups');
+      table.boolean('backup_manifest_enabled').defaultTo(true).comment('Generate backup manifests');
+      table.enum('backup_manifest_format', ['json', 'yaml']).defaultTo('json').comment('Manifest file format');
+      table.boolean('backup_encryption_enabled').defaultTo(false).comment('Enable backup encryption');
+      table.string('backup_database_schedule', 100).comment('Separate cron schedule for database-only backups');
+    })
+    
+    // Enhance backup_runs table
+    .table('backup_runs', table => {
+      // Manifest tracking
+      table.string('manifest_path', 500).comment('Path to backup manifest file');
+      table.uuid('manifest_id').comment('Unique identifier for the manifest');
+      table.enum('manifest_format', ['json', 'yaml']).comment('Format of the manifest file');
+      
+      // Incremental backup support
+      table.integer('parent_backup_id').unsigned().references('id').inTable('backup_runs').onDelete('SET NULL').comment('Parent backup for incremental backups');
+      table.enum('backup_mode', ['full', 'incremental', 'database']).defaultTo('full').comment('Type of backup performed');
+      
+      // Add indexes for better query performance
+      table.index(['backup_mode', 'status'], 'idx_backup_runs_mode_status');
+      table.index(['parent_backup_id'], 'idx_backup_runs_parent');
+      table.index(['created_at', 'backup_mode'], 'idx_backup_runs_created_mode');
+    })
+    
+    // Create backup_manifest table for storing detailed manifest metadata
+    .createTable('backup_manifest', table => {
+      table.increments('id').primary();
+      table.integer('backup_run_id').unsigned().notNullable().references('id').inTable('backup_runs').onDelete('CASCADE');
+      table.uuid('manifest_id').notNullable().unique().comment('Unique identifier matching backup_runs.manifest_id');
+      table.string('version', 20).notNullable().defaultTo('1.0.0').comment('Manifest schema version');
+      table.enum('format', ['json', 'yaml']).notNullable().defaultTo('json');
+      
+      // Backup metadata
+      table.timestamp('backup_start').notNullable();
+      table.timestamp('backup_end').notNullable();
+      table.bigInteger('total_size').unsigned().comment('Total size of backup in bytes');
+      table.integer('file_count').unsigned().comment('Number of files in backup');
+      table.integer('photo_count').unsigned().comment('Number of photos backed up');
+      table.integer('event_count').unsigned().comment('Number of events backed up');
+      
+      // Incremental backup metadata
+      table.boolean('is_incremental').defaultTo(false);
+      table.uuid('parent_manifest_id').comment('Parent manifest ID for incremental backups');
+      table.timestamp('incremental_since').comment('Timestamp for incremental backup baseline');
+      
+      // Content checksums
+      table.string('checksum_algorithm', 50).defaultTo('sha256').comment('Algorithm used for checksums');
+      table.text('manifest_checksum').comment('Checksum of the manifest file itself');
+      
+      // Storage information
+      table.string('storage_location', 500).comment('Primary storage location (local path or S3 URI)');
+      table.string('storage_provider', 50).comment('Storage provider (local, s3, etc.)');
+      
+      // Encryption metadata
+      table.boolean('is_encrypted').defaultTo(false);
+      table.string('encryption_algorithm', 100).comment('Encryption algorithm used');
+      table.string('encryption_key_id', 255).comment('ID of encryption key used');
+      
+      // Additional metadata as JSON
+      table.json('metadata').comment('Additional metadata as JSON');
+      
+      // Timestamps
+      table.timestamps(true, true);
+      
+      // Indexes
+      table.index(['backup_run_id'], 'idx_manifest_backup_run');
+      table.index(['manifest_id'], 'idx_manifest_uuid');
+      table.index(['parent_manifest_id'], 'idx_manifest_parent');
+      table.index(['backup_start', 'backup_end'], 'idx_manifest_time_range');
+      table.index(['is_incremental', 'created_at'], 'idx_manifest_incremental_created');
+    })
+    
+    // Add composite indexes for common query patterns
+    .raw(`
+      CREATE INDEX IF NOT EXISTS idx_backup_runs_recent_successful 
+      ON backup_runs(created_at DESC) 
+      WHERE status = 'completed' AND backup_mode = 'full';
+    `)
+    .raw(`
+      CREATE INDEX IF NOT EXISTS idx_backup_runs_incremental_chain 
+      ON backup_runs(parent_backup_id, created_at) 
+      WHERE backup_mode = 'incremental';
+    `);
+};
+
+exports.down = function(knex) {
+  return knex.schema
+    // Drop indexes first
+    .raw('DROP INDEX IF EXISTS idx_backup_runs_incremental_chain;')
+    .raw('DROP INDEX IF EXISTS idx_backup_runs_recent_successful;')
+    
+    // Drop backup_manifest table
+    .dropTableIfExists('backup_manifest')
+    
+    // Remove columns from backup_runs table
+    .table('backup_runs', table => {
+      table.dropIndex(['backup_mode', 'status'], 'idx_backup_runs_mode_status');
+      table.dropIndex(['parent_backup_id'], 'idx_backup_runs_parent');
+      table.dropIndex(['created_at', 'backup_mode'], 'idx_backup_runs_created_mode');
+      
+      table.dropColumn('manifest_path');
+      table.dropColumn('manifest_id');
+      table.dropColumn('manifest_format');
+      table.dropColumn('parent_backup_id');
+      table.dropColumn('backup_mode');
+    })
+    
+    // Remove columns from app_settings table
+    .table('app_settings', table => {
+      table.dropColumn('backup_s3_force_path_style');
+      table.dropColumn('backup_s3_ssl_enabled');
+      table.dropColumn('backup_s3_prefix');
+      table.dropColumn('backup_incremental');
+      table.dropColumn('backup_include_database');
+      table.dropColumn('backup_manifest_enabled');
+      table.dropColumn('backup_manifest_format');
+      table.dropColumn('backup_encryption_enabled');
+      table.dropColumn('backup_database_schedule');
+    });
+};

backend/migrations/032_add_restore_runs_table.js

@@ -0,0 +1,249 @@
+const { formatBoolean, parseBoolean } = require('./helpers');
+
+/**
+ * Add restore_runs table for tracking restore operations
+ */
+exports.up = async function(knex) {
+  // Create restore_runs table
+  await knex.schema.createTable('restore_runs', table => {
+    table.increments('id').primary();
+    
+    // Timing
+    table.timestamp('started_at').notNullable().defaultTo(knex.fn.now());
+    table.timestamp('completed_at');
+    table.integer('duration_seconds');
+    
+    // Status and type
+    table.string('status', 50).notNullable().defaultTo('running');
+    table.string('restore_type', 50).notNullable(); // full, database, files, selective
+    
+    // Source information
+    table.string('source', 500).notNullable(); // Backup source path or S3 URL
+    table.string('manifest_path', 500); // Path to manifest file
+    
+    // Results
+    table.text('error_message');
+    table.text('statistics'); // JSON object with detailed statistics
+    table.text('restore_log'); // JSON array of log entries
+    
+    // Safety backup
+    table.string('pre_restore_backup_path', 500); // Path to pre-restore safety backup
+    
+    // Flags
+    table.boolean('is_dry_run').defaultTo(formatBoolean(false));
+    table.boolean('was_rollback_attempted').defaultTo(formatBoolean(false));
+    table.boolean('was_successful').defaultTo(formatBoolean(false));
+    
+    // Operator information
+    table.string('operator_type', 50).defaultTo('manual'); // manual, scheduled, api
+    table.integer('operator_user_id').references('id').inTable('admin_users').onDelete('SET NULL');
+    table.string('operator_ip', 50);
+    
+    // Metadata
+    table.text('metadata'); // JSON object for additional data
+    
+    table.index(['status', 'started_at']);
+    table.index(['restore_type', 'started_at']);
+  });
+  
+  // Create restore_file_operations table for tracking individual file operations
+  await knex.schema.createTable('restore_file_operations', table => {
+    table.increments('id').primary();
+    
+    table.integer('restore_run_id').notNullable()
+      .references('id').inTable('restore_runs').onDelete('CASCADE');
+    
+    table.string('file_path', 500).notNullable();
+    table.string('operation', 50).notNullable(); // restore, skip, error
+    table.string('status', 50).notNullable(); // pending, in_progress, completed, failed
+    
+    table.bigInteger('file_size');
+    table.string('checksum', 64);
+    table.boolean('checksum_verified').defaultTo(formatBoolean(false));
+    
+    table.text('error_message');
+    table.timestamp('started_at');
+    table.timestamp('completed_at');
+    
+    table.index(['restore_run_id', 'status']);
+    table.index(['file_path']);
+  });
+  
+  // Create restore_validation_results table
+  await knex.schema.createTable('restore_validation_results', table => {
+    table.increments('id').primary();
+    
+    table.integer('restore_run_id').notNullable()
+      .references('id').inTable('restore_runs').onDelete('CASCADE');
+    
+    table.string('validation_type', 50).notNullable(); // pre-restore, post-restore
+    table.boolean('is_valid').notNullable();
+    
+    table.text('errors'); // JSON array of errors
+    table.text('warnings'); // JSON array of warnings
+    table.text('checksums'); // JSON object with checksum comparisons
+    
+    table.timestamp('validated_at').notNullable().defaultTo(knex.fn.now());
+    
+    table.index(['restore_run_id', 'validation_type']);
+  });
+  
+  // Add restore-related settings to app_settings
+  await knex('app_settings').insert([
+    {
+      setting_key: 'restore_allow_force',
+      setting_value: formatBoolean(false),
+      setting_type: 'restore',
+      description: 'Allow force restore with warnings',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      setting_key: 'restore_require_pre_backup',
+      setting_value: formatBoolean(true),
+      setting_type: 'restore',
+      description: 'Require pre-restore backup',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      setting_key: 'restore_max_file_size_mb',
+      setting_value: '5000',
+      setting_type: 'restore',
+      description: 'Maximum file size for restore (MB)',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      setting_key: 'restore_verify_checksums',
+      setting_value: formatBoolean(true),
+      setting_type: 'restore',
+      description: 'Verify file checksums during restore',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      setting_key: 'restore_email_on_completion',
+      setting_value: formatBoolean(true),
+      setting_type: 'restore',
+      description: 'Send email on restore completion',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      setting_key: 'restore_retention_days',
+      setting_value: '30',
+      setting_type: 'restore',
+      description: 'Days to retain restore history',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    }
+  ]);
+  
+  // Add new email templates for restore notifications
+  const emailTemplates = [
+    {
+      name: 'restore_completed',
+      subject: '✅ Restore Completed Successfully',
+      body: `<h2>Restore Operation Completed</h2>
+<p>A restore operation has completed successfully.</p>
+
+<h3>Details:</h3>
+<ul>
+  <li><strong>Restore Type:</strong> {{restore_type}}</li>
+  <li><strong>Duration:</strong> {{duration}}</li>
+  <li><strong>Files Restored:</strong> {{files_restored}}</li>
+  <li><strong>Backup ID:</strong> {{backup_id}}</li>
+  <li><strong>Timestamp:</strong> {{timestamp}}</li>
+</ul>
+
+<p>Please verify that all systems are functioning correctly after the restore.</p>`,
+      language: 'en',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      name: 'restore_failed',
+      subject: '❌ Restore Operation Failed',
+      body: `<h2>Restore Operation Failed</h2>
+<p>A restore operation has failed and requires attention.</p>
+
+<h3>Details:</h3>
+<ul>
+  <li><strong>Restore Type:</strong> {{restore_type}}</li>
+  <li><strong>Error:</strong> {{error_message}}</li>
+  <li><strong>Timestamp:</strong> {{timestamp}}</li>
+</ul>
+
+<p>Please check the system logs for more details and take appropriate action.</p>
+
+<p><strong>Important:</strong> If a pre-restore backup was created, it may be used for recovery.</p>`,
+      language: 'en',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      name: 'restore_completed',
+      subject: '✅ Wiederherstellung erfolgreich abgeschlossen',
+      body: `<h2>Wiederherstellungsvorgang abgeschlossen</h2>
+<p>Ein Wiederherstellungsvorgang wurde erfolgreich abgeschlossen.</p>
+
+<h3>Details:</h3>
+<ul>
+  <li><strong>Wiederherstellungstyp:</strong> {{restore_type}}</li>
+  <li><strong>Dauer:</strong> {{duration}}</li>
+  <li><strong>Wiederhergestellte Dateien:</strong> {{files_restored}}</li>
+  <li><strong>Backup-ID:</strong> {{backup_id}}</li>
+  <li><strong>Zeitstempel:</strong> {{timestamp}}</li>
+</ul>
+
+<p>Bitte überprüfen Sie, ob alle Systeme nach der Wiederherstellung ordnungsgemäß funktionieren.</p>`,
+      language: 'de',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      name: 'restore_failed',
+      subject: '❌ Wiederherstellungsvorgang fehlgeschlagen',
+      body: `<h2>Wiederherstellungsvorgang fehlgeschlagen</h2>
+<p>Ein Wiederherstellungsvorgang ist fehlgeschlagen und erfordert Ihre Aufmerksamkeit.</p>
+
+<h3>Details:</h3>
+<ul>
+  <li><strong>Wiederherstellungstyp:</strong> {{restore_type}}</li>
+  <li><strong>Fehler:</strong> {{error_message}}</li>
+  <li><strong>Zeitstempel:</strong> {{timestamp}}</li>
+</ul>
+
+<p>Bitte überprüfen Sie die Systemprotokolle für weitere Details und ergreifen Sie entsprechende Maßnahmen.</p>
+
+<p><strong>Wichtig:</strong> Falls ein Backup vor der Wiederherstellung erstellt wurde, kann es zur Wiederherstellung verwendet werden.</p>`,
+      language: 'de',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    }
+  ];
+  
+  await knex('email_templates').insert(emailTemplates);
+};
+
+exports.down = async function(knex) {
+  // Remove email templates
+  await knex('email_templates')
+    .whereIn('name', ['restore_completed', 'restore_failed'])
+    .delete();
+  
+  // Remove settings
+  await knex('app_settings')
+    .where('setting_type', 'restore')
+    .delete();
+  
+  // Drop tables
+  await knex.schema.dropTableIfExists('restore_validation_results');
+  await knex.schema.dropTableIfExists('restore_file_operations');
+  await knex.schema.dropTableIfExists('restore_runs');
+};

backend/migrations/033_add_gallery_feedback.js

@@ -0,0 +1,131 @@
+const { formatBoolean } = require('./helpers');
+
+exports.up = async function(knex) {
+  console.log('Adding gallery feedback tables...');
+  
+  // Create event_feedback_settings table
+  await knex.schema.createTable('event_feedback_settings', (table) => {
+    table.increments('id').primary();
+    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+    table.boolean('feedback_enabled').defaultTo(false);
+    table.boolean('allow_ratings').defaultTo(true);
+    table.boolean('allow_likes').defaultTo(true);
+    table.boolean('allow_comments').defaultTo(false);
+    table.boolean('allow_favorites').defaultTo(true);
+    table.boolean('require_name_email').defaultTo(false);
+    table.boolean('moderate_comments').defaultTo(true);
+    table.boolean('show_feedback_to_guests').defaultTo(true);
+    table.timestamp('created_at').defaultTo(knex.fn.now());
+    table.timestamp('updated_at').defaultTo(knex.fn.now());
+    table.unique(['event_id']);
+  });
+
+  // Create photo_feedback table
+  await knex.schema.createTable('photo_feedback', (table) => {
+    table.increments('id').primary();
+    table.integer('photo_id').references('id').inTable('photos').onDelete('CASCADE');
+    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+    table.string('feedback_type', 20).notNullable();
+    table.integer('rating');
+    table.text('comment_text');
+    table.string('guest_name', 100);
+    table.string('guest_email', 255);
+    table.string('guest_identifier', 64);
+    table.string('ip_address', 45);
+    table.text('user_agent');
+    table.boolean('is_approved').defaultTo(true);
+    table.boolean('is_hidden').defaultTo(false);
+    table.timestamp('created_at').defaultTo(knex.fn.now());
+    table.timestamp('updated_at').defaultTo(knex.fn.now());
+    
+    // Add indexes
+    table.index(['photo_id']);
+    table.index(['event_id']);
+    table.index(['feedback_type']);
+    table.index(['guest_identifier']);
+    
+    // Add check constraint for rating (PostgreSQL)
+    if (knex.client.config.client === 'pg') {
+      table.check('?? >= 1 AND ?? <= 5', ['rating', 'rating']);
+    }
+  });
+
+  // Create feedback_rate_limits table
+  await knex.schema.createTable('feedback_rate_limits', (table) => {
+    table.increments('id').primary();
+    table.string('identifier', 64).notNullable();
+    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+    table.string('action_type', 20).notNullable();
+    table.integer('action_count').defaultTo(1);
+    table.timestamp('window_start').defaultTo(knex.fn.now());
+    
+    // Add indexes
+    table.index(['identifier', 'event_id', 'action_type']);
+    table.index(['window_start']);
+  });
+
+  // Create feedback_word_filters table
+  await knex.schema.createTable('feedback_word_filters', (table) => {
+    table.increments('id').primary();
+    table.string('word', 100).notNullable();
+    table.string('severity', 20).defaultTo('moderate');
+    table.boolean('is_active').defaultTo(true);
+    table.timestamp('created_at').defaultTo(knex.fn.now());
+    table.unique(['word']);
+  });
+
+  // Add feedback summary columns to photos table
+  await knex.schema.alterTable('photos', (table) => {
+    table.integer('feedback_count').defaultTo(0);
+    table.integer('like_count').defaultTo(0);
+    table.decimal('average_rating', 3, 2).defaultTo(0);
+    table.integer('favorite_count').defaultTo(0);
+  });
+
+  // Add feedback notification settings to app_settings
+  await knex('app_settings').insert([
+    {
+      setting_key: 'feedback_notification_email',
+      setting_value: JSON.stringify(''),
+      setting_type: 'feedback',
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'feedback_rate_limits',
+      setting_value: JSON.stringify({
+        rating: { max: 100, window: 3600 }, // 100 ratings per hour
+        comment: { max: 20, window: 3600 }, // 20 comments per hour
+        like: { max: 200, window: 3600 } // 200 likes per hour
+      }),
+      setting_type: 'feedback',
+      updated_at: new Date()
+    }
+  ]);
+  
+  console.log('Gallery feedback tables created successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing gallery feedback tables...');
+  
+  // Remove feedback settings from app_settings
+  await knex('app_settings')
+    .whereIn('setting_key', ['feedback_notification_email', 'feedback_rate_limits'])
+    .delete();
+
+  // Remove feedback columns from photos table
+  await knex.schema.alterTable('photos', (table) => {
+    table.dropColumn('feedback_count');
+    table.dropColumn('like_count');
+    table.dropColumn('average_rating');
+    table.dropColumn('favorite_count');
+  });
+
+  // Drop tables in reverse order
+  await knex.schema.dropTableIfExists('feedback_word_filters');
+  await knex.schema.dropTableIfExists('feedback_rate_limits');
+  await knex.schema.dropTableIfExists('photo_feedback');
+  await knex.schema.dropTableIfExists('event_feedback_settings');
+  
+  console.log('Gallery feedback tables removed');
+};

backend/migrations/034_add_version_to_backups.js

@@ -0,0 +1,139 @@
+const { db } = require('../src/database/db');
+
+async function up() {
+  console.log('Adding version tracking to backup tables...');
+  
+  // Add version columns to database_backup_runs table
+  const hasDatabaseBackupRunsTable = await db.schema.hasTable('database_backup_runs');
+  if (hasDatabaseBackupRunsTable) {
+    const hasAppVersion = await db.schema.hasColumn('database_backup_runs', 'app_version');
+    if (!hasAppVersion) {
+      await db.schema.alterTable('database_backup_runs', (table) => {
+        table.string('app_version'); // Application version
+        table.string('node_version'); // Node.js version
+        table.string('db_schema_version'); // Database schema version (migration name)
+        table.json('environment_info'); // Additional environment information
+      });
+      console.log('Added version columns to database_backup_runs table');
+    }
+  }
+
+  // Add version columns to backup_runs table (file backups)
+  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
+  if (hasBackupRunsTable) {
+    const hasAppVersion = await db.schema.hasColumn('backup_runs', 'app_version');
+    if (!hasAppVersion) {
+      await db.schema.alterTable('backup_runs', (table) => {
+        table.string('app_version'); // Application version
+        table.string('node_version'); // Node.js version
+        table.string('db_schema_version'); // Database schema version
+        table.json('manifest_info'); // Manifest summary information
+      });
+      console.log('Added version columns to backup_runs table');
+    }
+  }
+
+  // Add restore tracking table
+  const hasRestoreHistoryTable = await db.schema.hasTable('restore_history');
+  if (!hasRestoreHistoryTable) {
+    await db.schema.createTable('restore_history', (table) => {
+      table.increments('id').primary();
+      table.datetime('started_at').notNullable();
+      table.datetime('completed_at');
+      table.string('status').defaultTo('running'); // running, completed, failed, partial
+      table.string('restore_type'); // database, files, full
+      table.string('backup_id'); // Reference to the backup that was restored
+      table.string('backup_app_version'); // Version of app that created the backup
+      table.string('restore_app_version'); // Version of app performing the restore
+      table.string('backup_node_version'); // Node version that created the backup
+      table.string('restore_node_version'); // Node version performing the restore
+      table.string('backup_schema_version'); // Schema version in the backup
+      table.string('restore_schema_version'); // Current schema version
+      table.json('version_compatibility'); // Compatibility check results
+      table.json('restore_options'); // Options used during restore
+      table.json('statistics'); // Restore statistics
+      table.text('warnings'); // Any warnings during restore
+      table.text('error_message'); // Error details if failed
+      table.string('restored_by'); // User who initiated the restore
+      table.index(['started_at'], 'idx_restore_started');
+      table.index(['backup_id'], 'idx_restore_backup_id');
+    });
+    console.log('Created restore_history table');
+  }
+
+  // Add version compatibility settings
+  const versionSettings = [
+    {
+      setting_key: 'backup_require_version_match',
+      setting_value: JSON.stringify(false), // If true, exact version match required for restore
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_allow_minor_version_mismatch',
+      setting_value: JSON.stringify(true), // Allow restoring from same major version
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_warn_on_version_mismatch',
+      setting_value: JSON.stringify(true), // Show warning when versions don't match
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_check_schema_compatibility',
+      setting_value: JSON.stringify(true), // Check if migrations are compatible
+      setting_type: 'backup'
+    }
+  ];
+
+  // Insert version settings if they don't exist
+  for (const setting of versionSettings) {
+    const exists = await db('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await db('app_settings').insert(setting);
+    }
+  }
+
+  console.log('Version tracking for backups added successfully');
+}
+
+async function down() {
+  // Remove version columns from database_backup_runs
+  const hasDatabaseBackupRunsTable = await db.schema.hasTable('database_backup_runs');
+  if (hasDatabaseBackupRunsTable) {
+    await db.schema.alterTable('database_backup_runs', (table) => {
+      table.dropColumn('app_version');
+      table.dropColumn('node_version');
+      table.dropColumn('db_schema_version');
+      table.dropColumn('environment_info');
+    });
+  }
+
+  // Remove version columns from backup_runs
+  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
+  if (hasBackupRunsTable) {
+    await db.schema.alterTable('backup_runs', (table) => {
+      table.dropColumn('app_version');
+      table.dropColumn('node_version');
+      table.dropColumn('db_schema_version');
+      table.dropColumn('manifest_info');
+    });
+  }
+
+  // Drop restore_history table
+  await db.schema.dropTableIfExists('restore_history');
+
+  // Remove version settings
+  await db('app_settings')
+    .whereIn('setting_key', [
+      'backup_require_version_match',
+      'backup_allow_minor_version_mismatch',
+      'backup_warn_on_version_mismatch',
+      'backup_check_schema_compatibility'
+    ])
+    .delete();
+}
+
+module.exports = { up, down };

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "picpeak-backend",
-  "version": "1.0.16",
+  "version": "1.0.78",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "scripts": {
@@ -8,34 +8,43 @@
     "dev": "nodemon server.js",
     "migrate": "node migrations/run-migrations.js",
     "migrate:safe": "node migrations/run-migrations-safe.js",
+    "fix-temp-photos": "node scripts/fix-temp-photos.js",
     "test": "jest",
-    "lint": "eslint src/"
+    "lint": "eslint src/",
+    "test-backup": "node scripts/test-backup-service.js",
+    "test-restore": "node scripts/test-restore-service.js"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.850.0",
+    "@aws-sdk/lib-storage": "^3.850.0",
+    "@aws-sdk/s3-request-presigner": "^3.850.0",
     "adm-zip": "^0.5.16",
     "archiver": "^5.3.1",
     "axios": "^1.10.0",
-    "bcrypt": "^5.1.0",
-    "chokidar": "^3.5.3",
+    "bcrypt": "6.0.0",
+    "chokidar": "4.0.3",
     "cors": "^2.8.5",
     "dotenv": "^16.0.3",
     "express": "^4.18.2",
     "express-rate-limit": "^6.7.0",
     "express-validator": "^7.0.1",
-    "form-data": "^4.0.3",
+    "form-data": "^4.0.4",
+    "handlebars": "^4.7.8",
     "helmet": "^7.0.0",
-    "i18next": "^25.3.1",
+    "i18next": "25.3.2",
     "i18next-browser-languagedetector": "^8.2.0",
     "i18next-http-backend": "^3.0.2",
     "joi": "^17.9.1",
+    "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.0",
     "knex": "^2.4.2",
-    "multer": "^2.0.1",
+    "mime-types": "^3.0.1",
+    "multer": "^2.0.2",
     "node-cron": "^3.0.2",
-    "nodemailer": "^6.9.1",
+    "nodemailer": "7.0.5",
     "pg": "^8.16.3",
     "react-i18next": "^15.6.0",
-    "sharp": "^0.32.0",
+    "sharp": "0.34.3",
     "sqlite3": "^5.1.6",
     "uuid": "^11.1.0",
     "winston": "^3.8.2",

backend/scripts/check-email-environment.js

@@ -0,0 +1,131 @@
+const { db } = require('../src/database/db');
+
+async function checkEmailEnvironment() {
+  console.log('=== Email Environment Check ===\n');
+  
+  // 1. Check environment variables
+  console.log('1. Environment Variables:');
+  const envVars = [
+    'SMTP_HOST',
+    'SMTP_PORT',
+    'SMTP_USER',
+    'SMTP_PASS',
+    'SMTP_FROM',
+    'SMTP_SECURE',
+    'EMAIL_PROCESSOR_ENABLED',
+    'NODE_ENV'
+  ];
+  
+  envVars.forEach(varName => {
+    const value = process.env[varName];
+    if (varName.includes('PASS')) {
+      console.log(`   ${varName}: ${value ? '***' : 'NOT SET'}`);
+    } else {
+      console.log(`   ${varName}: ${value || 'NOT SET'}`);
+    }
+  });
+  
+  // 2. Check database configuration
+  console.log('\n2. Database Email Configuration:');
+  try {
+    const emailConfig = await db('email_configs').first();
+    if (emailConfig) {
+      console.log('   Email configuration found in database:');
+      console.log(`   - SMTP Host: ${emailConfig.smtp_host}`);
+      console.log(`   - SMTP Port: ${emailConfig.smtp_port}`);
+      console.log(`   - SMTP User: ${emailConfig.smtp_user || 'NOT SET'}`);
+      console.log(`   - SMTP Secure: ${emailConfig.smtp_secure}`);
+      console.log(`   - From Address: ${emailConfig.smtp_from}`);
+    } else {
+      console.log('   ⚠️  No email configuration found in database!');
+      console.log('   This will prevent the email processor from initializing.');
+    }
+  } catch (error) {
+    console.log(`   ❌ Error reading email configuration: ${error.message}`);
+  }
+  
+  // 3. Check if the email processor should be disabled
+  console.log('\n3. Email Processor Status:');
+  const isDisabled = process.env.EMAIL_PROCESSOR_ENABLED === 'false';
+  if (isDisabled) {
+    console.log('   ⚠️  Email processor is DISABLED via EMAIL_PROCESSOR_ENABLED=false');
+  } else {
+    console.log('   ✅ Email processor is enabled (default)');
+  }
+  
+  // 4. Check pending emails
+  console.log('\n4. Email Queue Status:');
+  try {
+    const pending = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count')
+      .first();
+    
+    const failed = await db('email_queue')
+      .where('status', 'failed')
+      .where('retry_count', '>=', 3)
+      .count('* as count')
+      .first();
+    
+    const sent = await db('email_queue')
+      .where('status', 'sent')
+      .count('* as count')
+      .first();
+    
+    console.log(`   - Pending emails: ${pending.count}`);
+    console.log(`   - Failed emails (max retries): ${failed.count}`);
+    console.log(`   - Sent emails: ${sent.count}`);
+  } catch (error) {
+    console.log(`   ❌ Error querying email queue: ${error.message}`);
+  }
+  
+  // 5. Test database connection
+  console.log('\n5. Database Connection:');
+  try {
+    await db.raw('SELECT 1');
+    console.log('   ✅ Database connection successful');
+  } catch (error) {
+    console.log(`   ❌ Database connection failed: ${error.message}`);
+  }
+  
+  // 6. Check for any recent errors
+  console.log('\n6. Recent Email Errors:');
+  try {
+    const recentErrors = await db('email_queue')
+      .whereNotNull('error_message')
+      .orderBy('id', 'desc')
+      .limit(3)
+      .select('id', 'email_type', 'error_message', 'retry_count');
+    
+    if (recentErrors.length > 0) {
+      recentErrors.forEach((email, index) => {
+        console.log(`   ${index + 1}. Email ID ${email.id} (${email.email_type}):`);
+        console.log(`      Retries: ${email.retry_count}`);
+        console.log(`      Error: ${email.error_message}`);
+      });
+    } else {
+      console.log('   No recent errors found');
+    }
+  } catch (error) {
+    console.log(`   ❌ Error querying recent errors: ${error.message}`);
+  }
+  
+  console.log('\n=== Environment check complete ===');
+  console.log('\nRecommendations:');
+  
+  const emailConfig = await db('email_configs').first().catch(() => null);
+  if (!emailConfig) {
+    console.log('❗ Configure email settings in the admin panel or add email_configs record');
+  }
+  
+  if (!process.env.SMTP_HOST && !emailConfig) {
+    console.log('❗ Set SMTP environment variables or configure in database');
+  }
+  
+  await db.destroy();
+}
+
+checkEmailEnvironment().catch(error => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});

backend/scripts/check-email-processor.js

@@ -0,0 +1,157 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function checkEmailProcessor() {
+  try {
+    logger.info('=== Email Processor Diagnostic Check ===\n');
+    
+    // 1. Check pending emails
+    logger.info('1. Checking pending emails in queue...');
+    const pendingEmails = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .orderBy('created_at', 'asc');
+    
+    logger.info(`Found ${pendingEmails.length} pending emails\n`);
+    
+    if (pendingEmails.length > 0) {
+      logger.info('Pending email details:');
+      pendingEmails.forEach((email, index) => {
+        logger.info(`\nEmail ${index + 1}:`);
+        logger.info(`  ID: ${email.id}`);
+        logger.info(`  Type: ${email.email_type}`);
+        logger.info(`  Recipient: ${email.recipient_email}`);
+        logger.info(`  Event ID: ${email.event_id}`);
+        logger.info(`  Status: ${email.status}`);
+        logger.info(`  Retry Count: ${email.retry_count}`);
+        logger.info(`  Scheduled At: ${email.scheduled_at}`);
+        logger.info(`  Created At: ${email.created_at}`);
+        logger.info(`  Error: ${email.error_message || 'None'}`);
+        
+        // Check if email_data needs parsing
+        logger.info(`  Email Data Type: ${typeof email.email_data}`);
+        if (email.email_data) {
+          try {
+            const data = typeof email.email_data === 'string' 
+              ? JSON.parse(email.email_data) 
+              : email.email_data;
+            logger.info(`  Email Data Keys: ${Object.keys(data).join(', ')}`);
+          } catch (e) {
+            logger.error(`  Failed to parse email_data: ${e.message}`);
+          }
+        }
+      });
+    }
+    
+    // 2. Check failed emails
+    logger.info('\n\n2. Checking failed emails...');
+    const failedEmails = await db('email_queue')
+      .where('status', 'failed')
+      .orderBy('created_at', 'desc')
+      .limit(5);
+    
+    logger.info(`Found ${failedEmails.length} failed emails (showing last 5)\n`);
+    
+    if (failedEmails.length > 0) {
+      failedEmails.forEach((email, index) => {
+        logger.info(`\nFailed Email ${index + 1}:`);
+        logger.info(`  ID: ${email.id}`);
+        logger.info(`  Type: ${email.email_type}`);
+        logger.info(`  Retry Count: ${email.retry_count}`);
+        logger.info(`  Error: ${email.error_message || 'No error message'}`);
+        logger.info(`  Last Attempt: ${email.sent_at || 'Never'}`);
+      });
+    }
+    
+    // 3. Check if email processor should be running
+    logger.info('\n\n3. Checking email processor configuration...');
+    
+    // Check environment variables
+    const emailConfig = {
+      SMTP_HOST: process.env.SMTP_HOST,
+      SMTP_PORT: process.env.SMTP_PORT,
+      SMTP_USER: process.env.SMTP_USER,
+      SMTP_FROM: process.env.SMTP_FROM,
+      SMTP_SECURE: process.env.SMTP_SECURE,
+      EMAIL_PROCESSOR_ENABLED: process.env.EMAIL_PROCESSOR_ENABLED || 'true'
+    };
+    
+    logger.info('Email configuration:');
+    Object.entries(emailConfig).forEach(([key, value]) => {
+      if (key === 'SMTP_USER') {
+        logger.info(`  ${key}: ${value ? '***' : 'NOT SET'}`);
+      } else {
+        logger.info(`  ${key}: ${value || 'NOT SET'}`);
+      }
+    });
+    
+    // 4. Test email processor functionality
+    logger.info('\n\n4. Testing email processor functionality...');
+    
+    // Import the email processor
+    const { processEmailQueue, testEmailConnection } = require('../src/services/emailProcessor');
+    
+    // Test email connection
+    logger.info('Testing email connection...');
+    try {
+      const connectionTest = await testEmailConnection();
+      logger.info(`Email connection test: ${connectionTest ? 'SUCCESS' : 'FAILED'}`);
+    } catch (error) {
+      logger.error(`Email connection test failed: ${error.message}`);
+    }
+    
+    // Try to process queue once manually
+    if (pendingEmails.length > 0) {
+      logger.info('\n\n5. Attempting to process email queue manually...');
+      try {
+        await processEmailQueue();
+        logger.info('Manual queue processing completed');
+        
+        // Check status after processing
+        const stillPending = await db('email_queue')
+          .where('status', 'pending')
+          .where('retry_count', '<', 3)
+          .count('* as count')
+          .first();
+        
+        logger.info(`Emails still pending after processing: ${stillPending.count}`);
+      } catch (error) {
+        logger.error(`Error processing queue: ${error.message}`);
+        logger.error(`Stack trace: ${error.stack}`);
+      }
+    }
+    
+    // 5. Check for any recent successful emails
+    logger.info('\n\n6. Checking recent successful emails...');
+    const recentSuccess = await db('email_queue')
+      .where('status', 'sent')
+      .orderBy('sent_at', 'desc')
+      .limit(3);
+    
+    if (recentSuccess.length > 0) {
+      logger.info(`Last ${recentSuccess.length} successful emails:`);
+      recentSuccess.forEach((email, index) => {
+        logger.info(`  ${index + 1}. Type: ${email.email_type}, Sent: ${email.sent_at}`);
+      });
+    } else {
+      logger.info('No successfully sent emails found');
+    }
+    
+    logger.info('\n\n=== Diagnostic check complete ===');
+    
+  } catch (error) {
+    logger.error('Error running diagnostic check:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the check
+checkEmailProcessor();

backend/scripts/check-email-templates.js

@@ -0,0 +1,66 @@
+const { db } = require('../src/database/db');
+
+async function checkEmailTemplates() {
+  try {
+    console.log('=== Email Templates Check ===\n');
+    
+    // 1. Check table columns
+    console.log('1. Checking email_templates table structure...');
+    
+    // Check which columns exist
+    const columnChecks = [
+      'subject', 'subject_en', 'subject_de',
+      'body_html', 'body_html_en', 'body_html_de',
+      'body_text', 'body_text_en', 'body_text_de'
+    ];
+    
+    const existingColumns = [];
+    for (const col of columnChecks) {
+      const exists = await db.schema.hasColumn('email_templates', col);
+      if (exists) existingColumns.push(col);
+    }
+    
+    console.log('   Existing columns:', existingColumns.join(', '));
+    
+    // 2. Get all templates
+    console.log('\n2. Current email templates:');
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n   Template: ${template.template_key}`);
+      console.log('   -------------------');
+      
+      // Check which fields have content
+      const fields = ['subject', 'subject_en', 'subject_de', 
+                     'body_html', 'body_html_en', 'body_html_de',
+                     'body_text', 'body_text_en', 'body_text_de'];
+      
+      for (const field of fields) {
+        if (template[field]) {
+          const preview = template[field].substring(0, 50) + '...';
+          console.log(`   ${field}: ${preview}`);
+        }
+      }
+      
+      // Check for German translations
+      const hasGermanSubject = template.subject_de || template.body_html_de;
+      console.log(`   Has German translation: ${hasGermanSubject ? 'YES' : 'NO'}`);
+    }
+    
+    // 3. Summary
+    console.log('\n3. Summary:');
+    const totalTemplates = templates.length;
+    const templatesWithGerman = templates.filter(t => t.subject_de || t.body_html_de).length;
+    console.log(`   Total templates: ${totalTemplates}`);
+    console.log(`   Templates with German: ${templatesWithGerman}`);
+    console.log(`   Missing German: ${totalTemplates - templatesWithGerman}`);
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+checkEmailTemplates();

backend/scripts/check-german-templates.js

@@ -0,0 +1,53 @@
+const { db } = require('../src/database/db');
+
+async function checkGermanTemplates() {
+  try {
+    console.log('=== German Email Template Content Check ===\n');
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\nTemplate: ${template.template_key}`);
+      console.log('=====================================');
+      
+      // Check German subject
+      console.log('\nGERMAN SUBJECT:');
+      console.log(template.subject_de || 'MISSING');
+      
+      // Check if German HTML body has English content
+      console.log('\nGERMAN HTML BODY:');
+      const germanHtml = template.body_html_de || '';
+      
+      // Check for English phrases in German template
+      const englishPhrases = [
+        'Dear', 'Gallery', 'has been', 'Your photo', 'successfully',
+        'Details:', 'Link:', 'Password:', 'Expires:', 'Event Date:',
+        'Thank you', 'Best regards', 'View Gallery', 'days'
+      ];
+      
+      const foundEnglish = englishPhrases.filter(phrase => 
+        germanHtml.toLowerCase().includes(phrase.toLowerCase())
+      );
+      
+      if (foundEnglish.length > 0) {
+        console.log('⚠️  Found English phrases in German template:', foundEnglish.join(', '));
+      }
+      
+      // Show first 500 chars of German HTML
+      console.log(germanHtml.substring(0, 500) + '...\n');
+      
+      // Check German text body
+      console.log('GERMAN TEXT BODY:');
+      const germanText = template.body_text_de || '';
+      console.log(germanText.substring(0, 300) + '...\n');
+    }
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+checkGermanTemplates();

backend/scripts/check-storage.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * Script to check storage directory structure and verify files
+ * Usage: node scripts/check-storage.js [eventSlug]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+
+async function checkDirectory(dirPath, description) {
+  try {
+    await fs.access(dirPath);
+    const stats = await fs.stat(dirPath);
+    const files = await fs.readdir(dirPath);
+    console.log(`✓ ${description}: ${dirPath}`);
+    console.log(`  - Files/Folders: ${files.length}`);
+    console.log(`  - Permissions: ${(stats.mode & parseInt('777', 8)).toString(8)}`);
+    return true;
+  } catch (error) {
+    console.log(`✗ ${description}: ${dirPath} - ${error.message}`);
+    return false;
+  }
+}
+
+async function checkStorageStructure(eventSlug = null) {
+  console.log('Checking storage structure...');
+  console.log(`Storage base path: ${STORAGE_PATH}\n`);
+  
+  // Check main directories
+  await checkDirectory(STORAGE_PATH, 'Storage root');
+  await checkDirectory(path.join(STORAGE_PATH, 'events'), 'Events directory');
+  await checkDirectory(path.join(STORAGE_PATH, 'events/active'), 'Active events');
+  await checkDirectory(path.join(STORAGE_PATH, 'events/archived'), 'Archived events');
+  await checkDirectory(path.join(STORAGE_PATH, 'thumbnails'), 'Thumbnails');
+  await checkDirectory(path.join(STORAGE_PATH, 'uploads'), 'Uploads');
+  
+  console.log('\n---\n');
+  
+  // If event slug provided, check specific event
+  if (eventSlug) {
+    console.log(`Checking specific event: ${eventSlug}`);
+    
+    const event = await db('events').where('slug', eventSlug).first();
+    if (!event) {
+      console.log(`✗ Event not found in database: ${eventSlug}`);
+      return;
+    }
+    
+    console.log(`✓ Event found in database:`);
+    console.log(`  - ID: ${event.id}`);
+    console.log(`  - Name: ${event.event_name}`);
+    console.log(`  - Active: ${event.is_active}`);
+    console.log(`  - Archived: ${event.is_archived}`);
+    
+    // Check event directory
+    const eventDir = path.join(STORAGE_PATH, 'events/active', eventSlug);
+    const eventExists = await checkDirectory(eventDir, 'Event directory');
+    
+    if (eventExists) {
+      const files = await fs.readdir(eventDir);
+      console.log(`  - Photo files: ${files.filter(f => /\.(jpg|jpeg|png|gif)$/i.test(f)).length}`);
+    }
+    
+    // Check photos in database
+    const photos = await db('photos').where('event_id', event.id).select('id', 'filename', 'path', 'thumbnail_path');
+    console.log(`\nDatabase photos: ${photos.length}`);
+    
+    // Check if photo files exist
+    let existingPhotos = 0;
+    let missingPhotos = 0;
+    let existingThumbnails = 0;
+    let missingThumbnails = 0;
+    
+    for (const photo of photos) {
+      const photoPath = path.join(STORAGE_PATH, 'events/active', photo.path);
+      try {
+        await fs.access(photoPath);
+        existingPhotos++;
+      } catch {
+        missingPhotos++;
+        console.log(`  ✗ Missing photo: ${photo.path}`);
+      }
+      
+      if (photo.thumbnail_path) {
+        const thumbPath = path.join(STORAGE_PATH, photo.thumbnail_path.replace(/^\//, ''));
+        try {
+          await fs.access(thumbPath);
+          existingThumbnails++;
+        } catch {
+          missingThumbnails++;
+          console.log(`  ✗ Missing thumbnail: ${photo.thumbnail_path}`);
+        }
+      }
+    }
+    
+    console.log(`\nFile check summary:`);
+    console.log(`  - Photos: ${existingPhotos} exist, ${missingPhotos} missing`);
+    console.log(`  - Thumbnails: ${existingThumbnails} exist, ${missingThumbnails} missing`);
+  } else {
+    // List all event directories
+    try {
+      const activeDir = path.join(STORAGE_PATH, 'events/active');
+      const eventDirs = await fs.readdir(activeDir);
+      console.log(`Active event directories: ${eventDirs.length}`);
+      for (const dir of eventDirs.slice(0, 10)) {
+        console.log(`  - ${dir}`);
+      }
+      if (eventDirs.length > 10) {
+        console.log(`  ... and ${eventDirs.length - 10} more`);
+      }
+    } catch (error) {
+      console.log('Could not list event directories:', error.message);
+    }
+  }
+}
+
+// Parse command line arguments
+const eventSlug = process.argv[2] || null;
+
+// Run the script
+checkStorageStructure(eventSlug).then(async () => {
+  await db.destroy();
+  console.log('\nStorage check complete');
+}).catch(async error => {
+  console.error('Error:', error);
+  await db.destroy();
+  process.exit(1);
+});

backend/scripts/cleanup-thumbnails.js

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+
+/**
+ * Script to clean up orphaned and temporary thumbnails
+ * Usage: node scripts/cleanup-thumbnails.js [--dry-run]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function cleanupThumbnails(dryRun = false) {
+  console.log('Starting thumbnail cleanup...');
+  console.log(`Thumbnails directory: ${THUMBNAILS_DIR}`);
+  console.log(`Mode: ${dryRun ? 'DRY RUN' : 'LIVE'}\n`);
+  
+  try {
+    // Get all thumbnail files
+    const files = await fs.readdir(THUMBNAILS_DIR);
+    console.log(`Found ${files.length} files in thumbnails directory`);
+    
+    // Get all valid thumbnail paths from database
+    const validThumbnails = await db('photos')
+      .whereNotNull('thumbnail_path')
+      .select('thumbnail_path');
+    
+    const validPaths = new Set(
+      validThumbnails.map(t => path.basename(t.thumbnail_path))
+    );
+    
+    console.log(`Found ${validPaths.size} valid thumbnails in database\n`);
+    
+    let tempCount = 0;
+    let orphanedCount = 0;
+    let validCount = 0;
+    let deletedCount = 0;
+    
+    for (const file of files) {
+      // Skip directories
+      const filePath = path.join(THUMBNAILS_DIR, file);
+      const stats = await fs.stat(filePath);
+      if (stats.isDirectory()) continue;
+      
+      // Check if it's a temporary file
+      if (file.startsWith('thumb_temp_')) {
+        tempCount++;
+        console.log(`Temporary file: ${file}`);
+        
+        if (!dryRun) {
+          try {
+            await fs.unlink(filePath);
+            deletedCount++;
+          } catch (error) {
+            console.error(`  Failed to delete: ${error.message}`);
+          }
+        }
+      }
+      // Check if it's an orphaned thumbnail
+      else if (!validPaths.has(file)) {
+        orphanedCount++;
+        console.log(`Orphaned file: ${file}`);
+        
+        if (!dryRun) {
+          try {
+            await fs.unlink(filePath);
+            deletedCount++;
+          } catch (error) {
+            console.error(`  Failed to delete: ${error.message}`);
+          }
+        }
+      } else {
+        validCount++;
+      }
+    }
+    
+    console.log('\n--- Summary ---');
+    console.log(`Total files: ${files.length}`);
+    console.log(`Valid thumbnails: ${validCount}`);
+    console.log(`Temporary files: ${tempCount}`);
+    console.log(`Orphaned files: ${orphanedCount}`);
+    if (!dryRun) {
+      console.log(`Deleted files: ${deletedCount}`);
+    } else {
+      console.log(`Files to be deleted: ${tempCount + orphanedCount}`);
+    }
+    
+  } catch (error) {
+    console.error('Error during cleanup:', error);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const dryRun = process.argv.includes('--dry-run');
+
+// Run the cleanup
+cleanupThumbnails(dryRun).then(async () => {
+  await db.destroy();
+  console.log('\nCleanup complete');
+}).catch(async error => {
+  console.error('Cleanup failed:', error);
+  await db.destroy();
+  process.exit(1);
+});

backend/scripts/create-test-event.js

@@ -36,7 +36,8 @@ async function createTestEvent() {
     await db('events').where('slug', eventData.slug).delete();
     
     // Insert new event
-    const [eventId] = await db('events').insert(eventData);
+    const insertResult = await db('events').insert(eventData).returning('id');
+    const eventId = insertResult[0]?.id || insertResult[0];
     console.log('Event created with ID:', eventId);
     
     console.log('\nTest event created successfully!');

backend/scripts/debug-500-errors.js

@@ -0,0 +1,92 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function debugEndpoints() {
+  console.log('Debugging 500 errors...\n');
+  
+  try {
+    // Test email templates query
+    console.log('1. Testing email templates query:');
+    try {
+      const templates = await db('email_templates')
+        .select('*')
+        .orderBy('template_key');
+      
+      console.log(`Found ${templates.length} templates`);
+      if (templates.length > 0) {
+        console.log('First template columns:', Object.keys(templates[0]));
+        console.log('Template keys:', templates.map(t => t.template_key));
+      }
+    } catch (error) {
+      console.error('Email templates query failed:', error.message);
+      console.error('Error code:', error.code);
+    }
+    
+    // Test notifications query
+    console.log('\n2. Testing notifications query:');
+    try {
+      const notifications = await db('activity_logs')
+        .select(
+          'activity_logs.*',
+          'events.event_name'
+        )
+        .leftJoin('events', 'activity_logs.event_id', 'events.id')
+        .whereNull('activity_logs.read_at')
+        .orderBy('activity_logs.created_at', 'desc')
+        .limit(5);
+      
+      console.log(`Found ${notifications.length} unread notifications`);
+    } catch (error) {
+      console.error('Notifications query failed:', error.message);
+      console.error('Error code:', error.code);
+      
+      // Check if it's a column issue
+      if (error.message.includes('column')) {
+        console.log('\nChecking activity_logs columns:');
+        const columns = await db('activity_logs').columnInfo();
+        console.log('Columns:', Object.keys(columns));
+      }
+    }
+    
+    // Test specific template query
+    console.log('\n3. Testing specific template query (gallery_created):');
+    try {
+      const template = await db('email_templates')
+        .where('template_key', 'gallery_created')
+        .first();
+      
+      if (template) {
+        console.log('Template found:', template.template_key);
+        console.log('Has subject_en?', template.subject_en !== undefined);
+        console.log('Has subject?', template.subject !== undefined);
+      } else {
+        console.log('Template not found');
+      }
+    } catch (error) {
+      console.error('Template query failed:', error.message);
+    }
+    
+    // Check CMS pages
+    console.log('\n4. Checking CMS pages:');
+    try {
+      const pages = await db('cms_pages')
+        .select('slug', 'title', 'is_published')
+        .orderBy('slug');
+      
+      console.log(`Found ${pages.length} CMS pages:`);
+      pages.forEach(page => {
+        console.log(`  - ${page.slug}: ${page.title} (published: ${page.is_published})`);
+      });
+    } catch (error) {
+      console.error('CMS pages query failed:', error.message);
+    }
+    
+  } catch (error) {
+    console.error('General error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+debugEndpoints();

backend/scripts/debug-email-queue.js

@@ -0,0 +1,146 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function debugEmailQueue() {
+  try {
+    logger.info('=== Email Queue Debug Report ===\n');
+    
+    // 1. Count exactly like the admin dashboard does
+    logger.info('1. Admin Dashboard Query (ALL pending, no retry filter):');
+    const [adminCount] = await db('email_queue').where('status', 'pending').count('* as count');
+    logger.info(`   Pending emails (admin dashboard view): ${adminCount.count}\n`);
+    
+    // 2. Count like the email processor does
+    logger.info('2. Email Processor Query (pending with retry_count < 3):');
+    const [processorCount] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    logger.info(`   Pending emails (processor view): ${processorCount.count}\n`);
+    
+    // 3. Show the discrepancy
+    logger.info('3. Discrepancy Analysis:');
+    if (adminCount.count !== processorCount.count) {
+      logger.info(`   ⚠️  DISCREPANCY FOUND!`);
+      logger.info(`   Admin shows: ${adminCount.count}`);
+      logger.info(`   Processor will process: ${processorCount.count}`);
+      logger.info(`   Difference: ${adminCount.count - processorCount.count} email(s)\n`);
+      
+      // Find the problematic emails
+      logger.info('4. Emails with retry_count >= 3 (still pending):');
+      const stuckEmails = await db('email_queue')
+        .where('status', 'pending')
+        .where('retry_count', '>=', 3)
+        .select('*');
+      
+      if (stuckEmails.length > 0) {
+        logger.info(`   Found ${stuckEmails.length} stuck email(s):\n`);
+        stuckEmails.forEach((email, index) => {
+          logger.info(`   Email ${index + 1}:`);
+          logger.info(`     ID: ${email.id}`);
+          logger.info(`     Type: ${email.email_type}`);
+          logger.info(`     Recipient: ${email.recipient_email}`);
+          logger.info(`     Status: ${email.status}`);
+          logger.info(`     Retry Count: ${email.retry_count} ⚠️`);
+          logger.info(`     Created: ${email.created_at}`);
+          logger.info(`     Last Error: ${email.error_message || 'None'}\n`);
+        });
+      }
+    } else {
+      logger.info(`   ✅ No discrepancy - counts match\n`);
+    }
+    
+    // 5. Show ALL pending emails with details
+    logger.info('5. ALL Pending Emails (regardless of retry count):');
+    const allPending = await db('email_queue')
+      .where('status', 'pending')
+      .orderBy('retry_count', 'desc')
+      .orderBy('created_at', 'asc');
+    
+    if (allPending.length > 0) {
+      allPending.forEach((email, index) => {
+        const willProcess = email.retry_count < 3;
+        logger.info(`\n   Email ${index + 1}: ${willProcess ? '✅ WILL PROCESS' : '❌ STUCK (max retries)'}`);
+        logger.info(`     ID: ${email.id}`);
+        logger.info(`     Type: ${email.email_type}`);
+        logger.info(`     Recipient: ${email.recipient_email}`);
+        logger.info(`     Event ID: ${email.event_id}`);
+        logger.info(`     Retry Count: ${email.retry_count}/3`);
+        logger.info(`     Created: ${email.created_at}`);
+        logger.info(`     Scheduled: ${email.scheduled_at}`);
+        if (email.error_message) {
+          logger.info(`     Last Error: ${email.error_message}`);
+        }
+      });
+    } else {
+      logger.info('   No pending emails found');
+    }
+    
+    // 6. Show counts by status
+    logger.info('\n\n6. Email Queue Summary by Status:');
+    const statusCounts = await db('email_queue')
+      .select('status')
+      .count('* as count')
+      .groupBy('status')
+      .orderBy('status');
+    
+    statusCounts.forEach(row => {
+      logger.info(`   ${row.status}: ${row.count}`);
+    });
+    
+    // 7. Failed emails summary
+    logger.info('\n7. Failed Emails Summary:');
+    const failedSummary = await db('email_queue')
+      .where('status', 'failed')
+      .select('retry_count')
+      .count('* as count')
+      .groupBy('retry_count')
+      .orderBy('retry_count');
+    
+    if (failedSummary.length > 0) {
+      failedSummary.forEach(row => {
+        logger.info(`   Retry count ${row.retry_count}: ${row.count} email(s)`);
+      });
+    } else {
+      logger.info('   No failed emails');
+    }
+    
+    // 8. Recommendations
+    logger.info('\n\n=== RECOMMENDATIONS ===');
+    
+    if (adminCount.count > processorCount.count) {
+      logger.info('\n❗ You have emails stuck with retry_count >= 3');
+      logger.info('   These emails will NOT be processed automatically.');
+      logger.info('\n   To fix this, you can:');
+      logger.info('   1. Reset retry count: UPDATE email_queue SET retry_count = 0 WHERE status = \'pending\' AND retry_count >= 3;');
+      logger.info('   2. Mark as failed: UPDATE email_queue SET status = \'failed\' WHERE status = \'pending\' AND retry_count >= 3;');
+      logger.info('   3. Delete them: DELETE FROM email_queue WHERE status = \'pending\' AND retry_count >= 3;');
+    }
+    
+    const anyPending = adminCount.count > 0;
+    if (anyPending && processorCount.count === 0) {
+      logger.info('\n❗ All pending emails have exceeded retry limit');
+      logger.info('   The email processor will not attempt to send them.');
+    } else if (anyPending && processorCount.count > 0) {
+      logger.info('\n✅ Email processor should process the pending emails on next run');
+      logger.info('   Make sure the email processor service is running.');
+    }
+    
+    logger.info('\n=== Debug report complete ===');
+    
+  } catch (error) {
+    logger.error('Error running debug report:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the debug
+debugEmailQueue();

backend/scripts/diagnose-thumbnails.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * Script to diagnose thumbnail serving issues
+ * Usage: node scripts/diagnose-thumbnails.js <eventId>
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function diagnoseThumbnails(eventId) {
+  if (!eventId) {
+    console.error('Usage: node scripts/diagnose-thumbnails.js <eventId>');
+    process.exit(1);
+  }
+  
+  console.log(`Diagnosing thumbnails for event ID: ${eventId}`);
+  console.log(`Storage path: ${STORAGE_PATH}`);
+  console.log(`Thumbnails directory: ${THUMBNAILS_DIR}\n`);
+  
+  try {
+    // Get event info
+    const event = await db('events').where('id', eventId).first();
+    if (!event) {
+      console.error(`Event not found with ID: ${eventId}`);
+      return;
+    }
+    
+    console.log(`Event: ${event.event_name} (${event.slug})`);
+    console.log(`Active: ${event.is_active}, Archived: ${event.is_archived}\n`);
+    
+    // Get photos for this event
+    const photos = await db('photos')
+      .where('event_id', eventId)
+      .select('id', 'filename', 'path', 'thumbnail_path');
+    
+    console.log(`Found ${photos.length} photos in database\n`);
+    
+    let missingThumbnails = 0;
+    let existingThumbnails = 0;
+    let pathIssues = [];
+    
+    for (const photo of photos.slice(0, 10)) { // Check first 10 photos
+      console.log(`Photo ID ${photo.id}: ${photo.filename}`);
+      console.log(`  Photo path: ${photo.path}`);
+      console.log(`  Thumbnail path in DB: ${photo.thumbnail_path}`);
+      
+      if (photo.thumbnail_path) {
+        // Expected thumbnail filename
+        const expectedThumbName = `thumb_${photo.filename}`;
+        const expectedThumbPath = path.join(THUMBNAILS_DIR, expectedThumbName);
+        
+        // Check if thumbnail exists
+        try {
+          await fs.access(expectedThumbPath);
+          console.log(`  ✓ Thumbnail exists at: ${expectedThumbName}`);
+          existingThumbnails++;
+          
+          // Check if DB path matches expected path
+          const dbThumbName = path.basename(photo.thumbnail_path);
+          if (dbThumbName !== expectedThumbName) {
+            console.log(`  ⚠ Path mismatch! DB has: ${dbThumbName}, Expected: ${expectedThumbName}`);
+            pathIssues.push({
+              photoId: photo.id,
+              dbPath: photo.thumbnail_path,
+              expectedPath: `thumbnails/${expectedThumbName}`
+            });
+          }
+        } catch {
+          console.log(`  ✗ Thumbnail missing: ${expectedThumbName}`);
+          missingThumbnails++;
+        }
+      } else {
+        console.log(`  ✗ No thumbnail path in database`);
+        missingThumbnails++;
+      }
+      console.log('');
+    }
+    
+    console.log('--- Summary ---');
+    console.log(`Existing thumbnails: ${existingThumbnails}`);
+    console.log(`Missing thumbnails: ${missingThumbnails}`);
+    console.log(`Path issues: ${pathIssues.length}`);
+    
+    if (pathIssues.length > 0) {
+      console.log('\n--- Path Issues ---');
+      console.log('The following photos have incorrect thumbnail paths in the database:');
+      for (const issue of pathIssues) {
+        console.log(`Photo ID ${issue.photoId}:`);
+        console.log(`  Current: ${issue.dbPath}`);
+        console.log(`  Should be: ${issue.expectedPath}`);
+      }
+      
+      console.log('\nTo fix path issues, run:');
+      console.log(`UPDATE photos SET thumbnail_path = 'thumbnails/thumb_' || filename WHERE event_id = ${eventId};`);
+    }
+    
+    // Check for any thumbnails in the directory that match this event
+    const files = await fs.readdir(THUMBNAILS_DIR);
+    const eventThumbnails = files.filter(f => {
+      // Try to match thumbnails for this event
+      for (const photo of photos) {
+        if (f === `thumb_${photo.filename}`) return true;
+      }
+      return false;
+    });
+    
+    console.log(`\n--- Filesystem Check ---`);
+    console.log(`Found ${eventThumbnails.length} thumbnails in directory for this event`);
+    
+  } catch (error) {
+    console.error('Error during diagnosis:', error);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const eventId = process.argv[2] ? parseInt(process.argv[2]) : null;
+
+// Run the diagnosis
+diagnoseThumbnails(eventId).then(async () => {
+  await db.destroy();
+  console.log('\nDiagnosis complete');
+}).catch(async error => {
+  console.error('Diagnosis failed:', error);
+  await db.destroy();
+  process.exit(1);
+});

backend/scripts/fix-email-queue-schema.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+
+/**
+ * Script to diagnose and fix email_queue schema issues
+ * This helps resolve the "column updated_at does not exist" error
+ */
+
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function checkAndFixEmailQueueSchema() {
+  console.log('Checking email_queue table schema...');
+  
+  try {
+    // Get column information
+    const columns = await db('email_queue').columnInfo();
+    console.log('\nCurrent email_queue columns:', Object.keys(columns));
+    
+    // Check for updated_at column
+    if (columns.updated_at) {
+      console.log('\n⚠️  Found unexpected updated_at column in email_queue table!');
+      console.log('This column should not exist and is causing errors.');
+      
+      // Ask for confirmation before removing
+      console.log('\nRemoving updated_at column...');
+      await db.schema.table('email_queue', (table) => {
+        table.dropColumn('updated_at');
+      });
+      console.log('✅ Removed updated_at column from email_queue table');
+    } else {
+      console.log('✅ No updated_at column found (this is correct)');
+    }
+    
+    // Verify required columns exist
+    const requiredColumns = [
+      'id', 'event_id', 'recipient_email', 'email_type', 
+      'email_data', 'status', 'scheduled_at', 'sent_at', 
+      'error_message', 'retry_count', 'created_at'
+    ];
+    
+    const missingColumns = requiredColumns.filter(col => !columns[col]);
+    if (missingColumns.length > 0) {
+      console.log('\n⚠️  Missing required columns:', missingColumns);
+    } else {
+      console.log('✅ All required columns are present');
+    }
+    
+    // Check for any database triggers
+    if (process.env.DATABASE_CLIENT === 'pg') {
+      console.log('\nChecking for PostgreSQL triggers on email_queue...');
+      const triggers = await db.raw(`
+        SELECT trigger_name, event_manipulation, action_statement
+        FROM information_schema.triggers
+        WHERE event_object_table = 'email_queue'
+        AND trigger_schema = current_schema()
+      `);
+      
+      if (triggers.rows && triggers.rows.length > 0) {
+        console.log('⚠️  Found triggers on email_queue table:');
+        triggers.rows.forEach(trigger => {
+          console.log(`  - ${trigger.trigger_name} (${trigger.event_manipulation})`);
+        });
+      } else {
+        console.log('✅ No triggers found on email_queue table');
+      }
+    }
+    
+    // Test update query
+    console.log('\nTesting update query...');
+    const testEmail = await db('email_queue')
+      .where('status', 'pending')
+      .first();
+    
+    if (testEmail) {
+      try {
+        await db('email_queue')
+          .where('id', testEmail.id)
+          .update({
+            retry_count: testEmail.retry_count
+          });
+        console.log('✅ Update query works correctly');
+      } catch (error) {
+        console.log('❌ Update query failed:', error.message);
+      }
+    } else {
+      console.log('ℹ️  No pending emails to test with');
+    }
+    
+    console.log('\nSchema check complete!');
+    
+  } catch (error) {
+    console.error('Error checking schema:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Run the check
+checkAndFixEmailQueueSchema();

backend/scripts/fix-final-german-templates.js

@@ -0,0 +1,88 @@
+const { db } = require('../src/database/db');
+
+async function fixFinalGermanTemplates() {
+  try {
+    console.log('Fixing remaining English words in German templates...\n');
+    
+    // Get all templates
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      let updated = false;
+      let updates = {};
+      
+      // Fix subject_de
+      if (template.subject_de) {
+        updates.subject_de = template.subject_de;
+      }
+      
+      // Fix body_html_de
+      if (template.body_html_de) {
+        let html = template.body_html_de;
+        
+        // Replace English words with German
+        html = html.replace(/Gallery-Details:/g, 'Galerie-Details:');
+        html = html.replace(/Galerie-Details:/g, 'Galerie-Details:');
+        html = html.replace(/Details:/g, 'Details:');
+        html = html.replace(/Link:/g, 'Link:');
+        html = html.replace(/Gallery-Link:/g, 'Galerie-Link:');
+        html = html.replace(/Galerie-Link:/g, 'Galerie-Link:');
+        html = html.replace(/Archive-Details:/g, 'Archiv-Details:');
+        html = html.replace(/Archiv-Details:/g, 'Archiv-Details:');
+        
+        if (html !== template.body_html_de) {
+          updates.body_html_de = html;
+          updated = true;
+        }
+      }
+      
+      // Fix body_text_de
+      if (template.body_text_de) {
+        let text = template.body_text_de;
+        
+        text = text.replace(/Gallery-Details:/g, 'Galerie-Details:');
+        text = text.replace(/Galerie-Details:/g, 'Galerie-Details:');
+        text = text.replace(/Details:/g, 'Details:');
+        text = text.replace(/Link:/g, 'Link:');
+        text = text.replace(/Gallery-Link:/g, 'Galerie-Link:');
+        text = text.replace(/Galerie-Link:/g, 'Galerie-Link:');
+        text = text.replace(/Archive-Details:/g, 'Archiv-Details:');
+        text = text.replace(/Archiv-Details:/g, 'Archiv-Details:');
+        
+        if (text !== template.body_text_de) {
+          updates.body_text_de = text;
+          updated = true;
+        }
+      }
+      
+      // Also update the non-language-specific fields to match German
+      if (template.body_html_de) {
+        updates.body_html = template.body_html_de;
+      }
+      if (template.body_text_de) {
+        updates.body_text = template.body_text_de;
+      }
+      if (template.subject_de) {
+        updates.subject = template.subject_de;
+      }
+      
+      if (updated || Object.keys(updates).length > 0) {
+        await db('email_templates')
+          .where('template_key', template.template_key)
+          .update(updates);
+        console.log(`✅ Updated ${template.template_key}`);
+      } else {
+        console.log(`⏭️  No changes needed for ${template.template_key}`);
+      }
+    }
+    
+    console.log('\nDone!');
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+fixFinalGermanTemplates();

backend/scripts/fix-production-issues.js

@@ -0,0 +1,145 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function fixProductionIssues() {
+  console.log('Fixing production database issues...\n');
+  
+  try {
+    // 1. Check and fix email_templates structure
+    console.log('1. Checking email_templates structure:');
+    const emailColumns = await db('email_templates').columnInfo();
+    console.log('Current columns:', Object.keys(emailColumns));
+    
+    // Check if we need to add basic columns back
+    const hasSubject = 'subject' in emailColumns;
+    const hasSubjectEn = 'subject_en' in emailColumns;
+    
+    if (hasSubjectEn && !hasSubject) {
+      console.log('Adding basic columns back to email_templates...');
+      await db.schema.alterTable('email_templates', (table) => {
+        table.string('subject');
+        table.text('body_html');
+        table.text('body_text');
+      });
+      
+      // Copy values from _en columns
+      await db('email_templates').update({
+        subject: db.raw('subject_en'),
+        body_html: db.raw('body_html_en'),
+        body_text: db.raw('body_text_en')
+      });
+      console.log('Basic columns added successfully');
+    }
+    
+    // 2. Ensure default templates exist
+    console.log('\n2. Checking email templates:');
+    const templateCount = await db('email_templates').count('* as count');
+    console.log('Template count:', templateCount[0].count);
+    
+    if (templateCount[0].count === 0) {
+      console.log('No templates found, inserting defaults...');
+      const defaultTemplates = [
+        {
+          template_key: 'gallery_created',
+          subject: 'Your Photo Gallery is Ready!',
+          body_html: '<h2>Gallery Created Successfully</h2>...',
+          body_text: 'Gallery Created Successfully...',
+          variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date'])
+        },
+        {
+          template_key: 'expiration_warning',
+          subject: 'Your Photo Gallery Expires Soon',
+          body_html: '<h2>Gallery Expiring Soon</h2>...',
+          body_text: 'Gallery Expiring Soon...',
+          variables: JSON.stringify(['host_name', 'event_name', 'days_remaining', 'gallery_link'])
+        },
+        {
+          template_key: 'gallery_expired',
+          subject: 'Your Photo Gallery Has Expired',
+          body_html: '<h2>Gallery Expired</h2>...',
+          body_text: 'Gallery Expired...',
+          variables: JSON.stringify(['host_name', 'event_name'])
+        },
+        {
+          template_key: 'archive_complete',
+          subject: 'Gallery Archive Complete',
+          body_html: '<h2>Archive Complete</h2>...',
+          body_text: 'Archive Complete...',
+          variables: JSON.stringify(['host_name', 'event_name', 'archive_size'])
+        }
+      ];
+      
+      for (const template of defaultTemplates) {
+        // Add language columns if they exist
+        if (hasSubjectEn) {
+          template.subject_en = template.subject;
+          template.body_html_en = template.body_html;
+          template.body_text_en = template.body_text;
+          template.subject_de = template.subject;
+          template.body_html_de = template.body_html;
+          template.body_text_de = template.body_text;
+        }
+        
+        await db('email_templates').insert(template);
+      }
+      console.log('Default templates inserted');
+    }
+    
+    // 3. Check activity_logs structure
+    console.log('\n3. Checking activity_logs structure:');
+    const activityColumns = await db('activity_logs').columnInfo();
+    console.log('Columns:', Object.keys(activityColumns));
+    
+    // Check if read_at exists
+    if (!('read_at' in activityColumns)) {
+      console.log('Adding read_at column to activity_logs...');
+      await db.schema.alterTable('activity_logs', (table) => {
+        table.datetime('read_at').nullable();
+      });
+      console.log('read_at column added');
+    }
+    
+    // 4. Check and add CMS pages
+    console.log('\n4. Checking CMS pages:');
+    const cmsColumns = await db('cms_pages').columnInfo();
+    console.log('CMS columns:', Object.keys(cmsColumns));
+    
+    const impressum = await db('cms_pages').where('slug', 'impressum').first();
+    const datenschutz = await db('cms_pages').where('slug', 'datenschutz').first();
+    
+    if (!impressum) {
+      console.log('Adding Impressum page...');
+      await db('cms_pages').insert({
+        slug: 'impressum',
+        title_en: 'Legal Notice',
+        title_de: 'Impressum',
+        content_en: '<h1>Legal Notice</h1><p>Your legal information here...</p>',
+        content_de: '<h1>Impressum</h1><p>Ihre rechtlichen Informationen hier...</p>',
+        updated_at: new Date()
+      });
+    }
+    
+    if (!datenschutz) {
+      console.log('Adding Datenschutz page...');
+      await db('cms_pages').insert({
+        slug: 'datenschutz',
+        title_en: 'Privacy Policy',
+        title_de: 'Datenschutzerklärung',
+        content_en: '<h1>Privacy Policy</h1><p>Your privacy policy here...</p>',
+        content_de: '<h1>Datenschutzerklärung</h1><p>Ihre Datenschutzerklärung hier...</p>',
+        updated_at: new Date()
+      });
+    }
+    
+    console.log('\n✅ All fixes applied successfully!');
+    
+  } catch (error) {
+    console.error('Error fixing issues:', error);
+    console.error('Stack:', error.stack);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+fixProductionIssues();

backend/scripts/fix-stuck-emails.js

@@ -0,0 +1,126 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function fixStuckEmails() {
+  try {
+    logger.info('=== Fix Stuck Emails Script ===\n');
+    
+    // 1. Find stuck emails
+    logger.info('1. Finding stuck emails (pending with retry_count >= 3)...');
+    const stuckEmails = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '>=', 3)
+      .select('*');
+    
+    if (stuckEmails.length === 0) {
+      logger.info('   ✅ No stuck emails found!');
+      logger.info('\n=== Script complete ===');
+      await db.destroy();
+      process.exit(0);
+    }
+    
+    logger.info(`   Found ${stuckEmails.length} stuck email(s)\n`);
+    
+    // 2. Show details
+    logger.info('2. Stuck email details:');
+    stuckEmails.forEach((email, index) => {
+      logger.info(`\n   Email ${index + 1}:`);
+      logger.info(`     ID: ${email.id}`);
+      logger.info(`     Type: ${email.email_type}`);
+      logger.info(`     Recipient: ${email.recipient_email}`);
+      logger.info(`     Retry Count: ${email.retry_count}`);
+      logger.info(`     Last Error: ${email.error_message || 'None'}`);
+    });
+    
+    // 3. Ask for action
+    logger.info('\n\n3. Choose an action:');
+    logger.info('   1. Reset retry count to 0 (emails will be retried)');
+    logger.info('   2. Mark as failed (emails will not be retried)');
+    logger.info('   3. Delete these emails');
+    logger.info('   4. Cancel (do nothing)');
+    
+    // Get command line argument
+    const action = process.argv[2];
+    
+    if (!action || !['reset', 'fail', 'delete'].includes(action)) {
+      logger.info('\n❗ No valid action specified');
+      logger.info('\nUsage:');
+      logger.info('  node fix-stuck-emails.js reset   - Reset retry count to 0');
+      logger.info('  node fix-stuck-emails.js fail    - Mark as failed');
+      logger.info('  node fix-stuck-emails.js delete  - Delete stuck emails');
+      await db.destroy();
+      process.exit(1);
+    }
+    
+    // 4. Execute action
+    logger.info(`\n4. Executing action: ${action.toUpperCase()}`);
+    
+    const emailIds = stuckEmails.map(e => e.id);
+    
+    switch (action) {
+      case 'reset':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .update({
+            retry_count: 0,
+            error_message: null
+          });
+        logger.info(`   ✅ Reset retry count for ${emailIds.length} email(s)`);
+        logger.info('   These emails will be processed on the next run');
+        break;
+        
+      case 'fail':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .update({
+            status: 'failed'
+          });
+        logger.info(`   ✅ Marked ${emailIds.length} email(s) as failed`);
+        logger.info('   These emails will not be retried');
+        break;
+        
+      case 'delete':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .delete();
+        logger.info(`   ✅ Deleted ${emailIds.length} email(s)`);
+        break;
+    }
+    
+    // 5. Show updated counts
+    logger.info('\n5. Updated email queue status:');
+    const [pendingCount] = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count');
+    const [processableCount] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    
+    logger.info(`   Total pending: ${pendingCount.count}`);
+    logger.info(`   Processable (retry < 3): ${processableCount.count}`);
+    
+    if (pendingCount.count !== processableCount.count) {
+      logger.info(`   ⚠️  Still have ${pendingCount.count - processableCount.count} stuck email(s)`);
+    } else {
+      logger.info('   ✅ No stuck emails remaining');
+    }
+    
+    logger.info('\n=== Script complete ===');
+    
+  } catch (error) {
+    logger.error('Error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the fix
+fixStuckEmails();

backend/scripts/fix-temp-photos.js

@@ -0,0 +1,171 @@
+require('dotenv').config({ path: '../.env' });
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+const { generatePhotoFilename } = require('../src/utils/filenameSanitizer');
+
+async function fixTempPhotos() {
+  console.log('Starting to fix temporary photo files...\n');
+  
+  try {
+    // Find all photos with temp_ filenames
+    const tempPhotos = await db('photos')
+      .where('filename', 'like', 'temp_%')
+      .orderBy('event_id', 'asc')
+      .orderBy('category_id', 'asc')
+      .orderBy('id', 'asc');
+    
+    console.log(`Found ${tempPhotos.length} photos with temporary filenames\n`);
+    
+    if (tempPhotos.length === 0) {
+      console.log('No temporary photos found. Exiting.');
+      return;
+    }
+    
+    // Group photos by event and category
+    const grouped = {};
+    for (const photo of tempPhotos) {
+      const key = `${photo.event_id}_${photo.category_id || 'null'}`;
+      if (!grouped[key]) {
+        grouped[key] = [];
+      }
+      grouped[key].push(photo);
+    }
+    
+    console.log(`Processing ${Object.keys(grouped).length} event/category groups...\n`);
+    
+    // Process each group
+    for (const [key, photos] of Object.entries(grouped)) {
+      const [eventId, categoryIdStr] = key.split('_');
+      const categoryId = categoryIdStr === 'null' ? null : parseInt(categoryIdStr);
+      
+      console.log(`\nProcessing Event ID: ${eventId}, Category ID: ${categoryId || 'uncategorized'}`);
+      console.log(`Photos in group: ${photos.length}`);
+      
+      // Get event details
+      const event = await db('events').where({ id: eventId }).first();
+      if (!event) {
+        console.error(`Event ${eventId} not found! Skipping...`);
+        continue;
+      }
+      
+      // Get category details if applicable
+      let category = null;
+      let startCounter = 1;
+      
+      if (categoryId) {
+        category = await db('photo_categories').where({ id: categoryId }).first();
+        if (!category) {
+          console.error(`Category ${categoryId} not found! Treating as uncategorized...`);
+        } else {
+          // Get the highest counter for this category
+          const maxPhoto = await db('photos')
+            .where({ event_id: eventId, category_id: categoryId })
+            .whereNot('filename', 'like', 'temp_%')
+            .orderBy('id', 'desc')
+            .first();
+          
+          if (maxPhoto && maxPhoto.filename) {
+            // Extract counter from filename
+            const match = maxPhoto.filename.match(/_(\d+)\.[^.]+$/);
+            if (match) {
+              startCounter = parseInt(match[1]) + 1;
+            }
+          }
+        }
+      } else {
+        // For uncategorized, get the highest counter
+        const maxPhoto = await db('photos')
+          .where({ event_id: eventId })
+          .whereNull('category_id')
+          .whereNot('filename', 'like', 'temp_%')
+          .orderBy('id', 'desc')
+          .first();
+        
+        if (maxPhoto && maxPhoto.filename) {
+          const match = maxPhoto.filename.match(/_(\d+)\.[^.]+$/);
+          if (match) {
+            startCounter = parseInt(match[1]) + 1;
+          }
+        }
+      }
+      
+      console.log(`Starting counter: ${startCounter}`);
+      
+      // Process each photo in the group
+      let successCount = 0;
+      let errorCount = 0;
+      
+      for (let i = 0; i < photos.length; i++) {
+        const photo = photos[i];
+        const counter = startCounter + i;
+        
+        try {
+          // Generate new filename
+          const extension = path.extname(photo.filename);
+          const newFilename = generatePhotoFilename(
+            event.event_name,
+            category ? category.name : 'uncategorized',
+            counter,
+            extension
+          );
+          
+          // Build full paths
+          const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+          const oldPath = path.join(storagePath, 'events/active', photo.path);
+          const newPath = path.join(path.dirname(oldPath), newFilename);
+          
+          // Check if old file exists
+          try {
+            await fs.access(oldPath);
+          } catch (e) {
+            console.error(`File not found: ${oldPath}`);
+            errorCount++;
+            continue;
+          }
+          
+          // Rename the file
+          await fs.rename(oldPath, newPath);
+          
+          // Update database
+          const newRelativePath = path.relative(path.join(storagePath, 'events/active'), newPath);
+          await db('photos')
+            .where({ id: photo.id })
+            .update({
+              filename: newFilename,
+              path: newRelativePath
+            });
+          
+          console.log(`✓ Renamed: ${photo.filename} → ${newFilename}`);
+          successCount++;
+          
+        } catch (error) {
+          console.error(`✗ Failed to process photo ${photo.id}: ${error.message}`);
+          errorCount++;
+        }
+      }
+      
+      // Update category counter if needed
+      if (category && successCount > 0) {
+        const newCounter = startCounter + photos.length - 1;
+        await db('photo_categories')
+          .where({ id: categoryId })
+          .update({ photo_counter: newCounter });
+        console.log(`Updated category counter to ${newCounter}`);
+      }
+      
+      console.log(`\nGroup summary: ${successCount} successful, ${errorCount} errors`);
+    }
+    
+    console.log('\n=== COMPLETE ===');
+    console.log('All temporary photos have been processed.');
+    
+  } catch (error) {
+    console.error('Fatal error:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Run the script
+fixTempPhotos().catch(console.error);

backend/scripts/regenerate-thumbnails.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+
+/**
+ * Script to regenerate missing thumbnails for photos in the database
+ * Usage: node scripts/regenerate-thumbnails.js [eventId]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const sharp = require('sharp');
+const { db } = require('../src/database/db');
+
+// Configuration
+const THUMBNAIL_SIZE = 300;
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function ensureDirectoryExists(dirPath) {
+  try {
+    await fs.access(dirPath);
+  } catch {
+    await fs.mkdir(dirPath, { recursive: true });
+    console.log(`Created directory: ${dirPath}`);
+  }
+}
+
+async function generateThumbnail(photoPath, thumbnailPath) {
+  try {
+    await sharp(photoPath)
+      .resize(THUMBNAIL_SIZE, THUMBNAIL_SIZE, {
+        fit: 'cover',
+        position: 'center'
+      })
+      .jpeg({ quality: 80 })
+      .toFile(thumbnailPath);
+    
+    return true;
+  } catch (error) {
+    console.error(`Failed to generate thumbnail for ${photoPath}:`, error.message);
+    return false;
+  }
+}
+
+async function regenerateThumbnails(eventId = null) {
+  try {
+    console.log('Starting thumbnail regeneration...');
+    console.log(`Storage path: ${STORAGE_PATH}`);
+    console.log(`Thumbnails directory: ${THUMBNAILS_DIR}`);
+    
+    // Ensure thumbnails directory exists
+    await ensureDirectoryExists(THUMBNAILS_DIR);
+    
+    // Build query
+    let query = db('photos')
+      .join('events', 'photos.event_id', 'events.id')
+      .select(
+        'photos.id',
+        'photos.filename',
+        'photos.path',
+        'photos.thumbnail_path',
+        'events.slug as event_slug'
+      );
+    
+    if (eventId) {
+      query = query.where('photos.event_id', eventId);
+      console.log(`Filtering for event ID: ${eventId}`);
+    }
+    
+    const photos = await query;
+    console.log(`Found ${photos.length} photos to process`);
+    
+    let successCount = 0;
+    let skipCount = 0;
+    let errorCount = 0;
+    
+    for (const photo of photos) {
+      const photoPath = path.join(STORAGE_PATH, 'events/active', photo.path);
+      const thumbnailFilename = `thumb_${photo.filename}`;
+      const thumbnailPath = path.join(THUMBNAILS_DIR, thumbnailFilename);
+      
+      try {
+        // Check if photo file exists
+        await fs.access(photoPath);
+        
+        // Check if thumbnail already exists
+        try {
+          await fs.access(thumbnailPath);
+          console.log(`Thumbnail already exists for ${photo.filename}, skipping...`);
+          skipCount++;
+          continue;
+        } catch {
+          // Thumbnail doesn't exist, generate it
+        }
+        
+        console.log(`Generating thumbnail for ${photo.filename}...`);
+        const success = await generateThumbnail(photoPath, thumbnailPath);
+        
+        if (success) {
+          // Update database with thumbnail path
+          await db('photos')
+            .where('id', photo.id)
+            .update({
+              thumbnail_path: `thumbnails/${thumbnailFilename}`
+            });
+          
+          successCount++;
+          console.log(`✓ Generated thumbnail for ${photo.filename}`);
+        } else {
+          errorCount++;
+        }
+      } catch (error) {
+        console.error(`✗ Photo file not found: ${photoPath}`);
+        errorCount++;
+      }
+    }
+    
+    console.log('\nThumbnail regeneration complete!');
+    console.log(`- Successfully generated: ${successCount}`);
+    console.log(`- Skipped (already exist): ${skipCount}`);
+    console.log(`- Errors: ${errorCount}`);
+    console.log(`- Total processed: ${photos.length}`);
+    
+  } catch (error) {
+    console.error('Error during thumbnail regeneration:', error);
+    process.exit(1);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Parse command line arguments
+const eventId = process.argv[2] ? parseInt(process.argv[2]) : null;
+
+// Run the script
+regenerateThumbnails(eventId).then(() => {
+  console.log('Script completed successfully');
+  process.exit(0);
+}).catch(error => {
+  console.error('Script failed:', error);
+  process.exit(1);
+});

backend/scripts/run-email-processor.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+
+const { db } = require('../src/database/db');
+const { 
+  initializeTransporter, 
+  processEmailQueue, 
+  testEmailConnection 
+} = require('../src/services/emailProcessor');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function runEmailProcessor(runOnce = false) {
+  try {
+    logger.info('=== Starting Email Processor ===\n');
+    
+    // Initialize transporter
+    logger.info('Initializing email transporter...');
+    await initializeTransporter();
+    
+    // Test connection
+    logger.info('Testing email connection...');
+    const connectionOk = await testEmailConnection();
+    
+    if (!connectionOk) {
+      logger.error('Email connection test failed! Check your SMTP configuration.');
+      logger.info('\nRequired environment variables:');
+      logger.info('- SMTP_HOST');
+      logger.info('- SMTP_PORT');
+      logger.info('- SMTP_USER');
+      logger.info('- SMTP_PASS');
+      logger.info('- SMTP_FROM');
+      process.exit(1);
+    }
+    
+    logger.info('Email connection test successful!\n');
+    
+    if (runOnce) {
+      // Process queue once
+      logger.info('Processing email queue once...');
+      await processEmailQueue();
+      logger.info('Email processing complete');
+      
+      // Show final status
+      const pendingCount = await db('email_queue')
+        .where('status', 'pending')
+        .where('retry_count', '<', 3)
+        .count('* as count')
+        .first();
+      
+      logger.info(`\nEmails still pending: ${pendingCount.count}`);
+      
+      await db.destroy();
+      process.exit(0);
+    } else {
+      // Run continuously
+      logger.info('Starting continuous email processor...');
+      logger.info('Processing emails every 60 seconds. Press Ctrl+C to stop.\n');
+      
+      // Process immediately
+      await processEmailQueue();
+      
+      // Then every minute
+      setInterval(async () => {
+        try {
+          await processEmailQueue();
+        } catch (error) {
+          logger.error('Error processing email queue:', error);
+        }
+      }, 60000);
+    }
+    
+  } catch (error) {
+    logger.error('Fatal error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+// Handle graceful shutdown
+process.on('SIGINT', async () => {
+  logger.info('\n\nShutting down email processor...');
+  await db.destroy();
+  process.exit(0);
+});
+
+// Check command line arguments
+const args = process.argv.slice(2);
+const runOnce = args.includes('--once') || args.includes('-o');
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`
+Email Processor Runner
+
+Usage: node run-email-processor.js [options]
+
+Options:
+  --once, -o     Process the email queue once and exit
+  --help, -h     Show this help message
+
+By default, the processor runs continuously, checking for emails every 60 seconds.
+  `);
+  process.exit(0);
+}
+
+// Run the processor
+runEmailProcessor(runOnce);

backend/scripts/test-backup-integration.js

@@ -0,0 +1,577 @@
+#!/usr/bin/env node
+
+/**
+ * Manual Integration Test Script for Enhanced Backup System
+ * 
+ * This script provides a comprehensive test of the backup system with real services.
+ * It can be used to test against MinIO, AWS S3, or other S3-compatible services.
+ * 
+ * Usage:
+ *   node scripts/test-backup-integration.js [options]
+ * 
+ * Options:
+ *   --endpoint <url>     S3 endpoint URL (default: http://localhost:9000)
+ *   --access-key <key>   S3 access key (default: minioadmin)
+ *   --secret-key <key>   S3 secret key (default: minioadmin)
+ *   --bucket <name>      S3 bucket name (default: test-backup-<timestamp>)
+ *   --type <type>        Backup type: s3, local, rsync (default: s3)
+ *   --cleanup            Clean up test data after completion
+ *   --verbose            Enable verbose logging
+ *   --help               Show this help message
+ * 
+ * Examples:
+ *   # Test with local MinIO
+ *   node scripts/test-backup-integration.js
+ * 
+ *   # Test with AWS S3
+ *   node scripts/test-backup-integration.js \
+ *     --endpoint https://s3.amazonaws.com \
+ *     --access-key AKIAIOSFODNN7EXAMPLE \
+ *     --secret-key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY \
+ *     --bucket my-test-bucket
+ * 
+ *   # Test local backup
+ *   node scripts/test-backup-integration.js --type local
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const crypto = require('crypto');
+const { S3Client, CreateBucketCommand, HeadBucketCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand, DeleteBucketCommand } = require('@aws-sdk/client-s3');
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const options = {
+  endpoint: 'http://localhost:9000',
+  accessKey: 'minioadmin',
+  secretKey: 'minioadmin',
+  bucket: `test-backup-${Date.now()}`,
+  type: 's3',
+  cleanup: false,
+  verbose: false
+};
+
+for (let i = 0; i < args.length; i++) {
+  switch (args[i]) {
+    case '--endpoint':
+      options.endpoint = args[++i];
+      break;
+    case '--access-key':
+      options.accessKey = args[++i];
+      break;
+    case '--secret-key':
+      options.secretKey = args[++i];
+      break;
+    case '--bucket':
+      options.bucket = args[++i];
+      break;
+    case '--type':
+      options.type = args[++i];
+      break;
+    case '--cleanup':
+      options.cleanup = true;
+      break;
+    case '--verbose':
+      options.verbose = true;
+      break;
+    case '--help':
+      console.log(module.exports.description || 'Manual Integration Test Script');
+      process.exit(0);
+  }
+}
+
+// Load environment and services
+require('dotenv').config();
+const { db, initialize: initDb } = require('../src/database/db');
+const backupService = require('../src/services/backupService');
+const S3StorageAdapter = require('../src/services/storage/s3Storage');
+const logger = require('../src/utils/logger');
+
+// Configure logger based on verbose flag
+if (!options.verbose) {
+  logger.info = () => {};
+  logger.debug = () => {};
+}
+
+// Test results
+const results = {
+  passed: 0,
+  failed: 0,
+  skipped: 0,
+  tests: []
+};
+
+// Test utilities
+async function runTest(name, testFn) {
+  console.log(`\n📋 Running: ${name}`);
+  try {
+    const startTime = Date.now();
+    await testFn();
+    const duration = Date.now() - startTime;
+    console.log(`✅ PASSED: ${name} (${duration}ms)`);
+    results.passed++;
+    results.tests.push({ name, status: 'passed', duration });
+  } catch (error) {
+    console.error(`❌ FAILED: ${name}`);
+    console.error(`   Error: ${error.message}`);
+    if (options.verbose) {
+      console.error(error.stack);
+    }
+    results.failed++;
+    results.tests.push({ name, status: 'failed', error: error.message });
+  }
+}
+
+async function skipTest(name, reason) {
+  console.log(`\n⏭️  Skipping: ${name}`);
+  console.log(`   Reason: ${reason}`);
+  results.skipped++;
+  results.tests.push({ name, status: 'skipped', reason });
+}
+
+// Test functions
+async function testS3Connection() {
+  const s3Adapter = new S3StorageAdapter({
+    bucket: options.bucket,
+    endpoint: options.endpoint,
+    accessKeyId: options.accessKey,
+    secretAccessKey: options.secretKey,
+    region: 'us-east-1',
+    forcePathStyle: true,
+    sslEnabled: options.endpoint.startsWith('https')
+  });
+
+  await s3Adapter.testConnection();
+  console.log(`   ✓ Connected to S3 endpoint: ${options.endpoint}`);
+  console.log(`   ✓ Bucket accessible: ${options.bucket}`);
+}
+
+async function setupTestData() {
+  const storagePath = path.join(__dirname, '../test-storage');
+  process.env.STORAGE_PATH = storagePath;
+
+  // Create directory structure
+  const dirs = [
+    'events/active/wedding-2024',
+    'events/active/birthday-2024',
+    'events/archived',
+    'thumbnails',
+    'uploads',
+    'backups'
+  ];
+
+  for (const dir of dirs) {
+    await fs.mkdir(path.join(storagePath, dir), { recursive: true });
+  }
+
+  // Create test files with various sizes
+  const files = [
+    { path: 'events/active/wedding-2024/photo1.jpg', size: 1024 * 1024 }, // 1MB
+    { path: 'events/active/wedding-2024/photo2.jpg', size: 512 * 1024 },  // 512KB
+    { path: 'events/active/birthday-2024/photo1.jpg', size: 2 * 1024 * 1024 }, // 2MB
+    { path: 'events/archived/old-event.zip', size: 5 * 1024 * 1024 }, // 5MB
+    { path: 'thumbnails/thumb1.jpg', size: 50 * 1024 }, // 50KB
+    { path: 'uploads/logo.png', size: 100 * 1024 } // 100KB
+  ];
+
+  let totalSize = 0;
+  for (const file of files) {
+    const content = crypto.randomBytes(file.size);
+    await fs.writeFile(path.join(storagePath, file.path), content);
+    totalSize += file.size;
+  }
+
+  console.log(`   ✓ Created ${files.length} test files`);
+  console.log(`   ✓ Total size: ${(totalSize / 1024 / 1024).toFixed(2)} MB`);
+
+  return { storagePath, fileCount: files.length, totalSize };
+}
+
+async function configureBackup(type) {
+  const baseSettings = [
+    { setting_key: 'backup_enabled', setting_value: 'true' },
+    { setting_key: 'backup_destination_type', setting_value: `"${type}"` },
+    { setting_key: 'backup_include_archived', setting_value: 'true' },
+    { setting_key: 'backup_include_database', setting_value: 'true' },
+    { setting_key: 'backup_incremental', setting_value: 'true' },
+    { setting_key: 'backup_manifest_format', setting_value: '"json"' },
+    { setting_key: 'backup_max_file_size_mb', setting_value: '100' }
+  ];
+
+  const typeSpecificSettings = {
+    s3: [
+      { setting_key: 'backup_s3_bucket', setting_value: `"${options.bucket}"` },
+      { setting_key: 'backup_s3_endpoint', setting_value: `"${options.endpoint}"` },
+      { setting_key: 'backup_s3_access_key', setting_value: `"${options.accessKey}"` },
+      { setting_key: 'backup_s3_secret_key', setting_value: `"${options.secretKey}"` },
+      { setting_key: 'backup_s3_region', setting_value: '"us-east-1"' },
+      { setting_key: 'backup_s3_force_path_style', setting_value: 'true' },
+      { setting_key: 'backup_s3_ssl_enabled', setting_value: options.endpoint.startsWith('https') ? 'true' : 'false' }
+    ],
+    local: [
+      { setting_key: 'backup_destination_path', setting_value: `"${path.join(__dirname, '../test-backup')}"` }
+    ],
+    rsync: [
+      { setting_key: 'backup_rsync_host', setting_value: '"localhost"' },
+      { setting_key: 'backup_rsync_path', setting_value: `"${path.join(__dirname, '../test-backup-rsync')}"` }
+    ]
+  };
+
+  const settings = [...baseSettings, ...(typeSpecificSettings[type] || [])];
+
+  // Clear existing settings
+  await db('app_settings').where('setting_type', 'backup').del();
+
+  // Insert new settings
+  for (const setting of settings) {
+    await db('app_settings').insert({
+      setting_type: 'backup',
+      ...setting,
+      created_at: new Date(),
+      updated_at: new Date()
+    });
+  }
+
+  console.log(`   ✓ Configured ${type} backup with ${settings.length} settings`);
+}
+
+async function performBackup() {
+  const startTime = Date.now();
+  
+  // Run the backup
+  await backupService.runBackup();
+
+  // Get backup results
+  const backupRun = await db('backup_runs')
+    .orderBy('started_at', 'desc')
+    .first();
+
+  if (!backupRun) {
+    throw new Error('No backup run found');
+  }
+
+  if (backupRun.status !== 'completed') {
+    throw new Error(`Backup failed with status: ${backupRun.status}, error: ${backupRun.error_message}`);
+  }
+
+  const duration = Date.now() - startTime;
+
+  console.log(`   ✓ Backup completed in ${duration}ms`);
+  console.log(`   ✓ Files backed up: ${backupRun.files_backed_up}`);
+  console.log(`   ✓ Total size: ${(backupRun.total_size_bytes / 1024 / 1024).toFixed(2)} MB`);
+  console.log(`   ✓ Manifest: ${backupRun.manifest_path ? 'Generated' : 'Not generated'}`);
+
+  return backupRun;
+}
+
+async function verifyS3Backup(backupRun) {
+  const s3Client = new S3Client({
+    endpoint: options.endpoint,
+    region: 'us-east-1',
+    credentials: {
+      accessKeyId: options.accessKey,
+      secretAccessKey: options.secretKey
+    },
+    forcePathStyle: true
+  });
+
+  // List objects in bucket
+  const listResponse = await s3Client.send(new ListObjectsV2Command({
+    Bucket: options.bucket
+  }));
+
+  const objects = listResponse.Contents || [];
+  console.log(`   ✓ Objects in S3: ${objects.length}`);
+
+  // Verify key components
+  const hasBackupFolder = objects.some(obj => obj.Key.includes('backup-'));
+  const hasManifest = objects.some(obj => obj.Key.includes('backup-manifest'));
+  const hasSummary = objects.some(obj => obj.Key.includes('backup-summary.json'));
+  const hasPhotos = objects.some(obj => obj.Key.includes('events/active'));
+
+  if (!hasBackupFolder) throw new Error('No backup folder found in S3');
+  if (!hasManifest) throw new Error('No manifest found in S3');
+  if (!hasSummary) throw new Error('No summary found in S3');
+  if (!hasPhotos) throw new Error('No photos found in S3');
+
+  console.log(`   ✓ Backup structure verified`);
+
+  // Download and verify a file
+  const photoObject = objects.find(obj => obj.Key.includes('photo1.jpg'));
+  if (photoObject) {
+    const getResponse = await s3Client.send(new GetObjectCommand({
+      Bucket: options.bucket,
+      Key: photoObject.Key
+    }));
+
+    const chunks = [];
+    for await (const chunk of getResponse.Body) {
+      chunks.push(chunk);
+    }
+    const content = Buffer.concat(chunks);
+
+    console.log(`   ✓ Downloaded test file: ${photoObject.Key} (${content.length} bytes)`);
+  }
+}
+
+async function testIncrementalBackup(testData) {
+  // Modify a file
+  const modifiedFile = path.join(testData.storagePath, 'events/active/wedding-2024/photo1.jpg');
+  const newContent = crypto.randomBytes(1024 * 1024 + 100); // Slightly larger
+  await fs.writeFile(modifiedFile, newContent);
+
+  console.log(`   ✓ Modified test file`);
+
+  // Perform incremental backup
+  const backupRun = await performBackup();
+
+  if (backupRun.files_backed_up !== 1) {
+    throw new Error(`Expected 1 file in incremental backup, got ${backupRun.files_backed_up}`);
+  }
+
+  console.log(`   ✓ Incremental backup correctly identified changed file`);
+
+  // Verify manifest indicates incremental
+  if (backupRun.manifest_path) {
+    const { manifest } = await backupService.getBackupManifest(backupRun.id);
+    if (!manifest.incremental) {
+      throw new Error('Manifest does not indicate incremental backup');
+    }
+    console.log(`   ✓ Manifest correctly marked as incremental`);
+  }
+
+  return backupRun;
+}
+
+async function testManifestValidation(backupRun) {
+  if (!backupRun.manifest_path) {
+    throw new Error('No manifest path in backup run');
+  }
+
+  const result = await backupService.validateBackupManifest(backupRun.manifest_path);
+
+  if (!result.valid) {
+    throw new Error(`Manifest validation failed: ${result.error}`);
+  }
+
+  console.log(`   ✓ Manifest validation passed`);
+  console.log(`   ✓ Manifest version: ${result.manifest.manifest.version}`);
+  console.log(`   ✓ Files in manifest: ${result.manifest.files.count}`);
+}
+
+async function testBackupStatus() {
+  const status = await backupService.getBackupStatus(5);
+
+  console.log(`   ✓ Backup service running: ${status.isRunning}`);
+  console.log(`   ✓ Backup service healthy: ${status.isHealthy}`);
+  console.log(`   ✓ Recent runs: ${status.recentRuns.length}`);
+
+  if (status.lastRun) {
+    console.log(`   ✓ Last run status: ${status.lastRun.status}`);
+    console.log(`   ✓ Manifest valid: ${status.lastRun.manifestValid}`);
+  }
+}
+
+async function cleanupTestData() {
+  if (!options.cleanup) {
+    console.log('\n📌 Test data retained for inspection');
+    console.log(`   Storage: ${process.env.STORAGE_PATH}`);
+    if (options.type === 's3') {
+      console.log(`   S3 Bucket: ${options.bucket}`);
+    }
+    return;
+  }
+
+  console.log('\n🧹 Cleaning up test data...');
+
+  // Clean storage directory
+  if (process.env.STORAGE_PATH) {
+    await fs.rm(process.env.STORAGE_PATH, { recursive: true, force: true });
+    console.log('   ✓ Removed test storage directory');
+  }
+
+  // Clean S3 bucket if used
+  if (options.type === 's3') {
+    const s3Client = new S3Client({
+      endpoint: options.endpoint,
+      region: 'us-east-1',
+      credentials: {
+        accessKeyId: options.accessKey,
+        secretAccessKey: options.secretKey
+      },
+      forcePathStyle: true
+    });
+
+    try {
+      // List and delete all objects
+      const listResponse = await s3Client.send(new ListObjectsV2Command({
+        Bucket: options.bucket
+      }));
+
+      if (listResponse.Contents && listResponse.Contents.length > 0) {
+        await s3Client.send(new DeleteObjectsCommand({
+          Bucket: options.bucket,
+          Delete: {
+            Objects: listResponse.Contents.map(obj => ({ Key: obj.Key }))
+          }
+        }));
+        console.log(`   ✓ Deleted ${listResponse.Contents.length} objects from S3`);
+      }
+
+      // Delete bucket
+      await s3Client.send(new DeleteBucketCommand({
+        Bucket: options.bucket
+      }));
+      console.log(`   ✓ Deleted S3 bucket: ${options.bucket}`);
+    } catch (error) {
+      console.error(`   ⚠️  Failed to cleanup S3: ${error.message}`);
+    }
+  }
+
+  // Clean backup directories
+  const backupDirs = [
+    path.join(__dirname, '../test-backup'),
+    path.join(__dirname, '../test-backup-rsync')
+  ];
+
+  for (const dir of backupDirs) {
+    await fs.rm(dir, { recursive: true, force: true }).catch(() => {});
+  }
+  console.log('   ✓ Removed backup directories');
+}
+
+// Main test runner
+async function main() {
+  console.log('🚀 Enhanced Backup System Integration Test');
+  console.log('==========================================');
+  console.log(`Type: ${options.type}`);
+  console.log(`Endpoint: ${options.endpoint}`);
+  console.log(`Bucket: ${options.bucket}`);
+  console.log('');
+
+  let s3Client;
+  let testData;
+
+  try {
+    // Initialize database
+    console.log('📦 Initializing database...');
+    await initDb();
+    await db.migrate.latest();
+    console.log('   ✓ Database initialized');
+
+    // S3-specific setup
+    if (options.type === 's3') {
+      // Test S3 connection
+      await runTest('S3 Connection Test', testS3Connection);
+
+      // Create S3 bucket if needed
+      s3Client = new S3Client({
+        endpoint: options.endpoint,
+        region: 'us-east-1',
+        credentials: {
+          accessKeyId: options.accessKey,
+          secretAccessKey: options.secretKey
+        },
+        forcePathStyle: true
+      });
+
+      try {
+        await s3Client.send(new HeadBucketCommand({ Bucket: options.bucket }));
+        console.log(`\n📦 Using existing bucket: ${options.bucket}`);
+      } catch (error) {
+        if (error.name === 'NotFound') {
+          await s3Client.send(new CreateBucketCommand({ Bucket: options.bucket }));
+          console.log(`\n📦 Created new bucket: ${options.bucket}`);
+        } else {
+          throw error;
+        }
+      }
+    }
+
+    // Setup test data
+    console.log('\n📁 Setting up test data...');
+    testData = await setupTestData();
+
+    // Configure backup
+    console.log(`\n⚙️  Configuring ${options.type} backup...`);
+    await configureBackup(options.type);
+
+    // Run tests based on backup type
+    await runTest('Initial Full Backup', performBackup);
+
+    if (options.type === 's3') {
+      await runTest('Verify S3 Backup Contents', async () => {
+        const lastRun = await db('backup_runs').orderBy('started_at', 'desc').first();
+        await verifyS3Backup(lastRun);
+      });
+    }
+
+    await runTest('Incremental Backup', () => testIncrementalBackup(testData));
+
+    await runTest('Manifest Validation', async () => {
+      const lastRun = await db('backup_runs').orderBy('started_at', 'desc').first();
+      await testManifestValidation(lastRun);
+    });
+
+    await runTest('Backup Status Check', testBackupStatus);
+
+    // Performance test with larger files
+    if (options.type === 's3') {
+      await runTest('Large File Backup (10MB)', async () => {
+        const largeFile = path.join(testData.storagePath, 'events/active/large.jpg');
+        await fs.writeFile(largeFile, crypto.randomBytes(10 * 1024 * 1024));
+        await performBackup();
+      });
+    }
+
+    // Test backup service lifecycle
+    await runTest('Backup Service Start/Stop', async () => {
+      await backupService.startBackupService();
+      console.log('   ✓ Service started');
+      
+      backupService.stopBackupService();
+      console.log('   ✓ Service stopped');
+    });
+
+    // Print results summary
+    console.log('\n📊 Test Results Summary');
+    console.log('======================');
+    console.log(`✅ Passed: ${results.passed}`);
+    console.log(`❌ Failed: ${results.failed}`);
+    console.log(`⏭️  Skipped: ${results.skipped}`);
+    console.log(`📋 Total: ${results.tests.length}`);
+
+    if (results.failed > 0) {
+      console.log('\nFailed Tests:');
+      results.tests
+        .filter(t => t.status === 'failed')
+        .forEach(t => console.log(`  - ${t.name}: ${t.error}`));
+    }
+
+  } catch (error) {
+    console.error('\n💥 Fatal error:', error.message);
+    if (options.verbose) {
+      console.error(error.stack);
+    }
+    results.failed++;
+  } finally {
+    // Cleanup
+    await cleanupTestData();
+
+    // Close database
+    await db.destroy();
+
+    // Exit with appropriate code
+    process.exit(results.failed > 0 ? 1 : 0);
+  }
+}
+
+// Run if called directly
+if (require.main === module) {
+  main().catch(error => {
+    console.error('Unhandled error:', error);
+    process.exit(1);
+  });
+}
+
+module.exports = { runTest, skipTest };

backend/scripts/test-backup-manifest.js

@@ -0,0 +1,192 @@
+#!/usr/bin/env node
+
+/**
+ * Test script for backup manifest generator
+ * Demonstrates all features of the manifest generator
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const backupManifest = require('../src/services/backupManifest');
+const logger = require('../src/utils/logger');
+
+async function testManifestGeneration() {
+  console.log('=== Testing Backup Manifest Generator ===\n');
+
+  try {
+    // 1. Generate a full backup manifest
+    console.log('1. Generating full backup manifest...');
+    
+    const fullManifestOptions = {
+      backupType: 'full',
+      backupPath: '/backup/full/2025-01-21',
+      files: [
+        {
+          path: '/storage/events/active/wedding-smith-2025/DSC_001.jpg',
+          relativePath: 'events/active/wedding-smith-2025/DSC_001.jpg',
+          size: 2456789,
+          modified: new Date('2025-01-20T10:30:00Z'),
+          checksum: 'a1b2c3d4e5f6789012345678901234567890123456789012345678901234567890',
+          permissions: '644'
+        },
+        {
+          path: '/storage/events/active/wedding-smith-2025/DSC_002.jpg',
+          relativePath: 'events/active/wedding-smith-2025/DSC_002.jpg',
+          size: 2156789,
+          modified: new Date('2025-01-20T10:31:00Z'),
+          checksum: 'b2c3d4e5f67890123456789012345678901234567890123456789012345678901',
+          permissions: '644'
+        },
+        {
+          path: '/storage/thumbnails/wedding-smith-2025/thumb_DSC_001.jpg',
+          relativePath: 'thumbnails/wedding-smith-2025/thumb_DSC_001.jpg',
+          size: 45678,
+          modified: new Date('2025-01-20T10:35:00Z'),
+          checksum: 'c3d4e5f678901234567890123456789012345678901234567890123456789012',
+          permissions: '644'
+        }
+      ],
+      databaseInfo: {
+        type: 'sqlite',
+        backupFile: 'database-backup-20250121-103000.sql.gz',
+        size: 1048576,
+        checksum: 'd4e5f6789012345678901234567890123456789012345678901234567890123',
+        tables: {
+          events: 156,
+          photos: 4523,
+          access_logs: 12456,
+          admin_users: 3
+        },
+        rowCounts: {
+          events: 156,
+          photos: 4523,
+          access_logs: 12456,
+          admin_users: 3
+        }
+      },
+      format: 'json',
+      customMetadata: {
+        operator: 'admin@example.com',
+        reason: 'Scheduled daily backup',
+        retentionDays: 30,
+        compressionType: 'gzip'
+      }
+    };
+
+    const fullManifest = await backupManifest.generateManifest(fullManifestOptions);
+    
+    // Save in both formats
+    const jsonPath = path.join(__dirname, 'test-manifest-full.json');
+    const yamlPath = path.join(__dirname, 'test-manifest-full.yaml');
+    
+    await backupManifest.saveManifest(fullManifest, jsonPath, 'json');
+    await backupManifest.saveManifest(fullManifest, yamlPath, 'yaml');
+    
+    console.log('✓ Full backup manifest generated and saved\n');
+
+    // 2. Generate summary report
+    console.log('2. Generating summary report...');
+    const summaryReport = backupManifest.generateSummaryReport(fullManifest);
+    console.log(summaryReport);
+    console.log('\n');
+
+    // 3. Load and validate manifest
+    console.log('3. Loading and validating manifest...');
+    const loadedManifest = await backupManifest.loadManifest(jsonPath);
+    console.log('✓ Manifest loaded and validated successfully\n');
+
+    // 4. Generate incremental backup manifest
+    console.log('4. Generating incremental backup manifest...');
+    
+    const incrementalOptions = {
+      backupType: 'incremental',
+      backupPath: '/backup/incremental/2025-01-22',
+      parentBackupId: fullManifest.backup.id,
+      files: [
+        // Original files with same checksums (unchanged)
+        fullManifestOptions.files[0],
+        fullManifestOptions.files[2],
+        // Modified file
+        {
+          ...fullManifestOptions.files[1],
+          size: 2256789,
+          modified: new Date('2025-01-21T14:00:00Z'),
+          checksum: 'e5f678901234567890123456789012345678901234567890123456789012345'
+        },
+        // New file
+        {
+          path: '/storage/events/active/wedding-smith-2025/DSC_003.jpg',
+          relativePath: 'events/active/wedding-smith-2025/DSC_003.jpg',
+          size: 2356789,
+          modified: new Date('2025-01-21T14:30:00Z'),
+          checksum: 'f6789012345678901234567890123456789012345678901234567890123456',
+          permissions: '644'
+        }
+      ],
+      databaseInfo: {
+        ...fullManifestOptions.databaseInfo,
+        size: 1148576,
+        checksum: 'g7890123456789012345678901234567890123456789012345678901234567',
+        rowCounts: {
+          events: 158,
+          photos: 4567,
+          access_logs: 12789,
+          admin_users: 3
+        }
+      }
+    };
+
+    const incrementalManifest = await backupManifest.generateIncrementalManifest(
+      incrementalOptions, 
+      fullManifest
+    );
+    
+    const incrementalJsonPath = path.join(__dirname, 'test-manifest-incremental.json');
+    await backupManifest.saveManifest(incrementalManifest, incrementalJsonPath, 'json');
+    
+    console.log('✓ Incremental backup manifest generated');
+    console.log(`  - Added files: ${incrementalManifest.incremental.changes.added_files_count}`);
+    console.log(`  - Modified files: ${incrementalManifest.incremental.changes.modified_files_count}`);
+    console.log(`  - Deleted files: ${incrementalManifest.incremental.changes.deleted_files_count}`);
+    console.log(`  - Size difference: ${(incrementalManifest.incremental.changes.size_difference / 1024).toFixed(2)} KB\n`);
+
+    // 5. Compare manifests
+    console.log('5. Comparing manifests...');
+    const comparison = backupManifest.compareManifests(incrementalManifest, fullManifest);
+    console.log('Comparison results:');
+    console.log(`  - Added: ${comparison.added_files.length} files`);
+    console.log(`  - Modified: ${comparison.modified_files.length} files`);
+    console.log(`  - Deleted: ${comparison.deleted_files.length} files`);
+    console.log(`  - Unchanged: ${comparison.unchanged_files.length} files`);
+    console.log(`  - Database changed: ${comparison.database_changes.checksum_changed ? 'Yes' : 'No'}\n`);
+
+    // 6. Test manifest integrity
+    console.log('6. Testing manifest integrity...');
+    
+    // Corrupt the manifest
+    const corruptedManifest = JSON.parse(JSON.stringify(incrementalManifest));
+    corruptedManifest.files.manifest[0].size = 9999999; // Change a file size
+    
+    try {
+      backupManifest.validateManifest(corruptedManifest);
+      console.log('✗ Validation should have failed for corrupted manifest');
+    } catch (error) {
+      console.log('✓ Correctly detected corrupted manifest:', error.message);
+    }
+
+    console.log('\n=== All tests completed successfully! ===');
+    
+    // Clean up test files
+    await fs.unlink(jsonPath).catch(() => {});
+    await fs.unlink(yamlPath).catch(() => {});
+    await fs.unlink(incrementalJsonPath).catch(() => {});
+
+  } catch (error) {
+    console.error('Test failed:', error);
+    logger.error('Manifest test failed:', error);
+    process.exit(1);
+  }
+}
+
+// Run tests
+testManifestGeneration().catch(console.error);

backend/scripts/test-backup-service.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+
+require('dotenv').config();
+const { initializeDatabase } = require('../src/database/db');
+const { runBackup, getBackupStatus } = require('../src/services/backupService');
+const logger = require('../src/utils/logger');
+
+async function testBackupService() {
+  try {
+    console.log('Testing backup service...\n');
+    
+    // Initialize database
+    await initializeDatabase();
+    
+    // Get current backup status
+    console.log('Getting backup status...');
+    const statusBefore = await getBackupStatus();
+    console.log('Last run:', statusBefore.lastRun ? statusBefore.lastRun.started_at : 'Never');
+    console.log('Is healthy:', statusBefore.isHealthy);
+    console.log('');
+    
+    // Run backup
+    console.log('Running backup...');
+    await runBackup();
+    
+    // Get status after backup
+    console.log('\nGetting status after backup...');
+    const statusAfter = await getBackupStatus();
+    console.log('Last run:', statusAfter.lastRun ? statusAfter.lastRun.started_at : 'Never');
+    console.log('Status:', statusAfter.lastRun ? statusAfter.lastRun.status : 'Unknown');
+    console.log('Files backed up:', statusAfter.lastRun ? statusAfter.lastRun.files_backed_up : 0);
+    console.log('Total size:', statusAfter.lastRun ? `${(statusAfter.lastRun.total_size_bytes / 1024 / 1024).toFixed(2)} MB` : '0 MB');
+    
+    if (statusAfter.lastRun && statusAfter.lastRun.error_message) {
+      console.log('Error:', statusAfter.lastRun.error_message);
+    }
+    
+    console.log('\nBackup test completed!');
+    process.exit(0);
+  } catch (error) {
+    console.error('Test failed:', error);
+    process.exit(1);
+  }
+}
+
+testBackupService();

backend/scripts/test-cms-formatting.js

@@ -0,0 +1,52 @@
+/**
+ * Test script to verify CMS and email formatting improvements
+ */
+
+const { formatWelcomeMessage, nl2br } = require('../src/utils/formatters');
+
+console.log('Testing CMS and Email Formatting Improvements\n');
+
+// Test 1: Basic line break conversion
+console.log('Test 1: Basic line break conversion');
+const basicText = `Hello,
+This is line 1.
+This is line 2.
+
+This is line 4 with an extra break.`;
+
+console.log('Input:');
+console.log(basicText);
+console.log('\nOutput (nl2br):');
+console.log(nl2br(basicText));
+console.log('\n---\n');
+
+// Test 2: Welcome message formatting
+console.log('Test 2: Welcome message formatting');
+const welcomeMessage = `Dear guests,
+
+We're so excited to share these special moments with you!
+
+Please note:
+- Download your photos before the expiration date
+- The password is case-sensitive
+- Contact us if you have any issues
+
+Thank you for being part of our special day!
+
+Best regards,
+Sarah & John`;
+
+console.log('Input:');
+console.log(welcomeMessage);
+console.log('\nOutput (formatWelcomeMessage):');
+console.log(formatWelcomeMessage(welcomeMessage));
+console.log('\n---\n');
+
+// Test 3: Empty and edge cases
+console.log('Test 3: Edge cases');
+console.log('Empty string:', formatWelcomeMessage(''));
+console.log('Null:', formatWelcomeMessage(null));
+console.log('Only spaces:', formatWelcomeMessage('   \n   \n   '));
+console.log('Single line:', formatWelcomeMessage('This is a single line message'));
+
+console.log('\nAll tests completed!');

backend/scripts/test-german-emails.js

@@ -0,0 +1,85 @@
+const { db } = require('../src/database/db');
+const { processTemplate } = require('../src/services/emailProcessor');
+
+async function testGermanEmails() {
+  try {
+    console.log('=== Testing German Email Templates ===\n');
+    
+    // Test variables
+    const testVars = {
+      host_name: 'Max Mustermann',
+      event_name: 'Hochzeit Schmidt',
+      event_date: '15.07.2024',
+      gallery_link: 'https://example.com/gallery/test',
+      gallery_password: 'test1234',
+      expiry_date: '15.08.2024',
+      days_remaining: '7',
+      welcome_message: 'Herzlich willkommen zu unserer Hochzeitsgalerie!',
+      archive_size: '250 MB',
+      archive_date: '16.08.2024',
+      photo_count: '347',
+      admin_email: 'support@example.com',
+      eventId: 1
+    };
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n========== ${template.template_key.toUpperCase()} ==========`);
+      
+      // Process German version
+      const germanResult = await processGermanTemplate(template, testVars);
+      
+      console.log('\n--- GERMAN VERSION ---');
+      console.log('Subject:', germanResult.subject);
+      console.log('\nHTML Preview (first 500 chars):');
+      console.log(germanResult.htmlBody.substring(0, 500) + '...\n');
+      
+      // Check for any remaining English text
+      const englishWords = ['Dear', 'Gallery', 'Details:', 'Link:', 'Password:', 'days', 'Thank you'];
+      const foundEnglish = englishWords.filter(word => 
+        germanResult.htmlBody.includes(word) || germanResult.subject.includes(word)
+      );
+      
+      if (foundEnglish.length > 0) {
+        console.log('⚠️  WARNING: Found English words:', foundEnglish.join(', '));
+      } else {
+        console.log('✅ No English words found in German template');
+      }
+    }
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+async function processGermanTemplate(template, variables) {
+  // Process template as German
+  const subjectField = 'subject_de';
+  const htmlField = 'body_html_de';
+  const textField = 'body_text_de';
+  
+  let subject = template[subjectField] || template.subject || '';
+  let htmlBody = template[htmlField] || template.body_html || '';
+  let textBody = template[textField] || template.body_text || '';
+  
+  // Replace variables
+  Object.keys(variables).forEach(key => {
+    const regex = new RegExp(`{{${key}}}`, 'g');
+    subject = subject.replace(regex, variables[key]);
+    htmlBody = htmlBody.replace(regex, variables[key]);
+    textBody = textBody.replace(regex, variables[key]);
+  });
+  
+  // Handle conditionals (simplified)
+  htmlBody = htmlBody.replace(/{{#if welcome_message}}[\s\S]*?{{\/if}}/g, (match) => {
+    return variables.welcome_message ? match.replace(/{{#if welcome_message}}|{{\/if}}/g, '') : '';
+  });
+  
+  return { subject, htmlBody, textBody };
+}
+
+testGermanEmails();

backend/scripts/test-photo-auth.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+
+/**
+ * Script to test photo authentication
+ * Usage: node scripts/test-photo-auth.js <jwt-token>
+ */
+
+const axios = require('axios');
+
+async function testPhotoAuth(token) {
+  if (!token) {
+    console.error('Usage: node scripts/test-photo-auth.js <jwt-token>');
+    console.error('\nTo get a token, login to a gallery and check localStorage for gallery_token_<slug>');
+    process.exit(1);
+  }
+
+  const baseUrl = process.env.API_URL || 'http://localhost:3001';
+  
+  console.log(`Testing photo authentication with token: ${token.substring(0, 20)}...`);
+  console.log(`Base URL: ${baseUrl}\n`);
+
+  // Test URLs
+  const tests = [
+    {
+      name: 'Thumbnail via static route',
+      url: `${baseUrl}/thumbnails/thumb_Test_Gallery_uncategorized_5210.jpg`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    },
+    {
+      name: 'Photo via static route',
+      url: `${baseUrl}/photos/wedding-test-gallery-2025-07-14-1/Test_Gallery_uncategorized_5210.jpg`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    },
+    {
+      name: 'Gallery photos API',
+      url: `${baseUrl}/api/gallery/wedding-test-gallery-2025-07-14-1/photos`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    }
+  ];
+
+  for (const test of tests) {
+    console.log(`Testing: ${test.name}`);
+    console.log(`URL: ${test.url}`);
+    
+    try {
+      const response = await axios.get(test.url, {
+        headers: test.headers,
+        validateStatus: () => true // Don't throw on any status
+      });
+      
+      console.log(`Status: ${response.status}`);
+      console.log(`Headers:`, response.headers['content-type']);
+      
+      if (response.status === 200) {
+        if (test.name.includes('API')) {
+          console.log(`Photos count: ${response.data.photos?.length || 0}`);
+        } else {
+          console.log(`Content length: ${response.headers['content-length']} bytes`);
+        }
+      } else {
+        console.log(`Error:`, response.data);
+      }
+    } catch (error) {
+      console.log(`Network error:`, error.message);
+    }
+    
+    console.log('---\n');
+  }
+  
+  // Decode token to show info
+  try {
+    const parts = token.split('.');
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+    console.log('Token payload:', payload);
+  } catch (error) {
+    console.log('Failed to decode token');
+  }
+}
+
+// Get token from command line
+const token = process.argv[2];
+
+testPhotoAuth(token).catch(error => {
+  console.error('Test failed:', error);
+  process.exit(1);
+});

backend/scripts/test-restore-service.js

@@ -0,0 +1,325 @@
+/**
+ * Test script for the restore service
+ * 
+ * This script demonstrates the restore service functionality with safety checks
+ * 
+ * Usage:
+ *   node scripts/test-restore-service.js [options]
+ * 
+ * Options:
+ *   --dry-run    Perform validation only without actual restore
+ *   --force      Force restore even with warnings
+ *   --type       Restore type: full, database, files, selective (default: full)
+ *   --source     Backup source path or S3 URL
+ *   --manifest   Path to backup manifest
+ */
+
+require('dotenv').config();
+const { restoreService } = require('../src/services/restoreService');
+const { db } = require('../src/database/db');
+const logger = require('../src/utils/logger');
+const path = require('path');
+const fs = require('fs').promises;
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const options = {
+  dryRun: args.includes('--dry-run'),
+  force: args.includes('--force'),
+  restoreType: 'full',
+  source: null,
+  manifestPath: null
+};
+
+// Parse restore type
+const typeIndex = args.indexOf('--type');
+if (typeIndex !== -1 && args[typeIndex + 1]) {
+  options.restoreType = args[typeIndex + 1];
+}
+
+// Parse source
+const sourceIndex = args.indexOf('--source');
+if (sourceIndex !== -1 && args[sourceIndex + 1]) {
+  options.source = args[sourceIndex + 1];
+}
+
+// Parse manifest
+const manifestIndex = args.indexOf('--manifest');
+if (manifestIndex !== -1 && args[manifestIndex + 1]) {
+  options.manifestPath = args[manifestIndex + 1];
+}
+
+async function testRestore() {
+  console.log('=== PicPeak Restore Service Test ===\n');
+  
+  try {
+    // If no source/manifest provided, try to find a recent backup
+    if (!options.source || !options.manifestPath) {
+      console.log('No backup source specified. Looking for recent backups...\n');
+      
+      const recentBackup = await db('backup_runs')
+        .where('status', 'completed')
+        .whereNotNull('manifest_path')
+        .orderBy('completed_at', 'desc')
+        .first();
+      
+      if (!recentBackup) {
+        console.error('❌ No completed backups found in the database');
+        console.log('\nPlease run a backup first or specify --source and --manifest');
+        process.exit(1);
+      }
+      
+      console.log(`Found recent backup from ${recentBackup.completed_at}`);
+      console.log(`Backup ID: ${recentBackup.manifest_id}`);
+      console.log(`Files backed up: ${recentBackup.files_backed_up}`);
+      console.log(`Total size: ${(recentBackup.total_size_bytes / 1024 / 1024).toFixed(2)} MB`);
+      console.log(`Manifest: ${recentBackup.manifest_path}\n`);
+      
+      // For this test, we'll create a mock scenario
+      console.log('⚠️  This is a TEST MODE - using mock data for safety\n');
+      
+      // Create test backup directory
+      const testBackupDir = path.join(__dirname, '../temp/test-backup');
+      await fs.mkdir(testBackupDir, { recursive: true });
+      
+      // Create test manifest
+      const testManifest = {
+        manifest: {
+          version: '2.0',
+          created: new Date().toISOString(),
+          generator: 'Test Script',
+          format: 'json'
+        },
+        backup: {
+          id: 'test-backup-' + Date.now(),
+          type: 'full',
+          timestamp: new Date().toISOString(),
+          path: testBackupDir,
+          parent_backup_id: null,
+          retention_days: 30
+        },
+        system: {
+          hostname: require('os').hostname(),
+          platform: process.platform,
+          os_release: require('os').release(),
+          architecture: require('os').arch()
+        },
+        application: {
+          name: 'PicPeak',
+          version: require('../package.json').version,
+          node_version: process.version,
+          environment: 'test'
+        },
+        files: {
+          count: 0,
+          total_size: 0,
+          checksums: {},
+          manifest: []
+        },
+        database: {
+          type: process.env.DB_TYPE === 'postgresql' ? 'postgresql' : 'sqlite',
+          backup_file: null,
+          size: 0,
+          checksum: null,
+          tables: {},
+          row_counts: {}
+        },
+        verification: {
+          total_checksum: null,
+          file_count_check: 0,
+          size_check: 0,
+          integrity_timestamp: new Date().toISOString()
+        },
+        metadata: {
+          test_mode: true
+        }
+      };
+      
+      // Calculate checksum
+      const crypto = require('crypto');
+      const manifestCopy = JSON.parse(JSON.stringify(testManifest));
+      delete manifestCopy.verification.total_checksum;
+      testManifest.verification.total_checksum = crypto
+        .createHash('sha256')
+        .update(JSON.stringify(manifestCopy, Object.keys(manifestCopy).sort()))
+        .digest('hex');
+      
+      // Save test manifest
+      const testManifestPath = path.join(testBackupDir, 'test-manifest.json');
+      await fs.writeFile(testManifestPath, JSON.stringify(testManifest, null, 2));
+      
+      options.source = testBackupDir;
+      options.manifestPath = testManifestPath;
+    }
+    
+    // Display restore options
+    console.log('Restore Options:');
+    console.log(`- Type: ${options.restoreType}`);
+    console.log(`- Source: ${options.source}`);
+    console.log(`- Manifest: ${options.manifestPath}`);
+    console.log(`- Dry Run: ${options.dryRun ? 'Yes' : 'No'}`);
+    console.log(`- Force: ${options.force ? 'Yes' : 'No'}`);
+    console.log('');
+    
+    // Add S3 config if source is S3
+    if (options.source.startsWith('s3://')) {
+      options.s3Config = {
+        accessKeyId: process.env.BACKUP_S3_ACCESS_KEY,
+        secretAccessKey: process.env.BACKUP_S3_SECRET_KEY,
+        region: process.env.BACKUP_S3_REGION || 'us-east-1',
+        endpoint: process.env.BACKUP_S3_ENDPOINT
+      };
+      
+      if (!options.s3Config.accessKeyId || !options.s3Config.secretAccessKey) {
+        console.error('❌ S3 credentials not configured in environment');
+        process.exit(1);
+      }
+    }
+    
+    // Confirm before proceeding (unless dry run)
+    if (!options.dryRun) {
+      console.log('⚠️  WARNING: This will restore data from the backup!');
+      console.log('⚠️  Current data may be overwritten!');
+      console.log('');
+      console.log('Press Ctrl+C to cancel, or wait 5 seconds to continue...');
+      await new Promise(resolve => setTimeout(resolve, 5000));
+    }
+    
+    console.log('\nStarting restore operation...\n');
+    
+    // Perform restore
+    const result = await restoreService.restore(options);
+    
+    if (options.dryRun) {
+      console.log('\n=== DRY RUN RESULTS ===\n');
+      
+      console.log('Validation:');
+      console.log(`- Valid: ${result.validation.isValid ? '✅ Yes' : '❌ No'}`);
+      
+      if (result.validation.errors.length > 0) {
+        console.log('- Errors:');
+        result.validation.errors.forEach(err => console.log(`  ❌ ${err}`));
+      }
+      
+      if (result.validation.warnings.length > 0) {
+        console.log('- Warnings:');
+        result.validation.warnings.forEach(warn => console.log(`  ⚠️  ${warn}`));
+      }
+      
+      console.log('\nDisk Space:');
+      console.log(`- Required: ${result.spaceCheck.requiredFormatted}`);
+      console.log(`- Available: ${result.spaceCheck.availableFormatted}`);
+      console.log(`- Sufficient: ${result.spaceCheck.hasEnoughSpace ? '✅ Yes' : '❌ No'}`);
+      
+    } else {
+      console.log('\n=== RESTORE RESULTS ===\n');
+      
+      console.log(`Status: ${result.success ? '✅ SUCCESS' : '❌ FAILED'}`);
+      console.log(`Duration: ${result.duration}s`);
+      
+      if (result.result) {
+        console.log('\nItems Restored:');
+        if (result.result.databaseRestored !== undefined) {
+          console.log(`- Database: ${result.result.databaseRestored ? '✅' : '❌'}`);
+        }
+        if (result.result.filesRestored !== undefined) {
+          console.log(`- Files: ${result.result.filesRestored}`);
+        }
+        if (result.result.errors && result.result.errors.length > 0) {
+          console.log('- Errors:');
+          result.result.errors.forEach(err => console.log(`  ❌ ${err}`));
+        }
+      }
+      
+      if (result.verification) {
+        console.log('\nVerification:');
+        console.log(`- Valid: ${result.verification.isValid ? '✅ Yes' : '❌ No'}`);
+        if (result.verification.errors.length > 0) {
+          console.log('- Errors:');
+          result.verification.errors.forEach(err => console.log(`  ❌ ${err}`));
+        }
+      }
+      
+      if (result.preRestoreBackup) {
+        console.log('\nSafety Backup:');
+        console.log(`- Location: ${result.preRestoreBackup}`);
+        console.log('- This backup can be used to rollback if needed');
+      }
+    }
+    
+    // Show recent log entries
+    console.log('\nRecent Log Entries:');
+    result.logs.slice(-10).forEach(log => {
+      const icon = log.level === 'error' ? '❌' : log.level === 'warn' ? '⚠️ ' : 'ℹ️ ';
+      console.log(`${icon} [${log.timestamp}] ${log.message}`);
+    });
+    
+    // Clean up test files
+    if (options.source && options.source.includes('test-backup')) {
+      await fs.rmdir(path.dirname(options.source), { recursive: true }).catch(() => {});
+    }
+    
+  } catch (error) {
+    console.error('\n❌ Restore operation failed:', error.message);
+    
+    // Show logs if available
+    if (restoreService.restoreLog && restoreService.restoreLog.length > 0) {
+      console.log('\nError Log:');
+      restoreService.restoreLog.slice(-10).forEach(log => {
+        if (log.level === 'error' || log.level === 'warn') {
+          console.log(`[${log.timestamp}] ${log.level.toUpperCase()}: ${log.message}`);
+        }
+      });
+    }
+    
+    process.exit(1);
+  }
+  
+  // Cleanup
+  await db.destroy();
+  process.exit(0);
+}
+
+// Show help if requested
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`
+PicPeak Restore Service Test
+
+This script tests the restore service functionality with safety checks.
+
+Usage:
+  node scripts/test-restore-service.js [options]
+
+Options:
+  --dry-run    Perform validation only without actual restore
+  --force      Force restore even with warnings
+  --type       Restore type: full, database, files, selective (default: full)
+  --source     Backup source path or S3 URL
+  --manifest   Path to backup manifest
+  --help       Show this help message
+
+Examples:
+  # Dry run with automatic backup selection
+  node scripts/test-restore-service.js --dry-run
+
+  # Full restore from specific backup
+  node scripts/test-restore-service.js --source /backup/2024-01-20 --manifest /backup/2024-01-20/manifest.json
+
+  # Database-only restore with force
+  node scripts/test-restore-service.js --type database --force --source /backup/2024-01-20 --manifest /backup/2024-01-20/manifest.json
+
+  # Restore from S3
+  node scripts/test-restore-service.js --source s3://my-bucket/backups/2024-01-20 --manifest s3://my-bucket/backups/2024-01-20/manifest.json
+
+Safety Features:
+- Pre-restore validation checks compatibility and warns about potential issues
+- Automatic pre-restore backup is created (unless skipped)
+- Post-restore verification ensures data integrity
+- Rollback capability if restore fails
+- Detailed logging of all operations
+`);
+  process.exit(0);
+}
+
+// Run the test
+testRestore();

backend/scripts/test-security-logging.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+
+/**
+ * Test script to verify security logging is working correctly
+ * Run with: node scripts/test-security-logging.js
+ */
+
+require('dotenv').config({ path: '../.env' });
+const logger = require('../src/utils/logger');
+
+console.log('Testing Security Logging...\n');
+
+// Test 1: Basic logging
+console.log('1. Testing basic logging levels:');
+logger.info('Test info message', { test: true });
+logger.warn('Test warning message', { test: true });
+logger.error('Test error message', { test: true });
+
+// Test 2: Security event logging
+console.log('\n2. Testing security event logging:');
+
+// Rate limit exceeded
+logger.warn('Rate limit exceeded', {
+  ip: '192.168.1.100',
+  path: '/api/admin/login',
+  method: 'POST',
+  authenticated: false,
+  userAgent: 'Mozilla/5.0 Test',
+  timestamp: new Date().toISOString(),
+  rateLimitInfo: {
+    limit: 5,
+    current: 6,
+    remaining: 0,
+    resetTime: new Date(Date.now() + 900000).toISOString()
+  }
+});
+
+// Auth rate limit
+logger.warn('Auth rate limit exceeded', {
+  ip: '192.168.1.101',
+  path: '/api/auth/admin/login',
+  method: 'POST',
+  userAgent: 'Mozilla/5.0 Test',
+  authType: 'admin',
+  timestamp: new Date().toISOString()
+});
+
+// Failed login
+logger.warn('Failed login attempt', {
+  username: 'testuser',
+  ip: '192.168.1.102',
+  userAgent: 'Mozilla/5.0 Test',
+  reason: 'invalid_credentials',
+  timestamp: new Date().toISOString()
+});
+
+// JWT validation failure
+logger.warn('JWT validation failed', {
+  ip: '192.168.1.103',
+  path: '/api/admin/events',
+  method: 'GET',
+  userAgent: 'Mozilla/5.0 Test',
+  error: 'TokenExpiredError',
+  message: 'jwt expired',
+  timestamp: new Date().toISOString()
+});
+
+// Account lockout
+logger.warn('Login attempt on locked account', {
+  username: 'lockeduser',
+  ip: '192.168.1.104',
+  remainingLockTime: 1200,
+  timestamp: new Date().toISOString()
+});
+
+// Suspicious activity
+logger.warn('Suspicious login activity detected', {
+  username: 'suspicioususer',
+  ips: ['192.168.1.105', '192.168.1.106', '192.168.1.107'],
+  timeWindow: '15 minutes',
+  timestamp: new Date().toISOString()
+});
+
+console.log('\n3. Check log files:');
+console.log('- logs/security.log - Should contain all security warnings');
+console.log('- logs/error.log - Should contain error messages');
+console.log('- logs/combined.log - Should contain all messages');
+
+console.log('\n✅ Security logging test complete!');
+console.log('Review the log files to ensure all events are properly captured.');
+
+// Give logger time to flush
+setTimeout(() => {
+  process.exit(0);
+}, 1000);

backend/scripts/verify-template-equality.js

@@ -0,0 +1,110 @@
+const { db } = require('../src/database/db');
+
+async function verifyTemplateEquality() {
+  try {
+    console.log('Verifying template equality between German and English versions...\n');
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n=== ${template.template_key.toUpperCase()} ===`);
+      
+      // Check subject length similarity
+      const subjectEnLength = template.subject_en?.length || 0;
+      const subjectDeLength = template.subject_de?.length || 0;
+      console.log(`Subject length - EN: ${subjectEnLength}, DE: ${subjectDeLength}`);
+      
+      // Check HTML content features
+      const htmlEn = template.body_html_en || '';
+      const htmlDe = template.body_html_de || '';
+      
+      // Check for key features in both versions
+      const features = [
+        { name: 'Handlebars conditionals', pattern: /{{#if/g },
+        { name: 'Styled divs', pattern: /style="/g },
+        { name: 'Background colors', pattern: /background-color:/g },
+        { name: 'Buttons/CTAs', pattern: /<a.*style.*background-color.*>/g },
+        { name: 'Icons/Emojis', pattern: /[📧📞✅⚠️]/g },
+        { name: 'Lists', pattern: /<ul/g },
+        { name: 'Strong emphasis', pattern: /<strong>/g }
+      ];
+      
+      console.log('\nFeature comparison:');
+      for (const feature of features) {
+        const enCount = (htmlEn.match(feature.pattern) || []).length;
+        const deCount = (htmlDe.match(feature.pattern) || []).length;
+        const status = enCount === deCount ? '✅' : '❌';
+        console.log(`${status} ${feature.name}: EN=${enCount}, DE=${deCount}`);
+      }
+      
+      // Check text content length
+      const textEn = template.body_text_en || '';
+      const textDe = template.body_text_de || '';
+      console.log(`\nText content length - EN: ${textEn.length}, DE: ${textDe.length}`);
+      
+      // Check for specific variables usage
+      const variables = [
+        'host_name', 'event_name', 'event_date', 'gallery_link', 
+        'gallery_password', 'expiry_date', 'welcome_message',
+        'days_remaining', 'support_email', 'support_phone',
+        'archive_date', 'photo_count', 'archive_size'
+      ];
+      
+      const missingInEn = [];
+      const missingInDe = [];
+      
+      for (const variable of variables) {
+        const varPattern = new RegExp(`{{${variable}}}`, 'g');
+        const inEn = varPattern.test(htmlEn) || varPattern.test(textEn);
+        const inDe = varPattern.test(htmlDe) || varPattern.test(textDe);
+        
+        if (inDe && !inEn) missingInEn.push(variable);
+        if (inEn && !inDe) missingInDe.push(variable);
+      }
+      
+      if (missingInEn.length > 0) {
+        console.log(`\n⚠️  Variables in DE but missing in EN: ${missingInEn.join(', ')}`);
+      }
+      if (missingInDe.length > 0) {
+        console.log(`\n⚠️  Variables in EN but missing in DE: ${missingInDe.join(', ')}`);
+      }
+      
+      // Overall quality score
+      const enScore = [
+        htmlEn.includes('style='),
+        htmlEn.includes('{{#if'),
+        htmlEn.includes('background-color'),
+        htmlEn.includes('<strong>'),
+        htmlEn.includes('margin:'),
+        htmlEn.includes('padding:')
+      ].filter(Boolean).length;
+      
+      const deScore = [
+        htmlDe.includes('style='),
+        htmlDe.includes('{{#if'),
+        htmlDe.includes('background-color'),
+        htmlDe.includes('<strong>'),
+        htmlDe.includes('margin:'),
+        htmlDe.includes('padding:')
+      ].filter(Boolean).length;
+      
+      console.log(`\nQuality score (out of 6) - EN: ${enScore}, DE: ${deScore}`);
+      console.log(enScore === deScore ? '✅ Templates have equal quality!' : '❌ Quality mismatch');
+    }
+    
+    console.log('\n\nSummary:');
+    console.log('The English templates have been updated to match the German templates in:');
+    console.log('- HTML styling and structure');
+    console.log('- Conditional content blocks');
+    console.log('- Visual elements (buttons, alerts, icons)');
+    console.log('- Information completeness');
+    console.log('- Professional formatting');
+    
+  } catch (error) {
+    console.error('Error:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+verifyTemplateEquality();

backend/server.js

@@ -4,19 +4,27 @@ require('dotenv').config();
 const { validateEnvironment } = require('./src/config/validateEnv');
 validateEnvironment();
 
+// Initialize logger early to capture startup logs
+const logger = require('./src/utils/logger');
+logger.info('Server starting up', {
+  nodeVersion: process.version,
+  environment: process.env.NODE_ENV || 'development',
+  timestamp: new Date().toISOString()
+});
+
 const express = require('express');
 const helmet = require('helmet');
 const cors = require('cors');
-const rateLimit = require('express-rate-limit');
-const jwt = require('jsonwebtoken');
 const path = require('path');
 const { initializeDatabase, db } = require('./src/database/db');
 const { startFileWatcher } = require('./src/services/fileWatcher');
 const { startExpirationChecker } = require('./src/services/expirationChecker');
 const { initializeTransporter, startEmailQueueProcessor } = require('./src/services/emailProcessor');
+const { startBackupService } = require('./src/services/backupService');
+const { startScheduledBackups } = require('./src/services/databaseBackup');
 const { maintenanceMiddleware } = require('./src/middleware/maintenance');
 const { sessionTimeoutMiddleware } = require('./src/middleware/sessionTimeout');
-const logger = require('./src/utils/logger');
+const { createRateLimiter, createAuthRateLimiter } = require('./src/services/rateLimitService');
 
 // Import routes
 const authRoutes = require('./src/routes/auth-enhanced');
@@ -28,6 +36,10 @@ const adminAuthRoutes = require('./src/routes/adminAuth');
 const app = express();
 const PORT = process.env.PORT || 3000;
 
+// Trust proxy headers (required for Traefik/nginx)
+// Set to specific number of proxies or loopback to be more secure
+app.set('trust proxy', 'loopback, linklocal, uniquelocal');
+
 // Security middleware with custom CSP
 app.use(helmet({
   contentSecurityPolicy: {
@@ -89,41 +101,27 @@ const corsOptions = {
 
 app.use(cors(corsOptions));
 
-// Rate limiting with admin bypass
-const limiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: process.env.NODE_ENV === 'development' ? 1000 : 100, // More lenient in development
-  skip: (req) => {
-    // Skip rate limiting for authenticated admin users
-    if (req.path.startsWith('/api/admin/') && req.headers.authorization) {
-      const token = req.headers.authorization.replace('Bearer ', '');
-      try {
-        const decoded = jwt.verify(token, process.env.JWT_SECRET);
-        return decoded.type === 'admin';
-      } catch (err) {
-        return false;
-      }
-    }
-    // Also skip rate limiting for public settings endpoint in development
-    if (process.env.NODE_ENV === 'development' && req.path === '/api/public/settings') {
-      return true;
-    }
-    return false;
-  }
-});
+// Initialize rate limiters (they will be created dynamically)
+let generalRateLimiter;
+let authRateLimiter;
 
-const authLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: 5 // limit auth attempts
-});
+// Function to initialize rate limiters
+async function initializeRateLimiters() {
+  generalRateLimiter = await createRateLimiter();
+  authRateLimiter = await createAuthRateLimiter();
+  
+  // Apply rate limiting
+  app.use('/api/', generalRateLimiter);
+  app.use('/api/auth', authRateLimiter);
+  app.use('/api/gallery/:slug/verify', authRateLimiter);
+  app.use('/api/admin/auth/login', authRateLimiter);
+}
 
-// Apply rate limiting - admin routes check will skip for valid admin tokens
-app.use('/api/', limiter);
-app.use('/api/auth', authLimiter);
+// Note: Rate limiters will be initialized after database connection
 
-// Body parsing middleware
-app.use(express.json());
-app.use(express.urlencoded({ extended: true }));
+// Body parsing middleware with increased limits for large uploads
+app.use(express.json({ limit: '100mb' }));
+app.use(express.urlencoded({ extended: true, limit: '100mb' }));
 
 // Maintenance mode middleware - add after body parsing but before routes
 app.use(maintenanceMiddleware);
@@ -142,14 +140,39 @@ const setCorsHeaders = (req, res, next) => {
 // Import secure static middleware
 const secureStatic = require('./src/middleware/secureStatic');
 
+// Get storage path from environment or use default
+const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../storage');
+
 // Static file serving for photos (protected)
-app.use('/photos', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(__dirname, 'storage/events/active')));
+app.use('/photos', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(storagePath, 'events/active')));
 
 // Static file serving for thumbnails (protected)
-app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(__dirname, 'storage/thumbnails')));
+app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(storagePath, 'thumbnails')));
 
 // Static file serving for uploads (public - logos, favicons)
-app.use('/uploads', setCorsHeaders, secureStatic(path.join(__dirname, 'storage/uploads')));
+app.use('/uploads', setCorsHeaders, secureStatic(path.join(storagePath, 'uploads')));
+
+// Debug endpoint to check IP detection (only in development)
+if (process.env.NODE_ENV === 'development') {
+  app.get('/api/debug/ip', (req, res) => {
+    const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+    
+    res.json({
+      detectedIp: clientIp,
+      reqIp: req.ip,
+      headers: {
+        'x-forwarded-for': req.headers['x-forwarded-for'],
+        'x-real-ip': req.headers['x-real-ip'],
+        'x-forwarded-proto': req.headers['x-forwarded-proto'],
+        'x-forwarded-host': req.headers['x-forwarded-host']
+      },
+      trustProxy: app.get('trust proxy')
+    });
+  });
+}
 
 // Health check endpoint
 app.get('/health', async (req, res) => {
@@ -180,6 +203,10 @@ app.use('/api/gallery', galleryRoutes);
 app.use('/api/admin', adminRoutes);
 app.use('/api/admin/auth', adminAuthRoutes);
 app.use('/api/admin/system', require('./src/routes/adminSystem'));
+app.use('/api/admin/backup', require('./src/routes/adminBackup'));
+app.use('/api/admin/database-backup', require('./src/routes/adminDatabaseBackup'));
+app.use('/api/admin/feedback', require('./src/routes/adminFeedback'));
+app.use('/api/gallery', require('./src/routes/galleryFeedback'));
 app.use('/api/public/settings', require('./src/routes/publicSettings'));
 app.use('/api/public', require('./src/routes/publicCMS'));
 app.use('/api/images', require('./src/routes/protectedImages'));
@@ -196,9 +223,21 @@ async function startServer() {
     // Initialize database
     await initializeDatabase();
 
-  // Initialize auth security cleanup job
-  const { initializeCleanupJob } = require('./src/utils/authSecurity');
-  initializeCleanupJob();
+    // Initialize rate limiters after database is ready
+    await initializeRateLimiters();
+    logger.info('Rate limiters initialized with database configuration');
+
+    // Initialize auth security cleanup job
+    const { initializeCleanupJob } = require('./src/utils/authSecurity');
+    initializeCleanupJob();
+    
+    // Initialize temp upload cleanup job
+    const { cleanupTempUploads } = require('./src/utils/cleanupTempUploads');
+    // Run cleanup on startup
+    cleanupTempUploads();
+    // Schedule periodic cleanup every hour
+    setInterval(cleanupTempUploads, 60 * 60 * 1000);
+    logger.info('Temp upload cleanup scheduled');
     
     // Start file watcher
     startFileWatcher();
@@ -210,6 +249,12 @@ async function startServer() {
     await initializeTransporter();
     startEmailQueueProcessor();
     
+    // Start backup service
+    await startBackupService();
+    
+    // Start database backup service
+    await startScheduledBackups();
+    
     app.listen(PORT, () => {
       logger.info(`Server running on port ${PORT}`);
       logger.info(`Admin interface: ${process.env.ADMIN_URL || 'http://localhost:3000'}`);

backend/src/__tests__/dbCompat.test.js

@@ -0,0 +1,83 @@
+const { formatBoolean, isPostgreSQL, addDays, formatDateForDB, insertAndGetId } = require('../utils/dbCompat');
+
+describe('Database Compatibility', () => {
+  // Save original env
+  const originalEnv = process.env.DATABASE_CLIENT;
+  
+  afterEach(() => {
+    // Restore original env after each test
+    if (originalEnv) {
+      process.env.DATABASE_CLIENT = originalEnv;
+    } else {
+      delete process.env.DATABASE_CLIENT;
+    }
+  });
+
+  describe('formatBoolean', () => {
+    test('should format boolean values correctly', () => {
+      // Mock for SQLite
+      process.env.DATABASE_CLIENT = 'sqlite3';
+      expect(formatBoolean(true)).toBe(1);
+      expect(formatBoolean(false)).toBe(0);
+      
+      // Mock for PostgreSQL
+      process.env.DATABASE_CLIENT = 'pg';
+      expect(formatBoolean(true)).toBe(true);
+      expect(formatBoolean(false)).toBe(false);
+      
+      // Default (no env var) should be SQLite
+      delete process.env.DATABASE_CLIENT;
+      expect(formatBoolean(true)).toBe(1);
+      expect(formatBoolean(false)).toBe(0);
+    });
+  });
+
+  describe('isPostgreSQL', () => {
+    test('should detect PostgreSQL correctly', () => {
+      process.env.DATABASE_CLIENT = 'pg';
+      expect(isPostgreSQL()).toBe(true);
+      
+      process.env.DATABASE_CLIENT = 'sqlite3';
+      expect(isPostgreSQL()).toBe(false);
+      
+      delete process.env.DATABASE_CLIENT;
+      expect(isPostgreSQL()).toBe(false); // Default to SQLite
+    });
+  });
+
+  describe('formatDateForDB', () => {
+    test('should format dates as ISO strings', () => {
+      const date = new Date('2024-01-15T10:30:00Z');
+      expect(formatDateForDB(date)).toBe('2024-01-15T10:30:00.000Z');
+    });
+  });
+
+  describe('addDays', () => {
+    test('should add days correctly', () => {
+      const date = new Date('2024-01-15');
+      const result = addDays(date, 30);
+      expect(result.toISOString().split('T')[0]).toBe('2024-02-14');
+      
+      const negativeResult = addDays(date, -7);
+      expect(negativeResult.toISOString().split('T')[0]).toBe('2024-01-08');
+    });
+  });
+
+  describe('insertAndGetId', () => {
+    test('should handle PostgreSQL result format', async () => {
+      const mockQuery = {
+        returning: jest.fn().mockResolvedValue([{ id: 123 }])
+      };
+      const result = await insertAndGetId(mockQuery);
+      expect(result).toBe(123);
+    });
+
+    test('should handle SQLite result format', async () => {
+      const mockQuery = {
+        returning: jest.fn().mockResolvedValue([456])
+      };
+      const result = await insertAndGetId(mockQuery);
+      expect(result).toBe(456);
+    });
+  });
+});

backend/src/config/validateEnv.js

@@ -34,7 +34,7 @@ function validateEnvironment() {
     if (name === 'JWT_SECRET' && value) {
       // Check for the insecure default value
       if (value === 'your-secret-key') {
-        errors.push(`CRITICAL: JWT_SECRET is set to the insecure default value. Please set a secure secret key.`);
+        errors.push('CRITICAL: JWT_SECRET is set to the insecure default value. Please set a secure secret key.');
       }
       
       // Check minimum length (should be at least 32 characters for security)

backend/src/database/db.js

@@ -4,6 +4,33 @@ const knexConfig = require('../../knexfile');
 // Create database connection with built-in retry logic
 const db = knex(knexConfig);
 
+// Connection retry configuration
+const MAX_RETRIES = 3;
+const RETRY_DELAY = 1000;
+
+// Wrapper function to handle connection retries
+async function withRetry(queryFn, retries = MAX_RETRIES) {
+  for (let i = 0; i < retries; i++) {
+    try {
+      return await queryFn();
+    } catch (error) {
+      const isConnectionError = error.message && (
+        error.message.includes('Connection terminated unexpectedly') ||
+        error.message.includes('Connection ended unexpectedly') ||
+        error.message.includes('ECONNREFUSED') ||
+        error.message.includes('ETIMEDOUT')
+      );
+      
+      if (isConnectionError && i < retries - 1) {
+        console.log(`Database connection error, retrying in ${RETRY_DELAY}ms... (attempt ${i + 1}/${retries})`);
+        await new Promise(resolve => setTimeout(resolve, RETRY_DELAY * (i + 1)));
+        continue;
+      }
+      throw error;
+    }
+  }
+}
+
 async function initializeDatabase() {
   // Events table
   const hasEventsTable = await db.schema.hasTable('events');
@@ -59,9 +86,9 @@ async function initializeDatabase() {
           )
         `);
         
-        await db.raw(`INSERT INTO events_new SELECT * FROM events`);
-        await db.raw(`DROP TABLE events`);
-        await db.raw(`ALTER TABLE events_new RENAME TO events`);
+        await db.raw('INSERT INTO events_new SELECT * FROM events');
+        await db.raw('DROP TABLE events');
+        await db.raw('ALTER TABLE events_new RENAME TO events');
       } catch (error) {
         // If the migration fails, it might already have been applied
         console.log('Color theme migration may have already been applied');
@@ -225,4 +252,4 @@ async function logActivity(activityType, metadata = {}, eventId = null, actor =
   }
 }
 
-module.exports = { db, initializeDatabase, logActivity };
+module.exports = { db, initializeDatabase, logActivity, withRetry };

backend/src/middleware/auth-enhanced-v2.js

@@ -1,5 +1,6 @@
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
 const { isTokenRevoked } = require('../utils/tokenRevocation');
 const logger = require('../utils/logger');
 
@@ -57,7 +58,7 @@ async function adminAuth(req, res, next) {
     
     // Check if admin still exists and is active
     const admin = await db('admin_users')
-      .where({ id: decoded.id, is_active: true })
+      .where({ id: decoded.id, is_active: formatBoolean(true) })
       .first();
     
     if (!admin) {

backend/src/middleware/auth-enhanced.js

@@ -1,5 +1,6 @@
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
 const logger = require('../utils/logger');
 
 /**
@@ -50,7 +51,7 @@ async function adminAuth(req, res, next) {
     
     // Check if admin still exists and is active
     const admin = await db('admin_users')
-      .where({ id: decoded.id, is_active: true })
+      .where({ id: decoded.id, is_active: formatBoolean(true) })
       .first();
     
     if (!admin) {
@@ -165,7 +166,7 @@ async function photoAuth(req, res, next) {
     // Allow both admin and gallery tokens
     if (decoded.type === 'admin') {
       const admin = await db('admin_users')
-        .where({ id: decoded.id, is_active: true })
+        .where({ id: decoded.id, is_active: formatBoolean(true) })
         .first();
       
       if (!admin) {

backend/src/middleware/auth.js

@@ -1,23 +1,83 @@
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const logger = require('../utils/logger');
 
 async function adminAuth(req, res, next) {
   try {
     const token = req.headers.authorization?.split(' ')[1];
     if (!token) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      logger.warn('Admin auth attempt without token', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent']
+      });
       return res.status(401).json({ error: 'No token provided' });
     }
     
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
-    const admin = await db('admin_users').where({ id: decoded.id, is_active: true }).first();
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (jwtError) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      logger.warn('JWT validation failed', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent'],
+        error: jwtError.name,
+        message: jwtError.message,
+        timestamp: new Date().toISOString()
+      });
+      
+      if (jwtError.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    const admin = await db('admin_users').where({ id: decoded.id, is_active: formatBoolean(true) }).first();
     
     if (!admin) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      logger.warn('Admin auth failed - user not found or inactive', {
+        ip: clientIp,
+        userId: decoded.id,
+        path: req.path,
+        method: req.method,
+        timestamp: new Date().toISOString()
+      });
       return res.status(401).json({ error: 'Invalid token' });
     }
     
     req.admin = admin;
     next();
   } catch (error) {
+    const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                   req.headers['x-real-ip'] || 
+                   req.connection.remoteAddress || 
+                   req.ip;
+    
+    logger.error('Admin auth middleware error', {
+      ip: clientIp,
+      path: req.path,
+      error: error.message,
+      stack: error.stack,
+      timestamp: new Date().toISOString()
+    });
     res.status(401).json({ error: 'Invalid token' });
   }
 }

backend/src/middleware/feedbackRateLimit.js

@@ -0,0 +1,236 @@
+const crypto = require('crypto');
+const { db } = require('../database/db');
+const logger = require('../utils/logger');
+
+/**
+ * Generate a unique identifier for the guest
+ */
+function generateGuestIdentifier(req) {
+  const ip = req.ip || req.connection.remoteAddress || 'unknown';
+  const userAgent = req.headers['user-agent'] || 'unknown';
+  return crypto
+    .createHash('sha256')
+    .update(`${ip}:${userAgent}`)
+    .digest('hex');
+}
+
+/**
+ * Get rate limit settings from app_settings
+ */
+async function getRateLimitSettings() {
+  try {
+    const settings = await db('app_settings')
+      .where('setting_key', 'feedback_rate_limits')
+      .first();
+    
+    if (settings && settings.setting_value) {
+      return JSON.parse(settings.setting_value);
+    }
+    
+    // Default settings
+    return {
+      rating: { max: 100, window: 3600 }, // 100 ratings per hour
+      comment: { max: 20, window: 3600 }, // 20 comments per hour
+      like: { max: 200, window: 3600 }, // 200 likes per hour
+      favorite: { max: 100, window: 3600 } // 100 favorites per hour
+    };
+  } catch (error) {
+    logger.error('Error getting rate limit settings:', error);
+    // Return defaults on error
+    return {
+      rating: { max: 100, window: 3600 },
+      comment: { max: 20, window: 3600 },
+      like: { max: 200, window: 3600 },
+      favorite: { max: 100, window: 3600 }
+    };
+  }
+}
+
+/**
+ * Check if action is rate limited
+ */
+async function checkRateLimit(identifier, eventId, actionType) {
+  try {
+    const settings = await getRateLimitSettings();
+    const limit = settings[actionType] || { max: 100, window: 3600 };
+    
+    // Clean old entries (older than window)
+    const cutoff = new Date(Date.now() - limit.window * 1000);
+    await db('feedback_rate_limits')
+      .where('window_start', '<', cutoff)
+      .delete();
+    
+    // Count recent actions
+    const recentActions = await db('feedback_rate_limits')
+      .where({
+        identifier,
+        event_id: eventId,
+        action_type: actionType
+      })
+      .where('window_start', '>', cutoff)
+      .sum('action_count as total')
+      .first();
+    
+    const currentCount = recentActions?.total || 0;
+    
+    if (currentCount >= limit.max) {
+      return {
+        limited: true,
+        limit: limit.max,
+        window: limit.window,
+        current: currentCount,
+        resetAt: new Date(Date.now() + limit.window * 1000)
+      };
+    }
+    
+    return {
+      limited: false,
+      limit: limit.max,
+      window: limit.window,
+      current: currentCount,
+      remaining: limit.max - currentCount
+    };
+  } catch (error) {
+    logger.error('Error checking rate limit:', error);
+    // Allow action on error to avoid blocking legitimate users
+    return { limited: false };
+  }
+}
+
+/**
+ * Record an action for rate limiting
+ */
+async function recordAction(identifier, eventId, actionType) {
+  try {
+    await db('feedback_rate_limits').insert({
+      identifier,
+      event_id: eventId,
+      action_type: actionType,
+      action_count: 1,
+      window_start: new Date()
+    });
+  } catch (error) {
+    logger.error('Error recording rate limit action:', error);
+  }
+}
+
+/**
+ * Middleware factory for feedback rate limiting
+ */
+function feedbackRateLimit(actionType) {
+  return async (req, res, next) => {
+    try {
+      // Extract event ID from params or body
+      const eventId = req.params.eventId || req.body?.event_id;
+      if (!eventId) {
+        return res.status(400).json({ error: 'Event ID required' });
+      }
+      
+      // Generate guest identifier
+      const identifier = generateGuestIdentifier(req);
+      req.guestIdentifier = identifier;
+      
+      // Check rate limit
+      const rateLimitStatus = await checkRateLimit(identifier, eventId, actionType);
+      
+      // Set rate limit headers
+      res.set({
+        'X-RateLimit-Limit': rateLimitStatus.limit,
+        'X-RateLimit-Remaining': rateLimitStatus.remaining || 0,
+        'X-RateLimit-Reset': rateLimitStatus.resetAt ? rateLimitStatus.resetAt.toISOString() : new Date().toISOString()
+      });
+      
+      if (rateLimitStatus.limited) {
+        logger.warn(`Rate limit exceeded for ${actionType}`, {
+          identifier: identifier.substring(0, 16) + '...',
+          eventId,
+          actionType
+        });
+        
+        return res.status(429).json({
+          error: 'Too many requests',
+          message: `Rate limit exceeded. Please try again later.`,
+          retryAfter: rateLimitStatus.window
+        });
+      }
+      
+      // Record the action after successful processing
+      res.on('finish', async () => {
+        if (res.statusCode >= 200 && res.statusCode < 300) {
+          await recordAction(identifier, eventId, actionType);
+        }
+      });
+      
+      next();
+    } catch (error) {
+      logger.error('Error in rate limit middleware:', error);
+      // Allow request to proceed on error
+      next();
+    }
+  };
+}
+
+/**
+ * IP-based rate limiting for more strict control
+ */
+function strictRateLimit(options = {}) {
+  const {
+    windowMs = 15 * 60 * 1000, // 15 minutes
+    max = 100, // limit each IP to 100 requests per windowMs
+    message = 'Too many requests from this IP, please try again later.',
+    skipSuccessfulRequests = false
+  } = options;
+  
+  const store = new Map();
+  
+  // Clean up old entries periodically
+  setInterval(() => {
+    const now = Date.now();
+    for (const [key, data] of store.entries()) {
+      if (data.resetTime < now) {
+        store.delete(key);
+      }
+    }
+  }, windowMs);
+  
+  return (req, res, next) => {
+    const ip = req.ip || req.connection.remoteAddress;
+    const now = Date.now();
+    const resetTime = now + windowMs;
+    
+    let data = store.get(ip);
+    if (!data || data.resetTime < now) {
+      data = {
+        count: 0,
+        resetTime
+      };
+      store.set(ip, data);
+    }
+    
+    if (data.count >= max) {
+      return res.status(429).json({
+        error: 'Too many requests',
+        message,
+        retryAfter: Math.ceil((data.resetTime - now) / 1000)
+      });
+    }
+    
+    if (!skipSuccessfulRequests || res.statusCode >= 400) {
+      data.count++;
+    }
+    
+    res.setHeader('X-RateLimit-Limit', max);
+    res.setHeader('X-RateLimit-Remaining', Math.max(0, max - data.count));
+    res.setHeader('X-RateLimit-Reset', new Date(data.resetTime).toISOString());
+    
+    next();
+  };
+}
+
+module.exports = {
+  feedbackRateLimit,
+  strictRateLimit,
+  generateGuestIdentifier,
+  checkRateLimit,
+  recordAction
+};

backend/src/middleware/gallery.js

@@ -1,5 +1,6 @@
 const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
+const { db, withRetry } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
 
 // Middleware to verify gallery access
 async function verifyGalleryAccess(req, res, next) {
@@ -10,7 +11,15 @@ async function verifyGalleryAccess(req, res, next) {
     }
     
     const decoded = jwt.verify(token, process.env.JWT_SECRET);
-    const event = await db('events').where({ id: decoded.eventId, is_active: true }).first();
+    const event = await withRetry(async () => {
+      return await db('events')
+        .where({ 
+          id: decoded.eventId, 
+          is_active: formatBoolean(true),
+          is_archived: formatBoolean(false)
+        })
+        .first();
+    });
     
     if (!event) {
       return res.status(404).json({ error: 'Gallery not found or expired' });

backend/src/middleware/photoAuth.js

@@ -1,12 +1,15 @@
 const bcrypt = require('bcrypt');
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
 
 async function photoAuth(req, res, next) {
   try {
     // Extract event slug from the path
     let eventSlug;
     
+    console.log('PhotoAuth middleware - path:', req.path);
+    
     // For thumbnails, we need to parse the filename to get the event info
     if (req.path.startsWith('/thumb_')) {
       // For now, we'll rely on JWT token for thumbnail access
@@ -25,9 +28,22 @@ async function photoAuth(req, res, next) {
         
         // Check if it's a gallery token
         if (decoded.type === 'gallery') {
-          // For thumbnails, we accept any valid gallery token
+          // For thumbnails, we need to verify the token is for a valid event
           if (!eventSlug) {
-            const event = await db('events').where({ slug: decoded.eventSlug, is_active: true }).first();
+            // Extract event ID from the decoded token
+            if (decoded.eventId) {
+              const event = await db('events')
+                .where({ id: decoded.eventId, is_active: formatBoolean(true) })
+                .first();
+              if (event) {
+                req.event = event;
+                return next();
+              }
+            }
+            // Fallback to slug
+            const event = await db('events')
+              .where({ slug: decoded.eventSlug, is_active: formatBoolean(true) })
+              .first();
             if (event) {
               req.event = event;
               return next();
@@ -35,7 +51,9 @@ async function photoAuth(req, res, next) {
           }
           // For regular photos, check if token matches the event
           else if (decoded.eventSlug === eventSlug) {
-            const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
+            const event = await db('events')
+              .where({ slug: eventSlug, is_active: formatBoolean(true) })
+              .first();
             if (event) {
               req.event = event;
               return next();
@@ -45,18 +63,12 @@ async function photoAuth(req, res, next) {
         
         // Check if it's an admin token (admins can view all photos)
         if (decoded.type === 'admin') {
-          if (!eventSlug) {
-            // For thumbnails with admin token, allow access
-            return next();
-          }
-          const event = await db('events').where({ slug: eventSlug }).first();
-          if (event) {
-            req.event = event;
-            return next();
-          }
+          // For both thumbnails and photos with admin token, allow access
+          return next();
         }
       } catch (err) {
         // Token invalid, fall through to password check
+        console.error('JWT verification failed:', err.message);
       }
     }
     
@@ -67,12 +79,12 @@ async function photoAuth(req, res, next) {
       return res.status(401).json({ error: 'Authentication required' });
     }
     
-    // If no eventSlug (thumbnails), we require JWT token
-    if (!eventSlug) {
+    // If no eventSlug (thumbnails), and we don't have valid auth yet, deny access
+    if (!eventSlug && !password) {
       return res.status(401).json({ error: 'Authentication required for thumbnails' });
     }
     
-    const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
+    const event = await db('events').where({ slug: eventSlug, is_active: formatBoolean(true) }).first();
     if (!event) {
       return res.status(404).json({ error: 'Gallery not found' });
     }

backend/src/middleware/sessionTimeout.js

@@ -7,6 +7,11 @@ const sessions = new Map();
 // Default session timeout (60 minutes)
 const DEFAULT_SESSION_TIMEOUT = 60 * 60 * 1000;
 
+// Cache for session timeout setting
+let cachedTimeout = null;
+let cacheExpiry = 0;
+const CACHE_DURATION = 30 * 60 * 1000; // 30 minutes - reduced DB queries
+
 // Clean up expired sessions every 5 minutes
 setInterval(() => {
   const now = Date.now();
@@ -18,20 +23,46 @@ setInterval(() => {
 }, 5 * 60 * 1000);
 
 async function getSessionTimeout() {
+  const now = Date.now();
+  
+  // Return cached value if still valid
+  if (cachedTimeout && now < cacheExpiry) {
+    return cachedTimeout;
+  }
+  
   try {
     const setting = await db('app_settings')
       .where('setting_key', 'security_session_timeout_minutes')
-      .first();
+      .first()
+      .timeout(5000); // 5 second timeout
     
     if (setting && setting.setting_value) {
-      const minutes = parseInt(JSON.parse(setting.setting_value));
-      return minutes * 60 * 1000; // Convert to milliseconds
+      let value = setting.setting_value;
+      // Handle both string and object values
+      if (typeof value === 'string') {
+        try {
+          value = JSON.parse(value);
+        } catch (e) {
+          // If it's not JSON, try to parse as number directly
+          value = parseInt(value);
+        }
+      }
+      const minutes = parseInt(value);
+      if (!isNaN(minutes) && minutes > 0) {
+        cachedTimeout = minutes * 60 * 1000; // Convert to milliseconds
+        cacheExpiry = now + CACHE_DURATION;
+        return cachedTimeout;
+      }
     }
   } catch (error) {
-    console.error('Error getting session timeout:', error);
+    // Only log if it's not a connection error (to avoid spam)
+    if (error.code !== 'ECONNRESET' && !error.message?.includes('Connection terminated')) {
+      console.error('Error getting session timeout:', error.message);
+    }
   }
   
-  return DEFAULT_SESSION_TIMEOUT;
+  // Use cached value if available, otherwise default
+  return cachedTimeout || DEFAULT_SESSION_TIMEOUT;
 }
 
 async function sessionTimeoutMiddleware(req, res, next) {

backend/src/middleware/uploadValidation.js

@@ -0,0 +1,111 @@
+const fs = require('fs').promises;
+const path = require('path');
+const sharp = require('sharp');
+const logger = require('../utils/logger');
+
+/**
+ * Validate uploaded file is complete and not corrupted
+ */
+async function validateUploadedFile(filePath) {
+  try {
+    // Check file exists and has size
+    const stats = await fs.stat(filePath);
+    if (stats.size === 0) {
+      throw new Error('File is empty');
+    }
+    
+    // For image files, verify they can be read by Sharp
+    const ext = path.extname(filePath).toLowerCase();
+    const imageExtensions = ['.jpg', '.jpeg', '.png', '.gif', '.webp'];
+    
+    if (imageExtensions.includes(ext)) {
+      // Try to read metadata - this will fail if image is corrupted
+      let metadata;
+      try {
+        metadata = await sharp(filePath, {
+          failOnError: false, // Don't fail on recoverable errors
+          limitInputPixels: 268402689 // ~16k x 16k max
+        }).metadata();
+      } catch (metadataError) {
+        // If metadata reading fails, the file is likely incomplete
+        throw new Error(`Invalid image file: ${metadataError.message}`);
+      }
+      
+      if (!metadata || !metadata.width || !metadata.height) {
+        throw new Error('Invalid image dimensions - file may be incomplete');
+      }
+      
+      // Check for reasonable dimensions
+      if (metadata.width < 10 || metadata.height < 10) {
+        throw new Error('Image dimensions too small');
+      }
+      
+      // Additional check: verify we can actually decode a small portion of the image
+      try {
+        await sharp(filePath, {
+          failOnError: false,
+          limitInputPixels: 268402689
+        })
+        .resize(10, 10) // Try to resize to very small size
+        .toBuffer();
+      } catch (decodeError) {
+        throw new Error(`Image decode failed - file may be corrupted: ${decodeError.message}`);
+      }
+      
+      return true;
+    }
+    
+    return true;
+  } catch (error) {
+    logger.error(`File validation failed for ${filePath}:`, error.message);
+    throw error;
+  }
+}
+
+/**
+ * Middleware to validate uploaded files after multer processing
+ */
+async function validateUploadedFiles(req, res, next) {
+  if (!req.files || req.files.length === 0) {
+    return next();
+  }
+  
+  const validFiles = [];
+  const invalidFiles = [];
+  
+  // Validate each file
+  for (const file of req.files) {
+    try {
+      await validateUploadedFile(file.path);
+      validFiles.push(file);
+    } catch (error) {
+      logger.warn(`Removing invalid upload ${file.originalname}: ${error.message}`);
+      invalidFiles.push({
+        filename: file.originalname,
+        error: error.message
+      });
+      
+      // Delete the invalid file
+      try {
+        await fs.unlink(file.path);
+      } catch (unlinkErr) {
+        logger.error(`Failed to delete invalid file ${file.path}:`, unlinkErr.message);
+      }
+    }
+  }
+  
+  // Update req.files to only include valid files
+  req.files = validFiles;
+  
+  // Store invalid files info for response
+  if (invalidFiles.length > 0) {
+    req.invalidFiles = invalidFiles;
+  }
+  
+  next();
+}
+
+module.exports = {
+  validateUploadedFile,
+  validateUploadedFiles
+};