v2.5.5 — Fix PDF preview overlay, mobile login tagline

- PDF file preview now renders via portal above navbar
- Fix mobile login tagline text wrapping

.github/workflows/docker.yml

@@ -0,0 +1,25 @@
+name: Build & Push Docker Image
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: mauriceboe/nomad:latest

.gitignore

@@ -4,6 +4,9 @@ node_modules/
 # Build output
 client/dist/
 
+# Generated PWA icons (built from SVG via prebuild)
+client/public/icons/*.png
+
 # Database
 *.db
 *.db-shm

Dockerfile

@@ -11,9 +11,11 @@ FROM node:22-alpine
 
 WORKDIR /app
 
-# Server-Dependencies installieren
+# Server-Dependencies installieren (better-sqlite3 braucht Build-Tools)
 COPY server/package*.json ./
-RUN npm ci --production
+RUN apk add --no-cache python3 make g++ && \
+    npm ci --production && \
+    apk del python3 make g++
 
 # Server-Code kopieren
 COPY server/ ./
@@ -33,4 +35,4 @@ ENV PORT=3000
 
 EXPOSE 3000
 
-CMD ["node", "--experimental-sqlite", "src/index.js"]
+CMD ["node", "src/index.js"]

LICENSE

@@ -1,21 +1,661 @@
-MIT License
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
 
-Copyright (c) 2026 mauriceboe
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+                            Preamble
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

README.md

@@ -1,43 +1,88 @@
-# NOMAD
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="client/public/logo-light.svg" />
+    <source media="(prefers-color-scheme: light)" srcset="client/public/logo-dark.svg" />
+    <img src="client/public/logo-light.svg" alt="NOMAD" height="60" />
+  </picture>
+  <br />
+  <em>Navigation Organizer for Maps, Activities & Destinations</em>
+</p>
 
-**Navigation Organizer for Maps, Activities & Destinations**
+<p align="center">
+  <a href="LICENSE"><img src="https://img.shields.io/badge/License-AGPL_v3-blue.svg" alt="License: AGPL v3" /></a>
+  <a href="https://hub.docker.com/r/mauriceboe/nomad"><img src="https://img.shields.io/docker/pulls/mauriceboe/nomad" alt="Docker Pulls" /></a>
+  <a href="https://github.com/mauriceboe/NOMAD"><img src="https://img.shields.io/github/stars/mauriceboe/NOMAD" alt="GitHub Stars" /></a>
+  <a href="https://github.com/mauriceboe/NOMAD/commits"><img src="https://img.shields.io/github/last-commit/mauriceboe/NOMAD" alt="Last Commit" /></a>
+</p>
 
-A self-hosted, real-time collaborative travel planner for organizing trips with interactive maps, budgets, packing lists, and more.
+<p align="center">
+  A self-hosted, real-time collaborative travel planner with interactive maps, budgets, packing lists, and more.
+  <br />
+  <strong><a href="https://demo-nomad.pakulat.org">Live Demo</a></strong> — Try NOMAD without installing. Resets hourly.
+</p>
 
-[![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](LICENSE)
-[![Docker Pulls](https://img.shields.io/docker/pulls/mauriceboe/nomad)](https://hub.docker.com/r/mauriceboe/nomad)
-[![GitHub Stars](https://img.shields.io/github/stars/mauriceboe/NOMAD)](https://github.com/mauriceboe/NOMAD)
-[![Last Commit](https://img.shields.io/github/last-commit/mauriceboe/NOMAD)](https://github.com/mauriceboe/NOMAD/commits)
+![NOMAD Screenshot](docs/screenshot.png)
+![NOMAD Screenshot 2](docs/screenshot-2.png)
+
+<details>
+<summary>More Screenshots</summary>
+
+| | |
+|---|---|
+| ![Plan Detail](docs/screenshot-plan-detail.png) | ![Bookings](docs/screenshot-bookings.png) |
+| ![Budget](docs/screenshot-budget.png) | ![Packing List](docs/screenshot-packing.png) |
+| ![Files](docs/screenshot-files.png) | |
+
+</details>
 
 ## Features
 
-- **Real-Time Collaboration** — Plan together via WebSocket live sync — changes appear instantly across all connected users
-- **Interactive Map** — Leaflet map with marker clustering, route visualization, and customizable tile sources
-- **Google Places Integration** — Search places, auto-fill details including ratings, reviews, opening hours, and photos (requires API key)
+### Trip Planning
 - **Drag & Drop Planner** — Organize places into day plans with reordering and cross-day moves
-- **Weather Forecasts** — Current weather and 5-day forecasts with smart caching (requires API key)
+- **Interactive Map** — Leaflet map with photo markers, clustering, route visualization, and customizable tile sources
+- **Place Search** — Search via Google Places (with photos, ratings, opening hours) or OpenStreetMap (free, no API key needed)
+- **Day Notes** — Add timestamped, icon-tagged notes to individual days with drag & drop reordering
+- **Route Optimization** — Auto-optimize place order and export to Google Maps
+- **Weather Forecasts** — Current weather and 5-day forecasts with smart caching
+
+### Travel Management
+- **Reservations & Bookings** — Track flights, hotels, restaurants with status, confirmation numbers, and file attachments
 - **Budget Tracking** — Category-based expenses with pie chart, per-person/per-day splitting, and multi-currency support
 - **Packing Lists** — Categorized checklists with progress tracking, color coding, and smart suggestions
-- **Reservations & Bookings** — Track flights, hotels, restaurants with status, confirmation numbers, and file attachments
 - **Document Manager** — Attach documents, tickets, and PDFs to trips, places, or reservations (up to 50 MB per file)
-- **PDF Export** — Export complete trip plans as PDF with images and notes
+- **PDF Export** — Export complete trip plans as PDF with cover page, images, notes, and NOMAD branding
+
+### Mobile & PWA
+- **Progressive Web App** — Install on iOS and Android directly from the browser, no App Store needed
+- **Offline Support** — Service Worker caches map tiles, API data, uploads, and static assets via Workbox
+- **Native App Feel** — Fullscreen standalone mode, custom app icon, themed status bar, and splash screen
+- **Touch Optimized** — Responsive design with mobile-specific layouts, touch-friendly controls, and safe area handling
+
+### Collaboration
+- **Real-Time Sync** — Plan together via WebSocket — changes appear instantly across all connected users
 - **Multi-User** — Invite members to collaborate on shared trips with role-based access
-- **Admin Panel** — User management, create users, global categories, API key configuration, and backups
-- **Auto-Backups** — Scheduled backups with configurable interval and retention
-- **Route Optimization** — Auto-optimize place order and export to Google Maps
-- **Day Notes** — Add timestamped notes to individual days
-- **Dark Mode** — Full light and dark theme support
+- **Single Sign-On (OIDC)** — Login with Google, Apple, Authentik, Keycloak, or any OIDC provider
+
+### Addons (modular, admin-toggleable)
+- **Vacay** — Personal vacation day planner with calendar view, public holidays (100+ countries), company holidays, user fusion with live sync, and carry-over tracking
+- **Atlas** — Interactive world map with visited countries, travel stats, continent breakdown, streak tracking, and liquid glass UI effects
+- **Dashboard Widgets** — Currency converter and timezone clock, toggleable per user
+
+### Customization & Admin
+- **Dark Mode** — Full light and dark theme with dynamic status bar color matching
 - **Multilingual** — English and German (i18n)
-- **Mobile Friendly** — Responsive design with touch-optimized controls
+- **Admin Panel** — User management, global categories, addon management, API keys, and backups
+- **Auto-Backups** — Scheduled backups with configurable interval and retention
 - **Customizable** — Temperature units, time format (12h/24h), map tile sources, default coordinates
 
 ## Tech Stack
 
-- **Backend**: Node.js 22 + Express + SQLite (`node:sqlite`)
+- **Backend**: Node.js 22 + Express + SQLite (`better-sqlite3`)
 - **Frontend**: React 18 + Vite + Tailwind CSS
+- **PWA**: vite-plugin-pwa + Workbox
 - **Real-Time**: WebSocket (`ws`)
 - **State**: Zustand
-- **Auth**: JWT
+- **Auth**: JWT + OIDC
 - **Maps**: Leaflet + react-leaflet-cluster + Google Places API (optional)
 - **Weather**: OpenWeatherMap API (optional)
 - **Icons**: lucide-react
@@ -50,6 +95,15 @@ docker run -d -p 3000:3000 -v ./data:/app/data -v ./uploads:/app/uploads maurice
 
 The app runs on port `3000`. The first user to register becomes the admin.
 
+### Install as App (PWA)
+
+NOMAD works as a Progressive Web App — no App Store needed:
+
+1. Open your NOMAD instance in the browser (HTTPS required)
+2. **iOS**: Share button → "Add to Home Screen"
+3. **Android**: Menu → "Install app" or "Add to Home Screen"
+4. NOMAD launches fullscreen with its own icon, just like a native app
+
 <details>
 <summary>Docker Compose (recommended for production)</summary>
 
@@ -91,7 +145,53 @@ Your data is persisted in the mounted `data` and `uploads` volumes.
 
 For production, put NOMAD behind a reverse proxy with HTTPS (e.g. Nginx, Caddy, Traefik).
 
-Example with **Caddy**:
+> **Important:** NOMAD uses WebSockets for real-time sync. Your reverse proxy must support WebSocket upgrades on the `/ws` path.
+
+<details>
+<summary>Nginx</summary>
+
+```nginx
+server {
+    listen 80;
+    server_name nomad.yourdomain.com;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name nomad.yourdomain.com;
+
+    ssl_certificate /path/to/fullchain.pem;
+    ssl_certificate_key /path/to/privkey.pem;
+
+    location /ws {
+        proxy_pass http://localhost:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 86400;
+    }
+
+    location / {
+        proxy_pass http://localhost:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+```
+
+</details>
+
+<details>
+<summary>Caddy</summary>
+
+Caddy handles WebSocket upgrades automatically:
 
 ```
 nomad.yourdomain.com {
@@ -99,6 +199,8 @@ nomad.yourdomain.com {
 }
 ```
 
+</details>
+
 ## Optional API Keys
 
 API keys are configured in the **Admin Panel** after login. Keys set by the admin are automatically shared with all users — no per-user configuration needed.

SECURITY.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---|---|
+| Latest | Yes |
+| Older | No |
+
+Only the latest version receives security updates. Please update to the latest release.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it responsibly:
+
+1. **Do not** open a public issue
+2. Email: **mauriceboe@icloud.com**
+3. Include a description of the vulnerability and steps to reproduce
+
+You will receive a response within 48 hours. Once confirmed, a fix will be released as soon as possible.
+
+## Scope
+
+This policy covers the NOMAD application and its Docker image (`mauriceboe/nomad`).
+
+Third-party dependencies are monitored via GitHub Dependabot.

client/index.html

@@ -2,9 +2,25 @@
 <html lang="de">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23111827' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'><path d='M17.8 19.2 16 11l3.5-3.5C21 6 21 4 19 2c-2-2-4-2-5.5-.5L10 5 1.8 6.2c-.5.1-.9.6-.6 1.1l1.9 2.9 2.5-.9 4-4 2.7 2.7-4 4 .9 2.5 2.9 1.9c.5.3 1 0 1.1-.5z'/></svg>" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
     <title>NOMAD</title>
+
+    <!-- PWA / iOS -->
+    <meta name="theme-color" content="#09090b" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-status-bar-style" content="default" />
+    <meta name="apple-mobile-web-app-title" content="NOMAD" />
+    <link rel="apple-touch-icon" href="/icons/apple-touch-icon-180x180.png" />
+
+    <!-- Favicon -->
+    <link rel="icon" type="image/svg+xml" href="/icons/icon-dark.svg" />
+
+    <!-- Fonts -->
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link href="https://fonts.googleapis.com/css2?family=MuseoModerno:wght@400;700;800&display=swap" rel="stylesheet" />
+
+    <!-- Leaflet -->
     <link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css" />
   </head>
   <body>

client/package.json

@@ -1,10 +1,11 @@
 {
   "name": "nomad-client",
-  "version": "2.0.0",
+  "version": "2.5.5",
   "private": true,
   "type": "module",
   "scripts": {
     "dev": "vite",
+    "prebuild": "node scripts/generate-icons.mjs",
     "build": "vite build",
     "preview": "vite preview"
   },
@@ -30,7 +31,9 @@
     "@vitejs/plugin-react": "^4.2.1",
     "autoprefixer": "^10.4.18",
     "postcss": "^8.4.35",
+    "sharp": "^0.33.0",
     "tailwindcss": "^3.4.1",
-    "vite": "^5.1.4"
+    "vite": "^5.1.4",
+    "vite-plugin-pwa": "^0.21.0"
   }
 }

client/public/icons/icon-dark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="2000" zoomAndPan="magnify" viewBox="0 0 1500 1499.999933" height="2000" preserveAspectRatio="xMidYMid meet" version="1.0"><defs><clipPath id="a5b4275efd"><path d="M 45 5.265625 L 1455 5.265625 L 1455 1494.765625 L 45 1494.765625 Z M 45 5.265625 " clip-rule="nonzero"/></clipPath><clipPath id="61932b752f"><path d="M 855.636719 699.203125 L 222.246094 699.203125 C 197.679688 699.203125 179.90625 675.753906 186.539062 652.101562 L 360.429688 32.390625 C 364.921875 16.386719 379.511719 5.328125 396.132812 5.328125 L 1029.527344 5.328125 C 1054.089844 5.328125 1071.867188 28.777344 1065.230469 52.429688 L 891.339844 672.136719 C 886.851562 688.140625 872.257812 699.203125 855.636719 699.203125 Z M 444.238281 1166.980469 L 533.773438 847.898438 C 540.410156 824.246094 522.632812 800.796875 498.070312 800.796875 L 172.472656 800.796875 C 155.851562 800.796875 141.261719 811.855469 136.769531 827.859375 L 47.234375 1146.941406 C 40.597656 1170.59375 58.375 1194.042969 82.9375 1194.042969 L 408.535156 1194.042969 C 425.15625 1194.042969 439.75 1182.984375 444.238281 1166.980469 Z M 609.003906 827.859375 L 435.113281 1447.570312 C 428.476562 1471.21875 446.253906 1494.671875 470.816406 1494.671875 L 1104.210938 1494.671875 C 1120.832031 1494.671875 1135.421875 1483.609375 1139.914062 1467.605469 L 1313.804688 847.898438 C 1320.441406 824.246094 1302.664062 800.796875 1278.101562 800.796875 L 644.707031 800.796875 C 628.085938 800.796875 613.492188 811.855469 609.003906 827.859375 Z M 1056.105469 333.019531 L 966.570312 652.101562 C 959.933594 675.753906 977.710938 699.203125 1002.273438 699.203125 L 1327.871094 699.203125 C 1344.492188 699.203125 1359.085938 688.140625 1363.574219 672.136719 L 1453.109375 353.054688 C 1459.746094 329.40625 1441.96875 305.953125 1417.40625 305.953125 L 1091.808594 305.953125 C 1075.1875 305.953125 1060.597656 317.015625 1056.105469 333.019531 Z M 1056.105469 333.019531 " clip-rule="nonzero"/></clipPath></defs><g clip-path="url(#a5b4275efd)"><g clip-path="url(#61932b752f)"><path fill="#000000" d="M 40.597656 5.328125 L 40.597656 1494.671875 L 1459.472656 1494.671875 L 1459.472656 5.328125 Z M 40.597656 5.328125 " fill-opacity="1" fill-rule="nonzero"/></g></g></svg>

client/public/icons/icon-white.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="2000" zoomAndPan="magnify" viewBox="0 0 1500 1499.999933" height="2000" preserveAspectRatio="xMidYMid meet" version="1.0"><defs><clipPath id="ff6253e8fa"><path d="M 45 5.265625 L 1455 5.265625 L 1455 1494.765625 L 45 1494.765625 Z M 45 5.265625 " clip-rule="nonzero"/></clipPath><clipPath id="c6b14a8188"><path d="M 855.636719 699.203125 L 222.246094 699.203125 C 197.679688 699.203125 179.90625 675.75 186.539062 652.101562 L 360.429688 32.390625 C 364.921875 16.386719 379.511719 5.328125 396.132812 5.328125 L 1029.527344 5.328125 C 1054.089844 5.328125 1071.867188 28.777344 1065.230469 52.429688 L 891.339844 672.136719 C 886.851562 688.140625 872.257812 699.203125 855.636719 699.203125 Z M 444.238281 1166.980469 L 533.773438 847.898438 C 540.410156 824.246094 522.632812 800.796875 498.070312 800.796875 L 172.472656 800.796875 C 155.851562 800.796875 141.261719 811.855469 136.769531 827.859375 L 47.234375 1146.941406 C 40.597656 1170.59375 58.375 1194.042969 82.9375 1194.042969 L 408.535156 1194.042969 C 425.15625 1194.042969 439.75 1182.984375 444.238281 1166.980469 Z M 609.003906 827.859375 L 435.113281 1447.570312 C 428.476562 1471.21875 446.253906 1494.671875 470.816406 1494.671875 L 1104.210938 1494.671875 C 1120.832031 1494.671875 1135.421875 1483.609375 1139.914062 1467.605469 L 1313.804688 847.898438 C 1320.441406 824.246094 1302.664062 800.796875 1278.101562 800.796875 L 644.707031 800.796875 C 628.085938 800.796875 613.492188 811.855469 609.003906 827.859375 Z M 1056.105469 333.019531 L 966.570312 652.101562 C 959.933594 675.75 977.710938 699.203125 1002.273438 699.203125 L 1327.871094 699.203125 C 1344.492188 699.203125 1359.085938 688.140625 1363.574219 672.136719 L 1453.109375 353.054688 C 1459.746094 329.40625 1441.96875 305.953125 1417.40625 305.953125 L 1091.808594 305.953125 C 1075.1875 305.953125 1060.597656 317.015625 1056.105469 333.019531 Z M 1056.105469 333.019531 " clip-rule="nonzero"/></clipPath></defs><g clip-path="url(#ff6253e8fa)"><g clip-path="url(#c6b14a8188)"><path fill="#ffffff" d="M 40.597656 5.328125 L 40.597656 1494.671875 L 1459.472656 1494.671875 L 1459.472656 5.328125 Z M 40.597656 5.328125 " fill-opacity="1" fill-rule="nonzero"/></g></g></svg>

client/public/icons/icon.svg

@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0%" stop-color="#1e293b"/>
+      <stop offset="100%" stop-color="#0f172a"/>
+    </linearGradient>
+    <clipPath id="icon">
+      <path d="M 855.636719 699.203125 L 222.246094 699.203125 C 197.679688 699.203125 179.90625 675.75 186.539062 652.101562 L 360.429688 32.390625 C 364.921875 16.386719 379.511719 5.328125 396.132812 5.328125 L 1029.527344 5.328125 C 1054.089844 5.328125 1071.867188 28.777344 1065.230469 52.429688 L 891.339844 672.136719 C 886.851562 688.140625 872.257812 699.203125 855.636719 699.203125 Z M 444.238281 1166.980469 L 533.773438 847.898438 C 540.410156 824.246094 522.632812 800.796875 498.070312 800.796875 L 172.472656 800.796875 C 155.851562 800.796875 141.261719 811.855469 136.769531 827.859375 L 47.234375 1146.941406 C 40.597656 1170.59375 58.375 1194.042969 82.9375 1194.042969 L 408.535156 1194.042969 C 425.15625 1194.042969 439.75 1182.984375 444.238281 1166.980469 Z M 609.003906 827.859375 L 435.113281 1447.570312 C 428.476562 1471.21875 446.253906 1494.671875 470.816406 1494.671875 L 1104.210938 1494.671875 C 1120.832031 1494.671875 1135.421875 1483.609375 1139.914062 1467.605469 L 1313.804688 847.898438 C 1320.441406 824.246094 1302.664062 800.796875 1278.101562 800.796875 L 644.707031 800.796875 C 628.085938 800.796875 613.492188 811.855469 609.003906 827.859375 Z M 1056.105469 333.019531 L 966.570312 652.101562 C 959.933594 675.75 977.710938 699.203125 1002.273438 699.203125 L 1327.871094 699.203125 C 1344.492188 699.203125 1359.085938 688.140625 1363.574219 672.136719 L 1453.109375 353.054688 C 1459.746094 329.40625 1441.96875 305.953125 1417.40625 305.953125 L 1091.808594 305.953125 C 1075.1875 305.953125 1060.597656 317.015625 1056.105469 333.019531 Z"/>
+    </clipPath>
+  </defs>
+  <rect width="512" height="512" fill="url(#bg)"/>
+  <g transform="translate(56,51) scale(0.267)">
+    <rect width="1500" height="1500" fill="#ffffff" clip-path="url(#icon)"/>
+  </g>
+</svg>

client/scripts/generate-icons.mjs

@@ -0,0 +1,29 @@
+/**
+ * Generates PNG icons for PWA from the master SVG icon.
+ * Run: node scripts/generate-icons.mjs
+ * Called automatically via the "prebuild" npm script.
+ */
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+import sharp from 'sharp';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const iconsDir = join(__dirname, '..', 'public', 'icons');
+const svgBuffer = readFileSync(join(iconsDir, 'icon.svg'));
+
+const sizes = [
+  { name: 'apple-touch-icon-180x180.png', size: 180 },
+  { name: 'icon-192x192.png', size: 192 },
+  { name: 'icon-512x512.png', size: 512 },
+];
+
+for (const { name, size } of sizes) {
+  await sharp(svgBuffer, { density: 300 })
+    .resize(size, size)
+    .png({ compressionLevel: 9 })
+    .toFile(join(iconsDir, name));
+  console.log(`  \u2713 ${name} (${size}x${size})`);
+}
+
+console.log('PWA icons generated.');

client/src/App.jsx

@@ -10,8 +10,12 @@ import TripPlannerPage from './pages/TripPlannerPage'
 import FilesPage from './pages/FilesPage'
 import AdminPage from './pages/AdminPage'
 import SettingsPage from './pages/SettingsPage'
+import VacayPage from './pages/VacayPage'
+import AtlasPage from './pages/AtlasPage'
 import { ToastContainer } from './components/shared/Toast'
 import { TranslationProvider } from './i18n'
+import DemoBanner from './components/Layout/DemoBanner'
+import { authApi } from './api/client'
 
 function ProtectedRoute({ children, adminRequired = false }) {
   const { isAuthenticated, user, isLoading } = useAuthStore()
@@ -31,7 +35,7 @@ function ProtectedRoute({ children, adminRequired = false }) {
     return <Navigate to="/login" replace />
   }
 
-  if (adminRequired && user?.role !== 'admin') {
+  if (adminRequired && user && user.role !== 'admin') {
     return <Navigate to="/dashboard" replace />
   }
 
@@ -53,13 +57,17 @@ function RootRedirect() {
 }
 
 export default function App() {
-  const { loadUser, token, isAuthenticated } = useAuthStore()
+  const { loadUser, token, isAuthenticated, demoMode, setDemoMode, setHasMapsKey } = useAuthStore()
   const { loadSettings } = useSettingsStore()
 
   useEffect(() => {
     if (token) {
       loadUser()
     }
+    authApi.getAppConfig().then(config => {
+      if (config?.demo_mode) setDemoMode(true)
+      if (config?.has_maps_key !== undefined) setHasMapsKey(config.has_maps_key)
+    }).catch(() => {})
   }, [])
 
   const { settings } = useSettingsStore()
@@ -70,13 +78,17 @@ export default function App() {
     }
   }, [isAuthenticated])
 
-  // Apply dark mode class to <html>
+  // Apply dark mode class to <html> + update PWA theme-color
   useEffect(() => {
     if (settings.dark_mode) {
       document.documentElement.classList.add('dark')
     } else {
       document.documentElement.classList.remove('dark')
     }
+    const meta = document.querySelector('meta[name="theme-color"]')
+    if (meta) {
+      meta.setAttribute('content', settings.dark_mode ? '#09090b' : '#ffffff')
+    }
   }, [settings.dark_mode])
 
   return (
@@ -126,6 +138,22 @@ export default function App() {
             </ProtectedRoute>
           }
         />
+        <Route
+          path="/vacay"
+          element={
+            <ProtectedRoute>
+              <VacayPage />
+            </ProtectedRoute>
+          }
+        />
+        <Route
+          path="/atlas"
+          element={
+            <ProtectedRoute>
+              <AtlasPage />
+            </ProtectedRoute>
+          }
+        />
         <Route path="*" element={<Navigate to="/" replace />} />
       </Routes>
     </TranslationProvider>

client/src/api/client.js

@@ -53,6 +53,9 @@ export const authApi = {
   updateAppSettings: (data) => apiClient.put('/auth/app-settings', data).then(r => r.data),
   validateKeys: () => apiClient.get('/auth/validate-keys').then(r => r.data),
   travelStats: () => apiClient.get('/auth/travel-stats').then(r => r.data),
+  changePassword: (data) => apiClient.put('/auth/me/password', data).then(r => r.data),
+  deleteOwnAccount: () => apiClient.delete('/auth/me').then(r => r.data),
+  demoLogin: () => apiClient.post('/auth/demo-login').then(r => r.data),
 }
 
 export const tripsApi = {
@@ -121,6 +124,17 @@ export const adminApi = {
   updateUser: (id, data) => apiClient.put(`/admin/users/${id}`, data).then(r => r.data),
   deleteUser: (id) => apiClient.delete(`/admin/users/${id}`).then(r => r.data),
   stats: () => apiClient.get('/admin/stats').then(r => r.data),
+  saveDemoBaseline: () => apiClient.post('/admin/save-demo-baseline').then(r => r.data),
+  getOidc: () => apiClient.get('/admin/oidc').then(r => r.data),
+  updateOidc: (data) => apiClient.put('/admin/oidc', data).then(r => r.data),
+  addons: () => apiClient.get('/admin/addons').then(r => r.data),
+  updateAddon: (id, data) => apiClient.put(`/admin/addons/${id}`, data).then(r => r.data),
+  checkVersion: () => apiClient.get('/admin/version-check').then(r => r.data),
+  installUpdate: () => apiClient.post('/admin/update', {}, { timeout: 300000 }).then(r => r.data),
+}
+
+export const addonsApi = {
+  enabled: () => apiClient.get('/addons').then(r => r.data),
 }
 
 export const mapsApi = {

client/src/api/websocket.js

@@ -29,10 +29,8 @@ function handleMessage(event) {
     // Store our socket ID from welcome message
     if (parsed.type === 'welcome') {
       mySocketId = parsed.socketId
-      console.log('[WS] Got socketId:', mySocketId)
       return
     }
-    console.log('[WS] Received:', parsed.type, parsed)
     listeners.forEach(fn => {
       try { fn(parsed) } catch (err) { console.error('WebSocket listener error:', err) }
     })
@@ -61,14 +59,14 @@ function connectInternal(token, isReconnect = false) {
   socket = new WebSocket(url)
 
   socket.onopen = () => {
-    console.log('[WS] Connected', isReconnect ? '(reconnect)' : '(initial)')
+    // connection established
     reconnectDelay = 1000
     // Join active trips on any connect (initial or reconnect)
     if (activeTrips.size > 0) {
       activeTrips.forEach(tripId => {
         if (socket && socket.readyState === WebSocket.OPEN) {
           socket.send(JSON.stringify({ type: 'join', tripId }))
-          console.log('[WS] Joined trip', tripId)
+          // joined trip room
         }
       })
       // Refetch trip data for active trips

client/src/components/Admin/AddonManager.jsx

@@ -0,0 +1,162 @@
+import React, { useEffect, useState } from 'react'
+import { adminApi } from '../../api/client'
+import { useTranslation } from '../../i18n'
+import { useSettingsStore } from '../../store/settingsStore'
+import { useToast } from '../shared/Toast'
+import { Puzzle, ListChecks, Wallet, FileText, CalendarDays, Globe, Briefcase } from 'lucide-react'
+
+const ICON_MAP = {
+  ListChecks, Wallet, FileText, CalendarDays, Puzzle, Globe, Briefcase,
+}
+
+function AddonIcon({ name, size = 20 }) {
+  const Icon = ICON_MAP[name] || Puzzle
+  return <Icon size={size} />
+}
+
+export default function AddonManager() {
+  const { t } = useTranslation()
+  const dark = useSettingsStore(s => s.settings.dark_mode)
+  const toast = useToast()
+  const [addons, setAddons] = useState([])
+  const [loading, setLoading] = useState(true)
+
+  useEffect(() => {
+    loadAddons()
+  }, [])
+
+  const loadAddons = async () => {
+    setLoading(true)
+    try {
+      const data = await adminApi.addons()
+      setAddons(data.addons)
+    } catch (err) {
+      toast.error(t('admin.addons.toast.error'))
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  const handleToggle = async (addon) => {
+    const newEnabled = !addon.enabled
+    // Optimistic update
+    setAddons(prev => prev.map(a => a.id === addon.id ? { ...a, enabled: newEnabled } : a))
+    try {
+      await adminApi.updateAddon(addon.id, { enabled: newEnabled })
+      window.dispatchEvent(new Event('addons-changed'))
+      toast.success(t('admin.addons.toast.updated'))
+    } catch (err) {
+      // Rollback
+      setAddons(prev => prev.map(a => a.id === addon.id ? { ...a, enabled: !newEnabled } : a))
+      toast.error(t('admin.addons.toast.error'))
+    }
+  }
+
+  const tripAddons = addons.filter(a => a.type === 'trip')
+  const globalAddons = addons.filter(a => a.type === 'global')
+
+  if (loading) {
+    return (
+      <div className="p-8 text-center">
+        <div className="w-8 h-8 border-2 border-slate-200 border-t-slate-900 rounded-full animate-spin mx-auto" style={{ borderTopColor: 'var(--text-primary)' }}></div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="space-y-6">
+      {/* Header */}
+      <div className="rounded-xl border overflow-hidden" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
+        <div className="px-6 py-4 border-b" style={{ borderColor: 'var(--border-secondary)' }}>
+          <h2 className="font-semibold" style={{ color: 'var(--text-primary)' }}>{t('admin.addons.title')}</h2>
+          <p className="text-xs mt-1" style={{ color: 'var(--text-muted)', display: 'flex', alignItems: 'center', gap: 4, flexWrap: 'wrap' }}>
+            {t('admin.addons.subtitleBefore')}<img src={dark ? '/text-light.svg' : '/text-dark.svg'} alt="NOMAD" style={{ height: 11, display: 'inline', verticalAlign: 'middle', opacity: 0.7 }} />{t('admin.addons.subtitleAfter')}
+          </p>
+        </div>
+
+        {addons.length === 0 ? (
+          <div className="p-8 text-center text-sm" style={{ color: 'var(--text-faint)' }}>
+            {t('admin.addons.noAddons')}
+          </div>
+        ) : (
+          <div>
+            {/* Trip Addons */}
+            {tripAddons.length > 0 && (
+              <div>
+                <div className="px-6 py-2.5 border-b flex items-center gap-2" style={{ background: 'var(--bg-secondary)', borderColor: 'var(--border-secondary)' }}>
+                  <Briefcase size={13} style={{ color: 'var(--text-muted)' }} />
+                  <span className="text-xs font-medium uppercase tracking-wider" style={{ color: 'var(--text-muted)' }}>
+                    {t('admin.addons.type.trip')} — {t('admin.addons.tripHint')}
+                  </span>
+                </div>
+                {tripAddons.map(addon => (
+                  <AddonRow key={addon.id} addon={addon} onToggle={handleToggle} t={t} />
+                ))}
+              </div>
+            )}
+
+            {/* Global Addons */}
+            {globalAddons.length > 0 && (
+              <div>
+                <div className="px-6 py-2.5 border-b border-t flex items-center gap-2" style={{ background: 'var(--bg-secondary)', borderColor: 'var(--border-secondary)' }}>
+                  <Globe size={13} style={{ color: 'var(--text-muted)' }} />
+                  <span className="text-xs font-medium uppercase tracking-wider" style={{ color: 'var(--text-muted)' }}>
+                    {t('admin.addons.type.global')} — {t('admin.addons.globalHint')}
+                  </span>
+                </div>
+                {globalAddons.map(addon => (
+                  <AddonRow key={addon.id} addon={addon} onToggle={handleToggle} t={t} />
+                ))}
+              </div>
+            )}
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}
+
+function AddonRow({ addon, onToggle, t }) {
+  return (
+    <div className="flex items-center gap-4 px-6 py-4 border-b transition-colors hover:opacity-95" style={{ borderColor: 'var(--border-secondary)' }}>
+      {/* Icon */}
+      <div className="w-10 h-10 rounded-xl flex items-center justify-center shrink-0" style={{ background: 'var(--bg-secondary)', color: 'var(--text-primary)' }}>
+        <AddonIcon name={addon.icon} size={20} />
+      </div>
+
+      {/* Info */}
+      <div className="flex-1 min-w-0">
+        <div className="flex items-center gap-2">
+          <span className="text-sm font-semibold" style={{ color: 'var(--text-primary)' }}>{addon.name}</span>
+          <span className="text-[10px] font-medium px-1.5 py-0.5 rounded-full" style={{
+            background: addon.type === 'global' ? 'var(--bg-secondary)' : 'var(--bg-secondary)',
+            color: 'var(--text-muted)',
+          }}>
+            {addon.type === 'global' ? t('admin.addons.type.global') : t('admin.addons.type.trip')}
+          </span>
+        </div>
+        <p className="text-xs mt-0.5" style={{ color: 'var(--text-muted)' }}>{addon.description}</p>
+      </div>
+
+      {/* Toggle */}
+      <div className="flex items-center gap-2 shrink-0">
+        <span className="text-xs font-medium" style={{ color: addon.enabled ? 'var(--text-primary)' : 'var(--text-faint)' }}>
+          {addon.enabled ? t('admin.addons.enabled') : t('admin.addons.disabled')}
+        </span>
+        <button
+          onClick={() => onToggle(addon)}
+          className="relative inline-flex h-6 w-11 items-center rounded-full transition-colors"
+          style={{ background: addon.enabled ? 'var(--text-primary)' : 'var(--border-primary)' }}
+        >
+          <span
+            className="inline-block h-4 w-4 transform rounded-full transition-transform"
+            style={{
+              background: addon.enabled ? 'var(--bg-card)' : 'var(--bg-card)',
+              transform: addon.enabled ? 'translateX(22px)' : 'translateX(4px)',
+            }}
+          />
+        </button>
+      </div>
+    </div>
+  )
+}

client/src/components/Admin/BackupPanel.jsx

@@ -1,7 +1,7 @@
 import React, { useState, useEffect, useRef } from 'react'
 import { backupApi } from '../../api/client'
 import { useToast } from '../shared/Toast'
-import { Download, Trash2, Plus, RefreshCw, RotateCcw, Upload, Clock, Check, HardDrive } from 'lucide-react'
+import { Download, Trash2, Plus, RefreshCw, RotateCcw, Upload, Clock, Check, HardDrive, AlertTriangle } from 'lucide-react'
 import { useTranslation } from '../../i18n'
 
 const INTERVAL_OPTIONS = [
@@ -29,9 +29,10 @@ export default function BackupPanel() {
   const [autoSettings, setAutoSettings] = useState({ enabled: false, interval: 'daily', keep_days: 7 })
   const [autoSettingsSaving, setAutoSettingsSaving] = useState(false)
   const [autoSettingsDirty, setAutoSettingsDirty] = useState(false)
+  const [restoreConfirm, setRestoreConfirm] = useState(null) // { type: 'file'|'upload', filename, file? }
   const fileInputRef = useRef(null)
   const toast = useToast()
-  const { t, locale } = useTranslation()
+  const { t, language, locale } = useTranslation()
 
   const loadBackups = async () => {
     setIsLoading(true)
@@ -67,32 +68,42 @@ export default function BackupPanel() {
     }
   }
 
-  const handleRestore = async (filename) => {
-    if (!confirm(t('backup.confirm.restore', { name: filename }))) return
-    setRestoringFile(filename)
-    try {
-      await backupApi.restore(filename)
-      toast.success(t('backup.toast.restored'))
-      setTimeout(() => window.location.reload(), 1500)
-    } catch (err) {
-      toast.error(err.response?.data?.error || t('backup.toast.restoreError'))
-      setRestoringFile(null)
-    }
+  const handleRestore = (filename) => {
+    setRestoreConfirm({ type: 'file', filename })
   }
 
-  const handleUploadRestore = async (e) => {
+  const handleUploadRestore = (e) => {
     const file = e.target.files?.[0]
     if (!file) return
     e.target.value = ''
-    if (!confirm(t('backup.confirm.uploadRestore', { name: file.name }))) return
-    setIsUploading(true)
-    try {
-      await backupApi.uploadRestore(file)
-      toast.success(t('backup.toast.restored'))
-      setTimeout(() => window.location.reload(), 1500)
-    } catch (err) {
-      toast.error(err.response?.data?.error || t('backup.toast.uploadError'))
-      setIsUploading(false)
+    setRestoreConfirm({ type: 'upload', filename: file.name, file })
+  }
+
+  const executeRestore = async () => {
+    if (!restoreConfirm) return
+    const { type, filename, file } = restoreConfirm
+    setRestoreConfirm(null)
+
+    if (type === 'file') {
+      setRestoringFile(filename)
+      try {
+        await backupApi.restore(filename)
+        toast.success(t('backup.toast.restored'))
+        setTimeout(() => window.location.reload(), 1500)
+      } catch (err) {
+        toast.error(err.response?.data?.error || t('backup.toast.restoreError'))
+        setRestoringFile(null)
+      }
+    } else {
+      setIsUploading(true)
+      try {
+        await backupApi.uploadRestore(file)
+        toast.success(t('backup.toast.restored'))
+        setTimeout(() => window.location.reload(), 1500)
+      } catch (err) {
+        toast.error(err.response?.data?.error || t('backup.toast.uploadError'))
+        setIsUploading(false)
+      }
     }
   }
 
@@ -153,8 +164,8 @@ export default function BackupPanel() {
           <div className="flex items-center gap-3">
             <HardDrive className="w-5 h-5 text-gray-400" />
             <div>
-              <h2 className="text-lg font-semibold text-gray-900">{t('backup.title')}</h2>
-              <p className="text-sm text-gray-500 mt-0.5">{t('backup.subtitle')}</p>
+              <h2 className="font-semibold" style={{ color: 'var(--text-primary)' }}>{t('backup.title')}</h2>
+              <p className="text-xs mt-1" style={{ color: 'var(--text-muted)' }}>{t('backup.subtitle')}</p>
             </div>
           </div>
           <div className="flex items-center gap-2">
@@ -179,26 +190,28 @@ export default function BackupPanel() {
               onClick={() => fileInputRef.current?.click()}
               disabled={isUploading}
               className="flex items-center gap-2 border border-gray-200 text-gray-700 px-3 py-2 rounded-lg hover:bg-gray-50 text-sm font-medium disabled:opacity-60"
+              title={isUploading ? t('backup.uploading') : t('backup.upload')}
             >
               {isUploading ? (
                 <div className="w-4 h-4 border-2 border-gray-400 border-t-transparent rounded-full animate-spin" />
               ) : (
                 <Upload className="w-4 h-4" />
               )}
-              {isUploading ? t('backup.uploading') : t('backup.upload')}
+              <span className="hidden sm:inline">{isUploading ? t('backup.uploading') : t('backup.upload')}</span>
             </button>
 
             <button
               onClick={handleCreate}
               disabled={isCreating}
-              className="flex items-center gap-2 bg-slate-700 text-white px-4 py-2 rounded-lg hover:bg-slate-900 text-sm font-medium disabled:opacity-60"
+              className="flex items-center gap-2 bg-slate-900 dark:bg-slate-100 text-white dark:text-slate-900 px-3 sm:px-4 py-2 rounded-lg hover:bg-slate-900 text-sm font-medium disabled:opacity-60"
+              title={isCreating ? t('backup.creating') : t('backup.create')}
             >
               {isCreating ? (
                 <div className="w-4 h-4 border-2 border-white border-t-transparent rounded-full animate-spin" />
               ) : (
                 <Plus className="w-4 h-4" />
               )}
-              {isCreating ? t('backup.creating') : t('backup.create')}
+              <span className="hidden sm:inline">{isCreating ? t('backup.creating') : t('backup.create')}</span>
             </button>
           </div>
         </div>
@@ -275,23 +288,23 @@ export default function BackupPanel() {
         <div className="flex items-center gap-3 mb-6">
           <Clock className="w-5 h-5 text-gray-400" />
           <div>
-            <h2 className="text-lg font-semibold text-gray-900">{t('backup.auto.title')}</h2>
-            <p className="text-sm text-gray-500 mt-0.5">{t('backup.auto.subtitle')}</p>
+            <h2 className="font-semibold" style={{ color: 'var(--text-primary)' }}>{t('backup.auto.title')}</h2>
+            <p className="text-xs mt-1" style={{ color: 'var(--text-muted)' }}>{t('backup.auto.subtitle')}</p>
           </div>
         </div>
 
         <div className="flex flex-col gap-5">
           {/* Enable toggle */}
-          <label className="flex items-center justify-between cursor-pointer">
-            <div>
+          <label className="flex items-center justify-between gap-4 cursor-pointer">
+            <div className="min-w-0">
               <span className="text-sm font-medium text-gray-900">{t('backup.auto.enable')}</span>
               <p className="text-xs text-gray-500 mt-0.5">{t('backup.auto.enableHint')}</p>
             </div>
             <button
               onClick={() => handleAutoSettingsChange('enabled', !autoSettings.enabled)}
-              className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors ${autoSettings.enabled ? 'bg-slate-700' : 'bg-gray-200'}`}
+              className={`relative shrink-0 inline-flex h-6 w-11 items-center rounded-full transition-colors ${autoSettings.enabled ? 'bg-slate-900 dark:bg-slate-100' : 'bg-gray-200 dark:bg-gray-600'}`}
             >
-              <span className={`inline-block h-4 w-4 transform rounded-full bg-white shadow transition-transform ${autoSettings.enabled ? 'translate-x-6' : 'translate-x-1'}`} />
+              <span className={`absolute left-1 h-4 w-4 rounded-full bg-white shadow transition-transform duration-200 ${autoSettings.enabled ? 'translate-x-5' : 'translate-x-0'}`} />
             </button>
           </label>
 
@@ -307,7 +320,7 @@ export default function BackupPanel() {
                       onClick={() => handleAutoSettingsChange('interval', opt.value)}
                       className={`px-4 py-2 rounded-lg text-sm font-medium border transition-colors ${
                         autoSettings.interval === opt.value
-                          ? 'bg-slate-700 text-white border-slate-700'
+                          ? 'bg-slate-900 dark:bg-slate-100 text-white dark:text-slate-900 border-slate-700'
                           : 'bg-white text-gray-600 border-gray-200 hover:border-gray-300'
                       }`}
                     >
@@ -327,7 +340,7 @@ export default function BackupPanel() {
                       onClick={() => handleAutoSettingsChange('keep_days', opt.value)}
                       className={`px-4 py-2 rounded-lg text-sm font-medium border transition-colors ${
                         autoSettings.keep_days === opt.value
-                          ? 'bg-slate-700 text-white border-slate-700'
+                          ? 'bg-slate-900 dark:bg-slate-100 text-white dark:text-slate-900 border-slate-700'
                           : 'bg-white text-gray-600 border-gray-200 hover:border-gray-300'
                       }`}
                     >
@@ -344,7 +357,7 @@ export default function BackupPanel() {
             <button
               onClick={handleSaveAutoSettings}
               disabled={autoSettingsSaving || !autoSettingsDirty}
-              className="flex items-center gap-2 bg-slate-700 text-white px-5 py-2 rounded-lg hover:bg-slate-900 text-sm font-medium disabled:opacity-50 transition-colors"
+              className="flex items-center gap-2 bg-slate-900 dark:bg-slate-100 text-white dark:text-slate-900 px-5 py-2 rounded-lg hover:bg-slate-900 text-sm font-medium disabled:opacity-50 transition-colors"
             >
               {autoSettingsSaving
                 ? <div className="w-4 h-4 border-2 border-white border-t-transparent rounded-full animate-spin" />
@@ -355,6 +368,71 @@ export default function BackupPanel() {
           </div>
         </div>
       </div>
+
+      {/* Restore Warning Modal */}
+      {restoreConfirm && (
+        <div
+          style={{ position: 'fixed', inset: 0, zIndex: 9999, background: 'rgba(0,0,0,0.5)', backdropFilter: 'blur(4px)', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
+          onClick={() => setRestoreConfirm(null)}
+        >
+          <div
+            onClick={e => e.stopPropagation()}
+            style={{ width: '100%', maxWidth: 440, borderRadius: 16, overflow: 'hidden' }}
+            className="bg-white dark:bg-gray-800 border border-gray-200 dark:border-gray-700"
+          >
+            {/* Red header */}
+            <div style={{ background: 'linear-gradient(135deg, #dc2626, #b91c1c)', padding: '20px 24px', display: 'flex', alignItems: 'center', gap: 12 }}>
+              <div style={{ width: 40, height: 40, borderRadius: 10, background: 'rgba(255,255,255,0.2)', display: 'flex', alignItems: 'center', justifyContent: 'center', flexShrink: 0 }}>
+                <AlertTriangle size={20} style={{ color: 'white' }} />
+              </div>
+              <div>
+                <h3 style={{ margin: 0, fontSize: 16, fontWeight: 700, color: 'white' }}>
+                  {language === 'de' ? 'Backup wiederherstellen?' : 'Restore Backup?'}
+                </h3>
+                <p style={{ margin: '2px 0 0', fontSize: 12, color: 'rgba(255,255,255,0.8)' }}>
+                  {restoreConfirm.filename}
+                </p>
+              </div>
+            </div>
+
+            {/* Body */}
+            <div style={{ padding: '20px 24px' }}>
+              <p className="text-gray-700 dark:text-gray-300" style={{ fontSize: 13, lineHeight: 1.6, margin: 0 }}>
+                {language === 'de'
+                  ? 'Alle aktuellen Daten (Reisen, Orte, Benutzer, Uploads) werden unwiderruflich durch das Backup ersetzt. Dieser Vorgang kann nicht rückgängig gemacht werden.'
+                  : 'All current data (trips, places, users, uploads) will be permanently replaced by the backup. This action cannot be undone.'}
+              </p>
+
+              <div style={{ marginTop: 14, padding: '10px 12px', borderRadius: 10, fontSize: 12, lineHeight: 1.5 }}
+                className="bg-red-50 dark:bg-red-900/30 text-red-700 dark:text-red-300 border border-red-200 dark:border-red-800"
+              >
+                {language === 'de'
+                  ? 'Tipp: Erstelle zuerst ein Backup des aktuellen Stands, bevor du wiederherstellst.'
+                  : 'Tip: Create a backup of the current state before restoring.'}
+              </div>
+            </div>
+
+            {/* Footer */}
+            <div style={{ padding: '0 24px 20px', display: 'flex', gap: 10, justifyContent: 'flex-end' }}>
+              <button
+                onClick={() => setRestoreConfirm(null)}
+                className="text-gray-600 dark:text-gray-400 hover:bg-gray-100 dark:hover:bg-gray-700"
+                style={{ padding: '9px 20px', borderRadius: 10, fontSize: 13, fontWeight: 600, border: 'none', cursor: 'pointer', fontFamily: 'inherit' }}
+              >
+                {language === 'de' ? 'Abbrechen' : 'Cancel'}
+              </button>
+              <button
+                onClick={executeRestore}
+                style={{ padding: '9px 20px', borderRadius: 10, fontSize: 13, fontWeight: 600, border: 'none', cursor: 'pointer', fontFamily: 'inherit', background: '#dc2626', color: 'white' }}
+                onMouseEnter={e => e.currentTarget.style.background = '#b91c1c'}
+                onMouseLeave={e => e.currentTarget.style.background = '#dc2626'}
+              >
+                {language === 'de' ? 'Ja, wiederherstellen' : 'Yes, restore'}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
     </div>
   )
 }

client/src/components/Admin/CategoryManager.jsx

@@ -190,13 +190,14 @@ export default function CategoryManager() {
     <div className="bg-white rounded-2xl border border-gray-200 p-6">
       <div className="flex items-center justify-between mb-6">
         <div>
-          <h2 className="text-lg font-semibold text-gray-900">{t('categories.title')}</h2>
-          <p className="text-sm text-gray-500 mt-0.5">{t('categories.subtitle')}</p>
+          <h2 className="font-semibold" style={{ color: 'var(--text-primary)' }}>{t('categories.title')}</h2>
+          <p className="text-xs mt-1" style={{ color: 'var(--text-muted)' }}>{t('categories.subtitle')}</p>
         </div>
         <button onClick={handleStartCreate}
-          className="flex items-center gap-2 bg-slate-900 text-white px-4 py-2 rounded-lg hover:bg-slate-700 text-sm font-medium">
+          className="flex items-center gap-2 bg-slate-900 text-white px-3 sm:px-4 py-2 rounded-lg hover:bg-slate-700 text-sm font-medium">
           <Plus className="w-4 h-4" />
-          {t('categories.new')}
+          <span className="hidden sm:inline">{t('categories.new')}</span>
+          <span className="sm:hidden">Add</span>
         </button>
       </div>
 

client/src/components/Budget/BudgetPanel.jsx

@@ -190,7 +190,7 @@ export default function BudgetPanel({ tripId }) {
   const handleAddCategory = () => {
     if (!newCategoryName.trim()) return
     addBudgetItem(tripId, { name: t('budget.defaultEntry'), category: newCategoryName.trim(), total_price: 0 })
-    setNewCategoryName(''); setShowAddCategory(false)
+    setNewCategoryName('')
   }
 
   const th = { padding: '6px 8px', textAlign: 'center', fontSize: 11, fontWeight: 600, color: 'var(--text-muted)', textTransform: 'uppercase', letterSpacing: '0.05em', borderBottom: '2px solid var(--border-primary)', whiteSpace: 'nowrap', background: 'var(--bg-secondary)' }

client/src/components/Dashboard/CurrencyWidget.jsx

@@ -0,0 +1,89 @@
+import React, { useState, useEffect, useCallback } from 'react'
+import { ArrowRightLeft, RefreshCw } from 'lucide-react'
+import { useTranslation } from '../../i18n'
+import CustomSelect from '../shared/CustomSelect'
+
+const CURRENCIES = [
+  'EUR','USD','GBP','JPY','CHF','CAD','AUD','NZD','CNY','HKD',
+  'SGD','THB','TRY','SEK','NOK','DKK','PLN','CZK','HUF','RON',
+  'BGN','HRK','ISK','RUB','UAH','BRL','MXN','ARS','CLP','COP',
+  'INR','IDR','MYR','PHP','KRW','TWD','VND','ZAR','EGP','MAD',
+  'NGN','KES','AED','SAR','QAR','KWD','BHD','OMR','ILS',
+]
+
+const CURRENCY_OPTIONS = CURRENCIES.map(c => ({ value: c, label: c }))
+
+export default function CurrencyWidget() {
+  const { t } = useTranslation()
+  const [from, setFrom] = useState(() => localStorage.getItem('currency_from') || 'EUR')
+  const [to, setTo] = useState(() => localStorage.getItem('currency_to') || 'USD')
+  const [amount, setAmount] = useState('100')
+  const [rate, setRate] = useState(null)
+  const [loading, setLoading] = useState(false)
+
+  const fetchRate = useCallback(async () => {
+    if (from === to) { setRate(1); return }
+    setLoading(true)
+    try {
+      const resp = await fetch(`https://api.exchangerate-api.com/v4/latest/${from}`)
+      const data = await resp.json()
+      setRate(data.rates?.[to] || null)
+    } catch { setRate(null) }
+    finally { setLoading(false) }
+  }, [from, to])
+
+  useEffect(() => { fetchRate() }, [fetchRate])
+  useEffect(() => { localStorage.setItem('currency_from', from) }, [from])
+  useEffect(() => { localStorage.setItem('currency_to', to) }, [to])
+
+  const swap = () => { setFrom(to); setTo(from) }
+  const rawResult = rate && amount ? (parseFloat(amount) * rate).toFixed(2) : null
+  const formatNumber = (num) => {
+    if (!num || num === '—') return '—'
+    return parseFloat(num).toLocaleString('de-DE', { minimumFractionDigits: 2, maximumFractionDigits: 2 })
+  }
+  const result = rawResult
+
+  return (
+    <div className="rounded-2xl border p-4" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
+      <div className="flex items-center justify-between mb-3">
+        <span className="text-xs font-semibold uppercase tracking-wide" style={{ color: 'var(--text-faint)' }}>{t('dashboard.currency')}</span>
+        <button onClick={fetchRate} className="p-1 rounded-md transition-colors" style={{ color: 'var(--text-faint)' }}>
+          <RefreshCw size={12} className={loading ? 'animate-spin' : ''} />
+        </button>
+      </div>
+
+      {/* Amount */}
+      <div className="rounded-xl px-4 py-3 mb-3" style={{ background: 'var(--bg-secondary)', border: '1px solid var(--border-primary)' }}>
+        <input
+          type="number"
+          value={amount}
+          onChange={e => setAmount(e.target.value)}
+          className="w-full text-2xl font-black tabular-nums outline-none [appearance:textfield] [&::-webkit-inner-spin-button]:appearance-none"
+          style={{ color: 'var(--text-primary)', background: 'transparent', border: 'none' }}
+        />
+      </div>
+
+      {/* From / Swap / To */}
+      <div className="flex items-center gap-2 mb-3">
+        <div className="flex-1" style={{ '--bg-input': 'transparent', '--border-primary': 'transparent' }}>
+          <CustomSelect value={from} onChange={setFrom} options={CURRENCY_OPTIONS} searchable size="sm" />
+        </div>
+        <button onClick={swap} className="p-1.5 rounded-lg shrink-0 transition-colors" style={{ color: 'var(--text-muted)' }}>
+          <ArrowRightLeft size={13} />
+        </button>
+        <div className="flex-1" style={{ '--bg-input': 'transparent', '--border-primary': 'transparent' }}>
+          <CustomSelect value={to} onChange={setTo} options={CURRENCY_OPTIONS} searchable size="sm" />
+        </div>
+      </div>
+
+      {/* Result */}
+      <div className="rounded-xl p-3" style={{ background: 'var(--bg-secondary)' }}>
+        <p className="text-xl font-black tabular-nums" style={{ color: 'var(--text-primary)' }}>
+          {formatNumber(result)} <span className="text-sm font-semibold" style={{ color: 'var(--text-muted)' }}>{to}</span>
+        </p>
+        {rate && <p className="text-[10px] mt-0.5" style={{ color: 'var(--text-faint)' }}>1 {from} = {rate.toFixed(4)} {to}</p>}
+      </div>
+    </div>
+  )
+}

client/src/components/Dashboard/TimezoneWidget.jsx

@@ -0,0 +1,126 @@
+import React, { useState, useEffect } from 'react'
+import { Clock, Plus, X } from 'lucide-react'
+import { useTranslation } from '../../i18n'
+
+const POPULAR_ZONES = [
+  { label: 'New York', tz: 'America/New_York' },
+  { label: 'London', tz: 'Europe/London' },
+  { label: 'Berlin', tz: 'Europe/Berlin' },
+  { label: 'Paris', tz: 'Europe/Paris' },
+  { label: 'Dubai', tz: 'Asia/Dubai' },
+  { label: 'Mumbai', tz: 'Asia/Kolkata' },
+  { label: 'Bangkok', tz: 'Asia/Bangkok' },
+  { label: 'Tokyo', tz: 'Asia/Tokyo' },
+  { label: 'Sydney', tz: 'Australia/Sydney' },
+  { label: 'Los Angeles', tz: 'America/Los_Angeles' },
+  { label: 'Chicago', tz: 'America/Chicago' },
+  { label: 'São Paulo', tz: 'America/Sao_Paulo' },
+  { label: 'Istanbul', tz: 'Europe/Istanbul' },
+  { label: 'Singapore', tz: 'Asia/Singapore' },
+  { label: 'Hong Kong', tz: 'Asia/Hong_Kong' },
+  { label: 'Seoul', tz: 'Asia/Seoul' },
+  { label: 'Moscow', tz: 'Europe/Moscow' },
+  { label: 'Cairo', tz: 'Africa/Cairo' },
+]
+
+function getTime(tz) {
+  try {
+    return new Date().toLocaleTimeString('de-DE', { timeZone: tz, hour: '2-digit', minute: '2-digit' })
+  } catch { return '—' }
+}
+
+function getOffset(tz) {
+  try {
+    const now = new Date()
+    const local = new Date(now.toLocaleString('en-US', { timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone }))
+    const remote = new Date(now.toLocaleString('en-US', { timeZone: tz }))
+    const diff = (remote - local) / 3600000
+    const sign = diff >= 0 ? '+' : ''
+    return `${sign}${diff}h`
+  } catch { return '' }
+}
+
+export default function TimezoneWidget() {
+  const { t } = useTranslation()
+  const [zones, setZones] = useState(() => {
+    const saved = localStorage.getItem('dashboard_timezones')
+    return saved ? JSON.parse(saved) : [
+      { label: 'New York', tz: 'America/New_York' },
+      { label: 'Tokyo', tz: 'Asia/Tokyo' },
+    ]
+  })
+  const [now, setNow] = useState(Date.now())
+  const [showAdd, setShowAdd] = useState(false)
+
+  useEffect(() => {
+    const i = setInterval(() => setNow(Date.now()), 10000)
+    return () => clearInterval(i)
+  }, [])
+
+  useEffect(() => {
+    localStorage.setItem('dashboard_timezones', JSON.stringify(zones))
+  }, [zones])
+
+  const addZone = (zone) => {
+    if (!zones.find(z => z.tz === zone.tz)) {
+      setZones([...zones, zone])
+    }
+    setShowAdd(false)
+  }
+
+  const removeZone = (tz) => setZones(zones.filter(z => z.tz !== tz))
+
+  const localTime = new Date().toLocaleTimeString('de-DE', { hour: '2-digit', minute: '2-digit' })
+  const rawZone = Intl.DateTimeFormat().resolvedOptions().timeZone
+  const localZone = rawZone.split('/').pop().replace(/_/g, ' ')
+  // Show abbreviated timezone name (e.g. CET, CEST, EST)
+  const tzAbbr = new Date().toLocaleTimeString('en-US', { timeZoneName: 'short' }).split(' ').pop()
+
+  return (
+    <div className="rounded-2xl border p-4" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
+      <div className="flex items-center justify-between mb-3">
+        <span className="text-xs font-semibold uppercase tracking-wide" style={{ color: 'var(--text-faint)' }}>{t('dashboard.timezone')}</span>
+        <button onClick={() => setShowAdd(!showAdd)} className="p-1 rounded-md transition-colors" style={{ color: 'var(--text-faint)' }}>
+          <Plus size={12} />
+        </button>
+      </div>
+
+      {/* Local time */}
+      <div className="mb-3 pb-3" style={{ borderBottom: '1px solid var(--border-secondary)' }}>
+        <p className="text-2xl font-black tabular-nums" style={{ color: 'var(--text-primary)' }}>{localTime}</p>
+        <p className="text-[10px] font-semibold uppercase tracking-wide" style={{ color: 'var(--text-faint)' }}>{localZone} ({tzAbbr}) · {t('dashboard.localTime')}</p>
+      </div>
+
+      {/* Zone list */}
+      <div className="space-y-2">
+        {zones.map(z => (
+          <div key={z.tz} className="flex items-center justify-between group">
+            <div>
+              <p className="text-lg font-bold tabular-nums" style={{ color: 'var(--text-primary)' }}>{getTime(z.tz)}</p>
+              <p className="text-[10px]" style={{ color: 'var(--text-faint)' }}>{z.label} <span style={{ color: 'var(--text-muted)' }}>{getOffset(z.tz)}</span></p>
+            </div>
+            <button onClick={() => removeZone(z.tz)} className="opacity-0 group-hover:opacity-100 p-1 rounded transition-all" style={{ color: 'var(--text-faint)' }}>
+              <X size={11} />
+            </button>
+          </div>
+        ))}
+      </div>
+
+      {/* Add zone dropdown */}
+      {showAdd && (
+        <div className="mt-2 rounded-xl p-2 max-h-[200px] overflow-auto" style={{ background: 'var(--bg-secondary)' }}>
+          {POPULAR_ZONES.filter(z => !zones.find(existing => existing.tz === z.tz)).map(z => (
+            <button key={z.tz} onClick={() => addZone(z)}
+              className="w-full flex items-center justify-between px-2 py-1.5 rounded-lg text-xs text-left transition-colors"
+              style={{ color: 'var(--text-primary)' }}
+              onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+              onMouseLeave={e => e.currentTarget.style.background = 'transparent'}>
+              <span className="font-medium">{z.label}</span>
+              <span className="text-[10px]" style={{ color: 'var(--text-faint)' }}>{getTime(z.tz)}</span>
+            </button>
+          ))}
+        </div>
+      )}
+    </div>
+  )
+}

client/src/components/Dashboard/TravelStats.jsx

@@ -5,7 +5,7 @@ import { useTranslation } from '../../i18n'
 import { useSettingsStore } from '../../store/settingsStore'
 
 // Numeric ISO → country name lookup (countries-110m uses numeric IDs)
-const NUMERIC_TO_NAME = {"004":"Afghanistan","008":"Albania","012":"Algeria","024":"Angola","032":"Argentina","036":"Australia","040":"Austria","050":"Bangladesh","056":"Belgium","064":"Bhutan","068":"Bolivia","070":"Bosnia and Herzegovina","072":"Botswana","076":"Brazil","100":"Bulgaria","104":"Myanmar","108":"Burundi","112":"Belarus","116":"Cambodia","120":"Cameroon","124":"Canada","140":"Central African Republic","144":"Sri Lanka","148":"Chad","152":"Chile","156":"China","170":"Colombia","178":"Congo","180":"Democratic Republic of the Congo","188":"Costa Rica","191":"Croatia","192":"Cuba","196":"Cyprus","203":"Czech Republic","204":"Benin","208":"Denmark","214":"Dominican Republic","218":"Ecuador","818":"Egypt","222":"El Salvador","226":"Equatorial Guinea","232":"Eritrea","233":"Estonia","231":"Ethiopia","238":"Falkland Islands","246":"Finland","250":"France","266":"Gabon","270":"Gambia","268":"Georgia","276":"Germany","288":"Ghana","300":"Greece","320":"Guatemala","324":"Guinea","328":"Guyana","332":"Haiti","340":"Honduras","348":"Hungary","352":"Iceland","356":"India","360":"Indonesia","364":"Iran","368":"Iraq","372":"Ireland","376":"Israel","380":"Italy","384":"Ivory Coast","388":"Jamaica","392":"Japan","400":"Jordan","398":"Kazakhstan","404":"Kenya","408":"North Korea","410":"South Korea","414":"Kuwait","417":"Kyrgyzstan","418":"Laos","422":"Lebanon","426":"Lesotho","430":"Liberia","434":"Libya","440":"Lithuania","442":"Luxembourg","450":"Madagascar","454":"Malawi","458":"Malaysia","466":"Mali","478":"Mauritania","484":"Mexico","496":"Mongolia","498":"Moldova","504":"Morocco","508":"Mozambique","516":"Namibia","524":"Nepal","528":"Netherlands","540":"New Caledonia","554":"New Zealand","558":"Nicaragua","562":"Niger","566":"Nigeria","578":"Norway","512":"Oman","586":"Pakistan","591":"Panama","598":"Papua New Guinea","600":"Paraguay","604":"Peru","608":"Philippines","616":"Poland","620":"Portugal","630":"Puerto Rico","634":"Qatar","642":"Romania","643":"Russia","646":"Rwanda","682":"Saudi Arabia","686":"Senegal","688":"Serbia","694":"Sierra Leone","703":"Slovakia","705":"Slovenia","706":"Somalia","710":"South Africa","724":"Spain","144":"Sri Lanka","729":"Sudan","740":"Suriname","748":"Swaziland","752":"Sweden","756":"Switzerland","760":"Syria","762":"Tajikistan","764":"Thailand","768":"Togo","780":"Trinidad and Tobago","788":"Tunisia","792":"Turkey","795":"Turkmenistan","800":"Uganda","804":"Ukraine","784":"United Arab Emirates","826":"United Kingdom","840":"United States of America","858":"Uruguay","860":"Uzbekistan","862":"Venezuela","704":"Vietnam","887":"Yemen","894":"Zambia","716":"Zimbabwe"}
+const NUMERIC_TO_NAME = {"004":"Afghanistan","008":"Albania","012":"Algeria","024":"Angola","032":"Argentina","036":"Australia","040":"Austria","050":"Bangladesh","056":"Belgium","064":"Bhutan","068":"Bolivia","070":"Bosnia and Herzegovina","072":"Botswana","076":"Brazil","100":"Bulgaria","104":"Myanmar","108":"Burundi","112":"Belarus","116":"Cambodia","120":"Cameroon","124":"Canada","140":"Central African Republic","144":"Sri Lanka","148":"Chad","152":"Chile","156":"China","170":"Colombia","178":"Congo","180":"Democratic Republic of the Congo","188":"Costa Rica","191":"Croatia","192":"Cuba","196":"Cyprus","203":"Czech Republic","204":"Benin","208":"Denmark","214":"Dominican Republic","218":"Ecuador","818":"Egypt","222":"El Salvador","226":"Equatorial Guinea","232":"Eritrea","233":"Estonia","231":"Ethiopia","238":"Falkland Islands","246":"Finland","250":"France","266":"Gabon","270":"Gambia","268":"Georgia","276":"Germany","288":"Ghana","300":"Greece","320":"Guatemala","324":"Guinea","328":"Guyana","332":"Haiti","340":"Honduras","348":"Hungary","352":"Iceland","356":"India","360":"Indonesia","364":"Iran","368":"Iraq","372":"Ireland","376":"Israel","380":"Italy","384":"Ivory Coast","388":"Jamaica","392":"Japan","400":"Jordan","398":"Kazakhstan","404":"Kenya","408":"North Korea","410":"South Korea","414":"Kuwait","417":"Kyrgyzstan","418":"Laos","422":"Lebanon","426":"Lesotho","430":"Liberia","434":"Libya","440":"Lithuania","442":"Luxembourg","450":"Madagascar","454":"Malawi","458":"Malaysia","466":"Mali","478":"Mauritania","484":"Mexico","496":"Mongolia","498":"Moldova","504":"Morocco","508":"Mozambique","516":"Namibia","524":"Nepal","528":"Netherlands","540":"New Caledonia","554":"New Zealand","558":"Nicaragua","562":"Niger","566":"Nigeria","578":"Norway","512":"Oman","586":"Pakistan","591":"Panama","598":"Papua New Guinea","600":"Paraguay","604":"Peru","608":"Philippines","616":"Poland","620":"Portugal","630":"Puerto Rico","634":"Qatar","642":"Romania","643":"Russia","646":"Rwanda","682":"Saudi Arabia","686":"Senegal","688":"Serbia","694":"Sierra Leone","703":"Slovakia","705":"Slovenia","706":"Somalia","710":"South Africa","724":"Spain","729":"Sudan","740":"Suriname","748":"Swaziland","752":"Sweden","756":"Switzerland","760":"Syria","762":"Tajikistan","764":"Thailand","768":"Togo","780":"Trinidad and Tobago","788":"Tunisia","792":"Turkey","795":"Turkmenistan","800":"Uganda","804":"Ukraine","784":"United Arab Emirates","826":"United Kingdom","840":"United States of America","858":"Uruguay","860":"Uzbekistan","862":"Venezuela","704":"Vietnam","887":"Yemen","894":"Zambia","716":"Zimbabwe"}
 
 // Our country names from addresses → match against GeoJSON names
 function isCountryMatch(geoName, visitedCountries) {

client/src/components/Files/FileManager.jsx

@@ -1,4 +1,5 @@
 import React, { useState, useCallback } from 'react'
+import ReactDOM from 'react-dom'
 import { useDropzone } from 'react-dropzone'
 import { Upload, Trash2, ExternalLink, X, FileText, FileImage, File, MapPin, Ticket } from 'lucide-react'
 import { useToast } from '../shared/Toast'
@@ -68,10 +69,10 @@ function SourceBadge({ icon: Icon, label }) {
       fontSize: 10.5, color: '#4b5563',
       background: 'var(--bg-tertiary)', border: '1px solid var(--border-primary)',
       borderRadius: 6, padding: '2px 7px',
-      fontWeight: 500, whiteSpace: 'nowrap',
+      fontWeight: 500, maxWidth: '100%', overflow: 'hidden',
     }}>
       <Icon size={10} style={{ flexShrink: 0, color: 'var(--text-muted)' }} />
-      {label}
+      <span style={{ overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{label}</span>
     </span>
   )
 }
@@ -138,14 +139,14 @@ export default function FileManager({ files = [], onUpload, onDelete, onUpdate,
       {/* Lightbox */}
       {lightboxFile && <ImageLightbox file={lightboxFile} onClose={() => setLightboxFile(null)} />}
 
-      {/* Datei-Vorschau Modal */}
-      {previewFile && (
+      {/* Datei-Vorschau Modal — portal to body to escape stacking context */}
+      {previewFile && ReactDOM.createPortal(
         <div
-          style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.7)', zIndex: 2000, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 8 }}
+          style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.85)', zIndex: 10000, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
           onClick={() => setPreviewFile(null)}
         >
           <div
-            style={{ width: '100%', maxWidth: 950, height: '95vh', background: 'var(--bg-card)', borderRadius: 12, overflow: 'hidden', display: 'flex', flexDirection: 'column', boxShadow: '0 20px 60px rgba(0,0,0,0.3)' }}
+            style={{ width: '100%', maxWidth: 950, height: '94vh', background: 'var(--bg-card)', borderRadius: 12, overflow: 'hidden', display: 'flex', flexDirection: 'column', boxShadow: '0 20px 60px rgba(0,0,0,0.3)' }}
             onClick={e => e.stopPropagation()}
           >
             <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '10px 16px', borderBottom: '1px solid var(--border-primary)', flexShrink: 0 }}>
@@ -165,13 +166,19 @@ export default function FileManager({ files = [], onUpload, onDelete, onUpdate,
                 </button>
               </div>
             </div>
-            <iframe
-              src={`${previewFile.url || `/uploads/files/${previewFile.filename}`}#view=FitH`}
+            <object
+              data={`${previewFile.url || `/uploads/files/${previewFile.filename}`}#view=FitH`}
+              type="application/pdf"
               style={{ flex: 1, width: '100%', border: 'none' }}
               title={previewFile.original_name}
-            />
+            >
+              <p style={{ padding: 24, textAlign: 'center', color: 'var(--text-muted)' }}>
+                <a href={previewFile.url || `/uploads/files/${previewFile.filename}`} target="_blank" rel="noopener noreferrer" style={{ color: 'var(--text-primary)', textDecoration: 'underline' }}>PDF herunterladen</a>
+              </p>
+            </object>
           </div>
-        </div>
+        </div>,
+        document.body
       )}
 
       {/* Header */}

client/src/components/Layout/DemoBanner.jsx

@@ -0,0 +1,213 @@
+import React, { useState, useEffect } from 'react'
+import { Info, Github, Shield, Key, Users, Database, Upload, Clock, Puzzle, CalendarDays, Globe, ArrowRightLeft, Map, Briefcase, ListChecks, Wallet, FileText, Plane } from 'lucide-react'
+import { useTranslation } from '../../i18n'
+
+const texts = {
+  de: {
+    titleBefore: 'Willkommen bei ',
+    titleAfter: '',
+    title: 'Willkommen zur NOMAD Demo',
+    description: 'Du kannst Reisen ansehen, bearbeiten und eigene erstellen. Alle Aenderungen werden jede Stunde automatisch zurueckgesetzt.',
+    resetIn: 'Naechster Reset in',
+    minutes: 'Minuten',
+    uploadNote: 'Datei-Uploads (Fotos, Dokumente, Cover) sind in der Demo deaktiviert.',
+    fullVersionTitle: 'In der Vollversion zusaetzlich:',
+    features: [
+      'Datei-Uploads (Fotos, Dokumente, Cover)',
+      'API-Schluessel (Google Maps, Wetter)',
+      'Benutzer- & Rechteverwaltung',
+      'Automatische Backups',
+      'Addon-Verwaltung (aktivieren/deaktivieren)',
+      'OIDC / SSO Single Sign-On',
+    ],
+    addonsTitle: 'Modulare Addons (in der Vollversion deaktivierbar)',
+    addons: [
+      ['Vacay', 'Urlaubsplaner mit Kalender, Feiertagen & Fusion'],
+      ['Atlas', 'Weltkarte mit besuchten Laendern & Reisestatistiken'],
+      ['Packliste', 'Checklisten pro Reise'],
+      ['Budget', 'Kostenplanung mit Splitting'],
+      ['Dokumente', 'Dateien an Reisen anhaengen'],
+      ['Widgets', 'Waehrungsrechner & Zeitzonen'],
+    ],
+    whatIs: 'Was ist NOMAD?',
+    whatIsDesc: 'Ein selbst-gehosteter Reiseplaner mit Echtzeit-Kollaboration, interaktiver Karte, OIDC Login und Dark Mode.',
+    selfHost: 'Open Source — ',
+    selfHostLink: 'selbst hosten',
+    close: 'Verstanden',
+  },
+  en: {
+    titleBefore: 'Welcome to ',
+    titleAfter: '',
+    title: 'Welcome to the NOMAD Demo',
+    description: 'You can view, edit and create trips. All changes are automatically reset every hour.',
+    resetIn: 'Next reset in',
+    minutes: 'minutes',
+    uploadNote: 'File uploads (photos, documents, covers) are disabled in demo mode.',
+    fullVersionTitle: 'Additionally in the full version:',
+    features: [
+      'File uploads (photos, documents, covers)',
+      'API key management (Google Maps, Weather)',
+      'User & permission management',
+      'Automatic backups',
+      'Addon management (enable/disable)',
+      'OIDC / SSO single sign-on',
+    ],
+    addonsTitle: 'Modular Addons (can be deactivated in full version)',
+    addons: [
+      ['Vacay', 'Vacation planner with calendar, holidays & user fusion'],
+      ['Atlas', 'World map with visited countries & travel stats'],
+      ['Packing', 'Checklists per trip'],
+      ['Budget', 'Expense tracking with splitting'],
+      ['Documents', 'Attach files to trips'],
+      ['Widgets', 'Currency converter & timezones'],
+    ],
+    whatIs: 'What is NOMAD?',
+    whatIsDesc: 'A self-hosted travel planner with real-time collaboration, interactive maps, OIDC login and dark mode.',
+    selfHost: 'Open source — ',
+    selfHostLink: 'self-host it',
+    close: 'Got it',
+  },
+}
+
+const featureIcons = [Upload, Key, Users, Database, Puzzle, Shield]
+const addonIcons = [CalendarDays, Globe, ListChecks, Wallet, FileText, ArrowRightLeft]
+
+export default function DemoBanner() {
+  const [dismissed, setDismissed] = useState(false)
+  const [minutesLeft, setMinutesLeft] = useState(59 - new Date().getMinutes())
+  const { language } = useTranslation()
+  const t = texts[language] || texts.en
+
+  useEffect(() => {
+    const interval = setInterval(() => setMinutesLeft(59 - new Date().getMinutes()), 10000)
+    return () => clearInterval(interval)
+  }, [])
+
+  if (dismissed) return null
+
+  return (
+    <div style={{
+      position: 'fixed', inset: 0, zIndex: 9999,
+      background: 'rgba(0,0,0,0.6)', backdropFilter: 'blur(8px)',
+      display: 'flex', alignItems: 'center', justifyContent: 'center',
+      padding: 16, overflow: 'auto',
+      fontFamily: "-apple-system, BlinkMacSystemFont, 'SF Pro Text', system-ui, sans-serif",
+    }} onClick={() => setDismissed(true)}>
+      <div style={{
+        background: 'white', borderRadius: 20, padding: '28px 24px 20px',
+        maxWidth: 480, width: '100%',
+        boxShadow: '0 20px 60px rgba(0,0,0,0.3)',
+        maxHeight: '90vh', overflow: 'auto',
+      }} onClick={e => e.stopPropagation()}>
+
+        {/* Header */}
+        <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 14 }}>
+          <img src="/icons/icon-dark.svg" alt="" style={{ width: 36, height: 36, borderRadius: 10 }} />
+          <h2 style={{ margin: 0, fontSize: 17, fontWeight: 700, color: '#111827', display: 'flex', alignItems: 'center', gap: 5 }}>
+            {t.titleBefore}<img src="/text-dark.svg" alt="NOMAD" style={{ height: 18 }} />{t.titleAfter}
+          </h2>
+        </div>
+
+        <p style={{ fontSize: 13, color: '#6b7280', lineHeight: 1.6, margin: '0 0 12px' }}>
+          {t.description}
+        </p>
+
+        {/* Timer + Upload note */}
+        <div style={{ display: 'flex', gap: 8, marginBottom: 16 }}>
+          <div style={{
+            flex: 1, display: 'flex', alignItems: 'center', gap: 6,
+            background: '#f0f9ff', border: '1px solid #bae6fd', borderRadius: 10, padding: '8px 10px',
+          }}>
+            <Clock size={13} style={{ flexShrink: 0, color: '#0284c7' }} />
+            <span style={{ fontSize: 11, color: '#0369a1', fontWeight: 600 }}>
+              {t.resetIn} {minutesLeft} {t.minutes}
+            </span>
+          </div>
+          <div style={{
+            flex: 1, display: 'flex', alignItems: 'center', gap: 6,
+            background: '#fffbeb', border: '1px solid #fde68a', borderRadius: 10, padding: '8px 10px',
+          }}>
+            <Upload size={13} style={{ flexShrink: 0, color: '#b45309' }} />
+            <span style={{ fontSize: 11, color: '#b45309' }}>{t.uploadNote}</span>
+          </div>
+        </div>
+
+        {/* What is NOMAD */}
+        <div style={{
+          background: '#f8fafc', borderRadius: 12, padding: '12px 14px', marginBottom: 16,
+          border: '1px solid #e2e8f0',
+        }}>
+          <div style={{ display: 'flex', alignItems: 'center', gap: 8, marginBottom: 6 }}>
+            <Map size={14} style={{ color: '#111827' }} />
+            <span style={{ fontSize: 12, fontWeight: 700, color: '#111827', display: 'flex', alignItems: 'center', gap: 4 }}>
+              {language === 'de' ? 'Was ist ' : 'What is '}<img src="/text-dark.svg" alt="NOMAD" style={{ height: 13, marginRight: -2 }} />?
+            </span>
+          </div>
+          <p style={{ fontSize: 12, color: '#64748b', lineHeight: 1.5, margin: 0 }}>{t.whatIsDesc}</p>
+        </div>
+
+        {/* Addons */}
+        <p style={{ fontSize: 10, fontWeight: 700, color: '#374151', margin: '0 0 8px', textTransform: 'uppercase', letterSpacing: '0.08em', display: 'flex', alignItems: 'center', gap: 6 }}>
+          <Puzzle size={12} />
+          {t.addonsTitle}
+        </p>
+        <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 6, marginBottom: 16 }}>
+          {t.addons.map(([name, desc], i) => {
+            const Icon = addonIcons[i]
+            return (
+              <div key={name} style={{
+                background: '#f8fafc', borderRadius: 10, padding: '8px 10px',
+                border: '1px solid #f1f5f9',
+              }}>
+                <div style={{ display: 'flex', alignItems: 'center', gap: 6, marginBottom: 2 }}>
+                  <Icon size={12} style={{ flexShrink: 0, color: '#111827' }} />
+                  <span style={{ fontSize: 11, fontWeight: 700, color: '#111827' }}>{name}</span>
+                </div>
+                <p style={{ fontSize: 10, color: '#94a3b8', margin: 0, lineHeight: 1.3, paddingLeft: 18 }}>{desc}</p>
+              </div>
+            )
+          })}
+        </div>
+
+        {/* Full version features */}
+        <p style={{ fontSize: 10, fontWeight: 700, color: '#374151', margin: '0 0 8px', textTransform: 'uppercase', letterSpacing: '0.08em', display: 'flex', alignItems: 'center', gap: 6 }}>
+          <Shield size={12} />
+          {t.fullVersionTitle}
+        </p>
+        <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 6, marginBottom: 16 }}>
+          {t.features.map((text, i) => {
+            const Icon = featureIcons[i]
+            return (
+              <div key={text} style={{ display: 'flex', alignItems: 'center', gap: 8, fontSize: 11, color: '#4b5563', padding: '4px 0' }}>
+                <Icon size={13} style={{ flexShrink: 0, color: '#9ca3af' }} />
+                <span>{text}</span>
+              </div>
+            )
+          })}
+        </div>
+
+        {/* Footer */}
+        <div style={{
+          paddingTop: 14, borderTop: '1px solid #e5e7eb',
+          display: 'flex', alignItems: 'center', justifyContent: 'space-between',
+        }}>
+          <div style={{ display: 'flex', alignItems: 'center', gap: 6, fontSize: 11, color: '#9ca3af' }}>
+            <Github size={13} />
+            <span>{t.selfHost}</span>
+            <a href="https://github.com/mauriceboe/NOMAD" target="_blank" rel="noopener noreferrer"
+              style={{ color: '#111827', fontWeight: 600, textDecoration: 'none' }}>
+              {t.selfHostLink}
+            </a>
+          </div>
+          <button onClick={() => setDismissed(true)} style={{
+            background: '#111827', color: 'white', border: 'none',
+            borderRadius: 10, padding: '8px 20px', fontSize: 12,
+            fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit',
+          }}>
+            {t.close}
+          </button>
+        </div>
+      </div>
+    </div>
+  )
+}

client/src/components/Layout/Navbar.jsx

@@ -1,18 +1,46 @@
-import React, { useState } from 'react'
-import { Link, useNavigate } from 'react-router-dom'
+import React, { useState, useEffect, useRef } from 'react'
+import ReactDOM from 'react-dom'
+import { Link, useNavigate, useLocation } from 'react-router-dom'
 import { useAuthStore } from '../../store/authStore'
 import { useSettingsStore } from '../../store/settingsStore'
 import { useTranslation } from '../../i18n'
-import { Plane, LogOut, Settings, ChevronDown, Shield, ArrowLeft, Users, Moon, Sun } from 'lucide-react'
+import { addonsApi } from '../../api/client'
+import { Plane, LogOut, Settings, ChevronDown, Shield, ArrowLeft, Users, Moon, Sun, CalendarDays, Briefcase, Globe } from 'lucide-react'
+
+const ADDON_ICONS = { CalendarDays, Briefcase, Globe }
 
 export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }) {
   const { user, logout } = useAuthStore()
   const { settings, updateSetting } = useSettingsStore()
   const { t, locale } = useTranslation()
   const navigate = useNavigate()
+  const location = useLocation()
   const [userMenuOpen, setUserMenuOpen] = useState(false)
+  const [appVersion, setAppVersion] = useState(null)
+  const [globalAddons, setGlobalAddons] = useState([])
   const dark = settings.dark_mode
 
+  const loadAddons = () => {
+    if (user) {
+      addonsApi.enabled().then(data => {
+        setGlobalAddons(data.addons.filter(a => a.type === 'global'))
+      }).catch(() => {})
+    }
+  }
+  useEffect(loadAddons, [user, location.pathname])
+  // Listen for addon changes from AddonManager
+  useEffect(() => {
+    const handler = () => loadAddons()
+    window.addEventListener('addons-changed', handler)
+    return () => window.removeEventListener('addons-changed', handler)
+  }, [user])
+
+  useEffect(() => {
+    import('../../api/client').then(({ authApi }) => {
+      authApi.getAppConfig?.().then(c => setAppVersion(c?.version)).catch(() => {})
+    })
+  }, [])
+
   const handleLogout = () => {
     logout()
     navigate('/login')
@@ -28,7 +56,10 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare })
       backdropFilter: 'blur(20px)', WebkitBackdropFilter: 'blur(20px)',
       borderBottom: `1px solid ${dark ? 'rgba(255,255,255,0.07)' : 'rgba(0,0,0,0.07)'}`,
       boxShadow: dark ? '0 1px 12px rgba(0,0,0,0.2)' : '0 1px 12px rgba(0,0,0,0.05)',
-    }} className="h-14 flex items-center px-4 gap-4 fixed top-0 left-0 right-0 z-[200]">
+      touchAction: 'manipulation',
+      paddingTop: 'env(safe-area-inset-top, 0px)',
+      height: 'var(--nav-h)',
+    }} className="flex items-center px-4 gap-4 fixed top-0 left-0 right-0 z-[200]">
       {/* Left side */}
       <div className="flex items-center gap-3 min-w-0">
         {showBack && (
@@ -42,12 +73,47 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare })
           </button>
         )}
 
-        <Link to="/dashboard" className="flex items-center gap-2 transition-colors flex-shrink-0"
-          style={{ color: 'var(--text-primary)' }}>
-          <Plane className="w-5 h-5" style={{ color: 'var(--text-primary)' }} />
-          <span className="font-bold text-sm hidden sm:inline">NOMAD</span>
+        <Link to="/dashboard" className="flex items-center transition-colors flex-shrink-0">
+          <img src={dark ? '/icons/icon-white.svg' : '/icons/icon-dark.svg'} alt="NOMAD" className="sm:hidden" style={{ height: 22, width: 22 }} />
+          <img src={dark ? '/logo-light.svg' : '/logo-dark.svg'} alt="NOMAD" className="hidden sm:block" style={{ height: 28 }} />
         </Link>
 
+        {/* Global addon nav items */}
+        {globalAddons.length > 0 && !tripTitle && (
+          <>
+            <span style={{ color: 'var(--text-faint)' }}>|</span>
+            <Link to="/dashboard"
+              className="flex items-center gap-1.5 px-2.5 py-1 rounded-lg text-xs font-medium transition-colors flex-shrink-0"
+              style={{
+                color: location.pathname === '/dashboard' ? 'var(--text-primary)' : 'var(--text-muted)',
+                background: location.pathname === '/dashboard' ? 'var(--bg-hover)' : 'transparent',
+              }}
+              onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+              onMouseLeave={e => { if (location.pathname !== '/dashboard') e.currentTarget.style.background = 'transparent' }}>
+              <Briefcase className="w-3.5 h-3.5" />
+              <span className="hidden md:inline">{t('nav.myTrips')}</span>
+            </Link>
+            {globalAddons.map(addon => {
+              const Icon = ADDON_ICONS[addon.icon] || CalendarDays
+              const path = `/${addon.id}`
+              const isActive = location.pathname === path
+              return (
+                <Link key={addon.id} to={path}
+                  className="flex items-center gap-1.5 px-2.5 py-1 rounded-lg text-xs font-medium transition-colors flex-shrink-0"
+                  style={{
+                    color: isActive ? 'var(--text-primary)' : 'var(--text-muted)',
+                    background: isActive ? 'var(--bg-hover)' : 'transparent',
+                  }}
+                  onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+                  onMouseLeave={e => { if (!isActive) e.currentTarget.style.background = 'transparent' }}>
+                  <Icon className="w-3.5 h-3.5" />
+                  <span className="hidden md:inline">{addon.name}</span>
+                </Link>
+              )
+            })}
+          </>
+        )}
+
         {tripTitle && (
           <>
             <span className="hidden sm:inline" style={{ color: 'var(--text-faint)' }}>/</span>
@@ -103,11 +169,10 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare })
             <ChevronDown className="w-4 h-4" style={{ color: 'var(--text-faint)' }} />
           </button>
 
-          {userMenuOpen && (
+          {userMenuOpen && ReactDOM.createPortal(
             <>
-              <div className="fixed inset-0 z-10" onClick={() => setUserMenuOpen(false)} />
-              <div className="absolute right-0 top-full mt-2 w-52 rounded-xl shadow-xl border z-20 overflow-hidden"
-                style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
+              <div style={{ position: 'fixed', inset: 0, zIndex: 9998 }} onClick={() => setUserMenuOpen(false)} />
+              <div className="w-52 rounded-xl shadow-xl border overflow-hidden" style={{ position: 'fixed', top: 'var(--nav-h)', right: 8, zIndex: 9999, background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
                 <div className="px-4 py-3 border-b" style={{ borderColor: 'var(--border-secondary)' }}>
                   <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>{user.username}</p>
                   <p className="text-xs truncate" style={{ color: 'var(--text-muted)' }}>{user.email}</p>
@@ -146,9 +211,18 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare })
                     <LogOut className="w-4 h-4" />
                     {t('nav.logout')}
                   </button>
+                  {appVersion && (
+                    <div className="px-4 pt-2 pb-2.5 text-center" style={{ marginTop: 4, borderTop: '1px solid var(--border-secondary)' }}>
+                      <div style={{ display: 'inline-flex', alignItems: 'center', gap: 5, background: 'var(--bg-tertiary)', borderRadius: 99, padding: '4px 12px' }}>
+                        <img src={dark ? '/text-light.svg' : '/text-dark.svg'} alt="NOMAD" style={{ height: 10, opacity: 0.5 }} />
+                        <span style={{ fontSize: 10, fontWeight: 600, color: 'var(--text-faint)' }}>v{appVersion}</span>
+                      </div>
+                    </div>
+                  )}
                 </div>
               </div>
-            </>
+            </>,
+            document.body
           )}
         </div>
       )}

client/src/components/Map/MapView.jsx

@@ -1,4 +1,4 @@
-import React, { useEffect, useRef, useState } from 'react'
+import React, { useEffect, useRef, useState, useMemo } from 'react'
 import { MapContainer, TileLayer, Marker, Tooltip, Polyline, useMap } from 'react-leaflet'
 import MarkerClusterGroup from 'react-leaflet-cluster'
 import L from 'leaflet'
@@ -19,6 +19,11 @@ L.Icon.Default.mergeOptions({
  * Create a round photo-circle marker.
  * Shows image_url if available, otherwise category icon in colored circle.
  */
+function escAttr(s) {
+  if (!s) return ''
+  return s.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+}
+
 function createPlaceIcon(place, orderNumber, isSelected) {
   const size = isSelected ? 44 : 36
   const borderColor = isSelected ? '#111827' : 'white'
@@ -55,7 +60,7 @@ function createPlaceIcon(place, orderNumber, isSelected) {
         cursor:pointer;flex-shrink:0;position:relative;
       ">
         <div style="width:100%;height:100%;border-radius:50%;overflow:hidden;">
-          <img src="${place.image_url}" style="width:100%;height:100%;object-fit:cover;" />
+          <img src="${escAttr(place.image_url)}" style="width:100%;height:100%;object-fit:cover;" />
         </div>
         ${badgeHtml}
       </div>`,
@@ -84,19 +89,26 @@ function createPlaceIcon(place, orderNumber, isSelected) {
   })
 }
 
-function SelectionController({ places, selectedPlaceId }) {
+function SelectionController({ places, selectedPlaceId, dayPlaces, paddingOpts }) {
   const map = useMap()
   const prev = useRef(null)
 
   useEffect(() => {
     if (selectedPlaceId && selectedPlaceId !== prev.current) {
-      const place = places.find(p => p.id === selectedPlaceId)
-      if (place?.lat && place?.lng) {
-        map.setView([place.lat, place.lng], Math.max(map.getZoom(), 15), { animate: true, duration: 0.5 })
+      // Fit all day places into view (so you see context), but ensure selected is visible
+      const toFit = dayPlaces.length > 0 ? dayPlaces : places.filter(p => p.id === selectedPlaceId)
+      const withCoords = toFit.filter(p => p.lat && p.lng)
+      if (withCoords.length > 0) {
+        try {
+          const bounds = L.latLngBounds(withCoords.map(p => [p.lat, p.lng]))
+          if (bounds.isValid()) {
+            map.fitBounds(bounds, { ...paddingOpts, maxZoom: 16, animate: true })
+          }
+        } catch {}
       }
     }
     prev.current = selectedPlaceId
-  }, [selectedPlaceId, places, map])
+  }, [selectedPlaceId, places, dayPlaces, paddingOpts, map])
 
   return null
 }
@@ -116,7 +128,7 @@ function MapController({ center, zoom }) {
 }
 
 // Fit bounds when places change (fitKey triggers re-fit)
-function BoundsController({ places, fitKey }) {
+function BoundsController({ places, fitKey, paddingOpts }) {
   const map = useMap()
   const prevFitKey = useRef(-1)
 
@@ -126,9 +138,9 @@ function BoundsController({ places, fitKey }) {
     if (places.length === 0) return
     try {
       const bounds = L.latLngBounds(places.map(p => [p.lat, p.lng]))
-      if (bounds.isValid()) map.fitBounds(bounds, { padding: [60, 60], maxZoom: 15, animate: true })
+      if (bounds.isValid()) map.fitBounds(bounds, { ...paddingOpts, maxZoom: 16, animate: true })
     } catch {}
-  }, [fitKey, places, map])
+  }, [fitKey, places, paddingOpts, map])
 
   return null
 }
@@ -148,6 +160,7 @@ const mapPhotoCache = new Map()
 
 export function MapView({
   places = [],
+  dayPlaces = [],
   route = null,
   selectedPlaceId = null,
   onMarkerClick,
@@ -157,7 +170,20 @@ export function MapView({
   tileUrl = 'https://{s}.basemaps.cartocdn.com/light_all/{z}/{x}/{y}{r}.png',
   fitKey = 0,
   dayOrderMap = {},
+  leftWidth = 0,
+  rightWidth = 0,
+  hasInspector = false,
 }) {
+  // Dynamic padding: account for sidebars + bottom inspector
+  const paddingOpts = useMemo(() => {
+    const isMobile = typeof window !== 'undefined' && window.innerWidth < 768
+    if (isMobile) return { padding: [40, 20] }
+    const top = 60
+    const bottom = hasInspector ? 320 : 60
+    const left = leftWidth + 40
+    const right = rightWidth + 40
+    return { paddingTopLeft: [left, top], paddingBottomRight: [right, bottom] }
+  }, [leftWidth, rightWidth, hasInspector])
   const [photoUrls, setPhotoUrls] = useState({})
 
   // Fetch Google photos for places that have google_place_id but no image_url
@@ -195,8 +221,8 @@ export function MapView({
       />
 
       <MapController center={center} zoom={zoom} />
-      <BoundsController places={places} fitKey={fitKey} />
-      <SelectionController places={places} selectedPlaceId={selectedPlaceId} />
+      <BoundsController places={dayPlaces.length > 0 ? dayPlaces : places} fitKey={fitKey} paddingOpts={paddingOpts} />
+      <SelectionController places={places} selectedPlaceId={selectedPlaceId} dayPlaces={dayPlaces} paddingOpts={paddingOpts} />
       <MapClickHandler onClick={onMapClick} />
 
       <MarkerClusterGroup

client/src/components/PDF/TripPDF.jsx

@@ -1,8 +1,16 @@
 // Trip PDF via browser print window
 import { createElement } from 'react'
 import { getCategoryIcon } from '../shared/categoryIcons'
+import { FileText, Info, Clock, MapPin, Navigation, Train, Plane, Bus, Car, Ship, Coffee, Ticket, Star, Heart, Camera, Flag, Lightbulb, AlertTriangle, ShoppingBag, Bookmark } from 'lucide-react'
 import { mapsApi } from '../../api/client'
 
+const NOTE_ICON_MAP = { FileText, Info, Clock, MapPin, Navigation, Train, Plane, Bus, Car, Ship, Coffee, Ticket, Star, Heart, Camera, Flag, Lightbulb, AlertTriangle, ShoppingBag, Bookmark }
+function noteIconSvg(iconId) {
+  if (!_renderToStaticMarkup) return ''
+  const Icon = NOTE_ICON_MAP[iconId] || FileText
+  return _renderToStaticMarkup(createElement(Icon, { size: 14, strokeWidth: 1.8, color: '#94a3b8' }))
+}
+
 // ── SVG inline icons (for chips) ─────────────────────────────────────────────
 const svgPin   = `<svg width="11" height="11" viewBox="0 0 24 24" fill="#94a3b8" style="flex-shrink:0;margin-top:1px"><path d="M12 2C8.13 2 5 5.13 5 9c0 5.25 7 13 7 13s7-7.75 7-13c0-3.87-3.13-7-7-7z"/><circle cx="12" cy="9" r="2.5" fill="white"/></svg>`
 const svgClock = `<svg width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="#374151" stroke-width="2" stroke-linecap="round"><circle cx="12" cy="12" r="9"/><path d="M12 7v5l3 3"/></svg>`
@@ -104,7 +112,7 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
     const cost = dayCost(assignments, day.id, loc)
 
     const merged = []
-    assigned.forEach(a => merged.push({ type: 'place', k: a.sort_order ?? 0, data: a }))
+    assigned.forEach(a => merged.push({ type: 'place', k: a.order_index ?? a.sort_order ?? 0, data: a }))
     notes.forEach(n    => merged.push({ type: 'note',  k: n.sort_order ?? 0, data: n }))
     merged.sort((a, b) => a.k - b.k)
 
@@ -117,12 +125,7 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
             return `
               <div class="note-card">
                 <div class="note-line"></div>
-                <svg class="note-icon" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="#94a3b8" stroke-width="1.8" stroke-linecap="round">
-                  <rect x="4" y="3" width="16" height="18" rx="2"/>
-                  <line x1="8" y1="8" x2="16" y2="8"/>
-                  <line x1="8" y1="12" x2="16" y2="12"/>
-                  <line x1="8" y1="16" x2="13" y2="16"/>
-                </svg>
+                <span class="note-icon">${noteIconSvg(note.icon)}</span>
                 <div class="note-body">
                   <div class="note-text">${escHtml(note.text)}</div>
                   ${note.time ? `<div class="note-time">${escHtml(note.time)}</div>` : ''}
@@ -193,13 +196,31 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
 <head>
 <meta charset="UTF-8">
 <base href="${window.location.origin}/">
-<title>${escHtml(trip?.name || tr('pdf.travelPlan'))}</title>
+<title>${escHtml(trip?.title || tr('pdf.travelPlan'))}</title>
 <link href="https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,400;0,500;0,600;0,700;1,400&display=swap" rel="stylesheet">
 <style>
   *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
   body { font-family: 'Poppins', sans-serif; background: #fff; color: #1e293b; -webkit-print-color-adjust: exact; print-color-adjust: exact; }
   svg { -webkit-print-color-adjust: exact; print-color-adjust: exact; }
 
+  /* Footer on every printed page */
+  .pdf-footer {
+    position: fixed;
+    bottom: 20px;
+    left: 0;
+    right: 0;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 6px;
+    opacity: 0.3;
+  }
+  .pdf-footer span {
+    font-size: 7px;
+    color: #64748b;
+    letter-spacing: 0.5px;
+  }
+
   /* ── Cover ─────────────────────────────────────── */
   .cover {
     width: 100%; min-height: 100vh;
@@ -215,8 +236,7 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
   .cover-dim { position: absolute; inset: 0; background: rgba(8,12,28,0.55); }
   .cover-brand {
     position: absolute; top: 36px; right: 52px;
-    font-size: 9px; font-weight: 600; letter-spacing: 2.5px;
-    color: rgba(255,255,255,0.3); text-transform: uppercase;
+    z-index: 2;
   }
   .cover-body { position: relative; z-index: 1; }
   .cover-circle {
@@ -316,17 +336,23 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
 </head>
 <body>
 
+<!-- Footer on every page -->
+<div class="pdf-footer">
+  <span>made with</span>
+  <img src="${absUrl('/logo-dark.svg')}" style="height:10px;opacity:0.6;" />
+</div>
+
 <!-- Cover -->
 <div class="cover">
   ${coverImg ? `<div class="cover-bg" style="background-image:url('${escHtml(coverImg)}')"></div>` : ''}
   <div class="cover-dim"></div>
-  <div class="cover-brand">NOMAD</div>
+  <div class="cover-brand"><img src="${absUrl('/logo-light.svg')}" style="height:28px;opacity:0.5;" /></div>
   <div class="cover-body">
     ${coverImg
       ? `<div class="cover-circle"><img src="${escHtml(coverImg)}" /></div>`
       : `<div class="cover-circle-ph"></div>`}
     <div class="cover-label">${escHtml(tr('pdf.travelPlan'))}</div>
-    <div class="cover-title">${escHtml(trip?.name || 'Meine Reise')}</div>
+    <div class="cover-title">${escHtml(trip?.title || 'Meine Reise')}</div>
     ${trip?.description ? `<div class="cover-desc">${escHtml(trip.description)}</div>` : ''}
     ${range ? `<div class="cover-dates">${range}</div>` : ''}
     <div class="cover-line"></div>
@@ -356,15 +382,11 @@ ${daysHtml}
 
 </body></html>`
 
-  // Open print window
-  const blob = new Blob([html], { type: 'text/html' })
-  const url = URL.createObjectURL(blob)
-
-  // Modal in die App einfügen
+  // Open in modal with srcdoc iframe (no URL loading = no X-Frame-Options issue)
   const overlay = document.createElement('div')
   overlay.id = 'pdf-preview-overlay'
   overlay.style.cssText = 'position:fixed;inset:0;background:rgba(0,0,0,0.7);z-index:9999;display:flex;align-items:center;justify-content:center;padding:8px;'
-  overlay.onclick = (e) => { if (e.target === overlay) { overlay.remove(); URL.revokeObjectURL(url) } }
+  overlay.onclick = (e) => { if (e.target === overlay) overlay.remove() }
 
   const card = document.createElement('div')
   card.style.cssText = 'width:100%;max-width:1000px;height:95vh;background:var(--bg-card);border-radius:12px;overflow:hidden;display:flex;flex-direction:column;box-shadow:0 20px 60px rgba(0,0,0,0.3);'
@@ -372,7 +394,7 @@ ${daysHtml}
   const header = document.createElement('div')
   header.style.cssText = 'display:flex;align-items:center;justify-content:space-between;padding:10px 16px;border-bottom:1px solid var(--border-primary);flex-shrink:0;'
   header.innerHTML = `
-    <span style="font-size:13px;font-weight:600;color:var(--text-primary)">${escHtml(trip?.name || tr('pdf.travelPlan'))}</span>
+    <span style="font-size:13px;font-weight:600;color:var(--text-primary)">${escHtml(trip?.title || tr('pdf.travelPlan'))}</span>
     <div style="display:flex;align-items:center;gap:8px">
       <button id="pdf-print-btn" style="display:flex;align-items:center;gap:5px;font-size:12px;font-weight:500;color:var(--text-muted);background:none;border:none;cursor:pointer;padding:4px 8px;border-radius:6px;font-family:inherit">${tr('pdf.saveAsPdf')}</button>
       <button id="pdf-close-btn" style="background:none;border:none;cursor:pointer;color:var(--text-faint);display:flex;padding:4px;border-radius:6px">
@@ -383,13 +405,14 @@ ${daysHtml}
 
   const iframe = document.createElement('iframe')
   iframe.style.cssText = 'flex:1;width:100%;border:none;'
-  iframe.src = url
+  iframe.sandbox = 'allow-same-origin allow-modals'
+  iframe.srcdoc = html
 
   card.appendChild(header)
   card.appendChild(iframe)
   overlay.appendChild(card)
   document.body.appendChild(overlay)
 
-  header.querySelector('#pdf-close-btn').onclick = () => { overlay.remove(); URL.revokeObjectURL(url) }
+  header.querySelector('#pdf-close-btn').onclick = () => overlay.remove()
   header.querySelector('#pdf-print-btn').onclick = () => { iframe.contentWindow?.print() }
 }

client/src/components/Places/PlaceFormModal.jsx

@@ -3,6 +3,7 @@ import Modal from '../shared/Modal'
 import { mapsApi, tagsApi, categoriesApi } from '../../api/client'
 import { useToast } from '../shared/Toast'
 import { useAuthStore } from '../../store/authStore'
+import { useTranslation } from '../../i18n'
 import { Search, Plus, MapPin, Loader } from 'lucide-react'
 
 const STATUSES = [
@@ -23,7 +24,8 @@ export default function PlaceFormModal({
   onTagCreated,
 }) {
   const isEditing = !!place
-  const { user } = useAuthStore()
+  const { user, hasMapsKey } = useAuthStore()
+  const { t } = useTranslation()
   const toast = useToast()
 
   const [categories, setCategories] = useState(initialCategories)
@@ -124,14 +126,17 @@ export default function PlaceFormModal({
     }
   }
 
+  const [searchSource, setSearchSource] = useState(null)
+
   const handleMapSearch = async () => {
     if (!mapQuery.trim()) return
     setMapSearching(true)
     try {
       const data = await mapsApi.search(mapQuery)
       setMapResults(data.places || [])
+      setSearchSource(data.source || 'google')
     } catch (err) {
-      toast.error(err.response?.data?.error || 'Maps search failed')
+      toast.error(err.response?.data?.error || t('places.mapsSearchError'))
     } finally {
       setMapSearching(false)
     }
@@ -218,9 +223,13 @@ export default function PlaceFormModal({
           </div>
         )}
 
-        {/* Google Maps search — always visible when API key is set */}
-        {user?.maps_api_key && (
+        {/* Place search — Google Maps or OpenStreetMap fallback */}
           <div className="bg-slate-50 rounded-xl p-3 border border-slate-200">
+            {!hasMapsKey && (
+              <p className="mb-2 text-xs" style={{ color: 'var(--text-faint)' }}>
+                {t('places.osmActive')}
+              </p>
+            )}
             <div className="flex gap-2">
               <div className="relative flex-1">
                 <Search className="absolute left-2.5 top-1/2 -translate-y-1/2 w-4 h-4 text-slate-400" />
@@ -229,7 +238,7 @@ export default function PlaceFormModal({
                   value={mapQuery}
                   onChange={e => setMapQuery(e.target.value)}
                   onKeyDown={e => e.key === 'Enter' && handleMapSearch()}
-                  placeholder="Google Maps suchen..."
+                  placeholder={t('places.mapsSearchPlaceholder')}
                   className="w-full pl-8 pr-3 py-2 text-sm border border-slate-200 rounded-lg focus:ring-2 focus:ring-slate-400 focus:border-transparent bg-white"
                 />
               </div>
@@ -238,7 +247,7 @@ export default function PlaceFormModal({
                 disabled={mapSearching}
                 className="px-3 py-2 bg-slate-900 text-white text-sm rounded-lg hover:bg-slate-700 disabled:opacity-50"
               >
-                {mapSearching ? <Loader className="w-4 h-4 animate-spin" /> : 'Suchen'}
+                {mapSearching ? <Loader className="w-4 h-4 animate-spin" /> : t('common.search')}
               </button>
             </div>
 
@@ -263,7 +272,6 @@ export default function PlaceFormModal({
               </div>
             )}
           </div>
-        )}
 
         {/* Name */}
         <div>

client/src/components/Planner/DayPlanSidebar.jsx

@@ -1,6 +1,6 @@
 import React, { useState, useEffect, useRef } from 'react'
 import ReactDOM from 'react-dom'
-import { ChevronDown, ChevronRight, ChevronUp, Navigation, RotateCcw, ExternalLink, Clock, AlertCircle, CheckCircle2, Pencil, GripVertical, Ticket, Plus, FileText, Check, Trash2, Info, MapPin, Star, Heart, Camera, Lightbulb, Flag, Bookmark, Train, Bus, Plane, Car, Ship, Coffee, ShoppingBag, AlertTriangle, FileDown } from 'lucide-react'
+import { ChevronDown, ChevronRight, ChevronUp, Navigation, RotateCcw, ExternalLink, Clock, AlertCircle, CheckCircle2, Pencil, GripVertical, Ticket, Plus, FileText, Check, Trash2, Info, MapPin, Star, Heart, Camera, Lightbulb, Flag, Bookmark, Train, Bus, Plane, Car, Ship, Coffee, ShoppingBag, AlertTriangle, FileDown, Lock } from 'lucide-react'
 import { downloadTripPDF } from '../PDF/TripPDF'
 import { calculateRoute, generateGoogleMapsUrl, optimizeRoute } from '../Map/RouteCalculator'
 import PlaceAvatar from '../shared/PlaceAvatar'
@@ -79,7 +79,7 @@ export default function DayPlanSidebar({
   onAddReservation,
 }) {
   const toast = useToast()
-  const { t, locale } = useTranslation()
+  const { t, language, locale } = useTranslation()
   const timeFormat = useSettingsStore(s => s.settings.time_format) || '24h'
   const tripStore = useTripStore()
 
@@ -97,6 +97,8 @@ export default function DayPlanSidebar({
   const [isCalculating, setIsCalculating] = useState(false)
   const [routeInfo, setRouteInfo] = useState(null)
   const [draggingId, setDraggingId] = useState(null)
+  const [lockedIds, setLockedIds] = useState(new Set())
+  const [lockHoverId, setLockHoverId] = useState(null)
   const [dropTargetKey, setDropTargetKey] = useState(null)
   const [dragOverDayId, setDragOverDayId] = useState(null)
   const [hoveredId, setHoveredId] = useState(null)
@@ -205,16 +207,17 @@ export default function DayPlanSidebar({
     catch (err) { toast.error(err.message) }
   }
 
-  const handleMergedDrop = async (dayId, fromType, fromId, toType, toId) => {
+  const handleMergedDrop = async (dayId, fromType, fromId, toType, toId, insertAfter = false) => {
     const m = getMergedItems(dayId)
     const fromIdx = m.findIndex(i => i.type === fromType && i.data.id === fromId)
     const toIdx = m.findIndex(i => i.type === toType && i.data.id === toId)
     if (fromIdx === -1 || toIdx === -1 || fromIdx === toIdx) return
 
-    // Neue Reihenfolge erstellen — VOR dem Ziel einfügen (Standardkonvention)
+    // Neue Reihenfolge erstellen — VOR dem Ziel einfügen (Standard), oder NACH dem Ziel wenn insertAfter
     const newOrder = [...m]
     const [moved] = newOrder.splice(fromIdx, 1)
-    const adjustedTo = fromIdx < toIdx ? toIdx - 1 : toIdx
+    let adjustedTo = fromIdx < toIdx ? toIdx - 1 : toIdx
+    if (insertAfter) adjustedTo += 1
     newOrder.splice(adjustedTo, 0, moved)
 
     // Orte: neuer order_index über onReorder
@@ -290,15 +293,44 @@ export default function DayPlanSidebar({
     finally { setIsCalculating(false) }
   }
 
+  const toggleLock = (assignmentId) => {
+    setLockedIds(prev => {
+      const next = new Set(prev)
+      if (next.has(assignmentId)) next.delete(assignmentId)
+      else next.add(assignmentId)
+      return next
+    })
+  }
+
   const handleOptimize = async () => {
     if (!selectedDayId) return
     const da = getDayAssignments(selectedDayId)
     if (da.length < 3) return
-    const withCoords = da.map(a => a.place).filter(p => p?.lat && p?.lng)
-    const optimized = optimizeRoute(withCoords)
-    const reorderedIds = optimized.map(p => da.find(a => a.place?.id === p.id)?.id).filter(Boolean)
-    for (const a of da) { if (!reorderedIds.includes(a.id)) reorderedIds.push(a.id) }
-    await onReorder(selectedDayId, reorderedIds)
+
+    // Separate locked (stay at their index) and unlocked assignments
+    const locked = new Map() // index -> assignment
+    const unlocked = []
+    da.forEach((a, i) => {
+      if (lockedIds.has(a.id)) locked.set(i, a)
+      else unlocked.push(a)
+    })
+
+    // Optimize only unlocked places
+    const unlockedWithCoords = unlocked.map(a => a.place).filter(p => p?.lat && p?.lng)
+    const optimized = unlockedWithCoords.length >= 2 ? optimizeRoute(unlockedWithCoords) : unlockedWithCoords
+    const optimizedQueue = optimized.map(p => unlocked.find(a => a.place?.id === p.id)).filter(Boolean)
+    // Add unlocked without coords at the end
+    for (const a of unlocked) { if (!optimizedQueue.includes(a)) optimizedQueue.push(a) }
+
+    // Merge: locked stay at their index, fill gaps with optimized
+    const result = new Array(da.length)
+    locked.forEach((a, i) => { result[i] = a })
+    let qi = 0
+    for (let i = 0; i < result.length; i++) {
+      if (!result[i]) result[i] = optimizedQueue[qi++]
+    }
+
+    await onReorder(selectedDayId, result.map(a => a.id))
     toast.success(t('dayplan.toast.routeOptimized'))
   }
 
@@ -430,7 +462,7 @@ export default function DayPlanSidebar({
                   outlineOffset: -2,
                   borderRadius: isDragTarget ? 8 : 0,
                 }}
-                onMouseEnter={e => { if (!isSelected && !isDragTarget) e.currentTarget.style.background = 'var(--bg-hover)' }}
+                onMouseEnter={e => { if (!isSelected && !isDragTarget) e.currentTarget.style.background = 'var(--bg-tertiary)' }}
                 onMouseLeave={e => { if (!isSelected) e.currentTarget.style.background = isDragTarget ? 'rgba(17,24,39,0.07)' : 'transparent' }}
               >
                 {/* Tages-Badge */}
@@ -504,7 +536,7 @@ export default function DayPlanSidebar({
               {/* Aufgeklappte Orte + Notizen */}
               {isExpanded && (
                 <div
-                  style={{ background: 'var(--bg-hover)' }}
+                  style={{ background: 'var(--bg-hover)', paddingTop: 6 }}
                   onDragOver={e => { e.preventDefault(); if (draggingId) setDropTargetKey(`end-${day.id}`) }}
                   onDrop={e => {
                     e.preventDefault()
@@ -522,9 +554,9 @@ export default function DayPlanSidebar({
                     if (m.length === 0) return
                     const lastItem = m[m.length - 1]
                     if (assignmentId && String(lastItem?.data?.id) !== assignmentId)
-                      handleMergedDrop(day.id, 'place', Number(assignmentId), lastItem.type, lastItem.data.id)
+                      handleMergedDrop(day.id, 'place', Number(assignmentId), lastItem.type, lastItem.data.id, true)
                     else if (noteId && String(lastItem?.data?.id) !== noteId)
-                      handleMergedDrop(day.id, 'note', Number(noteId), lastItem.type, lastItem.data.id)
+                      handleMergedDrop(day.id, 'note', Number(noteId), lastItem.type, lastItem.data.id, true)
                   }}
                 >
                   {merged.length === 0 && !dayNoteUi ? (
@@ -582,7 +614,7 @@ export default function DayPlanSidebar({
                               dragDataRef.current = { assignmentId: String(assignment.id), fromDayId: String(day.id) }
                               setDraggingId(assignment.id)
                             }}
-                            onDragOver={e => { e.preventDefault(); e.stopPropagation(); setDragOverDayId(null); setDropTargetKey(`place-${assignment.id}`) }}
+                            onDragOver={e => { e.preventDefault(); e.stopPropagation(); setDragOverDayId(null); if (dropTargetKey !== `place-${assignment.id}`) setDropTargetKey(`place-${assignment.id}`) }}
                             onDrop={e => {
                               e.preventDefault(); e.stopPropagation()
                               const { placeId, assignmentId: fromAssignmentId, noteId, fromDayId } = getDragData(e)
@@ -607,25 +639,61 @@ export default function DayPlanSidebar({
                               }
                             }}
                             onDragEnd={() => { setDraggingId(null); setDragOverDayId(null); setDropTargetKey(null); dragDataRef.current = null }}
-                            onClick={() => { onPlaceClick(isPlaceSelected ? null : place.id); if (!isPlaceSelected) onSelectDay(day.id) }}
+                            onClick={() => { onPlaceClick(isPlaceSelected ? null : place.id); if (!isPlaceSelected) onSelectDay(day.id, true) }}
                             onMouseEnter={() => setHoveredId(assignment.id)}
                             onMouseLeave={() => setHoveredId(null)}
                             style={{
                               display: 'flex', alignItems: 'center', gap: 8,
                               padding: '7px 8px 7px 10px',
                               cursor: 'pointer',
-                              background: isPlaceSelected ? 'var(--bg-hover)' : (isHovered ? 'var(--bg-hover)' : 'transparent'),
-                              borderLeft: hasReservation
-                                ? `3px solid ${isConfirmed ? '#10b981' : '#f59e0b'}`
-                                : '3px solid transparent',
-                              transition: 'background 0.1s',
+                              background: lockedIds.has(assignment.id)
+                                ? 'rgba(220,38,38,0.08)'
+                                : isPlaceSelected ? 'var(--bg-hover)' : (isHovered ? 'var(--bg-hover)' : 'transparent'),
+                              borderLeft: lockedIds.has(assignment.id)
+                                ? '3px solid #dc2626'
+                                : hasReservation
+                                  ? `3px solid ${isConfirmed ? '#10b981' : '#f59e0b'}`
+                                  : '3px solid transparent',
+                              transition: 'background 0.15s, border-color 0.15s',
                               opacity: isDraggingThis ? 0.4 : 1,
                             }}
                           >
                             <div style={{ flexShrink: 0, color: 'var(--text-faint)', display: 'flex', alignItems: 'center', opacity: isHovered ? 1 : 0.3, transition: 'opacity 0.15s', cursor: 'grab' }}>
                               <GripVertical size={13} strokeWidth={1.8} />
                             </div>
-                            <PlaceAvatar place={place} category={cat} size={28} />
+                            <div
+                              onClick={e => { e.stopPropagation(); toggleLock(assignment.id) }}
+                              onMouseEnter={e => { e.stopPropagation(); setLockHoverId(assignment.id) }}
+                              onMouseLeave={() => setLockHoverId(null)}
+                              style={{ position: 'relative', flexShrink: 0, cursor: 'pointer' }}
+                            >
+                              <PlaceAvatar place={place} category={cat} size={28} />
+                              {/* Hover/locked overlay */}
+                              {(lockHoverId === assignment.id || lockedIds.has(assignment.id)) && (
+                                <div style={{
+                                  position: 'absolute', inset: 0, borderRadius: '50%',
+                                  background: lockedIds.has(assignment.id) ? 'rgba(220,38,38,0.6)' : 'rgba(220,38,38,0.4)',
+                                  display: 'flex', alignItems: 'center', justifyContent: 'center',
+                                  transition: 'background 0.15s',
+                                }}>
+                                  <Lock size={14} strokeWidth={2.5} style={{ color: 'white', filter: 'drop-shadow(0 1px 2px rgba(0,0,0,0.3))' }} />
+                                </div>
+                              )}
+                              {/* Custom tooltip */}
+                              {lockHoverId === assignment.id && (
+                                <div style={{
+                                  position: 'absolute', left: '100%', top: '50%', transform: 'translateY(-50%)',
+                                  marginLeft: 8, whiteSpace: 'nowrap', pointerEvents: 'none', zIndex: 50,
+                                  background: 'var(--bg-card, white)', color: 'var(--text-primary, #111827)',
+                                  fontSize: 11, fontWeight: 500, padding: '5px 10px', borderRadius: 8,
+                                  boxShadow: '0 4px 12px rgba(0,0,0,0.15)', border: '1px solid var(--border-faint, #e5e7eb)',
+                                }}>
+                                  {lockedIds.has(assignment.id)
+                                    ? (language === 'de' ? 'Klicken zum Entsperren' : 'Click to unlock')
+                                    : (language === 'de' ? 'Position bei Routenoptimierung beibehalten' : 'Keep position during route optimization')}
+                                </div>
+                              )}
+                            </div>
                             <div style={{ flex: 1, minWidth: 0 }}>
                               <div style={{ display: 'flex', alignItems: 'center', gap: 4, overflow: 'hidden' }}>
                                 {cat && (() => {
@@ -686,7 +754,7 @@ export default function DayPlanSidebar({
                           draggable
                           onDragStart={e => { e.dataTransfer.setData('noteId', String(note.id)); e.dataTransfer.setData('fromDayId', String(day.id)); e.dataTransfer.effectAllowed = 'move'; dragDataRef.current = { noteId: String(note.id), fromDayId: String(day.id) }; setDraggingId(`note-${note.id}`) }}
                           onDragEnd={() => { setDraggingId(null); setDropTargetKey(null); dragDataRef.current = null }}
-                          onDragOver={e => { e.preventDefault(); e.stopPropagation(); setDropTargetKey(`note-${note.id}`) }}
+                          onDragOver={e => { e.preventDefault(); e.stopPropagation(); if (dropTargetKey !== `note-${note.id}`) setDropTargetKey(`note-${note.id}`) }}
                           onDrop={e => {
                             e.preventDefault(); e.stopPropagation()
                             const { noteId: fromNoteId, assignmentId: fromAssignmentId, fromDayId } = getDragData(e)
@@ -749,10 +817,40 @@ export default function DayPlanSidebar({
                       )
                     })
                   )}
-                  {/* Drop-Indikator am Listenende */}
-                  {!!draggingId && dropTargetKey === `end-${day.id}` && (
-                    <div style={{ height: 2, background: 'var(--text-primary)', borderRadius: 1, margin: '2px 8px' }} />
-                  )}
+                  {/* Drop-Zone am Listenende — immer vorhanden als Drop-Target */}
+                  <div
+                    style={{ minHeight: 12, padding: '2px 8px' }}
+                    onDragOver={e => { e.preventDefault(); e.stopPropagation(); if (dropTargetKey !== `end-${day.id}`) setDropTargetKey(`end-${day.id}`) }}
+                    onDrop={e => {
+                      e.preventDefault(); e.stopPropagation()
+                      const { placeId, assignmentId, noteId, fromDayId } = getDragData(e)
+                      // Neuer Ort von der Orte-Liste
+                      if (placeId) {
+                        onAssignToDay?.(parseInt(placeId), day.id)
+                        setDropTargetKey(null); window.__dragData = null; return
+                      }
+                      if (!assignmentId && !noteId) { dragDataRef.current = null; window.__dragData = null; return }
+                      if (assignmentId && fromDayId !== day.id) {
+                        tripStore.moveAssignment(tripId, Number(assignmentId), fromDayId, day.id).catch(err => toast.error(err.message))
+                        setDraggingId(null); setDropTargetKey(null); dragDataRef.current = null; return
+                      }
+                      if (noteId && fromDayId !== day.id) {
+                        tripStore.moveDayNote(tripId, fromDayId, day.id, Number(noteId)).catch(err => toast.error(err.message))
+                        setDraggingId(null); setDropTargetKey(null); dragDataRef.current = null; return
+                      }
+                      const m = getMergedItems(day.id)
+                      if (m.length === 0) return
+                      const lastItem = m[m.length - 1]
+                      if (assignmentId && String(lastItem?.data?.id) !== assignmentId)
+                        handleMergedDrop(day.id, 'place', Number(assignmentId), lastItem.type, lastItem.data.id, true)
+                      else if (noteId && String(lastItem?.data?.id) !== noteId)
+                        handleMergedDrop(day.id, 'note', Number(noteId), lastItem.type, lastItem.data.id, true)
+                    }}
+                  >
+                    {dropTargetKey === `end-${day.id}` && (
+                      <div style={{ height: 2, background: 'var(--text-primary)', borderRadius: 1 }} />
+                    )}
+                  </div>
 
                   {/* Routen-Werkzeuge (ausgewählter Tag, 2+ Orte) */}
                   {isSelected && getDayAssignments(day.id).length >= 2 && (
@@ -778,15 +876,6 @@ export default function DayPlanSidebar({
                       )}
 
                       <div style={{ display: 'flex', gap: 6 }}>
-                        <button onClick={handleCalculateRoute} disabled={isCalculating} style={{
-                          flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 5,
-                          padding: '6px 0', fontSize: 11, fontWeight: 500, borderRadius: 8, border: 'none',
-                          background: 'var(--accent)', color: 'var(--accent-text)', cursor: 'pointer', fontFamily: 'inherit',
-                          opacity: isCalculating ? 0.6 : 1,
-                        }}>
-                          <Navigation size={12} strokeWidth={2} />
-                          {isCalculating ? t('dayplan.calculating') : t('dayplan.route')}
-                        </button>
                         <button onClick={handleOptimize} style={{
                           flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 5,
                           padding: '6px 0', fontSize: 11, fontWeight: 500, borderRadius: 8, border: 'none',

client/src/components/Planner/PlaceFormModal.jsx

@@ -2,6 +2,7 @@ import React, { useState, useEffect } from 'react'
 import Modal from '../shared/Modal'
 import CustomSelect from '../shared/CustomSelect'
 import { mapsApi } from '../../api/client'
+import { useAuthStore } from '../../store/authStore'
 import { useToast } from '../shared/Toast'
 import { Search } from 'lucide-react'
 import { useTranslation } from '../../i18n'
@@ -44,6 +45,7 @@ export default function PlaceFormModal({
   const [isSaving, setIsSaving] = useState(false)
   const toast = useToast()
   const { t, language } = useTranslation()
+  const { hasMapsKey } = useAuthStore()
 
   useEffect(() => {
     if (place) {
@@ -139,8 +141,13 @@ export default function PlaceFormModal({
       size="lg"
     >
       <form onSubmit={handleSubmit} className="space-y-4">
-        {/* Google Maps Search */}
+        {/* Place Search */}
         <div className="bg-slate-50 rounded-xl p-3 border border-slate-200">
+          {!hasMapsKey && (
+            <p className="mb-2 text-xs" style={{ color: 'var(--text-faint)' }}>
+              {t('places.osmActive')}
+            </p>
+          )}
           <div className="flex gap-2">
             <input
               type="text"
@@ -293,9 +300,9 @@ export default function PlaceFormModal({
 
         {/* Reservation */}
         <div className="border border-gray-200 rounded-xl p-3 space-y-3">
-          <div className="flex items-center gap-3">
-            <label className="block text-sm font-medium text-gray-700">{t('places.formReservation')}</label>
-            <div className="flex gap-2">
+          <div className="flex flex-col sm:flex-row sm:items-center gap-2 sm:gap-3">
+            <label className="block text-sm font-medium text-gray-700 shrink-0">{t('places.formReservation')}</label>
+            <div className="flex gap-2 flex-wrap">
               {['none', 'pending', 'confirmed'].map(status => (
                 <button
                   key={status}

client/src/components/Planner/ReservationsPanel.jsx

@@ -245,13 +245,14 @@ function ReservationCard({ r, tripId, onEdit, onDelete, files = [], onNavigateTo
   )
 }
 
-function PlaceReservationCard({ item, tripId }) {
+function PlaceReservationCard({ item, tripId, files = [], onNavigateToFiles }) {
   const { updatePlace } = useTripStore()
   const toast = useToast()
   const { t, locale } = useTranslation()
   const timeFormat = useSettingsStore(s => s.settings.time_format) || '24h'
   const [editing, setEditing] = useState(false)
   const confirmed = item.status === 'confirmed'
+  const placeFiles = files.filter(f => f.place_id === item.placeId)
 
   const handleDelete = async () => {
     if (!confirm(t('reservations.confirm.remove', { name: item.title }))) return
@@ -322,6 +323,26 @@ function PlaceReservationCard({ item, tripId }) {
             </div>
 
             {item.notes && <p style={{ margin: '7px 0 0', fontSize: 11.5, color: 'var(--text-muted)', lineHeight: 1.5, borderTop: '1px solid var(--border-secondary)', paddingTop: 7 }}>{item.notes}</p>}
+
+            {/* Files attached to the place */}
+            {placeFiles.length > 0 && (
+              <div style={{ marginTop: 8, borderTop: '1px solid var(--border-secondary)', paddingTop: 8, display: 'flex', flexDirection: 'column', gap: 4 }}>
+                {placeFiles.map(f => (
+                  <div key={f.id} style={{ display: 'flex', alignItems: 'center', gap: 6 }}>
+                    <FileText size={11} style={{ color: 'var(--text-faint)', flexShrink: 0 }} />
+                    <span style={{ fontSize: 11.5, color: 'var(--text-secondary)', flex: 1, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{f.original_name}</span>
+                    <a href={f.url} target="_blank" rel="noreferrer" style={{ display: 'flex', color: 'var(--text-faint)', flexShrink: 0 }} title={t('common.open')}>
+                      <ExternalLink size={11} />
+                    </a>
+                  </div>
+                ))}
+                {onNavigateToFiles && (
+                  <button onClick={onNavigateToFiles} style={{ alignSelf: 'flex-start', fontSize: 11, color: 'var(--text-muted)', background: 'none', border: 'none', cursor: 'pointer', padding: 0, textDecoration: 'underline', fontFamily: 'inherit' }}>
+                    {t('reservations.showFiles')}
+                  </button>
+                )}
+              </div>
+            )}
           </div>
         </div>
       </div>
@@ -388,7 +409,7 @@ export default function ReservationsPanel({ tripId, reservations, days, assignme
   const total = allPending.length + allConfirmed.length
 
   function renderCard(r) {
-    if (r._placeRes) return <PlaceReservationCard key={r.id} item={r} tripId={tripId} />
+    if (r._placeRes) return <PlaceReservationCard key={r.id} item={r} tripId={tripId} files={files} onNavigateToFiles={onNavigateToFiles} />
     return <ReservationCard key={r.id} r={r} tripId={tripId} onEdit={onEdit} onDelete={onDelete} files={files} onNavigateToFiles={onNavigateToFiles} />
   }
 

client/src/components/Trips/TripFormModal.jsx

@@ -92,7 +92,25 @@ export default function TripFormModal({ isOpen, onClose, onSave, trip, onCoverUp
     }
   }
 
-  const update = (field, value) => setFormData(prev => ({ ...prev, [field]: value }))
+  const update = (field, value) => setFormData(prev => {
+    const next = { ...prev, [field]: value }
+    // Auto-adjust end date when start date changes
+    if (field === 'start_date' && value) {
+      if (!prev.end_date || prev.end_date < value) {
+        // If no end date or end date is before new start, set end = start
+        next.end_date = value
+      } else if (prev.start_date) {
+        // Preserve trip duration: shift end date by same delta
+        const oldStart = new Date(prev.start_date + 'T00:00:00')
+        const oldEnd = new Date(prev.end_date + 'T00:00:00')
+        const duration = Math.round((oldEnd - oldStart) / 86400000)
+        const newEnd = new Date(value + 'T00:00:00')
+        newEnd.setDate(newEnd.getDate() + duration)
+        next.end_date = newEnd.toISOString().split('T')[0]
+      }
+    }
+    return next
+  })
 
   const inputCls = "w-full px-3 py-2.5 border border-slate-200 rounded-lg text-slate-900 placeholder-slate-400 focus:outline-none focus:ring-2 focus:ring-slate-300 focus:border-transparent text-sm"
 

client/src/components/Vacay/VacayCalendar.jsx

@@ -0,0 +1,96 @@
+import React, { useMemo, useState, useCallback } from 'react'
+import { useVacayStore } from '../../store/vacayStore'
+import { useTranslation } from '../../i18n'
+import { isWeekend } from './holidays'
+import VacayMonthCard from './VacayMonthCard'
+import { Building2, MousePointer2 } from 'lucide-react'
+
+export default function VacayCalendar() {
+  const { t } = useTranslation()
+  const { selectedYear, selectedUserId, entries, companyHolidays, toggleEntry, toggleCompanyHoliday, plan, users, holidays } = useVacayStore()
+  const [companyMode, setCompanyMode] = useState(false)
+
+  const companyHolidaySet = useMemo(() => {
+    const s = new Set()
+    companyHolidays.forEach(h => s.add(h.date))
+    return s
+  }, [companyHolidays])
+
+  const entryMap = useMemo(() => {
+    const map = {}
+    entries.forEach(e => {
+      if (!map[e.date]) map[e.date] = []
+      map[e.date].push(e)
+    })
+    return map
+  }, [entries])
+
+  const blockWeekends = plan?.block_weekends !== false
+  const companyHolidaysEnabled = plan?.company_holidays_enabled !== false
+
+  const handleCellClick = useCallback(async (dateStr) => {
+    if (companyMode) {
+      if (!companyHolidaysEnabled) return
+      await toggleCompanyHoliday(dateStr)
+      return
+    }
+    if (holidays[dateStr]) return
+    if (blockWeekends && isWeekend(dateStr)) return
+    if (companyHolidaysEnabled && companyHolidaySet.has(dateStr)) return
+    await toggleEntry(dateStr, selectedUserId || undefined)
+  }, [companyMode, toggleEntry, toggleCompanyHoliday, holidays, companyHolidaySet, blockWeekends, companyHolidaysEnabled, selectedUserId])
+
+  const selectedUser = users.find(u => u.id === selectedUserId)
+
+  return (
+    <div>
+      <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4 gap-3">
+        {Array.from({ length: 12 }, (_, i) => (
+          <VacayMonthCard
+            key={i}
+            year={selectedYear}
+            month={i}
+            holidays={holidays}
+            companyHolidaySet={companyHolidaySet}
+            companyHolidaysEnabled={companyHolidaysEnabled}
+            entryMap={entryMap}
+            onCellClick={handleCellClick}
+            companyMode={companyMode}
+            blockWeekends={blockWeekends}
+          />
+        ))}
+      </div>
+
+      {/* Floating toolbar */}
+      <div className="sticky bottom-3 sm:bottom-4 mt-3 sm:mt-4 flex items-center justify-center z-30 px-2">
+        <div className="flex items-center gap-1.5 sm:gap-2 px-2 sm:px-3 py-1.5 sm:py-2 rounded-xl border" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)', boxShadow: '0 8px 32px rgba(0,0,0,0.12)' }}>
+          <button
+            onClick={() => setCompanyMode(false)}
+            className="flex items-center gap-1 sm:gap-1.5 px-2 sm:px-3 py-1.5 rounded-lg text-[11px] sm:text-xs font-medium transition-all"
+            style={{
+              background: !companyMode ? 'var(--text-primary)' : 'transparent',
+              color: !companyMode ? 'var(--bg-card)' : 'var(--text-muted)',
+              border: companyMode ? '1px solid var(--border-primary)' : '1px solid transparent',
+            }}>
+            <MousePointer2 size={13} />
+            {selectedUser && <span className="w-2.5 h-2.5 rounded-full shrink-0" style={{ backgroundColor: selectedUser.color }} />}
+            {selectedUser ? selectedUser.username : t('vacay.modeVacation')}
+          </button>
+          {companyHolidaysEnabled && (
+            <button
+              onClick={() => setCompanyMode(true)}
+              className="flex items-center gap-1 sm:gap-1.5 px-2 sm:px-3 py-1.5 rounded-lg text-[11px] sm:text-xs font-medium transition-all"
+              style={{
+                background: companyMode ? '#d97706' : 'transparent',
+                color: companyMode ? '#fff' : 'var(--text-muted)',
+                border: !companyMode ? '1px solid var(--border-primary)' : '1px solid transparent',
+              }}>
+              <Building2 size={13} />
+              {t('vacay.modeCompany')}
+            </button>
+          )}
+        </div>
+      </div>
+    </div>
+  )
+}

client/src/components/Vacay/VacayMonthCard.jsx

@@ -0,0 +1,118 @@
+import React, { useMemo } from 'react'
+import { useTranslation } from '../../i18n'
+import { isWeekend } from './holidays'
+
+const WEEKDAYS_EN = ['Mo', 'Tu', 'We', 'Th', 'Fr', 'Sa', 'Su']
+const WEEKDAYS_DE = ['Mo', 'Di', 'Mi', 'Do', 'Fr', 'Sa', 'So']
+const MONTHS_EN = ['January', 'February', 'March', 'April', 'May', 'June', 'July', 'August', 'September', 'October', 'November', 'December']
+const MONTHS_DE = ['Januar', 'Februar', 'März', 'April', 'Mai', 'Juni', 'Juli', 'August', 'September', 'Oktober', 'November', 'Dezember']
+
+export default function VacayMonthCard({
+  year, month, holidays, companyHolidaySet, companyHolidaysEnabled = true, entryMap,
+  onCellClick, companyMode, blockWeekends
+}) {
+  const { language } = useTranslation()
+  const weekdays = language === 'de' ? WEEKDAYS_DE : WEEKDAYS_EN
+  const monthNames = language === 'de' ? MONTHS_DE : MONTHS_EN
+
+  const weeks = useMemo(() => {
+    const firstDay = new Date(year, month, 1)
+    const daysInMonth = new Date(year, month + 1, 0).getDate()
+    let startDow = firstDay.getDay() - 1
+    if (startDow < 0) startDow = 6
+    const cells = []
+    for (let i = 0; i < startDow; i++) cells.push(null)
+    for (let d = 1; d <= daysInMonth; d++) cells.push(d)
+    while (cells.length % 7 !== 0) cells.push(null)
+    const w = []
+    for (let i = 0; i < cells.length; i += 7) w.push(cells.slice(i, i + 7))
+    return w
+  }, [year, month])
+
+  const pad = (n) => String(n).padStart(2, '0')
+
+  return (
+    <div className="rounded-xl border overflow-hidden" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
+      <div className="px-3 py-2 border-b" style={{ borderColor: 'var(--border-secondary)' }}>
+        <span className="text-xs font-semibold" style={{ color: 'var(--text-primary)' }}>{monthNames[month]}</span>
+      </div>
+
+      <div className="grid grid-cols-7 border-b" style={{ borderColor: 'var(--border-secondary)' }}>
+        {weekdays.map((wd, i) => (
+          <div key={wd} className="text-center text-[10px] font-medium py-1" style={{ color: i >= 5 ? 'var(--text-faint)' : 'var(--text-muted)' }}>
+            {wd}
+          </div>
+        ))}
+      </div>
+
+      <div>
+        {weeks.map((week, wi) => (
+          <div key={wi} className="grid grid-cols-7">
+            {week.map((day, di) => {
+              if (day === null) return <div key={di} style={{ height: 28 }} />
+
+              const dateStr = `${year}-${pad(month + 1)}-${pad(day)}`
+              const weekend = di >= 5
+              const holiday = holidays[dateStr]
+              const isCompany = companyHolidaysEnabled && companyHolidaySet.has(dateStr)
+              const dayEntries = entryMap[dateStr] || []
+              const isBlocked = !!holiday || (weekend && blockWeekends) || (isCompany && !companyMode)
+
+              return (
+                <div
+                  key={di}
+                  className="relative flex items-center justify-center cursor-pointer transition-colors"
+                  style={{
+                    height: 28,
+                    background: weekend ? 'var(--bg-secondary)' : 'transparent',
+                    borderTop: '1px solid var(--border-secondary)',
+                    borderRight: '1px solid var(--border-secondary)',
+                    cursor: isBlocked ? 'default' : 'pointer',
+                  }}
+                  onClick={() => onCellClick(dateStr)}
+                  onMouseEnter={e => { if (!isBlocked) e.currentTarget.style.background = 'var(--bg-hover)' }}
+                  onMouseLeave={e => { e.currentTarget.style.background = weekend ? 'var(--bg-secondary)' : 'transparent' }}
+                >
+                  {holiday && <div className="absolute inset-0.5 rounded" style={{ background: 'rgba(239,68,68,0.12)' }} />}
+                  {isCompany && <div className="absolute inset-0.5 rounded" style={{ background: 'rgba(245,158,11,0.15)' }} />}
+
+                  {dayEntries.length === 1 && (
+                    <div className="absolute inset-0.5 rounded" style={{ backgroundColor: dayEntries[0].person_color, opacity: 0.4 }} />
+                  )}
+                  {dayEntries.length === 2 && (
+                    <div className="absolute inset-0.5 rounded" style={{
+                      background: `linear-gradient(135deg, ${dayEntries[0].person_color} 50%, ${dayEntries[1].person_color} 50%)`,
+                      opacity: 0.4,
+                    }} />
+                  )}
+                  {dayEntries.length === 3 && (
+                    <div className="absolute inset-0.5 rounded overflow-hidden" style={{ opacity: 0.4 }}>
+                      <div className="absolute top-0 left-0 w-1/2 h-full" style={{ backgroundColor: dayEntries[0].person_color }} />
+                      <div className="absolute top-0 right-0 w-1/2 h-1/2" style={{ backgroundColor: dayEntries[1].person_color }} />
+                      <div className="absolute bottom-0 right-0 w-1/2 h-1/2" style={{ backgroundColor: dayEntries[2].person_color }} />
+                    </div>
+                  )}
+                  {dayEntries.length >= 4 && (
+                    <div className="absolute inset-0.5 rounded overflow-hidden" style={{ opacity: 0.4 }}>
+                      <div className="absolute top-0 left-0 w-1/2 h-1/2" style={{ backgroundColor: dayEntries[0].person_color }} />
+                      <div className="absolute top-0 right-0 w-1/2 h-1/2" style={{ backgroundColor: dayEntries[1].person_color }} />
+                      <div className="absolute bottom-0 left-0 w-1/2 h-1/2" style={{ backgroundColor: dayEntries[2].person_color }} />
+                      <div className="absolute bottom-0 right-0 w-1/2 h-1/2" style={{ backgroundColor: dayEntries[3].person_color }} />
+                    </div>
+                  )}
+
+                  <span className="relative z-[1] text-[11px] font-medium" style={{
+                    color: holiday ? '#dc2626' : weekend ? 'var(--text-faint)' : 'var(--text-primary)',
+                    fontWeight: dayEntries.length > 0 ? 700 : 500,
+                  }}>
+                    {day}
+                  </span>
+                </div>
+              )
+            })}
+          </div>
+        ))}
+      </div>
+    </div>
+  )
+}

client/src/components/Vacay/VacayPersons.jsx

@@ -0,0 +1,190 @@
+import React, { useState, useEffect } from 'react'
+import ReactDOM from 'react-dom'
+import { UserPlus, Unlink, Check, Loader2, Clock, X } from 'lucide-react'
+import { useVacayStore } from '../../store/vacayStore'
+import { useAuthStore } from '../../store/authStore'
+import { useTranslation } from '../../i18n'
+import { useToast } from '../shared/Toast'
+import CustomSelect from '../shared/CustomSelect'
+import apiClient from '../../api/client'
+
+const PRESET_COLORS = [
+  '#6366f1', '#ec4899', '#14b8a6', '#8b5cf6', '#ef4444',
+  '#3b82f6', '#22c55e', '#06b6d4', '#f43f5e', '#a855f7',
+  '#10b981', '#0ea5e9', '#64748b', '#be185d', '#0d9488',
+]
+
+export default function VacayPersons() {
+  const { t } = useTranslation()
+  const toast = useToast()
+  const { users, pendingInvites, invite, cancelInvite, updateColor, selectedUserId, setSelectedUserId, isFused } = useVacayStore()
+  const { user: currentUser } = useAuthStore()
+
+  // Default selectedUserId to current user
+  useEffect(() => {
+    if (!selectedUserId && currentUser) setSelectedUserId(currentUser.id)
+  }, [currentUser, selectedUserId])
+  const [showInvite, setShowInvite] = useState(false)
+  const [showColorPicker, setShowColorPicker] = useState(false)
+  const [colorEditUserId, setColorEditUserId] = useState(null)
+  const [availableUsers, setAvailableUsers] = useState([])
+  const [selectedInviteUser, setSelectedInviteUser] = useState(null)
+  const [inviting, setInviting] = useState(false)
+
+  const loadAvailable = async () => {
+    try {
+      const data = await apiClient.get('/addons/vacay/available-users').then(r => r.data)
+      setAvailableUsers(data.users)
+    } catch { /* */ }
+  }
+
+  const handleInvite = async () => {
+    if (!selectedInviteUser) return
+    setInviting(true)
+    try {
+      await invite(selectedInviteUser)
+      toast.success(t('vacay.inviteSent'))
+      setShowInvite(false)
+      setSelectedInviteUser(null)
+    } catch (err) {
+      toast.error(err.response?.data?.error || t('vacay.inviteError'))
+    } finally {
+      setInviting(false)
+    }
+  }
+
+  const handleColorChange = async (color) => {
+    await updateColor(color, colorEditUserId)
+    setShowColorPicker(false)
+    setColorEditUserId(null)
+  }
+
+  const editingUserColor = users.find(u => u.id === colorEditUserId)?.color || '#6366f1'
+
+  return (
+    <div className="rounded-xl border p-3" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
+      <div className="flex items-center justify-between mb-2">
+        <span className="text-[11px] font-medium uppercase tracking-wider" style={{ color: 'var(--text-faint)' }}>{t('vacay.persons')}</span>
+        <button onClick={() => { setShowInvite(true); loadAvailable() }}
+          className="p-0.5 rounded transition-colors" style={{ color: 'var(--text-faint)' }}>
+          <UserPlus size={14} />
+        </button>
+      </div>
+
+      <div className="flex flex-col gap-0.5">
+        {users.map(u => {
+          const isSelected = selectedUserId === u.id
+          return (
+            <div key={u.id}
+              onClick={() => { if (isFused) setSelectedUserId(u.id) }}
+              className="flex items-center gap-2 px-2.5 py-1.5 rounded-lg group transition-all"
+              style={{
+                background: isSelected ? 'var(--bg-hover)' : 'transparent',
+                border: isSelected ? '1px solid var(--border-primary)' : '1px solid transparent',
+                cursor: isFused ? 'pointer' : 'default',
+              }}>
+              <button
+                onClick={(e) => { e.stopPropagation(); setColorEditUserId(u.id); setShowColorPicker(true) }}
+                className="w-3.5 h-3.5 rounded-full shrink-0 transition-transform hover:scale-125"
+                style={{ backgroundColor: u.color, cursor: 'pointer' }}
+                title={t('vacay.changeColor')}
+              />
+              <span className="text-xs font-medium flex-1 truncate" style={{ color: 'var(--text-primary)' }}>
+                {u.username}
+                {u.id === currentUser?.id && <span style={{ color: 'var(--text-faint)' }}> ({t('vacay.you')})</span>}
+              </span>
+              {isSelected && isFused && (
+                <Check size={12} style={{ color: 'var(--text-primary)' }} />
+              )}
+            </div>
+          )
+        })}
+
+        {/* Pending invites */}
+        {pendingInvites.map(inv => (
+          <div key={inv.id} className="flex items-center gap-2 px-2.5 py-1.5 rounded-lg group"
+            style={{ background: 'var(--bg-secondary)', opacity: 0.7 }}>
+            <Clock size={12} style={{ color: 'var(--text-faint)' }} />
+            <span className="text-xs flex-1 truncate" style={{ color: 'var(--text-muted)' }}>
+              {inv.username} <span className="text-[10px]">({t('vacay.pending')})</span>
+            </span>
+            <button onClick={() => cancelInvite(inv.user_id)}
+              className="opacity-0 group-hover:opacity-100 text-[10px] px-1.5 py-0.5 rounded transition-all"
+              style={{ color: 'var(--text-faint)' }}>
+              {t('common.cancel')}
+            </button>
+          </div>
+        ))}
+      </div>
+
+      {/* Invite Modal — Portal to body to avoid z-index issues */}
+      {showInvite && ReactDOM.createPortal(
+        <div className="fixed inset-0 flex items-center justify-center px-4" style={{ zIndex: 99990, backgroundColor: 'rgba(15,23,42,0.5)', paddingTop: 70 }}
+          onClick={() => setShowInvite(false)}>
+          <div className="rounded-2xl shadow-2xl w-full max-w-sm" style={{ background: 'var(--bg-card)', animation: 'modalIn 0.2s ease-out' }}
+            onClick={e => e.stopPropagation()}>
+            <div className="flex items-center justify-between p-5" style={{ borderBottom: '1px solid var(--border-secondary)' }}>
+              <h2 className="text-base font-semibold" style={{ color: 'var(--text-primary)' }}>{t('vacay.inviteUser')}</h2>
+              <button onClick={() => setShowInvite(false)} className="p-1.5 rounded-lg transition-colors" style={{ color: 'var(--text-faint)' }}>
+                <X size={16} />
+              </button>
+            </div>
+            <div className="p-5 space-y-4">
+              <p className="text-xs" style={{ color: 'var(--text-muted)' }}>{t('vacay.inviteHint')}</p>
+              {availableUsers.length === 0 ? (
+                <p className="text-xs text-center py-4" style={{ color: 'var(--text-faint)' }}>{t('vacay.noUsersAvailable')}</p>
+              ) : (
+                <CustomSelect
+                  value={selectedInviteUser}
+                  onChange={setSelectedInviteUser}
+                  options={availableUsers.map(u => ({ value: u.id, label: `${u.username} (${u.email})` }))}
+                  placeholder={t('vacay.selectUser')}
+                  searchable
+                />
+              )}
+              <div className="flex gap-3 justify-end pt-2">
+                <button onClick={() => setShowInvite(false)} className="px-4 py-2 text-sm rounded-lg"
+                  style={{ color: 'var(--text-muted)', border: '1px solid var(--border-primary)' }}>
+                  {t('common.cancel')}
+                </button>
+                <button onClick={handleInvite} disabled={!selectedInviteUser || inviting}
+                  className="px-4 py-2 text-sm rounded-lg transition-colors flex items-center gap-1.5 disabled:opacity-40"
+                  style={{ background: 'var(--text-primary)', color: 'var(--bg-card)' }}>
+                  {inviting && <Loader2 size={13} className="animate-spin" />}
+                  {t('vacay.sendInvite')}
+                </button>
+              </div>
+            </div>
+          </div>
+        </div>,
+        document.body
+      )}
+
+      {/* Color Picker Modal — Portal to body */}
+      {showColorPicker && ReactDOM.createPortal(
+        <div className="fixed inset-0 flex items-center justify-center px-4" style={{ zIndex: 99990, backgroundColor: 'rgba(15,23,42,0.5)', paddingTop: 70 }}
+          onClick={() => { setShowColorPicker(false); setColorEditUserId(null) }}>
+          <div className="rounded-2xl shadow-2xl w-full max-w-xs" style={{ background: 'var(--bg-card)', animation: 'modalIn 0.2s ease-out' }}
+            onClick={e => e.stopPropagation()}>
+            <div className="flex items-center justify-between p-5" style={{ borderBottom: '1px solid var(--border-secondary)' }}>
+              <h2 className="text-base font-semibold" style={{ color: 'var(--text-primary)' }}>{t('vacay.changeColor')}</h2>
+              <button onClick={() => { setShowColorPicker(false); setColorEditUserId(null) }} className="p-1.5 rounded-lg transition-colors" style={{ color: 'var(--text-faint)' }}>
+                <X size={16} />
+              </button>
+            </div>
+            <div className="p-5">
+              <div className="flex flex-wrap gap-2 justify-center">
+                {PRESET_COLORS.map(c => (
+                  <button key={c} onClick={() => handleColorChange(c)}
+                    className={`w-8 h-8 rounded-full transition-all ${editingUserColor === c ? 'ring-2 ring-offset-2 scale-110' : 'hover:scale-110'}`}
+                    style={{ backgroundColor: c }} />
+                ))}
+              </div>
+            </div>
+          </div>
+        </div>,
+        document.body
+      )}
+    </div>
+  )
+}

client/src/components/Vacay/VacaySettings.jsx

@@ -0,0 +1,213 @@
+import React, { useState, useEffect } from 'react'
+import { MapPin, CalendarOff, AlertCircle, Building2, Unlink, ArrowRightLeft, Globe } from 'lucide-react'
+import { useVacayStore } from '../../store/vacayStore'
+import { useTranslation } from '../../i18n'
+import { useToast } from '../shared/Toast'
+import CustomSelect from '../shared/CustomSelect'
+import apiClient from '../../api/client'
+
+export default function VacaySettings({ onClose }) {
+  const { t } = useTranslation()
+  const toast = useToast()
+  const { plan, updatePlan, isFused, dissolve, users } = useVacayStore()
+  const [countries, setCountries] = useState([])
+  const [regions, setRegions] = useState([])
+  const [loadingRegions, setLoadingRegions] = useState(false)
+
+  const { language } = useTranslation()
+
+  // Load available countries with localized names
+  useEffect(() => {
+    apiClient.get('/addons/vacay/holidays/countries').then(r => {
+      let displayNames
+      try { displayNames = new Intl.DisplayNames([language === 'de' ? 'de' : 'en'], { type: 'region' }) } catch { /* */ }
+      const list = r.data.map(c => ({
+        value: c.countryCode,
+        label: displayNames ? (displayNames.of(c.countryCode) || c.name) : c.name,
+      }))
+      list.sort((a, b) => a.label.localeCompare(b.label))
+      setCountries(list)
+    }).catch(() => {})
+  }, [language])
+
+  // When country changes, check if it has regions
+  const selectedCountry = plan?.holidays_region?.split('-')[0] || ''
+  const selectedRegion = plan?.holidays_region?.includes('-') ? plan.holidays_region : ''
+
+  useEffect(() => {
+    if (!selectedCountry || !plan?.holidays_enabled) { setRegions([]); return }
+    setLoadingRegions(true)
+    const year = new Date().getFullYear()
+    apiClient.get(`/addons/vacay/holidays/${year}/${selectedCountry}`).then(r => {
+      const allCounties = new Set()
+      r.data.forEach(h => {
+        if (h.counties) h.counties.forEach(c => allCounties.add(c))
+      })
+      if (allCounties.size > 0) {
+        let subdivisionNames
+        try { subdivisionNames = new Intl.DisplayNames([language === 'de' ? 'de' : 'en'], { type: 'region' }) } catch { /* */ }
+        const regionList = [...allCounties].sort().map(c => {
+          let label = c.split('-')[1] || c
+          // Try Intl for full subdivision name (not all browsers support subdivision codes)
+          // Fallback: use known mappings for DE
+          if (c.startsWith('DE-')) {
+            const deRegions = { BW:'Baden-Württemberg',BY:'Bayern',BE:'Berlin',BB:'Brandenburg',HB:'Bremen',HH:'Hamburg',HE:'Hessen',MV:'Mecklenburg-Vorpommern',NI:'Niedersachsen',NW:'Nordrhein-Westfalen',RP:'Rheinland-Pfalz',SL:'Saarland',SN:'Sachsen',ST:'Sachsen-Anhalt',SH:'Schleswig-Holstein',TH:'Thüringen' }
+            label = deRegions[c.split('-')[1]] || label
+          } else if (c.startsWith('CH-')) {
+            const chRegions = { AG:'Aargau',AI:'Appenzell Innerrhoden',AR:'Appenzell Ausserrhoden',BE:'Bern',BL:'Basel-Landschaft',BS:'Basel-Stadt',FR:'Freiburg',GE:'Genf',GL:'Glarus',GR:'Graubünden',JU:'Jura',LU:'Luzern',NE:'Neuenburg',NW:'Nidwalden',OW:'Obwalden',SG:'St. Gallen',SH:'Schaffhausen',SO:'Solothurn',SZ:'Schwyz',TG:'Thurgau',TI:'Tessin',UR:'Uri',VD:'Waadt',VS:'Wallis',ZG:'Zug',ZH:'Zürich' }
+            label = chRegions[c.split('-')[1]] || label
+          }
+          return { value: c, label }
+        })
+        setRegions(regionList)
+      } else {
+        setRegions([])
+        // If no regions, just set country code as region
+        if (plan.holidays_region !== selectedCountry) {
+          updatePlan({ holidays_region: selectedCountry })
+        }
+      }
+    }).catch(() => setRegions([])).finally(() => setLoadingRegions(false))
+  }, [selectedCountry, plan?.holidays_enabled])
+
+  if (!plan) return null
+
+  const toggle = (key) => updatePlan({ [key]: !plan[key] })
+
+  const handleCountryChange = (countryCode) => {
+    updatePlan({ holidays_region: countryCode })
+  }
+
+  const handleRegionChange = (regionCode) => {
+    updatePlan({ holidays_region: regionCode })
+  }
+
+  return (
+    <div className="space-y-5">
+      {/* Block weekends */}
+      <SettingToggle
+        icon={CalendarOff}
+        label={t('vacay.blockWeekends')}
+        hint={t('vacay.blockWeekendsHint')}
+        value={plan.block_weekends}
+        onChange={() => toggle('block_weekends')}
+      />
+
+      {/* Carry-over */}
+      <SettingToggle
+        icon={ArrowRightLeft}
+        label={t('vacay.carryOver')}
+        hint={t('vacay.carryOverHint')}
+        value={plan.carry_over_enabled}
+        onChange={() => toggle('carry_over_enabled')}
+      />
+
+      {/* Company holidays */}
+      <div>
+        <SettingToggle
+          icon={Building2}
+          label={t('vacay.companyHolidays')}
+          hint={t('vacay.companyHolidaysHint')}
+          value={plan.company_holidays_enabled}
+          onChange={() => toggle('company_holidays_enabled')}
+        />
+        {plan.company_holidays_enabled && (
+          <div className="ml-7 mt-2">
+            <div className="flex items-center gap-1.5 px-2 py-1.5 rounded-md" style={{ background: 'var(--bg-secondary)' }}>
+              <AlertCircle size={12} style={{ color: 'var(--text-faint)' }} />
+              <span className="text-[10px]" style={{ color: 'var(--text-faint)' }}>{t('vacay.companyHolidaysNoDeduct')}</span>
+            </div>
+          </div>
+        )}
+      </div>
+
+      {/* Public holidays */}
+      <div>
+        <SettingToggle
+          icon={Globe}
+          label={t('vacay.publicHolidays')}
+          hint={t('vacay.publicHolidaysHint')}
+          value={plan.holidays_enabled}
+          onChange={() => toggle('holidays_enabled')}
+        />
+        {plan.holidays_enabled && (
+          <div className="ml-7 mt-2 space-y-2">
+            <CustomSelect
+              value={selectedCountry}
+              onChange={handleCountryChange}
+              options={countries}
+              placeholder={t('vacay.selectCountry')}
+              searchable
+            />
+            {regions.length > 0 && (
+              <CustomSelect
+                value={selectedRegion}
+                onChange={handleRegionChange}
+                options={regions}
+                placeholder={t('vacay.selectRegion')}
+                searchable
+              />
+            )}
+          </div>
+        )}
+      </div>
+
+      {/* Dissolve fusion */}
+      {isFused && (
+        <div className="pt-4 mt-2 border-t" style={{ borderColor: 'var(--border-secondary)' }}>
+          <div className="rounded-xl overflow-hidden" style={{ border: '1px solid rgba(239,68,68,0.2)' }}>
+            <div className="px-4 py-3 flex items-center gap-3" style={{ background: 'rgba(239,68,68,0.06)' }}>
+              <div className="w-8 h-8 rounded-lg flex items-center justify-center" style={{ background: 'rgba(239,68,68,0.1)' }}>
+                <Unlink size={16} className="text-red-500" />
+              </div>
+              <div>
+                <p className="text-sm font-semibold" style={{ color: 'var(--text-primary)' }}>{t('vacay.dissolve')}</p>
+                <p className="text-[11px]" style={{ color: 'var(--text-faint)' }}>{t('vacay.dissolveHint')}</p>
+              </div>
+            </div>
+            <div className="px-4 py-3 flex items-center gap-2 flex-wrap" style={{ borderTop: '1px solid rgba(239,68,68,0.1)' }}>
+              {users.map(u => (
+                <div key={u.id} className="flex items-center gap-1.5 px-2 py-1 rounded-md" style={{ background: 'var(--bg-secondary)' }}>
+                  <span className="w-2 h-2 rounded-full" style={{ backgroundColor: u.color || '#6366f1' }} />
+                  <span className="text-xs font-medium" style={{ color: 'var(--text-primary)' }}>{u.username}</span>
+                </div>
+              ))}
+            </div>
+            <div className="px-4 py-3" style={{ borderTop: '1px solid rgba(239,68,68,0.1)' }}>
+              <button
+                onClick={async () => {
+                  await dissolve()
+                  toast.success(t('vacay.dissolved'))
+                  onClose()
+                }}
+                className="w-full px-3 py-2 text-xs font-medium bg-red-500 hover:bg-red-600 text-white rounded-lg transition-colors"
+              >
+                {t('vacay.dissolveAction')}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}
+
+function SettingToggle({ icon: Icon, label, hint, value, onChange }) {
+  return (
+    <div className="flex items-center justify-between gap-3">
+      <div className="flex items-center gap-2 min-w-0">
+        <Icon size={15} className="shrink-0" style={{ color: 'var(--text-muted)' }} />
+        <div className="min-w-0">
+          <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>{label}</p>
+          <p className="text-[11px]" style={{ color: 'var(--text-faint)' }}>{hint}</p>
+        </div>
+      </div>
+      <button onClick={onChange}
+        className="relative shrink-0 inline-flex h-6 w-11 items-center rounded-full transition-colors"
+        style={{ background: value ? 'var(--text-primary)' : 'var(--border-primary)' }}>
+        <span className="absolute left-1 h-4 w-4 rounded-full transition-transform duration-200"
+          style={{ background: 'var(--bg-card)', transform: value ? 'translateX(20px)' : 'translateX(0)' }} />
+      </button>
+    </div>
+  )
+}

client/src/components/Vacay/VacayStats.jsx

@@ -0,0 +1,124 @@
+import React, { useEffect, useState } from 'react'
+import { Briefcase, Pencil } from 'lucide-react'
+import { useVacayStore } from '../../store/vacayStore'
+import { useAuthStore } from '../../store/authStore'
+import { useTranslation } from '../../i18n'
+
+export default function VacayStats() {
+  const { t } = useTranslation()
+  const { stats, selectedYear, loadStats, updateVacationDays, isFused } = useVacayStore()
+  const { user: currentUser } = useAuthStore()
+
+  useEffect(() => { loadStats(selectedYear) }, [selectedYear])
+
+  return (
+    <div className="rounded-xl border p-3" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
+      <div className="flex items-center gap-1.5 mb-3">
+        <Briefcase size={13} style={{ color: 'var(--text-faint)' }} />
+        <span className="text-[11px] font-medium uppercase tracking-wider" style={{ color: 'var(--text-faint)' }}>
+          {t('vacay.entitlement')} {selectedYear}
+        </span>
+      </div>
+
+      {stats.length === 0 ? (
+        <p className="text-[11px] text-center py-3" style={{ color: 'var(--text-faint)' }}>{t('vacay.noData')}</p>
+      ) : (
+        <div className="space-y-2">
+          {stats.map(s => (
+            <StatCard
+              key={s.user_id}
+              stat={s}
+              isMe={s.user_id === currentUser?.id}
+              canEdit={s.user_id === currentUser?.id || isFused}
+              selectedYear={selectedYear}
+              onSave={updateVacationDays}
+              t={t}
+            />
+          ))}
+        </div>
+      )}
+    </div>
+  )
+}
+
+function StatCard({ stat: s, isMe, canEdit, selectedYear, onSave, t }) {
+  const [editing, setEditing] = useState(false)
+  const [localDays, setLocalDays] = useState(s.vacation_days)
+  const pct = s.total_available > 0 ? Math.min(100, (s.used / s.total_available) * 100) : 0
+
+  // Sync local state when stats reload from server
+  useEffect(() => {
+    if (!editing) setLocalDays(s.vacation_days)
+  }, [s.vacation_days, editing])
+
+  const handleSave = () => {
+    setEditing(false)
+    const days = parseInt(localDays)
+    if (!isNaN(days) && days >= 0 && days <= 365 && days !== s.vacation_days) {
+      onSave(selectedYear, days, s.user_id)
+    }
+  }
+
+  return (
+    <div className="rounded-lg p-2.5 space-y-2" style={{ border: '1px solid var(--border-secondary)' }}>
+      <div className="flex items-center gap-2">
+        <span className="w-2.5 h-2.5 rounded-full shrink-0" style={{ backgroundColor: s.person_color }} />
+        <span className="text-xs font-semibold flex-1 truncate" style={{ color: 'var(--text-primary)' }}>
+          {s.person_name}
+          {isMe && <span style={{ color: 'var(--text-faint)' }}> ({t('vacay.you')})</span>}
+        </span>
+        <span className="text-[10px] tabular-nums" style={{ color: 'var(--text-faint)' }}>{s.used}/{s.total_available}</span>
+      </div>
+      <div className="h-1.5 rounded-full overflow-hidden" style={{ background: 'var(--bg-secondary)' }}>
+        <div className="h-full rounded-full transition-all duration-500" style={{ width: `${pct}%`, backgroundColor: s.person_color }} />
+      </div>
+      <div className="grid grid-cols-3 gap-1.5">
+        {/* Days — editable */}
+        <div
+          className="rounded-md px-2 py-2 group/days"
+          style={{
+            background: canEdit ? 'var(--bg-card)' : 'var(--bg-secondary)',
+            border: canEdit ? '1px solid var(--border-primary)' : '1px solid transparent',
+            cursor: canEdit ? 'pointer' : 'default',
+          }}
+          onClick={() => { if (canEdit && !editing) setEditing(true) }}
+        >
+          <div className="text-[10px] mb-1" style={{ color: 'var(--text-faint)', height: 14, lineHeight: '14px' }}>
+            {t('vacay.entitlementDays')} {canEdit && !editing && <Pencil size={9} className="inline opacity-0 group-hover/days:opacity-100 transition-opacity" style={{ color: 'var(--text-faint)', verticalAlign: 'middle' }} />}
+          </div>
+          {editing ? (
+            <input
+              type="number"
+              value={localDays}
+              onChange={e => setLocalDays(e.target.value)}
+              onBlur={handleSave}
+              onKeyDown={e => { if (e.key === 'Enter') handleSave(); if (e.key === 'Escape') { setEditing(false); setLocalDays(s.vacation_days) } }}
+              autoFocus
+              className="w-full bg-transparent text-sm font-bold outline-none p-0 m-0 [appearance:textfield] [&::-webkit-inner-spin-button]:appearance-none"
+              style={{ color: 'var(--text-primary)', height: 18, lineHeight: '18px' }}
+            />
+          ) : (
+            <div className="text-sm font-bold" style={{ color: 'var(--text-primary)', height: 18, lineHeight: '18px' }}>{s.vacation_days}</div>
+          )}
+        </div>
+        {/* Used */}
+        <div className="rounded-md px-2 py-2" style={{ background: 'var(--bg-secondary)' }}>
+          <div className="text-[10px] mb-1" style={{ color: 'var(--text-faint)', height: 14, lineHeight: '14px' }}>{t('vacay.used')}</div>
+          <div className="text-sm font-bold" style={{ color: 'var(--text-primary)', height: 18, lineHeight: '18px' }}>{s.used}</div>
+        </div>
+        {/* Remaining */}
+        <div className="rounded-md px-2 py-2" style={{ background: 'var(--bg-secondary)' }}>
+          <div className="text-[10px] mb-1" style={{ color: 'var(--text-faint)', height: 14, lineHeight: '14px' }}>{t('vacay.remaining')}</div>
+          <div className="text-sm font-bold" style={{ color: s.remaining < 0 ? '#ef4444' : s.remaining <= 3 ? '#f59e0b' : '#22c55e', height: 18, lineHeight: '18px' }}>
+            {s.remaining}
+          </div>
+        </div>
+      </div>
+      {s.carried_over > 0 && (
+        <div className="flex items-center gap-1.5 px-2 py-1 rounded-md" style={{ background: 'rgba(245,158,11,0.08)', border: '1px solid rgba(245,158,11,0.15)' }}>
+          <span className="text-[10px]" style={{ color: '#d97706' }}>+{s.carried_over} {t('vacay.carriedOver', { year: selectedYear - 1 })}</span>
+        </div>
+      )}
+    </div>
+  )
+}

client/src/components/Vacay/holidays.js

@@ -0,0 +1,146 @@
+// German public holidays (Feiertage) calculation per Bundesland
+// Includes fixed and Easter-dependent movable holidays
+
+const BUNDESLAENDER = {
+  BW: 'Baden-Württemberg',
+  BY: 'Bayern',
+  BE: 'Berlin',
+  BB: 'Brandenburg',
+  HB: 'Bremen',
+  HH: 'Hamburg',
+  HE: 'Hessen',
+  MV: 'Mecklenburg-Vorpommern',
+  NI: 'Niedersachsen',
+  NW: 'Nordrhein-Westfalen',
+  RP: 'Rheinland-Pfalz',
+  SL: 'Saarland',
+  SN: 'Sachsen',
+  ST: 'Sachsen-Anhalt',
+  SH: 'Schleswig-Holstein',
+  TH: 'Thüringen',
+};
+
+// Gauss Easter algorithm
+function easterSunday(year) {
+  const a = year % 19;
+  const b = Math.floor(year / 100);
+  const c = year % 100;
+  const d = Math.floor(b / 4);
+  const e = b % 4;
+  const f = Math.floor((b + 8) / 25);
+  const g = Math.floor((b - f + 1) / 3);
+  const h = (19 * a + b - d - g + 15) % 30;
+  const i = Math.floor(c / 4);
+  const k = c % 4;
+  const l = (32 + 2 * e + 2 * i - h - k) % 7;
+  const m = Math.floor((a + 11 * h + 22 * l) / 451);
+  const month = Math.floor((h + l - 7 * m + 114) / 31);
+  const day = ((h + l - 7 * m + 114) % 31) + 1;
+  return new Date(year, month - 1, day);
+}
+
+function addDays(date, days) {
+  const d = new Date(date);
+  d.setDate(d.getDate() + days);
+  return d;
+}
+
+function fmt(date) {
+  const y = date.getFullYear();
+  const m = String(date.getMonth() + 1).padStart(2, '0');
+  const d = String(date.getDate()).padStart(2, '0');
+  return `${y}-${m}-${d}`;
+}
+
+export function getHolidays(year, bundesland = 'NW') {
+  const easter = easterSunday(year);
+  const holidays = {};
+
+  // Fixed holidays (nationwide)
+  holidays[`${year}-01-01`] = 'Neujahr';
+  holidays[`${year}-05-01`] = 'Tag der Arbeit';
+  holidays[`${year}-10-03`] = 'Tag der Deutschen Einheit';
+  holidays[`${year}-12-25`] = '1. Weihnachtsfeiertag';
+  holidays[`${year}-12-26`] = '2. Weihnachtsfeiertag';
+
+  // Easter-dependent (nationwide)
+  holidays[fmt(addDays(easter, -2))] = 'Karfreitag';
+  holidays[fmt(addDays(easter, 1))] = 'Ostermontag';
+  holidays[fmt(addDays(easter, 39))] = 'Christi Himmelfahrt';
+  holidays[fmt(addDays(easter, 50))] = 'Pfingstmontag';
+
+  // State-specific
+  const bl = bundesland.toUpperCase();
+
+  // Heilige Drei Könige (6. Jan) — BW, BY, ST
+  if (['BW', 'BY', 'ST'].includes(bl)) {
+    holidays[`${year}-01-06`] = 'Heilige Drei Könige';
+  }
+
+  // Internationaler Frauentag (8. März) — BE, MV
+  if (['BE', 'MV'].includes(bl)) {
+    holidays[`${year}-03-08`] = 'Internationaler Frauentag';
+  }
+
+  // Fronleichnam — BW, BY, HE, NW, RP, SL, SN (teilweise), TH (teilweise)
+  if (['BW', 'BY', 'HE', 'NW', 'RP', 'SL'].includes(bl)) {
+    holidays[fmt(addDays(easter, 60))] = 'Fronleichnam';
+  }
+
+  // Mariä Himmelfahrt (15. Aug) — SL, BY (teilweise)
+  if (['SL'].includes(bl)) {
+    holidays[`${year}-08-15`] = 'Mariä Himmelfahrt';
+  }
+
+  // Weltkindertag (20. Sep) — TH
+  if (bl === 'TH') {
+    holidays[`${year}-09-20`] = 'Weltkindertag';
+  }
+
+  // Reformationstag (31. Okt) — BB, HB, HH, MV, NI, SN, ST, SH, TH
+  if (['BB', 'HB', 'HH', 'MV', 'NI', 'SN', 'ST', 'SH', 'TH'].includes(bl)) {
+    holidays[`${year}-10-31`] = 'Reformationstag';
+  }
+
+  // Allerheiligen (1. Nov) — BW, BY, NW, RP, SL
+  if (['BW', 'BY', 'NW', 'RP', 'SL'].includes(bl)) {
+    holidays[`${year}-11-01`] = 'Allerheiligen';
+  }
+
+  // Buß- und Bettag — SN (Mittwoch vor dem 23. November)
+  if (bl === 'SN') {
+    const nov23 = new Date(year, 10, 23);
+    let bbt = new Date(nov23);
+    while (bbt.getDay() !== 3) bbt.setDate(bbt.getDate() - 1);
+    holidays[fmt(bbt)] = 'Buß- und Bettag';
+  }
+
+  return holidays;
+}
+
+export function isWeekend(dateStr) {
+  const d = new Date(dateStr + 'T00:00:00');
+  const day = d.getDay();
+  return day === 0 || day === 6;
+}
+
+export function getWeekday(dateStr) {
+  const d = new Date(dateStr + 'T00:00:00');
+  return ['So', 'Mo', 'Di', 'Mi', 'Do', 'Fr', 'Sa'][d.getDay()];
+}
+
+export function getWeekdayFull(dateStr) {
+  const d = new Date(dateStr + 'T00:00:00');
+  return ['Sonntag', 'Montag', 'Dienstag', 'Mittwoch', 'Donnerstag', 'Freitag', 'Samstag'][d.getDay()];
+}
+
+export function daysInMonth(year, month) {
+  return new Date(year, month, 0).getDate();
+}
+
+export function formatDate(dateStr) {
+  const d = new Date(dateStr + 'T00:00:00');
+  return d.toLocaleDateString('de-DE', { weekday: 'short', day: '2-digit', month: '2-digit', year: 'numeric' });
+}
+
+export { BUNDESLAENDER };

client/src/components/shared/CustomDateTimePicker.jsx

@@ -73,11 +73,26 @@ export function CustomDatePicker({ value, onChange, placeholder, style = {} }) {
       {open && ReactDOM.createPortal(
         <div ref={dropRef} style={{
           position: 'fixed',
-          top: (() => { const r = ref.current?.getBoundingClientRect(); return r ? r.bottom + 4 : 0 })(),
-          left: (() => { const r = ref.current?.getBoundingClientRect(); return r ? r.left : 0 })(),
+          ...(() => {
+            const r = ref.current?.getBoundingClientRect()
+            if (!r) return { top: 0, left: 0 }
+            const w = 268, pad = 8
+            const vw = window.innerWidth
+            const vh = window.innerHeight
+            let left = r.left
+            let top = r.bottom + 4
+            // Keep within viewport horizontally
+            if (left + w > vw - pad) left = Math.max(pad, vw - w - pad)
+            // If not enough space below, open above
+            if (top + 320 > vh) top = Math.max(pad, r.top - 320)
+            // On very small screens, center horizontally
+            if (vw < 360) left = Math.max(pad, (vw - w) / 2)
+            return { top, left }
+          })(),
           zIndex: 99999,
           background: 'var(--bg-card)', border: '1px solid var(--border-primary)',
           borderRadius: 14, boxShadow: '0 8px 32px rgba(0,0,0,0.12)', padding: 12, width: 268,
+          maxWidth: 'calc(100vw - 16px)',
           animation: 'selectIn 0.15s ease-out',
           backdropFilter: 'blur(24px)', WebkitBackdropFilter: 'blur(24px)',
         }}>

client/src/components/shared/Modal.jsx

@@ -39,8 +39,8 @@ export default function Modal({
 
   return (
     <div
-      className="fixed inset-0 z-50 flex items-center justify-center px-4 modal-backdrop"
-      style={{ backgroundColor: 'rgba(15, 23, 42, 0.5)', paddingTop: 70, paddingBottom: 20 }}
+      className="fixed inset-0 z-50 flex items-start sm:items-center justify-center px-4 modal-backdrop"
+      style={{ backgroundColor: 'rgba(15, 23, 42, 0.5)', paddingTop: 70, paddingBottom: 20, overflow: 'hidden' }}
       onMouseDown={e => { mouseDownTarget.current = e.target }}
       onClick={e => {
         if (e.target === e.currentTarget && mouseDownTarget.current === e.currentTarget) onClose()
@@ -50,7 +50,7 @@ export default function Modal({
       <div
         className={`
           rounded-2xl shadow-2xl w-full ${sizeClasses[size] || sizeClasses.md}
-          flex flex-col max-h-[90vh]
+          flex flex-col max-h-[calc(100vh-90px)]
           animate-in fade-in zoom-in-95 duration-200
         `}
         style={{

client/src/i18n/translations/de.js

@@ -48,6 +48,9 @@ const de = {
   'dashboard.subtitle.activeMany': '{count} aktive Reisen',
   'dashboard.subtitle.archivedSuffix': ' · {count} archiviert',
   'dashboard.newTrip': 'Neue Reise',
+  'dashboard.currency': 'Währung',
+  'dashboard.timezone': 'Zeitzonen',
+  'dashboard.localTime': 'Lokal',
   'dashboard.emptyTitle': 'Noch keine Reisen',
   'dashboard.emptyText': 'Erstelle deine erste Reise und beginne mit der Planung von Orten, Tagesabläufen und Packlisten.',
   'dashboard.emptyButton': 'Erste Reise erstellen',
@@ -125,8 +128,24 @@ const de = {
   'settings.email': 'E-Mail',
   'settings.role': 'Rolle',
   'settings.roleAdmin': 'Administrator',
+  'settings.oidcLinked': 'Verknüpft mit',
+  'settings.changePassword': 'Passwort ändern',
+  'settings.currentPassword': 'Aktuelles Passwort',
+  'settings.newPassword': 'Neues Passwort',
+  'settings.confirmPassword': 'Neues Passwort bestätigen',
+  'settings.updatePassword': 'Passwort aktualisieren',
+  'settings.passwordRequired': 'Bitte aktuelles und neues Passwort eingeben',
+  'settings.passwordTooShort': 'Passwort muss mindestens 8 Zeichen lang sein',
+  'settings.passwordMismatch': 'Passwörter stimmen nicht überein',
+  'settings.passwordChanged': 'Passwort erfolgreich geändert',
+  'settings.deleteAccount': 'Löschen',
+  'settings.deleteAccountTitle': 'Account wirklich löschen?',
+  'settings.deleteAccountWarning': 'Dein Account und alle deine Reisen, Orte und Dateien werden unwiderruflich gelöscht. Diese Aktion kann nicht rückgängig gemacht werden.',
+  'settings.deleteAccountConfirm': 'Endgültig löschen',
+  'settings.deleteBlockedTitle': 'Löschung nicht möglich',
+  'settings.deleteBlockedMessage': 'Du bist der einzige Administrator. Ernenne zuerst einen anderen Benutzer zum Admin, bevor du deinen Account löschen kannst.',
   'settings.roleUser': 'Benutzer',
-  'settings.saveProfile': 'Profil speichern',
+  'settings.saveProfile': 'Speichern',
   'settings.toast.mapSaved': 'Karteneinstellungen gespeichert',
   'settings.toast.keysSaved': 'API-Schlüssel gespeichert',
   'settings.toast.displaySaved': 'Anzeigeeinstellungen gespeichert',
@@ -188,6 +207,7 @@ const de = {
   'admin.table.email': 'E-Mail',
   'admin.table.role': 'Rolle',
   'admin.table.created': 'Erstellt',
+  'admin.table.lastLogin': 'Letzter Login',
   'admin.table.actions': 'Aktionen',
   'admin.you': '(Du)',
   'admin.editUser': 'Benutzer bearbeiten',
@@ -210,20 +230,174 @@ const de = {
   'admin.allowRegistration': 'Registrierung erlauben',
   'admin.allowRegistrationHint': 'Neue Benutzer können sich selbst registrieren',
   'admin.apiKeys': 'API-Schlüssel',
+  'admin.apiKeysHint': 'Optional. Aktiviert erweiterte Ortsdaten wie Fotos und Wetter.',
   'admin.mapsKey': 'Google Maps API Key',
   'admin.mapsKeyHint': 'Für Ortsuche benötigt. Erstellen unter console.cloud.google.com',
+  'admin.mapsKeyHintLong': 'Ohne API Key wird OpenStreetMap für die Ortssuche genutzt. Mit Google API Key können zusätzlich Bilder, Bewertungen und Öffnungszeiten geladen werden. Erstellen unter console.cloud.google.com.',
+  'admin.recommended': 'Empfohlen',
   'admin.weatherKey': 'OpenWeatherMap API Key',
   'admin.weatherKeyHint': 'Für Wetterdaten. Kostenlos unter openweathermap.org',
   'admin.validateKey': 'Test',
   'admin.keyValid': 'Verbunden',
   'admin.keyInvalid': 'Ungültig',
   'admin.keySaved': 'API-Schlüssel gespeichert',
+  'admin.oidcTitle': 'Single Sign-On (OIDC)',
+  'admin.oidcSubtitle': 'Anmeldung über externe Anbieter wie Google, Apple, Authentik oder Keycloak.',
+  'admin.oidcDisplayName': 'Anzeigename',
+  'admin.oidcIssuer': 'Issuer URL',
+  'admin.oidcIssuerHint': 'Die OpenID Connect Issuer URL des Anbieters. z.B. https://accounts.google.com',
+  'admin.oidcSaved': 'OIDC-Konfiguration gespeichert',
+
+  // Addons
+  'admin.tabs.addons': 'Addons',
+  'admin.addons.title': 'Addons',
+  'admin.addons.subtitle': 'Aktiviere oder deaktiviere Funktionen, um NOMAD nach deinen Wünschen anzupassen.',
+  'admin.addons.subtitleBefore': 'Aktiviere oder deaktiviere Funktionen, um ',
+  'admin.addons.subtitleAfter': ' nach deinen Wünschen anzupassen.',
+  'admin.addons.enabled': 'Aktiviert',
+  'admin.addons.disabled': 'Deaktiviert',
+  'admin.addons.type.trip': 'Trip',
+  'admin.addons.type.global': 'Global',
+  'admin.addons.tripHint': 'Verfügbar als Tab innerhalb jedes Trips',
+  'admin.addons.globalHint': 'Verfügbar als eigenständiger Bereich in der Navigation',
+  'admin.addons.toast.updated': 'Addon aktualisiert',
+  'admin.addons.toast.error': 'Addon konnte nicht aktualisiert werden',
+  'admin.addons.noAddons': 'Keine Addons verfügbar',
+  'admin.update.available': 'Update verfügbar',
+  'admin.update.text': 'NOMAD {version} ist verfügbar. Du verwendest {current}.',
+  'admin.update.button': 'Auf GitHub ansehen',
+  'admin.update.install': 'Update installieren',
+  'admin.update.confirmTitle': 'Update installieren?',
+  'admin.update.confirmText': 'NOMAD wird von {current} auf {version} aktualisiert. Der Server startet danach automatisch neu.',
+  'admin.update.dataInfo': 'Alle Daten (Reisen, Benutzer, API-Schlüssel, Uploads, Vacay, Atlas, Budgets) bleiben erhalten.',
+  'admin.update.warning': 'Die App ist während des Neustarts kurz nicht erreichbar.',
+  'admin.update.confirm': 'Jetzt aktualisieren',
+  'admin.update.installing': 'Wird aktualisiert…',
+  'admin.update.success': 'Update installiert! Server startet neu…',
+  'admin.update.failed': 'Update fehlgeschlagen',
+  'admin.update.backupHint': 'Wir empfehlen, vor dem Update ein Backup zu erstellen und herunterzuladen.',
+  'admin.update.backupLink': 'Zum Backup',
+  'admin.update.howTo': 'Update-Anleitung',
+  'admin.update.dockerText': 'Deine NOMAD-Instanz läuft in Docker. Um auf {version} zu aktualisieren, führe folgende Befehle auf deinem Server aus:',
+  'admin.update.reloadHint': 'Bitte lade die Seite in wenigen Sekunden neu.',
+
+  // Vacay addon
+  'vacay.subtitle': 'Urlaubstage planen und verwalten',
+  'vacay.settings': 'Einstellungen',
+  'vacay.year': 'Jahr',
+  'vacay.addYear': 'Jahr hinzufügen',
+  'vacay.removeYear': 'Jahr entfernen',
+  'vacay.removeYearConfirm': '{year} entfernen?',
+  'vacay.removeYearHint': 'Alle Urlaubseinträge und Betriebsferien für dieses Jahr werden unwiderruflich gelöscht.',
+  'vacay.remove': 'Entfernen',
+  'vacay.persons': 'Personen',
+  'vacay.noPersons': 'Keine Personen angelegt',
+  'vacay.addPerson': 'Person hinzufügen',
+  'vacay.editPerson': 'Person bearbeiten',
+  'vacay.removePerson': 'Person entfernen',
+  'vacay.removePersonConfirm': '{name} wirklich entfernen?',
+  'vacay.removePersonHint': 'Alle Urlaubseinträge dieser Person werden unwiderruflich gelöscht.',
+  'vacay.personName': 'Name',
+  'vacay.personNamePlaceholder': 'Name eingeben',
+  'vacay.color': 'Farbe',
+  'vacay.add': 'Hinzufügen',
+  'vacay.legend': 'Legende',
+  'vacay.publicHoliday': 'Feiertag',
+  'vacay.companyHoliday': 'Betriebsferien',
+  'vacay.weekend': 'Wochenende',
+  'vacay.modeVacation': 'Urlaub',
+  'vacay.modeCompany': 'Betriebsferien',
+  'vacay.entitlement': 'Urlaubsanspruch',
+  'vacay.entitlementDays': 'Tage',
+  'vacay.used': 'Weg',
+  'vacay.remaining': 'Rest',
+  'vacay.carriedOver': 'aus {year}',
+  'vacay.blockWeekends': 'Wochenenden sperren',
+  'vacay.blockWeekendsHint': 'Verhindert Urlaubseinträge an Samstagen und Sonntagen',
+  'vacay.publicHolidays': 'Feiertage',
+  'vacay.publicHolidaysHint': 'Feiertage im Kalender markieren',
+  'vacay.selectCountry': 'Land wählen',
+  'vacay.selectRegion': 'Region wählen (optional)',
+  'vacay.companyHolidays': 'Betriebsferien',
+  'vacay.companyHolidaysHint': 'Erlaubt das Markieren von unternehmensweiten Feiertagen',
+  'vacay.companyHolidaysNoDeduct': 'Betriebsferien werden nicht vom Urlaubskontingent abgezogen.',
+  'vacay.carryOver': 'Urlaubsmitnahme',
+  'vacay.carryOverHint': 'Resturlaub automatisch ins Folgejahr übertragen',
+  'vacay.sharing': 'Teilen',
+  'vacay.sharingHint': 'Teile deinen Urlaubsplan mit anderen NOMAD-Benutzern',
+  'vacay.owner': 'Besitzer',
+  'vacay.shareEmailPlaceholder': 'E-Mail des NOMAD-Benutzers',
+  'vacay.shareSuccess': 'Plan erfolgreich geteilt',
+  'vacay.shareError': 'Plan konnte nicht geteilt werden',
+  'vacay.dissolve': 'Fusion auflösen',
+  'vacay.dissolveHint': 'Kalender wieder trennen. Deine Einträge bleiben erhalten.',
+  'vacay.dissolveAction': 'Auflösen',
+  'vacay.dissolved': 'Kalender getrennt',
+  'vacay.fusedWith': 'Fusioniert mit',
+  'vacay.you': 'du',
+  'vacay.noData': 'Keine Daten',
+  'vacay.changeColor': 'Farbe ändern',
+  'vacay.inviteUser': 'Benutzer einladen',
+  'vacay.inviteHint': 'Lade einen anderen NOMAD-Benutzer ein, um einen gemeinsamen Urlaubskalender zu teilen.',
+  'vacay.selectUser': 'Benutzer wählen',
+  'vacay.sendInvite': 'Einladung senden',
+  'vacay.inviteSent': 'Einladung gesendet',
+  'vacay.inviteError': 'Einladung konnte nicht gesendet werden',
+  'vacay.pending': 'ausstehend',
+  'vacay.noUsersAvailable': 'Keine Benutzer verfügbar',
+  'vacay.accept': 'Annehmen',
+  'vacay.decline': 'Ablehnen',
+  'vacay.acceptFusion': 'Annehmen & Fusionieren',
+  'vacay.inviteTitle': 'Fusionsanfrage',
+  'vacay.inviteWantsToFuse': 'möchte einen Urlaubskalender mit dir teilen.',
+  'vacay.fuseInfo1': 'Beide sehen alle Urlaubseinträge in einem gemeinsamen Kalender.',
+  'vacay.fuseInfo2': 'Beide können Einträge für den jeweils anderen erstellen und bearbeiten.',
+  'vacay.fuseInfo3': 'Beide können Einträge löschen und den Urlaubsanspruch ändern.',
+  'vacay.fuseInfo4': 'Einstellungen wie Feiertage und Betriebsferien werden geteilt.',
+  'vacay.fuseInfo5': 'Die Fusion kann jederzeit von beiden Seiten aufgelöst werden. Einträge bleiben erhalten.',
+  'nav.myTrips': 'Meine Trips',
+
+  // Atlas addon
+  'atlas.subtitle': 'Dein Reise-Fußabdruck auf der Welt',
+  'atlas.countries': 'Länder',
+  'atlas.trips': 'Reisen',
+  'atlas.places': 'Orte',
+  'atlas.days': 'Tage',
+  'atlas.visitedCountries': 'Besuchte Länder',
+  'atlas.cities': 'Städte',
+  'atlas.noData': 'Noch keine Reisedaten',
+  'atlas.noDataHint': 'Erstelle einen Trip und füge Orte hinzu',
+  'atlas.lastTrip': 'Letzter Trip',
+  'atlas.nextTrip': 'Nächster Trip',
+  'atlas.daysLeft': 'Tage',
+  'atlas.streak': 'Streak',
+  'atlas.year': 'Jahr',
+  'atlas.years': 'Jahre',
+  'atlas.yearInRow': 'Jahr in Folge',
+  'atlas.yearsInRow': 'Jahre in Folge',
+  'atlas.tripIn': 'Reise in',
+  'atlas.tripsIn': 'Reisen in',
+  'atlas.since': 'seit',
+  'atlas.europe': 'Europa',
+  'atlas.asia': 'Asien',
+  'atlas.northAmerica': 'N-Amerika',
+  'atlas.southAmerica': 'S-Amerika',
+  'atlas.africa': 'Afrika',
+  'atlas.oceania': 'Ozeanien',
+  'atlas.other': 'Andere',
+  'atlas.firstVisit': 'Erste Reise',
+  'atlas.lastVisitLabel': 'Letzte Reise',
+  'atlas.tripSingular': 'Reise',
+  'atlas.tripPlural': 'Reisen',
+  'atlas.placeVisited': 'Ort besucht',
+  'atlas.placesVisited': 'Orte besucht',
 
   // Trip Planner
-  'trip.tabs.plan': 'Planung',
+  'trip.tabs.plan': 'Karte',
   'trip.tabs.reservations': 'Buchungen',
-  'trip.tabs.packing': 'Packliste',
-  'trip.tabs.packingShort': 'Packliste',
+  'trip.tabs.reservationsShort': 'Buchung',
+  'trip.tabs.packing': 'Liste',
+  'trip.tabs.packingShort': 'Liste',
   'trip.tabs.budget': 'Budget',
   'trip.tabs.files': 'Dateien',
   'trip.loading': 'Reise wird geladen...',
@@ -259,6 +433,9 @@ const de = {
   'dayplan.optimize': 'Optimieren',
   'dayplan.optimized': 'Route optimiert',
   'dayplan.routeError': 'Fehler bei der Routenberechnung',
+  'dayplan.toast.needTwoPlaces': 'Mindestens zwei Orte für Routenoptimierung nötig',
+  'dayplan.toast.routeOptimized': 'Route optimiert',
+  'dayplan.toast.noGeoPlaces': 'Keine Orte mit Koordinaten für Routenberechnung gefunden',
   'dayplan.confirmed': 'Bestätigt',
   'dayplan.pendingRes': 'Ausstehend',
   'dayplan.pdf': 'PDF',
@@ -293,8 +470,10 @@ const de = {
   'places.formNotesPlaceholder': 'Persönliche Notizen...',
   'places.formReservation': 'Reservierung',
   'places.reservationNotesPlaceholder': 'Reservierungsnotizen, Bestätigungsnummer...',
-  'places.mapsSearchPlaceholder': 'Google Maps suchen...',
-  'places.mapsSearchError': 'Google Maps Suche fehlgeschlagen. Bitte API-Schlüssel in den Einstellungen hinterlegen.',
+  'places.mapsSearchPlaceholder': 'Ortssuche...',
+  'places.mapsSearchError': 'Ortssuche fehlgeschlagen.',
+  'places.osmHint': 'OpenStreetMap-Suche aktiv (ohne Bilder, Öffnungszeiten, Bewertungen). Für erweiterte Daten Google API Key in den Einstellungen hinterlegen.',
+  'places.osmActive': 'Suche via OpenStreetMap (ohne Bilder, Bewertungen & Öffnungszeiten). Google API Key in den Einstellungen hinterlegen für erweiterte Daten.',
   'places.categoryCreateError': 'Fehler beim Erstellen der Kategorie',
   'places.nameRequired': 'Bitte einen Namen eingeben',
   'places.saveError': 'Fehler beim Speichern',

client/src/i18n/translations/en.js

@@ -48,6 +48,9 @@ const en = {
   'dashboard.subtitle.activeMany': '{count} active trips',
   'dashboard.subtitle.archivedSuffix': ' · {count} archived',
   'dashboard.newTrip': 'New Trip',
+  'dashboard.currency': 'Currency',
+  'dashboard.timezone': 'Timezones',
+  'dashboard.localTime': 'Local',
   'dashboard.emptyTitle': 'No trips yet',
   'dashboard.emptyText': 'Create your first trip and start planning!',
   'dashboard.emptyButton': 'Create First Trip',
@@ -125,6 +128,22 @@ const en = {
   'settings.email': 'Email',
   'settings.role': 'Role',
   'settings.roleAdmin': 'Administrator',
+  'settings.oidcLinked': 'Linked with',
+  'settings.changePassword': 'Change Password',
+  'settings.currentPassword': 'Current password',
+  'settings.newPassword': 'New password',
+  'settings.confirmPassword': 'Confirm new password',
+  'settings.updatePassword': 'Update password',
+  'settings.passwordRequired': 'Please enter current and new password',
+  'settings.passwordTooShort': 'Password must be at least 8 characters',
+  'settings.passwordMismatch': 'Passwords do not match',
+  'settings.passwordChanged': 'Password changed successfully',
+  'settings.deleteAccount': 'Delete account',
+  'settings.deleteAccountTitle': 'Delete your account?',
+  'settings.deleteAccountWarning': 'Your account and all your trips, places, and files will be permanently deleted. This action cannot be undone.',
+  'settings.deleteAccountConfirm': 'Delete permanently',
+  'settings.deleteBlockedTitle': 'Deletion not possible',
+  'settings.deleteBlockedMessage': 'You are the only administrator. Promote another user to admin before deleting your account.',
   'settings.roleUser': 'User',
   'settings.saveProfile': 'Save Profile',
   'settings.toast.mapSaved': 'Map settings saved',
@@ -188,6 +207,7 @@ const en = {
   'admin.table.email': 'Email',
   'admin.table.role': 'Role',
   'admin.table.created': 'Created',
+  'admin.table.lastLogin': 'Last Login',
   'admin.table.actions': 'Actions',
   'admin.you': '(You)',
   'admin.editUser': 'Edit User',
@@ -210,18 +230,172 @@ const en = {
   'admin.allowRegistration': 'Allow Registration',
   'admin.allowRegistrationHint': 'New users can register themselves',
   'admin.apiKeys': 'API Keys',
+  'admin.apiKeysHint': 'Optional. Enables extended place data like photos and weather.',
   'admin.mapsKey': 'Google Maps API Key',
   'admin.mapsKeyHint': 'Required for place search. Get at console.cloud.google.com',
+  'admin.mapsKeyHintLong': 'Without an API key, OpenStreetMap is used for place search. With a Google API key, photos, ratings, and opening hours can be loaded as well. Get one at console.cloud.google.com.',
+  'admin.recommended': 'Recommended',
   'admin.weatherKey': 'OpenWeatherMap API Key',
   'admin.weatherKeyHint': 'For weather data. Free at openweathermap.org',
   'admin.validateKey': 'Test',
   'admin.keyValid': 'Connected',
   'admin.keyInvalid': 'Invalid',
   'admin.keySaved': 'API keys saved',
+  'admin.oidcTitle': 'Single Sign-On (OIDC)',
+  'admin.oidcSubtitle': 'Allow login via external providers like Google, Apple, Authentik or Keycloak.',
+  'admin.oidcDisplayName': 'Display Name',
+  'admin.oidcIssuer': 'Issuer URL',
+  'admin.oidcIssuerHint': 'The OpenID Connect Issuer URL of the provider. e.g. https://accounts.google.com',
+  'admin.oidcSaved': 'OIDC configuration saved',
+
+  // Addons
+  'admin.tabs.addons': 'Addons',
+  'admin.addons.title': 'Addons',
+  'admin.addons.subtitle': 'Enable or disable features to customize your NOMAD experience.',
+  'admin.addons.subtitleBefore': 'Enable or disable features to customize your ',
+  'admin.addons.subtitleAfter': ' experience.',
+  'admin.addons.enabled': 'Enabled',
+  'admin.addons.disabled': 'Disabled',
+  'admin.addons.type.trip': 'Trip',
+  'admin.addons.type.global': 'Global',
+  'admin.addons.tripHint': 'Available as a tab within each trip',
+  'admin.addons.globalHint': 'Available as a standalone section in the main navigation',
+  'admin.addons.toast.updated': 'Addon updated',
+  'admin.addons.toast.error': 'Failed to update addon',
+  'admin.addons.noAddons': 'No addons available',
+  'admin.update.available': 'Update available',
+  'admin.update.text': 'NOMAD {version} is available. You are running {current}.',
+  'admin.update.button': 'View on GitHub',
+  'admin.update.install': 'Install Update',
+  'admin.update.confirmTitle': 'Install Update?',
+  'admin.update.confirmText': 'NOMAD will be updated from {current} to {version}. The server will restart automatically afterwards.',
+  'admin.update.dataInfo': 'All your data (trips, users, API keys, uploads, Vacay, Atlas, budgets) will be preserved.',
+  'admin.update.warning': 'The app will be briefly unavailable during the restart.',
+  'admin.update.confirm': 'Update Now',
+  'admin.update.installing': 'Updating…',
+  'admin.update.success': 'Update installed! Server is restarting…',
+  'admin.update.failed': 'Update failed',
+  'admin.update.backupHint': 'We recommend creating a backup before updating.',
+  'admin.update.backupLink': 'Go to Backup',
+  'admin.update.howTo': 'How to Update',
+  'admin.update.dockerText': 'Your NOMAD instance runs in Docker. To update to {version}, run the following commands on your server:',
+  'admin.update.reloadHint': 'Please reload the page in a few seconds.',
+
+  // Vacay addon
+  'vacay.subtitle': 'Plan and manage vacation days',
+  'vacay.settings': 'Settings',
+  'vacay.year': 'Year',
+  'vacay.addYear': 'Add year',
+  'vacay.removeYear': 'Remove year',
+  'vacay.removeYearConfirm': 'Remove {year}?',
+  'vacay.removeYearHint': 'All vacation entries and company holidays for this year will be permanently deleted.',
+  'vacay.remove': 'Remove',
+  'vacay.persons': 'Persons',
+  'vacay.noPersons': 'No persons added',
+  'vacay.addPerson': 'Add Person',
+  'vacay.editPerson': 'Edit Person',
+  'vacay.removePerson': 'Remove Person',
+  'vacay.removePersonConfirm': 'Remove {name}?',
+  'vacay.removePersonHint': 'All vacation entries for this person will be permanently deleted.',
+  'vacay.personName': 'Name',
+  'vacay.personNamePlaceholder': 'Enter name',
+  'vacay.color': 'Color',
+  'vacay.add': 'Add',
+  'vacay.legend': 'Legend',
+  'vacay.publicHoliday': 'Public Holiday',
+  'vacay.companyHoliday': 'Company Holiday',
+  'vacay.weekend': 'Weekend',
+  'vacay.modeVacation': 'Vacation',
+  'vacay.modeCompany': 'Company Holiday',
+  'vacay.entitlement': 'Entitlement',
+  'vacay.entitlementDays': 'Days',
+  'vacay.used': 'Used',
+  'vacay.remaining': 'Left',
+  'vacay.carriedOver': 'from {year}',
+  'vacay.blockWeekends': 'Block Weekends',
+  'vacay.blockWeekendsHint': 'Prevent vacation entries on Saturdays and Sundays',
+  'vacay.publicHolidays': 'Public Holidays',
+  'vacay.publicHolidaysHint': 'Mark public holidays in the calendar',
+  'vacay.selectCountry': 'Select country',
+  'vacay.selectRegion': 'Select region (optional)',
+  'vacay.companyHolidays': 'Company Holidays',
+  'vacay.companyHolidaysHint': 'Allow marking company-wide holiday days',
+  'vacay.companyHolidaysNoDeduct': 'Company holidays do not count towards vacation days.',
+  'vacay.carryOver': 'Carry Over',
+  'vacay.carryOverHint': 'Automatically carry remaining vacation days into the next year',
+  'vacay.sharing': 'Sharing',
+  'vacay.sharingHint': 'Share your vacation plan with other NOMAD users',
+  'vacay.owner': 'Owner',
+  'vacay.shareEmailPlaceholder': 'Email of NOMAD user',
+  'vacay.shareSuccess': 'Plan shared successfully',
+  'vacay.shareError': 'Could not share plan',
+  'vacay.dissolve': 'Dissolve Fusion',
+  'vacay.dissolveHint': 'Separate calendars again. Your entries will be kept.',
+  'vacay.dissolveAction': 'Dissolve',
+  'vacay.dissolved': 'Calendar separated',
+  'vacay.fusedWith': 'Fused with',
+  'vacay.you': 'you',
+  'vacay.noData': 'No data',
+  'vacay.changeColor': 'Change color',
+  'vacay.inviteUser': 'Invite User',
+  'vacay.inviteHint': 'Invite another NOMAD user to share a combined vacation calendar.',
+  'vacay.selectUser': 'Select user',
+  'vacay.sendInvite': 'Send Invite',
+  'vacay.inviteSent': 'Invite sent',
+  'vacay.inviteError': 'Could not send invite',
+  'vacay.pending': 'pending',
+  'vacay.noUsersAvailable': 'No users available',
+  'vacay.accept': 'Accept',
+  'vacay.decline': 'Decline',
+  'vacay.acceptFusion': 'Accept & Fuse',
+  'vacay.inviteTitle': 'Fusion Request',
+  'vacay.inviteWantsToFuse': 'wants to share a vacation calendar with you.',
+  'vacay.fuseInfo1': 'Both of you will see all vacation entries in one shared calendar.',
+  'vacay.fuseInfo2': 'Both parties can create and edit entries for each other.',
+  'vacay.fuseInfo3': 'Both parties can delete entries and change vacation entitlements.',
+  'vacay.fuseInfo4': 'Settings like public holidays and company holidays are shared.',
+  'vacay.fuseInfo5': 'The fusion can be dissolved at any time by either party. Your entries will be preserved.',
+  'nav.myTrips': 'My Trips',
+
+  // Atlas addon
+  'atlas.subtitle': 'Your travel footprint around the world',
+  'atlas.countries': 'Countries',
+  'atlas.trips': 'Trips',
+  'atlas.places': 'Places',
+  'atlas.days': 'Days',
+  'atlas.visitedCountries': 'Visited Countries',
+  'atlas.cities': 'Cities',
+  'atlas.noData': 'No travel data yet',
+  'atlas.noDataHint': 'Create a trip and add places to see your world map',
+  'atlas.lastTrip': 'Last trip',
+  'atlas.nextTrip': 'Next trip',
+  'atlas.daysLeft': 'days left',
+  'atlas.streak': 'Streak',
+  'atlas.year': 'year',
+  'atlas.years': 'years',
+  'atlas.yearInRow': 'year in a row',
+  'atlas.yearsInRow': 'years in a row',
+  'atlas.tripIn': 'trip in',
+  'atlas.tripsIn': 'trips in',
+  'atlas.since': 'since',
+  'atlas.europe': 'Europe',
+  'atlas.asia': 'Asia',
+  'atlas.northAmerica': 'N. America',
+  'atlas.southAmerica': 'S. America',
+  'atlas.africa': 'Africa',
+  'atlas.oceania': 'Oceania',
+  'atlas.other': 'Other',
+  'atlas.firstVisit': 'First trip',
+  'atlas.lastVisitLabel': 'Last trip',
+  'atlas.tripSingular': 'Trip',
+  'atlas.tripPlural': 'Trips',
+  'atlas.placeVisited': 'Place visited',
+  'atlas.placesVisited': 'Places visited',
 
   // Trip Planner
   'trip.tabs.plan': 'Plan',
   'trip.tabs.reservations': 'Bookings',
+  'trip.tabs.reservationsShort': 'Book',
   'trip.tabs.packing': 'Packing List',
   'trip.tabs.packingShort': 'Packing',
   'trip.tabs.budget': 'Budget',
@@ -259,6 +433,9 @@ const en = {
   'dayplan.optimize': 'Optimize',
   'dayplan.optimized': 'Route optimized',
   'dayplan.routeError': 'Failed to calculate route',
+  'dayplan.toast.needTwoPlaces': 'At least two places needed for route optimization',
+  'dayplan.toast.routeOptimized': 'Route optimized',
+  'dayplan.toast.noGeoPlaces': 'No places with coordinates found for route calculation',
   'dayplan.confirmed': 'Confirmed',
   'dayplan.pendingRes': 'Pending',
   'dayplan.pdf': 'PDF',
@@ -293,8 +470,10 @@ const en = {
   'places.formNotesPlaceholder': 'Personal notes...',
   'places.formReservation': 'Reservation',
   'places.reservationNotesPlaceholder': 'Reservation notes, confirmation number...',
-  'places.mapsSearchPlaceholder': 'Search Google Maps...',
-  'places.mapsSearchError': 'Google Maps search failed. Please add an API key in settings.',
+  'places.mapsSearchPlaceholder': 'Search places...',
+  'places.mapsSearchError': 'Place search failed.',
+  'places.osmHint': 'Using OpenStreetMap search (no photos, opening hours, or ratings). Add a Google API key in settings for full details.',
+  'places.osmActive': 'Search via OpenStreetMap (no photos, ratings or opening hours). Add a Google API key in Settings for enhanced data.',
   'places.categoryCreateError': 'Failed to create category',
   'places.nameRequired': 'Please enter a name',
   'places.saveError': 'Failed to save',

client/src/index.css

@@ -2,6 +2,100 @@
 @tailwind components;
 @tailwind utilities;
 
+html { height: 100%; overflow: hidden; background-color: var(--bg-primary); }
+body { height: 100%; overflow: auto; overscroll-behavior: none; -webkit-overflow-scrolling: touch; }
+
+
+.atlas-tooltip {
+  background: rgba(10, 10, 20, 0.6) !important;
+  backdrop-filter: blur(20px) saturate(180%) !important;
+  -webkit-backdrop-filter: blur(20px) saturate(180%) !important;
+  color: #f1f5f9 !important;
+  border: 1px solid rgba(255,255,255,0.1) !important;
+  border-radius: 14px !important;
+  padding: 10px 14px !important;
+  font-size: 12px !important;
+  font-family: inherit !important;
+  box-shadow: 0 8px 32px rgba(0,0,0,0.25) !important;
+  transition: none !important;
+}
+.atlas-tooltip::before { border-top-color: rgba(10, 10, 20, 0.6) !important; }
+html:not(.dark) .atlas-tooltip {
+  background: rgba(255, 255, 255, 0.75) !important;
+  color: #0f172a !important;
+  border: 1px solid rgba(0,0,0,0.08) !important;
+  box-shadow: 0 8px 32px rgba(0,0,0,0.1) !important;
+}
+html:not(.dark) .atlas-tooltip::before { border-top-color: rgba(255, 255, 255, 0.75) !important; }
+.leaflet-tooltip.atlas-tooltip { opacity: 1 !important; }
+.leaflet-tooltip-pane { transition: none !important; }
+.leaflet-fade-anim .leaflet-tooltip { transition: none !important; opacity: 1 !important; }
+
+.dark .leaflet-control-zoom a {
+  background: rgba(10, 10, 20, 0.7) !important;
+  color: #e2e8f0 !important;
+  border-color: rgba(255, 255, 255, 0.1) !important;
+  backdrop-filter: blur(12px);
+}
+.dark .leaflet-control-zoom a:hover {
+  background: rgba(30, 30, 40, 0.8) !important;
+}
+@media (max-width: 767px) {
+  .leaflet-control-zoom { display: none !important; }
+}
+
+/* Dark mode overrides for pages using hardcoded slate-* Tailwind classes */
+html.dark .bg-slate-50 { background-color: var(--bg-secondary) !important; }
+html.dark .bg-white { background-color: var(--bg-card) !important; }
+html.dark .bg-slate-100 { background-color: var(--bg-secondary) !important; }
+html.dark .bg-slate-900.text-white { background-color: #e2e8f0 !important; color: #0f172a !important; }
+html.dark .border-slate-200, html.dark .border-slate-300 { border-color: var(--border-primary) !important; }
+html.dark .border-slate-100, html.dark .border-b-slate-100 { border-color: var(--border-secondary) !important; }
+html.dark .text-slate-900 { color: var(--text-primary) !important; }
+html.dark .text-slate-700 { color: var(--text-secondary) !important; }
+html.dark .text-slate-600 { color: var(--text-muted) !important; }
+html.dark .text-slate-500 { color: var(--text-muted) !important; }
+html.dark .text-slate-400 { color: var(--text-faint) !important; }
+html.dark .hover\:bg-slate-50:hover, html.dark .hover\:bg-slate-100:hover { background-color: var(--bg-hover) !important; }
+html.dark .hover\:text-slate-900:hover { color: var(--text-primary) !important; }
+html.dark .hover\:bg-slate-700:hover { background-color: var(--bg-hover) !important; }
+html.dark .divide-slate-100 > :not([hidden]) ~ :not([hidden]) { border-color: var(--border-secondary) !important; }
+html.dark .focus\:ring-slate-400:focus { --tw-ring-color: var(--text-faint) !important; }
+html.dark input[class*="border-slate"], html.dark input[class*="text-slate"] { background: var(--bg-secondary) !important; color: var(--text-primary) !important; border-color: var(--border-primary) !important; }
+html.dark .text-amber-900 { color: #fbbf24 !important; }
+html.dark .text-amber-700 { color: #f59e0b !important; }
+html.dark .bg-amber-50 { background-color: rgba(245,158,11,0.1) !important; }
+html.dark .border-amber-200 { border-color: rgba(245,158,11,0.2) !important; }
+html.dark .disabled\:bg-slate-400:disabled { background-color: var(--text-faint) !important; }
+html.dark button.bg-slate-900 { background-color: #e2e8f0 !important; color: #0f172a !important; opacity: 1 !important; }
+html.dark button.bg-slate-900:hover { background-color: #cbd5e1 !important; }
+html.dark button.bg-slate-900:disabled { background-color: #ffffff !important; color: #000000 !important; opacity: 0.4 !important; }
+html.dark span.bg-slate-900 { background-color: #e2e8f0 !important; color: #0f172a !important; }
+html.dark span.bg-slate-100 { background-color: var(--bg-secondary) !important; color: var(--text-muted) !important; }
+html.dark .border-b { border-bottom-color: var(--border-secondary) !important; }
+/* Gray variants (CategoryManager, BackupPanel) */
+html.dark .bg-gray-50 { background-color: var(--bg-secondary) !important; }
+html.dark .bg-gray-100 { background-color: var(--bg-secondary) !important; }
+html.dark .border-gray-200, html.dark .border-gray-300 { border-color: var(--border-primary) !important; }
+html.dark .border-gray-100 { border-color: var(--border-secondary) !important; }
+html.dark .text-gray-900 { color: var(--text-primary) !important; }
+html.dark .text-gray-700 { color: var(--text-secondary) !important; }
+html.dark .text-gray-600 { color: var(--text-muted) !important; }
+html.dark .text-gray-500 { color: var(--text-muted) !important; }
+html.dark .text-gray-400 { color: var(--text-faint) !important; }
+html.dark .text-gray-300 { color: var(--text-faint) !important; }
+html.dark .hover\:bg-gray-50:hover, html.dark .hover\:bg-gray-200:hover { background-color: var(--bg-hover) !important; }
+html.dark .hover\:border-gray-200:hover, html.dark .hover\:border-gray-400:hover { border-color: var(--border-primary) !important; }
+html.dark input.bg-white, html.dark input[class*="bg-white"] { background: var(--bg-secondary) !important; color: var(--text-primary) !important; }
+html.dark .bg-gray-200 { background-color: var(--border-primary) !important; }
+html.dark .border-gray-300.border-t-slate-600 { border-color: var(--border-primary) !important; border-top-color: var(--text-primary) !important; }
+/* Modal buttons */
+html.dark button[class*="text-slate-600"][class*="border-slate-200"] { color: var(--text-muted) !important; border-color: var(--border-primary) !important; }
+html.dark button[class*="text-slate-600"][class*="border-slate-200"]:hover { background: var(--bg-hover) !important; }
+/* Dashed borders */
+html.dark .border-dashed.border-gray-300 { border-color: var(--border-primary) !important; }
+html.dark .bg-slate-50\/60, html.dark [class*="bg-slate-50/"] { background-color: transparent !important; }
+
 /* Reorder buttons: desktop = original style; mobile = always visible, larger touch targets */
 .reorder-buttons {
   flex-direction: column;
@@ -45,6 +139,8 @@
 
 /* ── Design tokens ─────────────────────────────── */
 :root {
+  --safe-top: env(safe-area-inset-top, 0px);
+  --nav-h: calc(56px + var(--safe-top));
   --font-system: -apple-system, BlinkMacSystemFont, 'SF Pro Text', 'Segoe UI', system-ui, sans-serif;
   --sp-1: 4px;
   --sp-2: 8px;
@@ -230,6 +326,15 @@ body {
   color: var(--text-faint);
 }
 
+/* Brand images: no save/copy/drag */
+img[alt="NOMAD"] {
+  pointer-events: none;
+  user-select: none;
+  -webkit-user-select: none;
+  -webkit-user-drag: none;
+  -webkit-touch-callout: none;
+}
+
 /* Weiche Übergänge */
 .transition-smooth {
   transition: all 0.2s ease;

client/src/pages/AdminPage.jsx

@@ -2,20 +2,25 @@ import React, { useEffect, useState } from 'react'
 import { useNavigate } from 'react-router-dom'
 import { adminApi, authApi } from '../api/client'
 import { useAuthStore } from '../store/authStore'
+import { useSettingsStore } from '../store/settingsStore'
 import { useTranslation } from '../i18n'
 import Navbar from '../components/Layout/Navbar'
 import Modal from '../components/shared/Modal'
 import { useToast } from '../components/shared/Toast'
 import CategoryManager from '../components/Admin/CategoryManager'
 import BackupPanel from '../components/Admin/BackupPanel'
-import { Users, Map, Briefcase, Shield, Trash2, Edit2, Camera, FileText, Eye, EyeOff, Save, CheckCircle, XCircle, Loader2, UserPlus } from 'lucide-react'
+import AddonManager from '../components/Admin/AddonManager'
+import { Users, Map, Briefcase, Shield, Trash2, Edit2, Camera, FileText, Eye, EyeOff, Save, CheckCircle, XCircle, Loader2, UserPlus, ArrowUpCircle, ExternalLink, Download, AlertTriangle, RefreshCw } from 'lucide-react'
 import CustomSelect from '../components/shared/CustomSelect'
 
 export default function AdminPage() {
-  const { t } = useTranslation()
+  const { demoMode } = useAuthStore()
+  const { t, locale } = useTranslation()
+  const hour12 = useSettingsStore(s => s.settings.time_format) === '12h'
   const TABS = [
     { id: 'users', label: t('admin.tabs.users') },
     { id: 'categories', label: t('admin.tabs.categories') },
+    { id: 'addons', label: t('admin.tabs.addons') },
     { id: 'settings', label: t('admin.tabs.settings') },
     { id: 'backup', label: t('admin.tabs.backup') },
   ]
@@ -29,6 +34,10 @@ export default function AdminPage() {
   const [showCreateUser, setShowCreateUser] = useState(false)
   const [createForm, setCreateForm] = useState({ username: '', email: '', password: '', role: 'user' })
 
+  // OIDC config
+  const [oidcConfig, setOidcConfig] = useState({ issuer: '', client_id: '', client_secret: '', display_name: '' })
+  const [savingOidc, setSavingOidc] = useState(false)
+
   // Registration toggle
   const [allowRegistration, setAllowRegistration] = useState(true)
 
@@ -40,6 +49,12 @@ export default function AdminPage() {
   const [validating, setValidating] = useState({})
   const [validation, setValidation] = useState({})
 
+  // Version check & update
+  const [updateInfo, setUpdateInfo] = useState(null)
+  const [showUpdateModal, setShowUpdateModal] = useState(false)
+  const [updating, setUpdating] = useState(false)
+  const [updateResult, setUpdateResult] = useState(null) // 'success' | 'error'
+
   const { user: currentUser, updateApiKeys } = useAuthStore()
   const navigate = useNavigate()
   const toast = useToast()
@@ -48,6 +63,10 @@ export default function AdminPage() {
     loadData()
     loadAppConfig()
     loadApiKeys()
+    adminApi.getOidc().then(setOidcConfig).catch(() => {})
+    adminApi.checkVersion().then(data => {
+      if (data.update_available) setUpdateInfo(data)
+    }).catch(() => {})
   }, [])
 
   const loadData = async () => {
@@ -77,14 +96,34 @@ export default function AdminPage() {
 
   const loadApiKeys = async () => {
     try {
-      const data = await authApi.me()
-      setMapsKey(data.user?.maps_api_key || '')
-      setWeatherKey(data.user?.openweather_api_key || '')
+      const data = await authApi.getSettings()
+      setMapsKey(data.settings?.maps_api_key || '')
+      setWeatherKey(data.settings?.openweather_api_key || '')
     } catch (err) {
       // ignore
     }
   }
 
+  const handleInstallUpdate = async () => {
+    setUpdating(true)
+    setUpdateResult(null)
+    try {
+      await adminApi.installUpdate()
+      setUpdateResult('success')
+      // Server is restarting — poll until it comes back, then reload
+      const poll = setInterval(async () => {
+        try {
+          await authApi.getAppConfig()
+          clearInterval(poll)
+          window.location.reload()
+        } catch { /* still restarting */ }
+      }, 2000)
+    } catch {
+      setUpdateResult('error')
+      setUpdating(false)
+    }
+  }
+
   const handleToggleRegistration = async (value) => {
     setAllowRegistration(value)
     try {
@@ -117,6 +156,8 @@ export default function AdminPage() {
   const handleValidateKeys = async () => {
     setValidating({ maps: true, weather: true })
     try {
+      // Save first so validation uses the current values
+      await updateApiKeys({ maps_api_key: mapsKey, openweather_api_key: weatherKey })
       const result = await authApi.validateKeys()
       setValidation(result)
     } catch (err) {
@@ -129,6 +170,8 @@ export default function AdminPage() {
   const handleValidateKey = async (keyType) => {
     setValidating(prev => ({ ...prev, [keyType]: true }))
     try {
+      // Save first so validation uses the current values
+      await updateApiKeys({ maps_api_key: mapsKey, openweather_api_key: weatherKey })
       const result = await authApi.validateKeys()
       setValidation(prev => ({ ...prev, [keyType]: result[keyType] }))
     } catch (err) {
@@ -192,10 +235,10 @@ export default function AdminPage() {
   }
 
   return (
-    <div className="min-h-screen bg-slate-50">
+    <div className="min-h-screen" style={{ background: 'var(--bg-secondary)' }}>
       <Navbar />
 
-      <div className="pt-14">
+      <div style={{ paddingTop: 'var(--nav-h)' }}>
         <div className="max-w-6xl mx-auto px-4 py-8">
           {/* Header */}
           <div className="flex items-center gap-3 mb-6">
@@ -208,14 +251,83 @@ export default function AdminPage() {
             </div>
           </div>
 
+          {/* Update Banner */}
+          {updateInfo && (
+            <div className="mb-6 p-4 rounded-xl border flex flex-col sm:flex-row items-start sm:items-center gap-4 bg-amber-50 dark:bg-amber-950/40 border-amber-300 dark:border-amber-700">
+              <div className="flex items-center gap-4 flex-1 min-w-0">
+                <div className="flex-shrink-0 w-10 h-10 rounded-full flex items-center justify-center bg-amber-500 dark:bg-amber-600">
+                  <ArrowUpCircle className="w-5 h-5 text-white" />
+                </div>
+                <div>
+                  <p className="text-sm font-semibold text-amber-900 dark:text-amber-200">{t('admin.update.available')}</p>
+                  <p className="text-xs text-amber-700 dark:text-amber-400 mt-0.5">
+                    {t('admin.update.text').replace('{version}', `v${updateInfo.latest}`).replace('{current}', `v${updateInfo.current}`)}
+                  </p>
+                </div>
+              </div>
+              <div className="flex items-center gap-2 flex-shrink-0">
+                {updateInfo.release_url && (
+                  <a
+                    href={updateInfo.release_url}
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    className="flex items-center gap-1.5 px-3 py-2 rounded-lg text-xs font-medium transition-colors text-amber-800 dark:text-amber-300 border border-amber-300 dark:border-amber-600 hover:bg-amber-100 dark:hover:bg-amber-900/50"
+                  >
+                    <ExternalLink className="w-3.5 h-3.5" />
+                    {t('admin.update.button')}
+                  </a>
+                )}
+                {updateInfo.is_docker ? (
+                  <button
+                    onClick={() => setShowUpdateModal(true)}
+                    className="flex items-center gap-1.5 px-4 py-2 rounded-lg text-sm font-semibold transition-colors bg-slate-900 dark:bg-white text-white dark:text-slate-900 hover:bg-slate-700 dark:hover:bg-gray-200"
+                  >
+                    <Download className="w-4 h-4" />
+                    {t('admin.update.howTo')}
+                  </button>
+                ) : (
+                  <button
+                    onClick={() => setShowUpdateModal(true)}
+                    className="flex items-center gap-1.5 px-4 py-2 rounded-lg text-sm font-semibold transition-colors bg-slate-900 dark:bg-white text-white dark:text-slate-900 hover:bg-slate-700 dark:hover:bg-gray-200"
+                  >
+                    <Download className="w-4 h-4" />
+                    {t('admin.update.install')}
+                  </button>
+                )}
+              </div>
+            </div>
+          )}
+
+          {/* Demo Baseline Button */}
+          {demoMode && (
+            <div className="mb-6 p-4 bg-amber-50 border border-amber-200 rounded-xl flex items-center justify-between">
+              <div>
+                <p className="text-sm font-semibold text-amber-900">Demo Baseline</p>
+                <p className="text-xs text-amber-700">Save current state as the hourly reset point. All admin trips and settings will be preserved.</p>
+              </div>
+              <button
+                onClick={async () => {
+                  try {
+                    await adminApi.saveDemoBaseline()
+                    toast.success('Baseline saved! Resets will restore to this state.')
+                  } catch (e) {
+                    toast.error(e.response?.data?.error || 'Failed to save baseline')
+                  }
+                }}
+                className="px-4 py-2 bg-amber-600 text-white rounded-lg text-sm font-semibold hover:bg-amber-700 transition-colors flex-shrink-0 ml-4"
+              >
+                Save Baseline
+              </button>
+            </div>
+          )}
+
           {/* Stats */}
           {stats && (
-            <div className="grid grid-cols-2 sm:grid-cols-5 gap-4 mb-6">
+            <div className="grid grid-cols-2 sm:grid-cols-4 gap-4 mb-6">
               {[
                 { label: t('admin.stats.users'), value: stats.totalUsers, icon: Users },
                 { label: t('admin.stats.trips'), value: stats.totalTrips, icon: Briefcase },
                 { label: t('admin.stats.places'), value: stats.totalPlaces, icon: Map },
-                { label: t('admin.stats.photos'), value: stats.totalPhotos || 0, icon: Camera },
                 { label: t('admin.stats.files'), value: stats.totalFiles || 0, icon: FileText },
               ].map(({ label, value, icon: Icon }) => (
                 <div key={label} className="rounded-xl border p-4" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
@@ -232,12 +344,12 @@ export default function AdminPage() {
           )}
 
           {/* Tabs */}
-          <div className="flex gap-1 mb-6 bg-white border border-slate-200 rounded-xl p-1 w-fit">
+          <div className="grid grid-cols-3 sm:flex gap-1 mb-6 rounded-xl p-1" style={{ background: 'var(--bg-card)', border: '1px solid var(--border-primary)' }}>
             {TABS.map(tab => (
               <button
                 key={tab.id}
                 onClick={() => setActiveTab(tab.id)}
-                className={`px-4 py-2 text-sm font-medium rounded-lg transition-colors ${
+                className={`px-3 sm:px-4 py-2 text-xs sm:text-sm font-medium rounded-lg transition-colors ${
                   activeTab === tab.id
                     ? 'bg-slate-900 text-white'
                     : 'text-slate-600 hover:text-slate-900 hover:bg-slate-50'
@@ -252,7 +364,10 @@ export default function AdminPage() {
           {activeTab === 'users' && (
             <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
               <div className="p-5 border-b border-slate-100 flex items-center justify-between">
-                <h2 className="font-semibold text-slate-900">{t('admin.tabs.users')} ({users.length})</h2>
+                <div>
+                  <h2 className="font-semibold text-slate-900">{t('admin.tabs.users')}</h2>
+                  <p className="text-xs text-slate-400 mt-1">{users.length} {t('admin.stats.users')}</p>
+                </div>
                 <button
                   onClick={() => setShowCreateUser(true)}
                   className="flex items-center gap-1.5 px-3 py-1.5 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700 transition-colors"
@@ -275,6 +390,7 @@ export default function AdminPage() {
                         <th className="px-5 py-3">{t('admin.table.email')}</th>
                         <th className="px-5 py-3">{t('admin.table.role')}</th>
                         <th className="px-5 py-3">{t('admin.table.created')}</th>
+                        <th className="px-5 py-3">{t('admin.table.lastLogin')}</th>
                         <th className="px-5 py-3 text-right">{t('admin.table.actions')}</th>
                       </tr>
                     </thead>
@@ -283,8 +399,11 @@ export default function AdminPage() {
                         <tr key={u.id} className={`hover:bg-slate-50 transition-colors ${u.id === currentUser?.id ? 'bg-slate-50/60' : ''}`}>
                           <td className="px-5 py-3">
                             <div className="flex items-center gap-2">
-                              <div className="w-8 h-8 rounded-full bg-slate-100 flex items-center justify-center text-sm font-medium text-slate-700">
-                                {u.username.charAt(0).toUpperCase()}
+                              <div className="relative">
+                                <div className="w-8 h-8 rounded-full bg-slate-100 flex items-center justify-center text-sm font-medium text-slate-700">
+                                  {u.username.charAt(0).toUpperCase()}
+                                </div>
+                                <span className="absolute -bottom-0.5 -right-0.5 w-3 h-3 rounded-full border-2" style={{ borderColor: 'var(--bg-card)', background: u.online ? '#22c55e' : '#94a3b8' }} />
                               </div>
                               <div>
                                 <p className="text-sm font-medium text-slate-900">{u.username}</p>
@@ -306,7 +425,10 @@ export default function AdminPage() {
                             </span>
                           </td>
                           <td className="px-5 py-3 text-sm text-slate-500">
-                            {new Date(u.created_at).toLocaleDateString('de-DE')}
+                            {new Date(u.created_at).toLocaleDateString(locale)}
+                          </td>
+                          <td className="px-5 py-3 text-sm text-slate-500">
+                            {u.last_login ? new Date(u.last_login).toLocaleDateString(locale, { day: 'numeric', month: 'short', hour: '2-digit', minute: '2-digit', hour12 }) : '—'}
                           </td>
                           <td className="px-5 py-3">
                             <div className="flex items-center gap-2 justify-end">
@@ -338,6 +460,8 @@ export default function AdminPage() {
 
           {activeTab === 'categories' && <CategoryManager />}
 
+          {activeTab === 'addons' && <AddonManager />}
+
           {activeTab === 'settings' && (
             <div className="space-y-6">
               {/* Registration Toggle */}
@@ -371,11 +495,15 @@ export default function AdminPage() {
               <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
                 <div className="px-6 py-4 border-b border-slate-100">
                   <h2 className="font-semibold text-slate-900">{t('admin.apiKeys')}</h2>
+                  <p className="text-xs text-slate-400 mt-1">{t('admin.apiKeysHint')}</p>
                 </div>
                 <div className="p-6 space-y-4">
                   {/* Google Maps Key */}
                   <div>
-                    <label className="block text-sm font-medium text-slate-700 mb-1.5">{t('admin.mapsKey')}</label>
+                    <label className="flex items-center gap-2 text-sm font-medium text-slate-700 mb-1.5">
+                      {t('admin.mapsKey')}
+                      <span style={{ fontSize: 10, fontWeight: 500, padding: '1px 7px', borderRadius: 99, background: '#dbeafe', color: '#1d4ed8' }}>{t('admin.recommended')}</span>
+                    </label>
                     <div className="flex gap-2">
                       <div className="relative flex-1">
                         <input
@@ -408,7 +536,7 @@ export default function AdminPage() {
                         {t('admin.validateKey')}
                       </button>
                     </div>
-                    <p className="text-xs text-slate-400 mt-1">{t('admin.mapsKeyHint')}</p>
+                    <p className="text-xs text-slate-400 mt-1">{t('admin.mapsKeyHintLong')}</p>
                     {validation.maps === true && (
                       <p className="text-xs text-emerald-600 mt-1 flex items-center gap-1">
                         <span className="w-2 h-2 bg-emerald-500 rounded-full inline-block"></span>
@@ -483,6 +611,73 @@ export default function AdminPage() {
                   </button>
                 </div>
               </div>
+
+              {/* OIDC / SSO Configuration */}
+              <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
+                <div className="px-6 py-4 border-b border-slate-100">
+                  <h2 className="font-semibold text-slate-900">{t('admin.oidcTitle')}</h2>
+                  <p className="text-xs text-slate-400 mt-1">{t('admin.oidcSubtitle')}</p>
+                </div>
+                <div className="p-6 space-y-4">
+                  <div>
+                    <label className="block text-sm font-medium text-slate-700 mb-1.5">{t('admin.oidcDisplayName')}</label>
+                    <input
+                      type="text"
+                      value={oidcConfig.display_name}
+                      onChange={e => setOidcConfig(c => ({ ...c, display_name: e.target.value }))}
+                      placeholder='z.B. Google, Authentik, Keycloak'
+                      className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                    />
+                  </div>
+                  <div>
+                    <label className="block text-sm font-medium text-slate-700 mb-1.5">{t('admin.oidcIssuer')}</label>
+                    <input
+                      type="url"
+                      value={oidcConfig.issuer}
+                      onChange={e => setOidcConfig(c => ({ ...c, issuer: e.target.value }))}
+                      placeholder='https://accounts.google.com'
+                      className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                    />
+                    <p className="text-xs text-slate-400 mt-1">{t('admin.oidcIssuerHint')}</p>
+                  </div>
+                  <div>
+                    <label className="block text-sm font-medium text-slate-700 mb-1.5">Client ID</label>
+                    <input
+                      type="text"
+                      value={oidcConfig.client_id}
+                      onChange={e => setOidcConfig(c => ({ ...c, client_id: e.target.value }))}
+                      className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                    />
+                  </div>
+                  <div>
+                    <label className="block text-sm font-medium text-slate-700 mb-1.5">Client Secret</label>
+                    <input
+                      type="password"
+                      value={oidcConfig.client_secret}
+                      onChange={e => setOidcConfig(c => ({ ...c, client_secret: e.target.value }))}
+                      className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                    />
+                  </div>
+                  <button
+                    onClick={async () => {
+                      setSavingOidc(true)
+                      try {
+                        await adminApi.updateOidc(oidcConfig)
+                        toast.success(t('admin.oidcSaved'))
+                      } catch (err) {
+                        toast.error(err.response?.data?.error || t('common.error'))
+                      } finally {
+                        setSavingOidc(false)
+                      }
+                    }}
+                    disabled={savingOidc}
+                    className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
+                  >
+                    {savingOidc ? <div className="w-4 h-4 border-2 border-white/30 border-t-white rounded-full animate-spin" /> : <Save className="w-4 h-4" />}
+                    {t('common.save')}
+                  </button>
+                </div>
+              </div>
             </div>
           )}
 
@@ -625,6 +820,171 @@ export default function AdminPage() {
           </div>
         )}
       </Modal>
+
+      {/* Update confirmation popup — matches backup restore style */}
+      {showUpdateModal && (
+        <div
+          style={{ position: 'fixed', inset: 0, zIndex: 9999, background: 'rgba(0,0,0,0.5)', backdropFilter: 'blur(4px)', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }}
+          onClick={() => { if (!updating) setShowUpdateModal(false) }}
+        >
+          <div
+            onClick={e => e.stopPropagation()}
+            style={{ width: '100%', maxWidth: 440, borderRadius: 16, overflow: 'hidden' }}
+            className="bg-white dark:bg-gray-800 border border-gray-200 dark:border-gray-700"
+          >
+            {updateResult === 'success' ? (
+              <>
+                <div style={{ background: 'linear-gradient(135deg, #16a34a, #15803d)', padding: '20px 24px', display: 'flex', alignItems: 'center', gap: 12 }}>
+                  <div style={{ width: 40, height: 40, borderRadius: 10, background: 'rgba(255,255,255,0.2)', display: 'flex', alignItems: 'center', justifyContent: 'center', flexShrink: 0 }}>
+                    <CheckCircle size={20} style={{ color: 'white' }} />
+                  </div>
+                  <div>
+                    <h3 style={{ margin: 0, fontSize: 16, fontWeight: 700, color: 'white' }}>{t('admin.update.success')}</h3>
+                  </div>
+                </div>
+                <div style={{ padding: '20px 24px', textAlign: 'center' }}>
+                  <RefreshCw className="w-5 h-5 animate-spin mx-auto mb-2" style={{ color: 'var(--text-muted)' }} />
+                  <p style={{ fontSize: 13, color: 'var(--text-muted)' }}>{t('admin.update.reloadHint')}</p>
+                </div>
+              </>
+            ) : updateResult === 'error' ? (
+              <>
+                <div style={{ background: 'linear-gradient(135deg, #dc2626, #b91c1c)', padding: '20px 24px', display: 'flex', alignItems: 'center', gap: 12 }}>
+                  <div style={{ width: 40, height: 40, borderRadius: 10, background: 'rgba(255,255,255,0.2)', display: 'flex', alignItems: 'center', justifyContent: 'center', flexShrink: 0 }}>
+                    <XCircle size={20} style={{ color: 'white' }} />
+                  </div>
+                  <div>
+                    <h3 style={{ margin: 0, fontSize: 16, fontWeight: 700, color: 'white' }}>{t('admin.update.failed')}</h3>
+                  </div>
+                </div>
+                <div style={{ padding: '0 24px 20px', display: 'flex', justifyContent: 'flex-end', marginTop: 16 }}>
+                  <button
+                    onClick={() => { setShowUpdateModal(false); setUpdateResult(null) }}
+                    className="bg-slate-900 dark:bg-white text-white dark:text-slate-900 hover:bg-slate-700 dark:hover:bg-gray-200"
+                    style={{ padding: '9px 20px', borderRadius: 10, fontSize: 13, fontWeight: 600, border: 'none', cursor: 'pointer', fontFamily: 'inherit' }}
+                  >
+                    {t('common.cancel')}
+                  </button>
+                </div>
+              </>
+            ) : (
+              <>
+                {/* Red header */}
+                <div style={{ background: 'linear-gradient(135deg, #dc2626, #b91c1c)', padding: '20px 24px', display: 'flex', alignItems: 'center', gap: 12 }}>
+                  <div style={{ width: 40, height: 40, borderRadius: 10, background: 'rgba(255,255,255,0.2)', display: 'flex', alignItems: 'center', justifyContent: 'center', flexShrink: 0 }}>
+                    <AlertTriangle size={20} style={{ color: 'white' }} />
+                  </div>
+                  <div>
+                    <h3 style={{ margin: 0, fontSize: 16, fontWeight: 700, color: 'white' }}>{t('admin.update.confirmTitle')}</h3>
+                    <p style={{ margin: '2px 0 0', fontSize: 12, color: 'rgba(255,255,255,0.8)' }}>
+                      v{updateInfo?.current} → v{updateInfo?.latest}
+                    </p>
+                  </div>
+                </div>
+
+                {/* Body */}
+                <div style={{ padding: '20px 24px' }}>
+                  {updateInfo?.is_docker ? (
+                    <>
+                      <p className="text-gray-700 dark:text-gray-300" style={{ fontSize: 13, lineHeight: 1.6, margin: 0 }}>
+                        {t('admin.update.dockerText').replace('{version}', `v${updateInfo.latest}`)}
+                      </p>
+
+                      <div style={{ marginTop: 14, padding: '12px 14px', borderRadius: 10, fontSize: 12, lineHeight: 1.8, fontFamily: 'monospace', whiteSpace: 'pre-wrap', wordBreak: 'break-all' }}
+                        className="bg-gray-900 dark:bg-gray-950 text-gray-100 border border-gray-700"
+                      >
+{`docker pull mauriceboe/nomad:latest
+docker stop nomad && docker rm nomad
+docker run -d --name nomad \\
+  -p 3000:3000 \\
+  -v /opt/nomad/data:/app/data \\
+  -v /opt/nomad/uploads:/app/uploads \\
+  --restart unless-stopped \\
+  mauriceboe/nomad:latest`}
+                      </div>
+
+                      <div style={{ marginTop: 10, padding: '10px 12px', borderRadius: 10, fontSize: 12, lineHeight: 1.5 }}
+                        className="bg-emerald-50 dark:bg-emerald-900/30 text-emerald-700 dark:text-emerald-300 border border-emerald-200 dark:border-emerald-800"
+                      >
+                        <div className="flex items-start gap-2">
+                          <CheckCircle className="w-3.5 h-3.5 mt-0.5 flex-shrink-0" />
+                          <span>{t('admin.update.dataInfo')}</span>
+                        </div>
+                      </div>
+                    </>
+                  ) : (
+                    <>
+                      <p className="text-gray-700 dark:text-gray-300" style={{ fontSize: 13, lineHeight: 1.6, margin: 0 }}>
+                        {updateInfo && t('admin.update.confirmText').replace('{current}', `v${updateInfo.current}`).replace('{version}', `v${updateInfo.latest}`)}
+                      </p>
+
+                      <div style={{ marginTop: 14, padding: '10px 12px', borderRadius: 10, fontSize: 12, lineHeight: 1.5 }}
+                        className="bg-emerald-50 dark:bg-emerald-900/30 text-emerald-700 dark:text-emerald-300 border border-emerald-200 dark:border-emerald-800"
+                      >
+                        <div className="flex items-start gap-2">
+                          <CheckCircle className="w-3.5 h-3.5 mt-0.5 flex-shrink-0" />
+                          <span>{t('admin.update.dataInfo')}</span>
+                        </div>
+                      </div>
+
+                      <div style={{ marginTop: 10, padding: '10px 12px', borderRadius: 10, fontSize: 12, lineHeight: 1.5 }}
+                        className="bg-blue-50 dark:bg-blue-900/30 text-blue-700 dark:text-blue-300 border border-blue-200 dark:border-blue-800"
+                      >
+                        <div className="flex items-start gap-2">
+                          <Download className="w-3.5 h-3.5 mt-0.5 flex-shrink-0" />
+                          <span>
+                            {t('admin.update.backupHint')}{' '}
+                            <button
+                              onClick={() => { setShowUpdateModal(false); setActiveTab('backup') }}
+                              className="underline font-semibold hover:text-blue-950 dark:hover:text-blue-100"
+                            >{t('admin.update.backupLink')}</button>
+                          </span>
+                        </div>
+                      </div>
+
+                      <div style={{ marginTop: 10, padding: '10px 12px', borderRadius: 10, fontSize: 12, lineHeight: 1.5 }}
+                        className="bg-red-50 dark:bg-red-900/30 text-red-700 dark:text-red-300 border border-red-200 dark:border-red-800"
+                      >
+                        <div className="flex items-start gap-2">
+                          <AlertTriangle className="w-3.5 h-3.5 mt-0.5 flex-shrink-0" />
+                          <span>{t('admin.update.warning')}</span>
+                        </div>
+                      </div>
+                    </>
+                  )}
+                </div>
+
+                {/* Footer */}
+                <div style={{ padding: '0 24px 20px', display: 'flex', gap: 10, justifyContent: 'flex-end' }}>
+                  <button
+                    onClick={() => setShowUpdateModal(false)}
+                    disabled={updating}
+                    className="text-gray-600 dark:text-gray-400 hover:bg-gray-100 dark:hover:bg-gray-700 disabled:opacity-40"
+                    style={{ padding: '9px 20px', borderRadius: 10, fontSize: 13, fontWeight: 600, border: 'none', cursor: 'pointer', fontFamily: 'inherit' }}
+                  >
+                    {t('common.cancel')}
+                  </button>
+                  {!updateInfo?.is_docker && (
+                    <button
+                      onClick={handleInstallUpdate}
+                      disabled={updating}
+                      className="bg-slate-900 dark:bg-white text-white dark:text-slate-900 hover:bg-slate-700 dark:hover:bg-gray-200 disabled:opacity-60 flex items-center gap-2"
+                      style={{ padding: '9px 20px', borderRadius: 10, fontSize: 13, fontWeight: 600, border: 'none', cursor: 'pointer', fontFamily: 'inherit' }}
+                    >
+                      {updating ? (
+                        <Loader2 size={14} className="animate-spin" />
+                      ) : (
+                        <Download size={14} />
+                      )}
+                      {updating ? t('admin.update.installing') : t('admin.update.confirm')}
+                    </button>
+                  )}
+                </div>
+              </>
+            )}
+          </div>
+        </div>
+      )}
     </div>
   )
 }

client/src/pages/AtlasPage.jsx

@@ -0,0 +1,470 @@
+import React, { useEffect, useState, useRef } from 'react'
+import { useNavigate } from 'react-router-dom'
+import { useTranslation } from '../i18n'
+import { useSettingsStore } from '../store/settingsStore'
+import Navbar from '../components/Layout/Navbar'
+import apiClient from '../api/client'
+import { Globe, MapPin, Briefcase, Calendar, Flag, ChevronRight, PanelLeftOpen, PanelLeftClose, X } from 'lucide-react'
+import L from 'leaflet'
+
+// Convert country code to flag emoji
+function MobileStats({ data, stats, countries, resolveName, t, dark }) {
+  const tp = dark ? '#f1f5f9' : '#0f172a'
+  const tf = dark ? '#475569' : '#94a3b8'
+  const { continents, lastTrip, nextTrip, streak, firstYear, tripsThisYear } = data || {}
+  const CL = { 'Europe': t('atlas.europe'), 'Asia': t('atlas.asia'), 'North America': t('atlas.northAmerica'), 'South America': t('atlas.southAmerica'), 'Africa': t('atlas.africa'), 'Oceania': t('atlas.oceania') }
+  const thisYear = new Date().getFullYear()
+
+  return (
+    <div className="space-y-4">
+      {/* Stats grid */}
+      <div className="grid grid-cols-5 gap-2">
+        {[[stats.totalCountries, t('atlas.countries')], [stats.totalTrips, t('atlas.trips')], [stats.totalPlaces, t('atlas.places')], [stats.totalCities || 0, t('atlas.cities')], [stats.totalDays, t('atlas.days')]].map(([v, l], i) => (
+          <div key={i} className="text-center py-2">
+            <p className="text-xl font-black tabular-nums" style={{ color: tp }}>{v}</p>
+            <p className="text-[9px] font-semibold uppercase tracking-wide" style={{ color: tf }}>{l}</p>
+          </div>
+        ))}
+      </div>
+      {/* Continents */}
+      <div className="grid grid-cols-6 gap-1">
+        {['Europe', 'Asia', 'North America', 'South America', 'Africa', 'Oceania'].map(cont => {
+          const count = continents?.[cont] || 0
+          return (
+            <div key={cont} className="text-center py-1">
+              <p className="text-base font-bold tabular-nums" style={{ color: count > 0 ? tp : (dark ? 'rgba(255,255,255,0.15)' : 'rgba(0,0,0,0.12)') }}>{count}</p>
+              <p className="text-[8px] font-semibold uppercase" style={{ color: count > 0 ? tf : (dark ? 'rgba(255,255,255,0.1)' : 'rgba(0,0,0,0.08)') }}>{CL[cont]}</p>
+            </div>
+          )
+        })}
+      </div>
+      {/* Highlights */}
+      <div className="flex gap-3">
+        {streak > 0 && (
+          <div className="text-center flex-1 py-2">
+            <p className="text-xl font-black tabular-nums" style={{ color: tp }}>{streak}</p>
+            <p className="text-[9px] font-semibold uppercase tracking-wide" style={{ color: tf }}>{streak === 1 ? t('atlas.yearInRow') : t('atlas.yearsInRow')}</p>
+          </div>
+        )}
+        {tripsThisYear > 0 && (
+          <div className="text-center flex-1 py-2">
+            <p className="text-xl font-black tabular-nums" style={{ color: tp }}>{tripsThisYear}</p>
+            <p className="text-[9px] font-semibold uppercase tracking-wide" style={{ color: tf }}>{tripsThisYear === 1 ? t('atlas.tripIn') : t('atlas.tripsIn')} {thisYear}</p>
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}
+
+function countryCodeToFlag(code) {
+  if (!code || code.length !== 2) return ''
+  return String.fromCodePoint(...[...code.toUpperCase()].map(c => 0x1F1E6 + c.charCodeAt(0) - 65))
+}
+
+function useCountryNames(language) {
+  const [resolver, setResolver] = useState(() => (code) => code)
+  useEffect(() => {
+    try {
+      const dn = new Intl.DisplayNames([language === 'de' ? 'de' : 'en'], { type: 'region' })
+      setResolver(() => (code) => { try { return dn.of(code) } catch { return code } })
+    } catch { /* */ }
+  }, [language])
+  return resolver
+}
+
+// Map visited country codes to ISO-3166 alpha3 (GeoJSON uses alpha3)
+const A2_TO_A3 = {"AF":"AFG","AL":"ALB","DZ":"DZA","AD":"AND","AO":"AGO","AR":"ARG","AM":"ARM","AU":"AUS","AT":"AUT","AZ":"AZE","BR":"BRA","BE":"BEL","BG":"BGR","CA":"CAN","CL":"CHL","CN":"CHN","CO":"COL","HR":"HRV","CZ":"CZE","DK":"DNK","EG":"EGY","EE":"EST","FI":"FIN","FR":"FRA","DE":"DEU","GR":"GRC","HU":"HUN","IS":"ISL","IN":"IND","ID":"IDN","IR":"IRN","IQ":"IRQ","IE":"IRL","IL":"ISR","IT":"ITA","JP":"JPN","KE":"KEN","KR":"KOR","LV":"LVA","LT":"LTU","LU":"LUX","MY":"MYS","MX":"MEX","MA":"MAR","NL":"NLD","NZ":"NZL","NO":"NOR","PK":"PAK","PE":"PER","PH":"PHL","PL":"POL","PT":"PRT","RO":"ROU","RU":"RUS","SA":"SAU","RS":"SRB","SK":"SVK","SI":"SVN","ZA":"ZAF","ES":"ESP","SE":"SWE","CH":"CHE","TH":"THA","TR":"TUR","UA":"UKR","AE":"ARE","GB":"GBR","US":"USA","VN":"VNM","NG":"NGA"}
+
+export default function AtlasPage() {
+  const { t, language } = useTranslation()
+  const { settings } = useSettingsStore()
+  const navigate = useNavigate()
+  const resolveName = useCountryNames(language)
+  const dark = settings.dark_mode
+  const mapRef = useRef(null)
+  const mapInstance = useRef(null)
+  const geoLayerRef = useRef(null)
+  const glareRef = useRef(null)
+  const borderGlareRef = useRef(null)
+  const panelRef = useRef(null)
+
+  const handlePanelMouseMove = (e) => {
+    if (!panelRef.current || !glareRef.current || !borderGlareRef.current) return
+    const rect = panelRef.current.getBoundingClientRect()
+    const x = e.clientX - rect.left
+    const y = e.clientY - rect.top
+    // Subtle inner glow
+    glareRef.current.style.background = `radial-gradient(circle 300px at ${x}px ${y}px, ${dark ? 'rgba(255,255,255,0.025)' : 'rgba(255,255,255,0.25)'} 0%, transparent 70%)`
+    glareRef.current.style.opacity = '1'
+    // Border glow that follows cursor
+    borderGlareRef.current.style.opacity = '1'
+    borderGlareRef.current.style.maskImage = `radial-gradient(circle 150px at ${x}px ${y}px, black 0%, transparent 100%)`
+    borderGlareRef.current.style.WebkitMaskImage = `radial-gradient(circle 150px at ${x}px ${y}px, black 0%, transparent 100%)`
+  }
+  const handlePanelMouseLeave = () => {
+    if (glareRef.current) glareRef.current.style.opacity = '0'
+    if (borderGlareRef.current) borderGlareRef.current.style.opacity = '0'
+  }
+
+  const [data, setData] = useState(null)
+  const [loading, setLoading] = useState(true)
+  const [sidebarOpen, setSidebarOpen] = useState(true)
+  const [mobileSidebarOpen, setMobileSidebarOpen] = useState(false)
+  const [selectedCountry, setSelectedCountry] = useState(null)
+  const [countryDetail, setCountryDetail] = useState(null)
+  const [geoData, setGeoData] = useState(null)
+
+  // Load atlas data
+  useEffect(() => {
+    apiClient.get('/addons/atlas/stats').then(r => {
+      setData(r.data)
+      setLoading(false)
+    }).catch(() => setLoading(false))
+  }, [])
+
+  // Load GeoJSON world data (direct GeoJSON, no conversion needed)
+  useEffect(() => {
+    fetch('https://raw.githubusercontent.com/nvkelso/natural-earth-vector/master/geojson/ne_110m_admin_0_countries.geojson')
+      .then(r => r.json())
+      .then(geo => setGeoData(geo))
+      .catch(() => {})
+  }, [])
+
+  // Initialize map — runs after loading is done and mapRef is available
+  useEffect(() => {
+    if (loading || !mapRef.current) return
+    if (mapInstance.current) { mapInstance.current.remove(); mapInstance.current = null }
+
+    const map = L.map(mapRef.current, {
+      center: [25, 0],
+      zoom: 3,
+      minZoom: 3,
+      maxZoom: 7,
+      zoomControl: false,
+      attributionControl: false,
+      maxBounds: [[-90, -220], [90, 220]],
+      maxBoundsViscosity: 1.0,
+      fadeAnimation: false,
+      preferCanvas: true,
+    })
+
+    L.control.zoom({ position: 'bottomright' }).addTo(map)
+
+    const tileUrl = dark
+      ? 'https://{s}.basemaps.cartocdn.com/dark_nolabels/{z}/{x}/{y}{r}.png'
+      : 'https://{s}.basemaps.cartocdn.com/light_nolabels/{z}/{x}/{y}{r}.png'
+
+    L.tileLayer(tileUrl, {
+      maxZoom: 8,
+      keepBuffer: 25,
+      updateWhenZooming: true,
+      updateWhenIdle: false,
+      tileSize: 256,
+      zoomOffset: 0,
+      crossOrigin: true,
+      loading: true,
+    }).addTo(map)
+
+    // Preload adjacent zoom level tiles
+    L.tileLayer(tileUrl, {
+      maxZoom: 8,
+      keepBuffer: 10,
+      opacity: 0,
+      tileSize: 256,
+      crossOrigin: true,
+    }).addTo(map)
+
+    mapInstance.current = map
+    return () => { map.remove(); mapInstance.current = null }
+  }, [dark, loading])
+
+  // Render GeoJSON countries
+  useEffect(() => {
+    if (!mapInstance.current || !geoData || !data) return
+
+    const visitedA3 = new Set(data.countries.map(c => A2_TO_A3[c.code]).filter(Boolean))
+    const countryMap = {}
+    data.countries.forEach(c => { if (A2_TO_A3[c.code]) countryMap[A2_TO_A3[c.code]] = c })
+
+    if (geoLayerRef.current) {
+      mapInstance.current.removeLayer(geoLayerRef.current)
+    }
+
+    // Generate deterministic color per country code
+    const VISITED_COLORS = ['#6366f1','#ec4899','#14b8a6','#f97316','#8b5cf6','#ef4444','#3b82f6','#22c55e','#06b6d4','#f43f5e','#a855f7','#10b981','#0ea5e9','#e11d48','#0d9488','#7c3aed','#2563eb','#dc2626','#059669','#d946ef']
+    // Assign colors in order of visit (by index in countries array) so no two neighbors share a color easily
+    const visitedA3List = [...visitedA3]
+    const colorMap = {}
+    visitedA3List.forEach((a3, i) => { colorMap[a3] = VISITED_COLORS[i % VISITED_COLORS.length] })
+    const colorForCode = (a3) => colorMap[a3] || VISITED_COLORS[0]
+
+    const canvasRenderer = L.canvas({ padding: 0.5, tolerance: 5 })
+
+    geoLayerRef.current = L.geoJSON(geoData, {
+      renderer: canvasRenderer,
+      interactive: true,
+      bubblingMouseEvents: false,
+      style: (feature) => {
+        const a3 = feature.properties?.ISO_A3 || feature.properties?.ADM0_A3 || feature.properties?.['ISO3166-1-Alpha-3'] || feature.id
+        const visited = visitedA3.has(a3)
+        return {
+          fillColor: visited ? colorForCode(a3) : (dark ? '#1e1e2e' : '#e2e8f0'),
+          fillOpacity: visited ? 0.7 : 0.3,
+          color: dark ? '#333' : '#cbd5e1',
+          weight: 0.5,
+        }
+      },
+      onEachFeature: (feature, layer) => {
+        const a3 = feature.properties?.ISO_A3 || feature.properties?.ADM0_A3 || feature.properties?.['ISO3166-1-Alpha-3'] || feature.id
+        const c = countryMap[a3]
+        if (c) {
+          const name = resolveName(c.code)
+          const formatDate = (d) => { if (!d) return '—'; const dt = new Date(d); return dt.toLocaleDateString(language === 'de' ? 'de-DE' : 'en-US', { month: 'short', year: 'numeric' }) }
+          const tooltipHtml = `
+            <div style="display:flex;flex-direction:column;gap:8px;min-width:160px">
+              <div style="font-size:13px;font-weight:600;text-transform:uppercase;letter-spacing:0.1em;padding-bottom:6px;border-bottom:1px solid ${dark ? 'rgba(255,255,255,0.08)' : 'rgba(0,0,0,0.08)'}">${name}</div>
+              <div style="display:flex;gap:14px">
+                <div><span style="font-size:16px;font-weight:800">${c.tripCount}</span> <span style="font-size:10px;opacity:0.5;text-transform:uppercase;letter-spacing:0.05em">${c.tripCount === 1 ? t('atlas.tripSingular') : t('atlas.tripPlural')}</span></div>
+                <div><span style="font-size:16px;font-weight:800">${c.placeCount}</span> <span style="font-size:10px;opacity:0.5;text-transform:uppercase;letter-spacing:0.05em">${c.placeCount === 1 ? t('atlas.placeVisited') : t('atlas.placesVisited')}</span></div>
+              </div>
+              <div style="display:flex;gap:2px;border-top:1px solid ${dark ? 'rgba(255,255,255,0.08)' : 'rgba(0,0,0,0.08)'};padding-top:8px">
+                <div style="flex:1;display:flex;flex-direction:column;gap:2px">
+                  <span style="font-size:9px;text-transform:uppercase;letter-spacing:0.08em;opacity:0.4">${t('atlas.firstVisit')}</span>
+                  <span style="font-size:12px;font-weight:700">${formatDate(c.firstVisit)}</span>
+                </div>
+                <div style="flex:1;display:flex;flex-direction:column;gap:2px">
+                  <span style="font-size:9px;text-transform:uppercase;letter-spacing:0.08em;opacity:0.4">${t('atlas.lastVisitLabel')}</span>
+                  <span style="font-size:12px;font-weight:700">${formatDate(c.lastVisit)}</span>
+                </div>
+              </div>
+              </div>
+            </div>`
+          layer.bindTooltip(tooltipHtml, {
+            sticky: false, permanent: false, className: 'atlas-tooltip', direction: 'top', offset: [0, -10], opacity: 1
+          })
+          layer.on('click', () => loadCountryDetail(c.code))
+          layer.on('mouseover', (e) => {
+            e.target.setStyle({ fillOpacity: 0.9, weight: 2, color: dark ? '#818cf8' : '#4f46e5' })
+          })
+          layer.on('mouseout', (e) => {
+            geoLayerRef.current.resetStyle(e.target)
+          })
+        }
+      }
+    }).addTo(mapInstance.current)
+  }, [geoData, data, dark])
+
+  const loadCountryDetail = async (code) => {
+    setSelectedCountry(code)
+    try {
+      const r = await apiClient.get(`/addons/atlas/country/${code}`)
+      setCountryDetail(r.data)
+    } catch { /* */ }
+  }
+
+  const stats = data?.stats || { totalTrips: 0, totalPlaces: 0, totalCountries: 0, totalDays: 0 }
+  const countries = data?.countries || []
+
+  if (loading) {
+    return (
+      <div className="min-h-screen" style={{ background: 'var(--bg-primary)' }}>
+        <Navbar />
+        <div className="flex items-center justify-center" style={{ paddingTop: 'var(--nav-h)', minHeight: 'calc(100vh - var(--nav-h))' }}>
+          <div className="w-8 h-8 border-2 rounded-full animate-spin" style={{ borderColor: 'var(--border-primary)', borderTopColor: 'var(--text-primary)' }} />
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="min-h-screen" style={{ background: 'var(--bg-primary)' }}>
+      <Navbar />
+      <div style={{ position: 'fixed', top: 'var(--nav-h)', left: 0, right: 0, bottom: 0 }}>
+        {/* Map */}
+        <div ref={mapRef} style={{ position: 'absolute', inset: 0, zIndex: 1, background: dark ? '#1a1a2e' : '#f0f0f0' }} />
+
+        {/* Mobile: Bottom bar */}
+        <div className="md:hidden absolute bottom-3 left-0 right-0 z-10 flex justify-center" style={{ touchAction: 'manipulation' }}>
+          <div className="flex items-center gap-4 px-5 py-4 rounded-2xl"
+            style={{ background: dark ? 'rgba(0,0,0,0.45)' : 'rgba(255,255,255,0.5)', backdropFilter: 'blur(16px)' }}>
+            {/* Countries highlighted */}
+            <div className="text-center px-3 py-1.5 rounded-xl" style={{ background: dark ? 'rgba(255,255,255,0.08)' : 'rgba(0,0,0,0.05)' }}>
+              <p className="text-3xl font-black tabular-nums leading-none" style={{ color: 'var(--text-primary)' }}>{stats.totalCountries}</p>
+              <p className="text-[9px] font-semibold uppercase tracking-wide mt-1" style={{ color: 'var(--text-faint)' }}>{t('atlas.countries')}</p>
+            </div>
+            {[[stats.totalTrips, t('atlas.trips')], [stats.totalPlaces, t('atlas.places')], [stats.totalCities || 0, t('atlas.cities')], [stats.totalDays, t('atlas.days')]].map(([v, l], i) => (
+              <div key={i} className="text-center px-1">
+                <p className="text-xl font-black tabular-nums leading-none" style={{ color: 'var(--text-primary)' }}>{v}</p>
+                <p className="text-[9px] font-semibold uppercase tracking-wide mt-1" style={{ color: 'var(--text-faint)' }}>{l}</p>
+              </div>
+            ))}
+          </div>
+        </div>
+
+        {/* Desktop Panel — bottom center, glass effect */}
+        <div
+          ref={panelRef}
+          onMouseMove={handlePanelMouseMove}
+          onMouseLeave={handlePanelMouseLeave}
+          className="hidden md:flex flex-col absolute z-10 overflow-hidden transition-all duration-300"
+          style={{
+            bottom: 16,
+            left: '50%',
+            transform: 'translateX(-50%)',
+            width: 'fit-content',
+            background: dark ? 'rgba(10,10,15,0.55)' : 'rgba(255,255,255,0.2)',
+            backdropFilter: 'blur(24px) saturate(180%)',
+            WebkitBackdropFilter: 'blur(24px) saturate(180%)',
+            border: '1px solid ' + (dark ? 'rgba(255,255,255,0.08)' : 'rgba(0,0,0,0.06)'),
+            borderRadius: 20,
+            boxShadow: dark
+              ? '0 8px 32px rgba(0,0,0,0.3)'
+              : '0 8px 32px rgba(0,0,0,0.08)',
+          }}
+        >
+          {/* Liquid glass glare effect */}
+          <div ref={glareRef} className="absolute inset-0 pointer-events-none" style={{ opacity: 0, transition: 'opacity 0.3s ease', borderRadius: 20 }} />
+          {/* Border glow that follows cursor */}
+          <div ref={borderGlareRef} className="absolute inset-0 pointer-events-none" style={{
+            opacity: 0, transition: 'opacity 0.3s ease', borderRadius: 20,
+            border: dark ? '1.5px solid rgba(255,255,255,0.5)' : '2px solid rgba(0,0,0,0.15)',
+          }} />
+          <SidebarContent
+            data={data} stats={stats} countries={countries} selectedCountry={selectedCountry}
+            countryDetail={countryDetail} resolveName={resolveName}
+            onCountryClick={loadCountryDetail} onTripClick={(id) => navigate(`/trips/${id}`)}
+            t={t} dark={dark}
+          />
+        </div>
+
+
+      </div>
+    </div>
+  )
+}
+
+function SidebarContent({ data, stats, countries, selectedCountry, countryDetail, resolveName, onCountryClick, onTripClick, t, dark }) {
+  const bg = (o) => dark ? `rgba(255,255,255,${o})` : `rgba(0,0,0,${o})`
+  const tp = dark ? '#f1f5f9' : '#0f172a'
+  const tm = dark ? '#94a3b8' : '#64748b'
+  const tf = dark ? '#475569' : '#94a3b8'
+  const accent = '#818cf8'
+
+  const { mostVisited, continents, lastTrip, nextTrip, streak, firstYear, tripsThisYear } = data || {}
+  const contEntries = continents ? Object.entries(continents).sort((a, b) => b[1] - a[1]) : []
+  const maxCont = contEntries.length > 0 ? contEntries[0][1] : 1
+  const CL = { 'Europe': t('atlas.europe'), 'Asia': t('atlas.asia'), 'North America': t('atlas.northAmerica'), 'South America': t('atlas.southAmerica'), 'Africa': t('atlas.africa'), 'Oceania': t('atlas.oceania') }
+  const contColors = ['#818cf8', '#f472b6', '#34d399', '#fbbf24', '#fb923c', '#22d3ee']
+
+  if (countries.length === 0 && !lastTrip) {
+    return (
+      <div className="p-8 text-center">
+        <Globe size={28} className="mx-auto mb-2" style={{ color: tf, opacity: 0.4 }} />
+        <p className="text-sm font-medium" style={{ color: tm }}>{t('atlas.noData')}</p>
+        <p className="text-xs mt-1" style={{ color: tf }}>{t('atlas.noDataHint')}</p>
+      </div>
+    )
+  }
+
+  const thisYear = new Date().getFullYear()
+  const divider = `2px solid ${bg(0.08)}`
+
+  return (
+    <div className="flex items-stretch justify-center">
+
+      {/* ═══ SECTION 1: Numbers ═══ */}
+      {/* Countries hero */}
+      <div className="flex items-baseline gap-1.5 px-5 py-4 mx-2 my-2 rounded-xl" style={{ background: bg(0.08) }}>
+        <span className="text-5xl font-black tabular-nums leading-none" style={{ color: tp }}>{stats.totalCountries}</span>
+        <span className="text-sm font-medium" style={{ color: tm }}>{t('atlas.countries')}</span>
+      </div>
+      {/* Other stats */}
+      {[[stats.totalTrips, t('atlas.trips')], [stats.totalPlaces, t('atlas.places')], [stats.totalCities || 0, t('atlas.cities')], [stats.totalDays, t('atlas.days')]].map(([v, l], i) => (
+        <div key={i} className="flex flex-col items-center justify-center px-3 py-5 shrink-0">
+          <span className="text-2xl font-black tabular-nums leading-none" style={{ color: tp }}>{v}</span>
+          <span className="text-[9px] font-semibold mt-1.5 uppercase tracking-wide whitespace-nowrap" style={{ color: tf }}>{l}</span>
+        </div>
+      ))}
+
+      {/* ═══ DIVIDER ═══ */}
+      <div style={{ width: 2, background: bg(0.08), margin: '12px 14px' }} />
+
+      {/* ═══ SECTION 2: Continents ═══ */}
+      <div className="flex items-center gap-4 px-3 py-4 shrink-0">
+        {['Europe', 'Asia', 'North America', 'South America', 'Africa', 'Oceania'].map((cont) => {
+          const count = continents?.[cont] || 0
+          const active = count > 0
+          return (
+            <div key={cont} className="flex flex-col items-center shrink-0">
+              <span className="text-2xl font-black tabular-nums leading-none" style={{ color: active ? tp : bg(0.15) }}>{count}</span>
+              <span className="text-[9px] font-semibold mt-1.5 uppercase tracking-wide whitespace-nowrap" style={{ color: active ? tf : bg(0.1) }}>{CL[cont]}</span>
+            </div>
+          )
+        })}
+      </div>
+
+      {/* ═══ DIVIDER ═══ */}
+      <div style={{ width: 2, background: bg(0.08), margin: '12px 14px' }} />
+
+      {/* ═══ SECTION 3: Highlights & Streaks ═══ */}
+      <div className="flex items-center gap-5 px-3 py-4">
+        {/* Last trip */}
+        {lastTrip && (
+          <button onClick={() => onTripClick(lastTrip.id)} className="flex items-center gap-2.5 text-left transition-opacity hover:opacity-75">
+            <div className="w-10 h-10 rounded-xl flex items-center justify-center text-lg shrink-0" style={{ background: bg(0.06) }}>
+              {lastTrip.countryCode ? countryCodeToFlag(lastTrip.countryCode) : <MapPin size={16} style={{ color: tm }} />}
+            </div>
+            <div className="min-w-0">
+              <p className="text-[9px] uppercase tracking-wider font-semibold" style={{ color: tf }}>{t('atlas.lastTrip')}</p>
+              <p className="text-[13px] font-bold truncate" style={{ color: tp }}>{lastTrip.title}</p>
+            </div>
+          </button>
+        )}
+        {/* Streak */}
+        {streak > 0 && (
+          <div className="flex flex-col items-center justify-center px-3">
+            <span className="text-2xl font-black tabular-nums leading-none" style={{ color: tp }}>{streak}</span>
+            <span className="text-[9px] font-semibold mt-1.5 uppercase tracking-wide text-center leading-tight whitespace-nowrap" style={{ color: tf }}>
+              {streak === 1 ? t('atlas.yearInRow') : t('atlas.yearsInRow')}
+            </span>
+          </div>
+        )}
+        {/* This year */}
+        {tripsThisYear > 0 && (
+          <div className="flex flex-col items-center justify-center px-3">
+            <span className="text-2xl font-black tabular-nums leading-none" style={{ color: tp }}>{tripsThisYear}</span>
+            <span className="text-[9px] font-semibold mt-1.5 uppercase tracking-wide text-center leading-tight whitespace-nowrap" style={{ color: tf }}>
+              {tripsThisYear === 1 ? t('atlas.tripIn') : t('atlas.tripsIn')} {thisYear}
+            </span>
+          </div>
+        )}
+      </div>
+
+      {/* ═══ Country detail overlay ═══ */}
+      {selectedCountry && countryDetail && (
+        <>
+          <div style={{ width: 2, background: bg(0.08), margin: '12px 0' }} />
+          <div className="flex items-center gap-3 px-6 py-4">
+            <span className="text-3xl">{countryCodeToFlag(selectedCountry)}</span>
+            <div>
+              <p className="text-sm font-bold" style={{ color: tp }}>{resolveName(selectedCountry)}</p>
+              <p className="text-[10px] mb-1" style={{ color: tf }}>{countryDetail.places.length} {t('atlas.places')} · {countryDetail.trips.length} Trips</p>
+              <div className="flex flex-wrap gap-1">
+                {countryDetail.trips.slice(0, 3).map(trip => (
+                  <button key={trip.id} onClick={() => onTripClick(trip.id)}
+                    className="flex items-center gap-1 px-2 py-0.5 rounded text-[10px] font-semibold transition-opacity hover:opacity-75"
+                    style={{ background: bg(0.08), color: tp }}>
+                    <Briefcase size={9} style={{ color: tm }} />
+                    {trip.title}
+                  </button>
+                ))}
+              </div>
+            </div>
+          </div>
+        </>
+      )}
+    </div>
+  )
+}
+

client/src/pages/DashboardPage.jsx

@@ -2,14 +2,17 @@ import React, { useEffect, useState, useRef } from 'react'
 import { useNavigate } from 'react-router-dom'
 import { tripsApi } from '../api/client'
 import { useAuthStore } from '../store/authStore'
+import { useSettingsStore } from '../store/settingsStore'
 import { useTranslation } from '../i18n'
 import Navbar from '../components/Layout/Navbar'
-import TravelStats from '../components/Dashboard/TravelStats'
+import DemoBanner from '../components/Layout/DemoBanner'
+import CurrencyWidget from '../components/Dashboard/CurrencyWidget'
+import TimezoneWidget from '../components/Dashboard/TimezoneWidget'
 import TripFormModal from '../components/Trips/TripFormModal'
 import { useToast } from '../components/shared/Toast'
 import {
   Plus, Calendar, Trash2, Edit2, Map, ChevronDown, ChevronUp,
-  Archive, ArchiveRestore, Clock, MapPin,
+  Archive, ArchiveRestore, Clock, MapPin, Settings, X, ArrowRightLeft,
 } from 'lucide-react'
 
 const font = { fontFamily: "-apple-system, BlinkMacSystemFont, 'SF Pro Text', system-ui, sans-serif" }
@@ -71,8 +74,42 @@ const GRADIENTS = [
 ]
 function tripGradient(id) { return GRADIENTS[id % GRADIENTS.length] }
 
+// ── Liquid Glass hover effect ────────────────────────────────────────────────
+function LiquidGlass({ children, dark, style, className = '', onClick }) {
+  const ref = useRef(null)
+  const glareRef = useRef(null)
+  const borderRef = useRef(null)
+
+  const onMove = (e) => {
+    if (!ref.current || !glareRef.current || !borderRef.current) return
+    const rect = ref.current.getBoundingClientRect()
+    const x = e.clientX - rect.left
+    const y = e.clientY - rect.top
+    glareRef.current.style.background = `radial-gradient(circle 250px at ${x}px ${y}px, ${dark ? 'rgba(255,255,255,0.04)' : 'rgba(0,0,0,0.03)'} 0%, transparent 70%)`
+    glareRef.current.style.opacity = '1'
+    borderRef.current.style.opacity = '1'
+    borderRef.current.style.maskImage = `radial-gradient(circle 120px at ${x}px ${y}px, black 0%, transparent 100%)`
+    borderRef.current.style.WebkitMaskImage = `radial-gradient(circle 120px at ${x}px ${y}px, black 0%, transparent 100%)`
+  }
+  const onLeave = () => {
+    if (glareRef.current) glareRef.current.style.opacity = '0'
+    if (borderRef.current) borderRef.current.style.opacity = '0'
+  }
+
+  return (
+    <div ref={ref} onMouseMove={onMove} onMouseLeave={onLeave} onClick={onClick} className={className}
+      style={{ position: 'relative', overflow: 'hidden', ...style }}>
+      <div ref={glareRef} style={{ position: 'absolute', inset: 0, pointerEvents: 'none', opacity: 0, transition: 'opacity 0.3s', borderRadius: 'inherit', zIndex: 1 }} />
+      <div ref={borderRef} style={{ position: 'absolute', inset: 0, pointerEvents: 'none', opacity: 0, transition: 'opacity 0.3s', borderRadius: 'inherit', zIndex: 1,
+        border: dark ? '1.5px solid rgba(255,255,255,0.4)' : '1.5px solid rgba(0,0,0,0.12)',
+      }} />
+      {children}
+    </div>
+  )
+}
+
 // ── Spotlight Card (next upcoming trip) ─────────────────────────────────────
-function SpotlightCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale }) {
+function SpotlightCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale, dark }) {
   const status = getTripStatus(trip)
 
   const coverBg = trip.cover_image
@@ -80,7 +117,7 @@ function SpotlightCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale }
     : tripGradient(trip.id)
 
   return (
-    <div style={{ marginBottom: 32, borderRadius: 20, overflow: 'hidden', boxShadow: '0 8px 40px rgba(0,0,0,0.13)', position: 'relative', cursor: 'pointer' }}
+    <LiquidGlass dark={dark} style={{ marginBottom: 32, borderRadius: 20, boxShadow: '0 8px 40px rgba(0,0,0,0.13)', cursor: 'pointer' }}
       onClick={() => onClick(trip)}>
       {/* Cover / Background */}
       <div style={{ height: 300, background: coverBg, position: 'relative' }}>
@@ -148,7 +185,7 @@ function SpotlightCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale }
           </div>
         </div>
       </div>
-    </div>
+    </LiquidGlass>
   )
 }
 
@@ -167,9 +204,9 @@ function TripCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale }) {
       onMouseLeave={() => setHovered(false)}
       onClick={() => onClick(trip)}
       style={{
-        background: 'var(--bg-card)', borderRadius: 16, overflow: 'hidden', cursor: 'pointer',
-        border: '1px solid var(--border-primary)', transition: 'all 0.18s',
-        boxShadow: hovered ? '0 8px 28px rgba(0,0,0,0.10)' : '0 1px 4px rgba(0,0,0,0.04)',
+        background: hovered ? 'var(--bg-tertiary)' : 'var(--bg-card)', borderRadius: 16, overflow: 'hidden', cursor: 'pointer',
+        border: `1px solid ${hovered ? 'var(--text-faint)' : 'var(--border-primary)'}`, transition: 'all 0.18s',
+        boxShadow: hovered ? '0 8px 28px rgba(0,0,0,0.15)' : '0 1px 4px rgba(0,0,0,0.04)',
         transform: hovered ? 'translateY(-2px)' : 'none',
       }}
     >
@@ -344,10 +381,26 @@ export default function DashboardPage() {
   const [showForm, setShowForm] = useState(false)
   const [editingTrip, setEditingTrip] = useState(null)
   const [showArchived, setShowArchived] = useState(false)
+  const [showWidgetSettings, setShowWidgetSettings] = useState(false)
 
   const navigate = useNavigate()
   const toast = useToast()
   const { t, locale } = useTranslation()
+  const { demoMode } = useAuthStore()
+  const { settings, updateSetting } = useSettingsStore()
+  const dark = settings.dark_mode
+  const showCurrency = settings.dashboard_currency !== 'off'
+  const showTimezone = settings.dashboard_timezone !== 'off'
+  const showSidebar = showCurrency || showTimezone
+
+  useEffect(() => {
+    if (showWidgetSettings === 'mobile') {
+      document.body.style.overflow = 'hidden'
+    } else {
+      document.body.style.overflow = ''
+    }
+    return () => { document.body.style.overflow = '' }
+  }, [showWidgetSettings])
 
   useEffect(() => { loadTrips() }, [])
 
@@ -435,9 +488,10 @@ export default function DashboardPage() {
   const rest = spotlight ? trips.filter(t => t.id !== spotlight.id) : trips
 
   return (
-    <div style={{ minHeight: '100vh', background: 'var(--bg-secondary)', ...font }}>
+    <div style={{ position: 'fixed', inset: 0, display: 'flex', flexDirection: 'column', background: 'var(--bg-secondary)', ...font }}>
       <Navbar />
-      <div style={{ paddingTop: 56 }}>
+      {demoMode && <DemoBanner />}
+      <div style={{ flex: 1, overflow: 'auto', overscrollBehavior: 'contain', marginTop: 'var(--nav-h)' }}>
         <div style={{ maxWidth: 1300, margin: '0 auto', padding: '32px 20px 60px' }}>
 
           {/* Header */}
@@ -450,21 +504,75 @@ export default function DashboardPage() {
                   : t('dashboard.subtitle.empty')}
               </p>
             </div>
-            <button
-              onClick={() => { setEditingTrip(null); setShowForm(true) }}
-              style={{
-                display: 'flex', alignItems: 'center', gap: 7, padding: '9px 18px',
-                background: 'var(--accent)', color: 'var(--accent-text)', border: 'none', borderRadius: 12,
-                fontSize: 13, fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit',
-                boxShadow: '0 2px 8px rgba(0,0,0,0.15)',
-              }}
-              onMouseEnter={e => e.currentTarget.style.opacity = '0.85'}
+            <div style={{ display: 'flex', gap: 8, alignItems: 'stretch' }}>
+              {/* Widget settings */}
+              <button
+                onClick={() => setShowWidgetSettings(s => s ? false : true)}
+                style={{
+                  display: 'flex', alignItems: 'center', justifyContent: 'center',
+                  padding: '0 14px',
+                  background: 'var(--bg-card)', border: '1px solid var(--border-primary)', borderRadius: 12,
+                  cursor: 'pointer', color: 'var(--text-faint)', fontFamily: 'inherit',
+                  transition: 'background 0.15s, border-color 0.15s',
+                }}
+                onMouseEnter={e => { e.currentTarget.style.background = 'var(--bg-hover)'; e.currentTarget.style.borderColor = 'var(--text-faint)' }}
+                onMouseLeave={e => { e.currentTarget.style.background = 'var(--bg-card)'; e.currentTarget.style.borderColor = 'var(--border-primary)' }}
+              >
+                <Settings size={15} />
+              </button>
+              <button
+                onClick={() => { setEditingTrip(null); setShowForm(true) }}
+                style={{
+                  display: 'flex', alignItems: 'center', gap: 7, padding: '9px 18px',
+                  background: 'var(--accent)', color: 'var(--accent-text)', border: 'none', borderRadius: 12,
+                  fontSize: 13, fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit',
+                  boxShadow: '0 2px 8px rgba(0,0,0,0.15)',
+                }}
+                onMouseEnter={e => e.currentTarget.style.opacity = '0.85'}
               onMouseLeave={e => e.currentTarget.style.opacity = '1'}
             >
               <Plus size={15} /> {t('dashboard.newTrip')}
-            </button>
+              </button>
+            </div>
           </div>
 
+          {/* Widget settings dropdown */}
+          {showWidgetSettings && (
+            <div className="rounded-xl border p-3 mb-4 flex items-center gap-4" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
+              <span className="text-xs font-semibold" style={{ color: 'var(--text-muted)' }}>Widgets:</span>
+              <label className="flex items-center gap-2 cursor-pointer">
+                <button onClick={() => updateSetting('dashboard_currency', showCurrency ? 'off' : 'on')}
+                  className="relative inline-flex h-5 w-9 items-center rounded-full transition-colors"
+                  style={{ background: showCurrency ? 'var(--text-primary)' : 'var(--border-primary)' }}>
+                  <span className="absolute left-0.5 h-4 w-4 rounded-full transition-transform duration-200"
+                    style={{ background: 'var(--bg-card)', transform: showCurrency ? 'translateX(16px)' : 'translateX(0)' }} />
+                </button>
+                <span className="text-xs" style={{ color: 'var(--text-primary)' }}>{t('dashboard.currency')}</span>
+              </label>
+              <label className="flex items-center gap-2 cursor-pointer">
+                <button onClick={() => updateSetting('dashboard_timezone', showTimezone ? 'off' : 'on')}
+                  className="relative inline-flex h-5 w-9 items-center rounded-full transition-colors"
+                  style={{ background: showTimezone ? 'var(--text-primary)' : 'var(--border-primary)' }}>
+                  <span className="absolute left-0.5 h-4 w-4 rounded-full transition-transform duration-200"
+                    style={{ background: 'var(--bg-card)', transform: showTimezone ? 'translateX(16px)' : 'translateX(0)' }} />
+                </button>
+                <span className="text-xs" style={{ color: 'var(--text-primary)' }}>{t('dashboard.timezone')}</span>
+              </label>
+            </div>
+          )}
+
+          {/* Mobile widgets button */}
+          {showSidebar && (
+            <button
+              onClick={() => setShowWidgetSettings('mobile')}
+              className="lg:hidden flex items-center justify-center gap-2 w-full py-2.5 rounded-xl text-xs font-semibold mb-4"
+              style={{ background: 'var(--bg-card)', border: '1px solid var(--border-primary)', color: 'var(--text-primary)' }}
+            >
+              <ArrowRightLeft size={13} style={{ color: 'var(--text-faint)' }} />
+              {showCurrency && showTimezone ? `${t('dashboard.currency')} & ${t('dashboard.timezone')}` : showCurrency ? t('dashboard.currency') : t('dashboard.timezone')}
+            </button>
+          )}
+
           <div style={{ display: 'flex', gap: 24, alignItems: 'flex-start' }}>
           {/* Main content */}
           <div style={{ flex: 1, minWidth: 0 }}>
@@ -502,7 +610,7 @@ export default function DashboardPage() {
           {!isLoading && spotlight && (
             <SpotlightCard
               trip={spotlight}
-              t={t} locale={locale}
+              t={t} locale={locale} dark={dark}
               onEdit={tr => { setEditingTrip(tr); setShowForm(true) }}
               onDelete={handleDelete}
               onArchive={handleArchive}
@@ -559,14 +667,37 @@ export default function DashboardPage() {
           )}
           </div>
 
-          {/* Stats sidebar */}
-          <div className="hidden lg:block" style={{ position: 'sticky', top: 80, flexShrink: 0 }}>
-            <TravelStats />
-          </div>
+          {/* Widgets sidebar */}
+          {showSidebar && (
+            <div className="hidden lg:flex flex-col gap-4" style={{ position: 'sticky', top: 80, flexShrink: 0, width: 280 }}>
+              {showCurrency && <LiquidGlass dark={dark} style={{ borderRadius: 16 }}><CurrencyWidget /></LiquidGlass>}
+              {showTimezone && <LiquidGlass dark={dark} style={{ borderRadius: 16 }}><TimezoneWidget /></LiquidGlass>}
+            </div>
+          )}
           </div>
         </div>
       </div>
 
+      {/* Mobile widgets bottom sheet */}
+      {showWidgetSettings === 'mobile' && (
+        <div className="lg:hidden fixed inset-0 z-50" style={{ background: 'rgba(0,0,0,0.3)', touchAction: 'none' }} onClick={() => setShowWidgetSettings(false)}>
+          <div className="absolute bottom-0 left-0 right-0 flex flex-col overflow-hidden"
+            style={{ maxHeight: '80vh', background: 'var(--bg-card)', borderRadius: '20px 20px 0 0', overscrollBehavior: 'contain' }}
+            onClick={e => e.stopPropagation()}>
+            <div className="flex items-center justify-between px-4 py-3" style={{ borderBottom: '1px solid var(--border-secondary)' }}>
+              <span className="text-sm font-semibold" style={{ color: 'var(--text-primary)' }}>Widgets</span>
+              <button onClick={() => setShowWidgetSettings(false)} className="w-7 h-7 rounded-full flex items-center justify-center" style={{ background: 'var(--bg-secondary)' }}>
+                <X size={14} style={{ color: 'var(--text-primary)' }} />
+              </button>
+            </div>
+            <div className="flex-1 overflow-auto p-4 space-y-4">
+              {showCurrency && <CurrencyWidget />}
+              {showTimezone && <TimezoneWidget />}
+            </div>
+          </div>
+        </div>
+      )}
+
       <TripFormModal
         isOpen={showForm}
         onClose={() => { setShowForm(false); setEditingTrip(null) }}

client/src/pages/FilesPage.jsx

@@ -61,7 +61,7 @@ export default function FilesPage() {
     <div className="min-h-screen bg-slate-50">
       <Navbar tripTitle={trip?.title} tripId={tripId} showBack onBack={() => navigate(`/trips/${tripId}`)} />
 
-      <div className="pt-14">
+      <div style={{ paddingTop: 'var(--nav-h)' }}>
         <div className="max-w-5xl mx-auto px-4 py-6">
           <div className="flex items-center gap-3 mb-6">
             <Link

client/src/pages/LoginPage.jsx

@@ -4,7 +4,7 @@ import { useAuthStore } from '../store/authStore'
 import { useSettingsStore } from '../store/settingsStore'
 import { useTranslation } from '../i18n'
 import { authApi } from '../api/client'
-import { Plane, Eye, EyeOff, Mail, Lock, MapPin, Calendar, Package, User, Globe, Zap, Users, Wallet, Map, CheckSquare, BookMarked, FolderOpen, Route } from 'lucide-react'
+import { Plane, Eye, EyeOff, Mail, Lock, MapPin, Calendar, Package, User, Globe, Zap, Users, Wallet, Map, CheckSquare, BookMarked, FolderOpen, Route, Shield } from 'lucide-react'
 
 export default function LoginPage() {
   const { t, language } = useTranslation()
@@ -17,7 +17,7 @@ export default function LoginPage() {
   const [error, setError] = useState('')
   const [appConfig, setAppConfig] = useState(null)
 
-  const { login, register } = useAuthStore()
+  const { login, register, demoLogin } = useAuthStore()
   const { setLanguageLocal } = useSettingsStore()
   const navigate = useNavigate()
 
@@ -28,8 +28,48 @@ export default function LoginPage() {
         if (!config.has_users) setMode('register')
       }
     })
+
+    // Handle OIDC callback token (via URL fragment to avoid logging)
+    const hash = window.location.hash.substring(1)
+    const hashParams = new URLSearchParams(hash)
+    const token = hashParams.get('token')
+    const params = new URLSearchParams(window.location.search)
+    const oidcError = params.get('oidc_error')
+    if (token) {
+      localStorage.setItem('auth_token', token)
+      window.history.replaceState({}, '', '/login')
+      login.__fromOidc = true
+      navigate('/dashboard')
+      window.location.reload()
+    }
+    if (oidcError) {
+      const errorMessages = {
+        registration_disabled: language === 'de' ? 'Registrierung ist deaktiviert. Kontaktiere den Administrator.' : 'Registration is disabled. Contact your administrator.',
+        no_email: language === 'de' ? 'Keine E-Mail vom Provider erhalten.' : 'No email received from provider.',
+        token_failed: language === 'de' ? 'Authentifizierung fehlgeschlagen.' : 'Authentication failed.',
+        invalid_state: language === 'de' ? 'Ungueltige Sitzung. Bitte erneut versuchen.' : 'Invalid session. Please try again.',
+      }
+      setError(errorMessages[oidcError] || oidcError)
+      window.history.replaceState({}, '', '/login')
+    }
   }, [])
 
+  const handleDemoLogin = async () => {
+    setError('')
+    setIsLoading(true)
+    try {
+      await demoLogin()
+      setShowTakeoff(true)
+      setTimeout(() => navigate('/dashboard'), 2600)
+    } catch (err) {
+      setError(err.message || 'Demo-Login fehlgeschlagen')
+    } finally {
+      setIsLoading(false)
+    }
+  }
+
+  const [showTakeoff, setShowTakeoff] = useState(false)
+
   const handleSubmit = async (e) => {
     e.preventDefault()
     setError('')
@@ -42,10 +82,10 @@ export default function LoginPage() {
       } else {
         await login(email, password)
       }
-      navigate('/dashboard')
+      setShowTakeoff(true)
+      setTimeout(() => navigate('/dashboard'), 2600)
     } catch (err) {
       setError(err.message || t('login.error'))
-    } finally {
       setIsLoading(false)
     }
   }
@@ -58,6 +98,157 @@ export default function LoginPage() {
     color: '#111827', background: 'white', boxSizing: 'border-box', transition: 'border-color 0.15s',
   }
 
+  if (showTakeoff) {
+    return (
+      <div className="takeoff-overlay" style={{ position: 'fixed', inset: 0, zIndex: 99999, overflow: 'hidden' }}>
+        {/* Sky gradient */}
+        <div className="takeoff-sky" style={{ position: 'absolute', inset: 0 }} />
+
+        {/* Stars */}
+        {Array.from({ length: 60 }, (_, i) => (
+          <div key={i} className="takeoff-star" style={{
+            position: 'absolute',
+            width: Math.random() > 0.7 ? 3 : 1.5,
+            height: Math.random() > 0.7 ? 3 : 1.5,
+            borderRadius: '50%',
+            background: 'white',
+            top: `${Math.random() * 100}%`,
+            left: `${Math.random() * 100}%`,
+            animationDelay: `${0.3 + Math.random() * 0.5}s, ${Math.random() * 1}s`,
+          }} />
+        ))}
+
+        {/* Clouds rushing past */}
+        {[0, 1, 2, 3, 4].map(i => (
+          <div key={i} className="takeoff-cloud" style={{
+            position: 'absolute',
+            width: 120 + i * 40,
+            height: 40 + i * 10,
+            borderRadius: '50%',
+            background: 'rgba(255,255,255,0.15)',
+            filter: 'blur(8px)',
+            right: -200,
+            top: `${25 + i * 12}%`,
+            animationDelay: `${0.3 + i * 0.25}s`,
+          }} />
+        ))}
+
+        {/* Speed lines */}
+        {Array.from({ length: 12 }, (_, i) => (
+          <div key={i} className="takeoff-speedline" style={{
+            position: 'absolute',
+            width: 80 + Math.random() * 120,
+            height: 1.5,
+            background: 'linear-gradient(90deg, transparent, rgba(255,255,255,0.3), transparent)',
+            top: `${10 + Math.random() * 80}%`,
+            right: -200,
+            animationDelay: `${0.5 + i * 0.12}s`,
+          }} />
+        ))}
+
+        {/* Plane */}
+        <div className="takeoff-plane" style={{ position: 'absolute', left: '50%', bottom: '10%', transform: 'translate(-50%, 0)' }}>
+          <svg viewBox="0 0 480 120" style={{ width: 200, filter: 'drop-shadow(0 0 20px rgba(255,255,255,0.3))' }}>
+            <g fill="white" transform="translate(240,60) rotate(-12)">
+              <ellipse cx="0" cy="0" rx="120" ry="12" />
+              <path d="M-20,-10 L-60,-55 L-40,-55 L0,-15 Z" />
+              <path d="M-20,10 L-60,55 L-40,55 L0,15 Z" />
+              <path d="M-100,-5 L-120,-30 L-108,-30 L-90,-8 Z" />
+              <path d="M-100,5 L-120,30 L-108,30 L-90,8 Z" />
+              <ellipse cx="60" cy="0" rx="18" ry="8" />
+            </g>
+          </svg>
+        </div>
+
+        {/* Contrail */}
+        <div className="takeoff-trail" style={{
+          position: 'absolute', left: '50%', bottom: '8%',
+          width: 3, height: 0, background: 'linear-gradient(to top, transparent, rgba(255,255,255,0.5))',
+          transformOrigin: 'bottom center',
+        }} />
+
+        {/* Logo fade in + burst */}
+        <div className="takeoff-logo" style={{
+          position: 'absolute', top: '50%', left: '50%', transform: 'translate(-50%, -50%)',
+          display: 'flex', flexDirection: 'column', alignItems: 'center', gap: 8,
+        }}>
+          <img src="/logo-light.svg" alt="NOMAD" style={{ height: 72 }} />
+          <p style={{ margin: 0, fontSize: 20, color: 'rgba(255,255,255,0.6)', fontFamily: "'MuseoModerno', sans-serif", textTransform: 'lowercase', whiteSpace: 'nowrap' }}>{t('login.tagline')}</p>
+        </div>
+
+
+        <style>{`
+          .takeoff-sky {
+            background: linear-gradient(to top, #1a1a2e 0%, #16213e 30%, #0f3460 60%, #0a0a23 100%);
+            animation: skyShift 2.6s ease-in-out forwards;
+          }
+          @keyframes skyShift {
+            0%   { background: linear-gradient(to top, #0a0a23 0%, #0f172a 40%, #111827 100%); }
+            100% { background: linear-gradient(to top, #000011 0%, #000016 50%, #000011 100%); }
+          }
+
+          .takeoff-star {
+            opacity: 0;
+            animation: starAppear 0.5s ease-out forwards, starTwinkle 2s ease-in-out infinite alternate;
+          }
+          @keyframes starAppear {
+            0%   { opacity: 0; transform: scale(0); }
+            100% { opacity: 0.7; transform: scale(1); }
+          }
+          @keyframes starTwinkle {
+            0%   { opacity: 0.3; }
+            100% { opacity: 0.9; }
+          }
+
+          .takeoff-cloud {
+            animation: cloudRush 0.6s ease-in forwards;
+          }
+          @keyframes cloudRush {
+            0%   { right: -200px; opacity: 0; }
+            20%  { opacity: 0.4; }
+            100% { right: 120%; opacity: 0; }
+          }
+
+          .takeoff-speedline {
+            animation: speedRush 0.4s ease-in forwards;
+          }
+          @keyframes speedRush {
+            0%   { right: -200px; opacity: 0; }
+            30%  { opacity: 0.6; }
+            100% { right: 120%; opacity: 0; }
+          }
+
+          .takeoff-plane {
+            animation: planeUp 1s ease-in forwards;
+          }
+          @keyframes planeUp {
+            0%   { transform: translate(-50%, 0) rotate(0deg) scale(1); bottom: 8%; left: 50%; opacity: 1; }
+            100% { transform: translate(-50%, 0) rotate(-22deg) scale(0.15); bottom: 120%; left: 58%; opacity: 0; }
+          }
+
+          .takeoff-trail {
+            animation: trailGrow 0.9s ease-out 0.15s forwards;
+          }
+          @keyframes trailGrow {
+            0%   { height: 0; opacity: 0; transform: translateX(-50%) rotate(-5deg); }
+            30%  { height: 150px; opacity: 0.6; }
+            60%  { height: 350px; opacity: 0.4; }
+            100% { height: 600px; opacity: 0; transform: translateX(-50%) rotate(-8deg); }
+          }
+
+          .takeoff-logo {
+            opacity: 0;
+            animation: logoReveal 0.5s ease-out 0.9s forwards;
+          }
+          @keyframes logoReveal {
+            0%   { opacity: 0; transform: translate(-50%, -40%) scale(0.9); }
+            100% { opacity: 1; transform: translate(-50%, -50%) scale(1); }
+          }
+        `}</style>
+      </div>
+    )
+  }
+
   return (
     <div style={{ minHeight: '100vh', display: 'flex', fontFamily: "-apple-system, BlinkMacSystemFont, 'SF Pro Text', system-ui, sans-serif", position: 'relative' }}>
 
@@ -178,14 +369,11 @@ export default function LoginPage() {
 
         <div style={{ position: 'relative', zIndex: 1, maxWidth: 560, textAlign: 'center' }}>
           {/* Logo */}
-          <div style={{ display: 'flex', alignItems: 'center', gap: 12, marginBottom: 48, justifyContent: 'center' }}>
-            <div style={{ width: 48, height: 48, background: 'white', borderRadius: 14, display: 'flex', alignItems: 'center', justifyContent: 'center', boxShadow: '0 0 30px rgba(255,255,255,0.1)' }}>
-              <Plane size={24} style={{ color: '#0f172a' }} />
-            </div>
-            <span style={{ fontSize: 28, fontWeight: 800, color: 'white', letterSpacing: '-0.02em' }}>NOMAD</span>
+          <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', marginBottom: 48 }}>
+            <img src="/logo-light.svg" alt="NOMAD" style={{ height: 64 }} />
           </div>
 
-          <h2 style={{ margin: '0 0 12px', fontSize: 36, fontWeight: 800, color: 'white', lineHeight: 1.15, letterSpacing: '-0.02em' }}>
+          <h2 style={{ margin: '0 0 12px', fontSize: 36, fontWeight: 700, color: 'white', lineHeight: 1.15, letterSpacing: '-0.02em', fontFamily: "'MuseoModerno', sans-serif", textTransform: 'lowercase' }}>
             {t('login.tagline')}
           </h2>
           <p style={{ margin: '0 0 44px', fontSize: 15, color: 'rgba(255,255,255,0.5)', lineHeight: 1.7 }}>
@@ -224,13 +412,11 @@ export default function LoginPage() {
         <div style={{ width: '100%', maxWidth: 400 }}>
 
           {/* Mobile logo */}
-          <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 36, justifyContent: 'center' }}
+          <div style={{ display: 'flex', flexDirection: 'column', alignItems: 'center', gap: 6, marginBottom: 36 }}
             className="mobile-logo">
             <style>{`@media(min-width:1024px){.mobile-logo{display:none!important}}`}</style>
-            <div style={{ width: 36, height: 36, background: '#111827', borderRadius: 10, display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
-              <Plane size={18} style={{ color: 'white' }} />
-            </div>
-            <span style={{ fontSize: 22, fontWeight: 800, color: '#111827', letterSpacing: '-0.02em' }}>NOMAD</span>
+            <img src="/logo-dark.svg" alt="NOMAD" style={{ height: 48 }} />
+            <p style={{ margin: 0, fontSize: 16, color: '#9ca3af', fontFamily: "'MuseoModerno', sans-serif", textTransform: 'lowercase', whiteSpace: 'nowrap' }}>{t('login.tagline')}</p>
           </div>
 
           <div style={{ background: 'white', borderRadius: 20, border: '1px solid #e5e7eb', padding: '36px 32px', boxShadow: '0 2px 16px rgba(0,0,0,0.06)' }}>
@@ -309,13 +495,13 @@ export default function LoginPage() {
               >
                 {isLoading
                   ? <><div style={{ width: 15, height: 15, border: '2px solid rgba(255,255,255,0.3)', borderTopColor: 'white', borderRadius: '50%', animation: 'spin 0.7s linear infinite' }} />{mode === 'register' ? t('login.creating') : t('login.signingIn')}</>
-                  : mode === 'register' ? t('login.createAccount') : t('login.signIn')
+                  : <><Plane size={16} />{mode === 'register' ? t('login.createAccount') : t('login.signIn')}</>
                 }
               </button>
             </form>
 
             {/* Toggle login/register */}
-            {showRegisterOption && appConfig?.has_users && (
+            {showRegisterOption && appConfig?.has_users && !appConfig?.demo_mode && (
               <p style={{ textAlign: 'center', marginTop: 16, fontSize: 13, color: '#9ca3af' }}>
                 {mode === 'login' ? t('login.noAccount') + ' ' : t('login.hasAccount') + ' '}
                 <button onClick={() => { setMode(m => m === 'login' ? 'register' : 'login'); setError('') }}
@@ -325,6 +511,53 @@ export default function LoginPage() {
               </p>
             )}
           </div>
+
+          {/* OIDC / SSO login button */}
+          {appConfig?.oidc_configured && (
+            <>
+              <div style={{ display: 'flex', alignItems: 'center', gap: 12, marginTop: 16 }}>
+                <div style={{ flex: 1, height: 1, background: '#e5e7eb' }} />
+                <span style={{ fontSize: 12, color: '#9ca3af' }}>{language === 'de' ? 'oder' : 'or'}</span>
+                <div style={{ flex: 1, height: 1, background: '#e5e7eb' }} />
+              </div>
+              <a href="/api/auth/oidc/login"
+                style={{
+                  marginTop: 12, width: '100%', padding: '12px',
+                  background: 'white', color: '#374151',
+                  border: '1px solid #d1d5db', borderRadius: 12,
+                  fontSize: 14, fontWeight: 600, cursor: 'pointer',
+                  fontFamily: 'inherit', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 8,
+                  textDecoration: 'none', transition: 'all 0.15s',
+                  boxSizing: 'border-box',
+                }}
+                onMouseEnter={e => { e.currentTarget.style.background = '#f9fafb'; e.currentTarget.style.borderColor = '#9ca3af' }}
+                onMouseLeave={e => { e.currentTarget.style.background = 'white'; e.currentTarget.style.borderColor = '#d1d5db' }}
+              >
+                <Shield size={16} />
+                {language === 'de' ? `Anmelden mit ${appConfig.oidc_display_name}` : `Sign in with ${appConfig.oidc_display_name}`}
+              </a>
+            </>
+          )}
+
+          {/* Demo login button */}
+          {appConfig?.demo_mode && (
+            <button onClick={handleDemoLogin} disabled={isLoading}
+              style={{
+                marginTop: 16, width: '100%', padding: '14px',
+                background: 'linear-gradient(135deg, #f59e0b, #d97706)',
+                color: '#451a03', border: 'none', borderRadius: 14,
+                fontSize: 15, fontWeight: 700, cursor: isLoading ? 'default' : 'pointer',
+                fontFamily: 'inherit', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 10,
+                opacity: isLoading ? 0.7 : 1, transition: 'all 0.2s',
+                boxShadow: '0 2px 12px rgba(245, 158, 11, 0.3)',
+              }}
+              onMouseEnter={e => { if (!isLoading) e.currentTarget.style.transform = 'translateY(-1px)'; e.currentTarget.style.boxShadow = '0 4px 16px rgba(245, 158, 11, 0.4)' }}
+              onMouseLeave={e => { e.currentTarget.style.transform = 'translateY(0)'; e.currentTarget.style.boxShadow = '0 2px 12px rgba(245, 158, 11, 0.3)' }}
+            >
+              <Plane size={18} />
+              {language === 'de' ? 'Demo ausprobieren — ohne Registrierung' : 'Try the demo — no registration needed'}
+            </button>
+          )}
         </div>
       </div>
 

client/src/pages/PhotosPage.jsx

@@ -71,7 +71,7 @@ export default function PhotosPage() {
     <div className="min-h-screen bg-slate-50">
       <Navbar tripTitle={trip?.title} tripId={tripId} showBack onBack={() => navigate(`/trips/${tripId}`)} />
 
-      <div className="pt-14">
+      <div style={{ paddingTop: 'var(--nav-h)' }}>
         <div className="max-w-7xl mx-auto px-4 py-6">
           {/* Header */}
           <div className="flex items-center gap-3 mb-6">

client/src/pages/SettingsPage.jsx

@@ -6,7 +6,8 @@ import { useTranslation } from '../i18n'
 import Navbar from '../components/Layout/Navbar'
 import CustomSelect from '../components/shared/CustomSelect'
 import { useToast } from '../components/shared/Toast'
-import { Save, Map, Palette, User, Moon, Sun, Shield, Camera, Trash2 } from 'lucide-react'
+import { Save, Map, Palette, User, Moon, Sun, Shield, Camera, Trash2, Lock } from 'lucide-react'
+import { authApi, adminApi } from '../api/client'
 
 const MAP_PRESETS = [
   { name: 'OpenStreetMap', url: 'https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png' },
@@ -31,7 +32,8 @@ function Section({ title, icon: Icon, children }) {
 }
 
 export default function SettingsPage() {
-  const { user, updateProfile, uploadAvatar, deleteAvatar } = useAuthStore()
+  const { user, updateProfile, uploadAvatar, deleteAvatar, logout } = useAuthStore()
+  const [showDeleteConfirm, setShowDeleteConfirm] = useState(false)
   const avatarInputRef = React.useRef(null)
   const { settings, updateSetting, updateSettings } = useSettingsStore()
   const { t, locale } = useTranslation()
@@ -52,6 +54,8 @@ export default function SettingsPage() {
   // Account
   const [username, setUsername] = useState(user?.username || '')
   const [email, setEmail] = useState(user?.email || '')
+  const [newPassword, setNewPassword] = useState('')
+  const [confirmPassword, setConfirmPassword] = useState('')
 
   useEffect(() => {
     setMapTileUrl(settings.map_tile_url || '')
@@ -132,7 +136,7 @@ export default function SettingsPage() {
     <div className="min-h-screen" style={{ background: 'var(--bg-secondary)' }}>
       <Navbar />
 
-      <div className="pt-14">
+      <div style={{ paddingTop: 'var(--nav-h)' }}>
         <div className="max-w-2xl mx-auto px-4 py-8 space-y-6">
           <div>
             <h1 className="text-2xl font-bold" style={{ color: 'var(--text-primary)' }}>{t('settings.title')}</h1>
@@ -344,76 +348,244 @@ export default function SettingsPage() {
               />
             </div>
 
+            {/* Change Password */}
+            <div style={{ paddingTop: 8, marginTop: 8, borderTop: '1px solid var(--border-secondary)' }}>
+              <label className="block text-sm font-medium text-slate-700 mb-3">{t('settings.changePassword')}</label>
+              <div className="space-y-3">
+                <input
+                  type="password"
+                  value={newPassword}
+                  onChange={e => setNewPassword(e.target.value)}
+                  placeholder={t('settings.newPassword')}
+                  className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                />
+                <input
+                  type="password"
+                  value={confirmPassword}
+                  onChange={e => setConfirmPassword(e.target.value)}
+                  placeholder={t('settings.confirmPassword')}
+                  className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                />
+                <button
+                  onClick={async () => {
+                    if (!newPassword) return toast.error(t('settings.passwordRequired'))
+                    if (newPassword.length < 8) return toast.error(t('settings.passwordTooShort'))
+                    if (newPassword !== confirmPassword) return toast.error(t('settings.passwordMismatch'))
+                    try {
+                      await authApi.changePassword({ new_password: newPassword })
+                      toast.success(t('settings.passwordChanged'))
+                      setNewPassword(''); setConfirmPassword('')
+                    } catch (err) {
+                      toast.error(err.response?.data?.error || t('common.error'))
+                    }
+                  }}
+                  className="flex items-center gap-2 px-4 py-2 rounded-lg text-sm font-medium transition-colors"
+                  style={{ border: '1px solid var(--border-primary)', background: 'var(--bg-card)', color: 'var(--text-secondary)' }}
+                  onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+                  onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
+                >
+                  <Lock size={14} />
+                  {t('settings.updatePassword')}
+                </button>
+              </div>
+            </div>
+
             <div className="flex items-center gap-4">
-              {user?.avatar_url ? (
-                <img src={user.avatar_url} alt="" style={{ width: 64, height: 64, borderRadius: '50%', objectFit: 'cover', flexShrink: 0 }} />
-              ) : (
-                <div style={{
-                  width: 64, height: 64, borderRadius: '50%', flexShrink: 0,
-                  display: 'flex', alignItems: 'center', justifyContent: 'center',
-                  fontSize: 24, fontWeight: 700,
-                  background: 'var(--bg-hover)', color: 'var(--text-secondary)',
-                }}>
-                  {user?.username?.charAt(0).toUpperCase()}
-                </div>
-              )}
-              <div className="flex flex-col gap-2">
+              <div style={{ position: 'relative', flexShrink: 0 }}>
+                {user?.avatar_url ? (
+                  <img src={user.avatar_url} alt="" style={{ width: 64, height: 64, borderRadius: '50%', objectFit: 'cover' }} />
+                ) : (
+                  <div style={{
+                    width: 64, height: 64, borderRadius: '50%',
+                    display: 'flex', alignItems: 'center', justifyContent: 'center',
+                    fontSize: 24, fontWeight: 700,
+                    background: 'var(--bg-hover)', color: 'var(--text-secondary)',
+                  }}>
+                    {user?.username?.charAt(0).toUpperCase()}
+                  </div>
+                )}
+                <input
+                  ref={avatarInputRef}
+                  type="file"
+                  accept="image/*"
+                  onChange={handleAvatarUpload}
+                  style={{ display: 'none' }}
+                />
+                <button
+                  onClick={() => avatarInputRef.current?.click()}
+                  style={{
+                    position: 'absolute', bottom: -3, right: -3,
+                    width: 28, height: 28, borderRadius: '50%',
+                    background: 'var(--text-primary)', color: 'var(--bg-card)',
+                    border: '2px solid var(--bg-card)',
+                    display: 'flex', alignItems: 'center', justifyContent: 'center',
+                    cursor: 'pointer', padding: 0, transition: 'transform 0.15s, opacity 0.15s',
+                  }}
+                  onMouseEnter={e => { e.currentTarget.style.transform = 'scale(1.15)'; e.currentTarget.style.opacity = '0.85' }}
+                  onMouseLeave={e => { e.currentTarget.style.transform = 'scale(1)'; e.currentTarget.style.opacity = '1' }}
+                >
+                  <Camera size={14} />
+                </button>
+                {user?.avatar_url && (
+                  <button
+                    onClick={handleAvatarRemove}
+                    style={{
+                      position: 'absolute', top: -2, right: -2,
+                      width: 20, height: 20, borderRadius: '50%',
+                      background: '#ef4444', color: 'white',
+                      border: '2px solid var(--bg-card)',
+                      display: 'flex', alignItems: 'center', justifyContent: 'center',
+                      cursor: 'pointer', padding: 0,
+                    }}
+                  >
+                    <Trash2 size={10} />
+                  </button>
+                )}
+              </div>
+              <div className="flex flex-col gap-1">
                 <div className="text-sm" style={{ color: 'var(--text-muted)' }}>
                   <span className="font-medium" style={{ display: 'inline-flex', alignItems: 'center', gap: 4, color: 'var(--text-secondary)' }}>
                     {user?.role === 'admin' ? <><Shield size={13} /> {t('settings.roleAdmin')}</> : t('settings.roleUser')}
                   </span>
-                </div>
-                <div className="flex items-center gap-2">
-                  <input
-                    ref={avatarInputRef}
-                    type="file"
-                    accept="image/*"
-                    onChange={handleAvatarUpload}
-                    style={{ display: 'none' }}
-                  />
-                  <button
-                    onClick={() => avatarInputRef.current?.click()}
-                    className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-xs font-medium transition-colors"
-                    style={{
-                      border: '1px solid var(--border-primary)',
-                      background: 'var(--bg-card)',
-                      color: 'var(--text-secondary)',
-                    }}
-                    onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
-                    onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
-                  >
-                    <Camera size={14} />
-                    {t('settings.uploadAvatar')}
-                  </button>
-                  {user?.avatar_url && (
-                    <button
-                      onClick={handleAvatarRemove}
-                      className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-xs font-medium transition-colors"
-                      style={{
-                        border: '1px solid var(--border-primary)',
-                        background: 'var(--bg-card)',
-                        color: '#ef4444',
-                      }}
-                      onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
-                      onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
-                    >
-                      <Trash2 size={14} />
-                      {t('settings.removeAvatar')}
-                    </button>
+                  {user?.oidc_issuer && (
+                    <span style={{
+                      display: 'inline-flex', alignItems: 'center', gap: 4,
+                      fontSize: 10, fontWeight: 500, padding: '1px 8px', borderRadius: 99,
+                      background: '#dbeafe', color: '#1d4ed8', marginLeft: 6,
+                    }}>
+                      SSO
+                    </span>
                   )}
                 </div>
+                {user?.oidc_issuer && (
+                  <p style={{ fontSize: 11, color: 'var(--text-faint)', marginTop: -2 }}>
+                    {t('settings.oidcLinked')} {user.oidc_issuer.replace('https://', '').replace(/\/+$/, '')}
+                  </p>
+                )}
               </div>
             </div>
 
-            <button
-              onClick={saveProfile}
-              disabled={saving.profile}
-              className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
-            >
-              {saving.profile ? <div className="w-4 h-4 border-2 border-white/30 border-t-white rounded-full animate-spin" /> : <Save className="w-4 h-4" />}
-              {t('settings.saveProfile')}
-            </button>
+            <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginTop: 12 }}>
+              <button
+                onClick={saveProfile}
+                disabled={saving.profile}
+                className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
+              >
+                {saving.profile ? <div className="w-4 h-4 border-2 border-white/30 border-t-white rounded-full animate-spin" /> : <Save className="w-4 h-4" />}
+                {t('settings.saveProfile')}
+              </button>
+              <button
+                onClick={async () => {
+                  if (user?.role === 'admin') {
+                    try {
+                      const data = await adminApi.stats()
+                      const adminUsers = (await adminApi.users()).users.filter(u => u.role === 'admin')
+                      if (adminUsers.length <= 1) {
+                        setShowDeleteConfirm('blocked')
+                        return
+                      }
+                    } catch {}
+                  }
+                  setShowDeleteConfirm(true)
+                }}
+                className="flex items-center gap-2 px-4 py-2 rounded-lg text-sm font-medium transition-colors text-red-500 hover:bg-red-50"
+                style={{ border: '1px solid #fecaca' }}
+              >
+                <Trash2 size={14} />
+                {t('settings.deleteAccount')}
+              </button>
+            </div>
           </Section>
+
+          {/* Delete Account Confirmation */}
+          {showDeleteConfirm === 'blocked' && (
+            <div style={{
+              position: 'fixed', inset: 0, zIndex: 9999,
+              background: 'rgba(0,0,0,0.5)', backdropFilter: 'blur(4px)',
+              display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 24,
+            }} onClick={() => setShowDeleteConfirm(false)}>
+              <div style={{
+                background: 'var(--bg-card)', borderRadius: 16, padding: '28px 24px',
+                maxWidth: 400, width: '100%', boxShadow: '0 20px 60px rgba(0,0,0,0.3)',
+              }} onClick={e => e.stopPropagation()}>
+                <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 16 }}>
+                  <div style={{ width: 36, height: 36, borderRadius: 10, background: '#fef3c7', display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
+                    <Shield size={18} style={{ color: '#d97706' }} />
+                  </div>
+                  <h3 style={{ margin: 0, fontSize: 16, fontWeight: 700, color: 'var(--text-primary)' }}>{t('settings.deleteBlockedTitle')}</h3>
+                </div>
+                <p style={{ fontSize: 13, color: 'var(--text-muted)', lineHeight: 1.6, margin: '0 0 20px' }}>
+                  {t('settings.deleteBlockedMessage')}
+                </p>
+                <div style={{ display: 'flex', justifyContent: 'flex-end' }}>
+                  <button
+                    onClick={() => setShowDeleteConfirm(false)}
+                    style={{
+                      padding: '8px 16px', borderRadius: 8, fontSize: 13, fontWeight: 500,
+                      border: '1px solid var(--border-primary)', background: 'var(--bg-card)', color: 'var(--text-secondary)',
+                      cursor: 'pointer', fontFamily: 'inherit',
+                    }}
+                  >
+                    {t('common.ok') || 'OK'}
+                  </button>
+                </div>
+              </div>
+            </div>
+          )}
+
+          {showDeleteConfirm === true && (
+            <div style={{
+              position: 'fixed', inset: 0, zIndex: 9999,
+              background: 'rgba(0,0,0,0.5)', backdropFilter: 'blur(4px)',
+              display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 24,
+            }} onClick={() => setShowDeleteConfirm(false)}>
+              <div style={{
+                background: 'var(--bg-card)', borderRadius: 16, padding: '28px 24px',
+                maxWidth: 400, width: '100%', boxShadow: '0 20px 60px rgba(0,0,0,0.3)',
+              }} onClick={e => e.stopPropagation()}>
+                <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 16 }}>
+                  <div style={{ width: 36, height: 36, borderRadius: 10, background: '#fef2f2', display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
+                    <Trash2 size={18} style={{ color: '#ef4444' }} />
+                  </div>
+                  <h3 style={{ margin: 0, fontSize: 16, fontWeight: 700, color: 'var(--text-primary)' }}>{t('settings.deleteAccountTitle')}</h3>
+                </div>
+                <p style={{ fontSize: 13, color: 'var(--text-muted)', lineHeight: 1.6, margin: '0 0 20px' }}>
+                  {t('settings.deleteAccountWarning')}
+                </p>
+                <div style={{ display: 'flex', justifyContent: 'flex-end', gap: 8 }}>
+                  <button
+                    onClick={() => setShowDeleteConfirm(false)}
+                    style={{
+                      padding: '8px 16px', borderRadius: 8, fontSize: 13, fontWeight: 500,
+                      border: '1px solid var(--border-primary)', background: 'var(--bg-card)', color: 'var(--text-secondary)',
+                      cursor: 'pointer', fontFamily: 'inherit',
+                    }}
+                  >
+                    {t('common.cancel')}
+                  </button>
+                  <button
+                    onClick={async () => {
+                      try {
+                        await authApi.deleteOwnAccount()
+                        logout()
+                        navigate('/login')
+                      } catch (err) {
+                        toast.error(err.response?.data?.error || t('common.error'))
+                        setShowDeleteConfirm(false)
+                      }
+                    }}
+                    style={{
+                      padding: '8px 16px', borderRadius: 8, fontSize: 13, fontWeight: 600,
+                      border: 'none', background: '#ef4444', color: 'white',
+                      cursor: 'pointer', fontFamily: 'inherit',
+                    }}
+                  >
+                    {t('settings.deleteAccountConfirm')}
+                  </button>
+                </div>
+              </div>
+            </div>
+          )}
         </div>
       </div>
     </div>

client/src/pages/TripPlannerPage.jsx

@@ -1,4 +1,5 @@
 import React, { useState, useEffect, useCallback, useRef, useMemo } from 'react'
+import ReactDOM from 'react-dom'
 import { useParams, useNavigate } from 'react-router-dom'
 import { useTripStore } from '../store/tripStore'
 import { useSettingsStore } from '../store/settingsStore'
@@ -19,6 +20,7 @@ import { useToast } from '../components/shared/Toast'
 import { Map, X, PanelLeftClose, PanelLeftOpen, PanelRightClose, PanelRightOpen } from 'lucide-react'
 import { useTranslation } from '../i18n'
 import { joinTrip, leaveTrip, addListener, removeListener } from '../api/websocket'
+import { addonsApi } from '../api/client'
 
 const MIN_SIDEBAR = 200
 const MAX_SIDEBAR = 520
@@ -32,12 +34,22 @@ export default function TripPlannerPage() {
   const tripStore = useTripStore()
   const { trip, days, places, assignments, packingItems, categories, reservations, budgetItems, files, selectedDayId, isLoading } = tripStore
 
+  const [enabledAddons, setEnabledAddons] = useState({ packing: true, budget: true, documents: true })
+
+  useEffect(() => {
+    addonsApi.enabled().then(data => {
+      const map = {}
+      data.addons.forEach(a => { map[a.id] = true })
+      setEnabledAddons({ packing: !!map.packing, budget: !!map.budget, documents: !!map.documents })
+    }).catch(() => {})
+  }, [])
+
   const TRIP_TABS = [
     { id: 'plan', label: t('trip.tabs.plan') },
-    { id: 'buchungen', label: t('trip.tabs.reservations') },
-    { id: 'packliste', label: t('trip.tabs.packing'), shortLabel: t('trip.tabs.packingShort') },
-    { id: 'finanzplan', label: t('trip.tabs.budget') },
-    { id: 'dateien', label: t('trip.tabs.files') },
+    { id: 'buchungen', label: t('trip.tabs.reservations'), shortLabel: t('trip.tabs.reservationsShort') },
+    ...(enabledAddons.packing ? [{ id: 'packliste', label: t('trip.tabs.packing'), shortLabel: t('trip.tabs.packingShort') }] : []),
+    ...(enabledAddons.budget ? [{ id: 'finanzplan', label: t('trip.tabs.budget') }] : []),
+    ...(enabledAddons.documents ? [{ id: 'dateien', label: t('trip.tabs.files') }] : []),
   ]
 
   const [activeTab, setActiveTab] = useState('plan')
@@ -121,13 +133,8 @@ export default function TripPlannerPage() {
     return places.filter(p => p.lat && p.lng)
   }, [places])
 
-  const handleSelectDay = useCallback((dayId) => {
-    tripStore.setSelectedDay(dayId)
-    setRouteInfo(null)
-    setFitKey(k => k + 1)
-    setMobileSidebarOpen(null)
-
-    // Auto-show Luftlinien for the selected day
+  const updateRouteForDay = useCallback((dayId) => {
+    if (!dayId) { setRoute(null); setRouteInfo(null); return }
     const da = (tripStore.assignments[String(dayId)] || []).slice().sort((a, b) => a.order_index - b.order_index)
     const waypoints = da.map(a => a.place).filter(p => p?.lat && p?.lng)
     if (waypoints.length >= 2) {
@@ -135,12 +142,22 @@ export default function TripPlannerPage() {
     } else {
       setRoute(null)
     }
+    setRouteInfo(null)
   }, [tripStore])
 
+  const handleSelectDay = useCallback((dayId, skipFit) => {
+    const changed = dayId !== selectedDayId
+    tripStore.setSelectedDay(dayId)
+    if (changed && !skipFit) setFitKey(k => k + 1)
+    setMobileSidebarOpen(null)
+    updateRouteForDay(dayId)
+  }, [tripStore, updateRouteForDay, selectedDayId])
+
   const handlePlaceClick = useCallback((placeId) => {
     setSelectedPlaceId(placeId)
     if (placeId) { setLeftCollapsed(false); setRightCollapsed(false) }
-  }, [])
+    updateRouteForDay(selectedDayId)
+  }, [selectedDayId, updateRouteForDay])
 
   const handleMarkerClick = useCallback((placeId) => {
     const opening = placeId !== undefined
@@ -177,16 +194,29 @@ export default function TripPlannerPage() {
     try {
       await tripStore.assignPlaceToDay(tripId, target, placeId, position)
       toast.success(t('trip.toast.assignedToDay'))
+      updateRouteForDay(target)
     } catch (err) { toast.error(err.message) }
-  }, [selectedDayId, tripId, tripStore, toast])
+  }, [selectedDayId, tripId, tripStore, toast, updateRouteForDay])
 
   const handleRemoveAssignment = useCallback(async (dayId, assignmentId) => {
-    try { await tripStore.removeAssignment(tripId, dayId, assignmentId) }
+    try {
+      await tripStore.removeAssignment(tripId, dayId, assignmentId)
+      updateRouteForDay(dayId)
+    }
     catch (err) { toast.error(err.message) }
-  }, [tripId, tripStore, toast])
+  }, [tripId, tripStore, toast, updateRouteForDay])
 
   const handleReorder = useCallback(async (dayId, orderedIds) => {
-    try { await tripStore.reorderAssignments(tripId, dayId, orderedIds) }
+    try {
+      await tripStore.reorderAssignments(tripId, dayId, orderedIds)
+      // Build route directly from orderedIds to avoid stale closure
+      const dayItems = tripStore.assignments[String(dayId)] || []
+      const ordered = orderedIds.map(id => dayItems.find(a => a.id === id)).filter(Boolean)
+      const waypoints = ordered.map(a => a.place).filter(p => p?.lat && p?.lng)
+      if (waypoints.length >= 2) setRoute(waypoints.map(p => [p.lat, p.lng]))
+      else setRoute(null)
+      setRouteInfo(null)
+    }
     catch { toast.error(t('trip.toast.reorderError')) }
   }, [tripId, tripStore, toast])
 
@@ -228,6 +258,13 @@ export default function TripPlannerPage() {
     return map
   }, [selectedDayId, assignments])
 
+  // Places assigned to selected day (with coords) — used for map fitting
+  const dayPlaces = useMemo(() => {
+    if (!selectedDayId) return []
+    const da = assignments[String(selectedDayId)] || []
+    return da.map(a => a.place).filter(p => p?.lat && p?.lng)
+  }, [selectedDayId, assignments])
+
   const mapTileUrl = settings.map_tile_url || 'https://{s}.basemaps.cartocdn.com/light_all/{z}/{x}/{y}{r}.png'
   const defaultCenter = [settings.default_lat || 48.8566, settings.default_lng || 2.3522]
   const defaultZoom = settings.default_zoom || 10
@@ -247,11 +284,11 @@ export default function TripPlannerPage() {
   if (!trip) return null
 
   return (
-    <div style={{ height: '100vh', display: 'flex', flexDirection: 'column', overflow: 'hidden', ...fontStyle }}>
+    <div style={{ position: 'fixed', inset: 0, display: 'flex', flexDirection: 'column', overflow: 'hidden', ...fontStyle }}>
       <Navbar tripTitle={trip.title} tripId={tripId} showBack onBack={() => navigate('/dashboard')} onShare={() => setShowMembersModal(true)} />
 
       <div style={{
-        position: 'fixed', top: 56, left: 0, right: 0, zIndex: 40,
+        position: 'fixed', top: 'var(--nav-h)', left: 0, right: 0, zIndex: 40,
         display: 'flex', alignItems: 'center', justifyContent: 'center',
         padding: '0 12px',
         background: 'var(--bg-elevated)',
@@ -286,13 +323,14 @@ export default function TripPlannerPage() {
         })}
       </div>
 
-      {/* Offset by navbar (56px) + tab bar (44px) */}
-      <div style={{ flex: 1, overflow: 'hidden', marginTop: 100, position: 'relative' }}>
+      {/* Offset by navbar + tab bar (44px) */}
+      <div style={{ position: 'fixed', top: 'calc(var(--nav-h) + 44px)', left: 0, right: 0, bottom: 0, overflow: 'hidden', overscrollBehavior: 'contain' }}>
 
         {activeTab === 'plan' && (
           <div style={{ position: 'absolute', inset: 0 }}>
             <MapView
               places={mapPlaces()}
+              dayPlaces={dayPlaces}
               route={route}
               selectedPlaceId={selectedPlaceId}
               onMarkerClick={handleMarkerClick}
@@ -302,6 +340,9 @@ export default function TripPlannerPage() {
               tileUrl={mapTileUrl}
               fitKey={fitKey}
               dayOrderMap={dayOrderMap}
+              leftWidth={leftCollapsed ? 0 : leftWidth}
+              rightWidth={rightCollapsed ? 0 : rightWidth}
+              hasInspector={!!selectedPlace}
             />
 
             {routeInfo && (
@@ -321,7 +362,7 @@ export default function TripPlannerPage() {
             <div className="hidden md:block" style={{ position: 'absolute', left: 10, top: 10, bottom: 10, zIndex: 20 }}>
               <button onClick={() => setLeftCollapsed(c => !c)}
                 style={{
-                  position: leftCollapsed ? 'fixed' : 'absolute', top: leftCollapsed ? 'calc(56px + 44px + 14px)' : 14, left: leftCollapsed ? 10 : undefined, right: leftCollapsed ? undefined : -28, zIndex: 25,
+                  position: leftCollapsed ? 'fixed' : 'absolute', top: leftCollapsed ? 'calc(var(--nav-h) + 44px + 14px)' : 14, left: leftCollapsed ? 10 : undefined, right: leftCollapsed ? undefined : -28, zIndex: 25,
                   width: 36, height: 36, borderRadius: leftCollapsed ? 10 : '0 10px 10px 0',
                   background: leftCollapsed ? '#000' : 'var(--sidebar-bg)', backdropFilter: 'blur(20px)', WebkitBackdropFilter: 'blur(20px)',
                   boxShadow: leftCollapsed ? '0 2px 12px rgba(0,0,0,0.2)' : 'none', border: 'none',
@@ -376,7 +417,7 @@ export default function TripPlannerPage() {
             <div className="hidden md:block" style={{ position: 'absolute', right: 10, top: 10, bottom: 10, zIndex: 20 }}>
               <button onClick={() => setRightCollapsed(c => !c)}
                 style={{
-                  position: rightCollapsed ? 'fixed' : 'absolute', top: rightCollapsed ? 'calc(56px + 44px + 14px)' : 14, right: rightCollapsed ? 10 : undefined, left: rightCollapsed ? undefined : -28, zIndex: 25,
+                  position: rightCollapsed ? 'fixed' : 'absolute', top: rightCollapsed ? 'calc(var(--nav-h) + 44px + 14px)' : 14, right: rightCollapsed ? 10 : undefined, left: rightCollapsed ? undefined : -28, zIndex: 25,
                   width: 36, height: 36, borderRadius: rightCollapsed ? 10 : '10px 0 0 10px',
                   background: rightCollapsed ? '#000' : 'var(--sidebar-bg)', backdropFilter: 'blur(20px)', WebkitBackdropFilter: 'blur(20px)',
                   boxShadow: rightCollapsed ? '0 2px 12px rgba(0,0,0,0.2)' : 'none', border: 'none',
@@ -422,16 +463,20 @@ export default function TripPlannerPage() {
               </div>
             </div>
 
-            <div className="flex md:hidden" style={{ position: 'absolute', top: 12, left: 12, right: 12, justifyContent: 'space-between', zIndex: 30 }}>
-              <button onClick={() => setMobileSidebarOpen('left')}
-                style={{ background: 'var(--bg-card)', color: 'var(--text-primary)', backdropFilter: 'blur(12px)', border: '1px solid var(--border-primary)', borderRadius: 24, padding: '11px 24px', fontSize: 15, fontWeight: 600, cursor: 'pointer', boxShadow: '0 2px 12px rgba(0,0,0,0.15)', minHeight: 44, fontFamily: 'inherit' }}>
-                {t('trip.mobilePlan')}
-              </button>
-              <button onClick={() => setMobileSidebarOpen('right')}
-                style={{ background: 'var(--bg-card)', color: 'var(--text-primary)', backdropFilter: 'blur(12px)', border: '1px solid var(--border-primary)', borderRadius: 24, padding: '11px 24px', fontSize: 15, fontWeight: 600, cursor: 'pointer', boxShadow: '0 2px 12px rgba(0,0,0,0.15)', minHeight: 44, fontFamily: 'inherit' }}>
-                {t('trip.mobilePlaces')}
-              </button>
-            </div>
+            {/* Mobile sidebar buttons — portal to body to escape Leaflet touch handling */}
+            {activeTab === 'plan' && !mobileSidebarOpen && !showPlaceForm && !showMembersModal && !showReservationModal && ReactDOM.createPortal(
+              <div className="flex md:hidden" style={{ position: 'fixed', top: 'calc(var(--nav-h) + 44px + 12px)', left: 12, right: 12, justifyContent: 'space-between', zIndex: 100, pointerEvents: 'none' }}>
+                <button onClick={() => setMobileSidebarOpen('left')}
+                  style={{ pointerEvents: 'auto', background: 'var(--bg-card)', color: 'var(--text-primary)', backdropFilter: 'blur(12px)', border: '1px solid var(--border-primary)', borderRadius: 24, padding: '11px 24px', fontSize: 15, fontWeight: 600, cursor: 'pointer', boxShadow: '0 2px 12px rgba(0,0,0,0.15)', minHeight: 44, fontFamily: 'inherit', touchAction: 'manipulation' }}>
+                  {t('trip.mobilePlan')}
+                </button>
+                <button onClick={() => setMobileSidebarOpen('right')}
+                  style={{ pointerEvents: 'auto', background: 'var(--bg-card)', color: 'var(--text-primary)', backdropFilter: 'blur(12px)', border: '1px solid var(--border-primary)', borderRadius: 24, padding: '11px 24px', fontSize: 15, fontWeight: 600, cursor: 'pointer', boxShadow: '0 2px 12px rgba(0,0,0,0.15)', minHeight: 44, fontFamily: 'inherit', touchAction: 'manipulation' }}>
+                  {t('trip.mobilePlaces')}
+                </button>
+              </div>,
+              document.body
+            )}
 
             {selectedPlace && (
               <PlaceInspector
@@ -450,9 +495,9 @@ export default function TripPlannerPage() {
               />
             )}
 
-            {mobileSidebarOpen && (
-              <div style={{ position: 'absolute', inset: 0, background: 'rgba(0,0,0,0.3)', zIndex: 50 }} onClick={() => setMobileSidebarOpen(null)}>
-                <div style={{ position: 'absolute', bottom: 0, left: 0, right: 0, background: 'var(--bg-card)', borderRadius: '20px 20px 0 0', maxHeight: '80vh', display: 'flex', flexDirection: 'column', overflow: 'hidden' }} onClick={e => e.stopPropagation()}>
+            {mobileSidebarOpen && ReactDOM.createPortal(
+              <div style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.3)', zIndex: 9999 }} onClick={() => setMobileSidebarOpen(null)}>
+                <div style={{ position: 'absolute', top: 'var(--nav-h)', left: 0, right: 0, bottom: 0, background: 'var(--bg-card)', display: 'flex', flexDirection: 'column', overflow: 'hidden' }} onClick={e => e.stopPropagation()}>
                   <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '14px 16px', borderBottom: '1px solid var(--border-secondary)' }}>
                     <span style={{ fontWeight: 600, fontSize: 14, color: 'var(--text-primary)' }}>{mobileSidebarOpen === 'left' ? t('trip.mobilePlan') : t('trip.mobilePlaces')}</span>
                     <button onClick={() => setMobileSidebarOpen(null)} style={{ background: 'var(--bg-tertiary)', border: 'none', borderRadius: '50%', width: 28, height: 28, cursor: 'pointer', display: 'flex', alignItems: 'center', justifyContent: 'center', color: 'var(--text-primary)' }}>
@@ -461,18 +506,19 @@ export default function TripPlannerPage() {
                   </div>
                   <div style={{ flex: 1, overflow: 'auto' }}>
                     {mobileSidebarOpen === 'left'
-                      ? <DayPlanSidebar trip={trip} days={days} places={places} categories={categories} assignments={assignments} selectedDayId={selectedDayId} selectedPlaceId={selectedPlaceId} onSelectDay={(id) => { handleSelectDay(id); setMobileSidebarOpen(null) }} onPlaceClick={handlePlaceClick} onReorder={handleReorder} onUpdateDayTitle={handleUpdateDayTitle} onAssignToDay={handleAssignToDay} onRouteCalculated={(r) => { if (r) { setRoute(r.coordinates); setRouteInfo({ distance: r.distanceText, duration: r.durationText }) } }} reservations={reservations} onAddReservation={(dayId) => { setEditingReservation(null); tripStore.setSelectedDay(dayId); setShowReservationModal(true); setMobileSidebarOpen(null) }} />
+                      ? <DayPlanSidebar tripId={tripId} trip={trip} days={days} places={places} categories={categories} assignments={assignments} selectedDayId={selectedDayId} selectedPlaceId={selectedPlaceId} onSelectDay={(id) => { handleSelectDay(id); setMobileSidebarOpen(null) }} onPlaceClick={handlePlaceClick} onReorder={handleReorder} onUpdateDayTitle={handleUpdateDayTitle} onAssignToDay={handleAssignToDay} onRouteCalculated={(r) => { if (r) { setRoute(r.coordinates); setRouteInfo({ distance: r.distanceText, duration: r.durationText }) } }} reservations={reservations} onAddReservation={(dayId) => { setEditingReservation(null); tripStore.setSelectedDay(dayId); setShowReservationModal(true); setMobileSidebarOpen(null) }} />
                       : <PlacesSidebar places={places} categories={categories} assignments={assignments} selectedDayId={selectedDayId} selectedPlaceId={selectedPlaceId} onPlaceClick={handlePlaceClick} onAddPlace={() => { setEditingPlace(null); setShowPlaceForm(true); setMobileSidebarOpen(null) }} onAssignToDay={handleAssignToDay} days={days} isMobile />
                     }
                   </div>
                 </div>
-              </div>
+              </div>,
+              document.body
             )}
           </div>
         )}
 
         {activeTab === 'buchungen' && (
-          <div style={{ height: '100%', maxWidth: 1200, margin: '0 auto', width: '100%', display: 'flex', flexDirection: 'column' }}>
+          <div style={{ height: '100%', maxWidth: 1200, margin: '0 auto', width: '100%', display: 'flex', flexDirection: 'column', overflowY: 'auto', overscrollBehavior: 'contain' }}>
             <ReservationsPanel
               tripId={tripId}
               reservations={reservations}
@@ -488,19 +534,19 @@ export default function TripPlannerPage() {
         )}
 
         {activeTab === 'packliste' && (
-          <div style={{ height: '100%', overflowY: 'auto', maxWidth: 1200, margin: '0 auto', width: '100%', padding: '8px 0' }}>
+          <div style={{ height: '100%', overflowY: 'auto', overscrollBehavior: 'contain', maxWidth: 1200, margin: '0 auto', width: '100%', padding: '8px 0' }}>
             <PackingListPanel tripId={tripId} items={packingItems} />
           </div>
         )}
 
         {activeTab === 'finanzplan' && (
-          <div style={{ height: '100%', overflowY: 'auto', maxWidth: 1400, margin: '0 auto', width: '100%', padding: '8px 0' }}>
+          <div style={{ height: '100%', overflowY: 'auto', overscrollBehavior: 'contain', maxWidth: 1400, margin: '0 auto', width: '100%', padding: '8px 0' }}>
             <BudgetPanel tripId={tripId} />
           </div>
         )}
 
         {activeTab === 'dateien' && (
-          <div style={{ height: '100%', overflow: 'hidden' }}>
+          <div style={{ height: '100%', overflow: 'hidden', overscrollBehavior: 'contain' }}>
             <FileManager
               files={files || []}
               onUpload={(fd) => tripStore.addFile(tripId, fd)}

client/src/pages/VacayPage.jsx

@@ -0,0 +1,282 @@
+import React, { useEffect, useState, useCallback } from 'react'
+import ReactDOM from 'react-dom'
+import { useTranslation } from '../i18n'
+import { useVacayStore } from '../store/vacayStore'
+import { addListener, removeListener } from '../api/websocket'
+import Navbar from '../components/Layout/Navbar'
+import VacayCalendar from '../components/Vacay/VacayCalendar'
+import VacayPersons from '../components/Vacay/VacayPersons'
+import VacayStats from '../components/Vacay/VacayStats'
+import VacaySettings from '../components/Vacay/VacaySettings'
+import { Plus, Minus, ChevronLeft, ChevronRight, Settings, CalendarDays, AlertTriangle, Users, Eye, Pencil, Trash2, Unlink, ShieldCheck, SlidersHorizontal } from 'lucide-react'
+import Modal from '../components/shared/Modal'
+
+export default function VacayPage() {
+  const { t } = useTranslation()
+  const { years, selectedYear, setSelectedYear, addYear, removeYear, loadAll, loadPlan, loadEntries, loadStats, loadHolidays, loading, incomingInvites, acceptInvite, declineInvite, plan } = useVacayStore()
+  const [showSettings, setShowSettings] = useState(false)
+  const [deleteYear, setDeleteYear] = useState(null)
+  const [showMobileSidebar, setShowMobileSidebar] = useState(false)
+
+  useEffect(() => { loadAll() }, [])
+
+  // Live sync via WebSocket
+  const handleWsMessage = useCallback((msg) => {
+    if (msg.type === 'vacay:update' || msg.type === 'vacay:settings') {
+      loadPlan()
+      loadEntries(selectedYear)
+      loadStats(selectedYear)
+      if (msg.type === 'vacay:settings') loadAll()
+    }
+    if (msg.type === 'vacay:invite' || msg.type === 'vacay:accepted' || msg.type === 'vacay:declined' || msg.type === 'vacay:cancelled' || msg.type === 'vacay:dissolved') {
+      loadAll()
+    }
+  }, [selectedYear])
+
+  useEffect(() => {
+    addListener(handleWsMessage)
+    return () => removeListener(handleWsMessage)
+  }, [handleWsMessage])
+  useEffect(() => {
+    if (selectedYear) { loadEntries(selectedYear); loadStats(selectedYear); loadHolidays(selectedYear) }
+  }, [selectedYear])
+
+  const handleAddYear = () => {
+    const nextYear = years.length > 0 ? Math.max(...years) + 1 : new Date().getFullYear()
+    addYear(nextYear)
+  }
+
+  if (loading) {
+    return (
+      <div className="min-h-screen" style={{ background: 'var(--bg-primary)' }}>
+        <Navbar />
+        <div className="flex items-center justify-center" style={{ paddingTop: 'var(--nav-h)', minHeight: 'calc(100vh - var(--nav-h))' }}>
+          <div className="w-8 h-8 border-2 rounded-full animate-spin" style={{ borderColor: 'var(--border-primary)', borderTopColor: 'var(--text-primary)' }} />
+        </div>
+      </div>
+    )
+  }
+
+  // Sidebar content (shared between desktop sidebar and mobile drawer)
+  const sidebarContent = (
+    <>
+      {/* Year Selector */}
+      <div className="rounded-xl border p-3" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
+        <div className="flex items-center justify-between mb-2">
+          <span className="text-[11px] font-medium uppercase tracking-wider" style={{ color: 'var(--text-faint)' }}>{t('vacay.year')}</span>
+          <button onClick={handleAddYear} className="p-0.5 rounded transition-colors" style={{ color: 'var(--text-faint)' }} title={t('vacay.addYear')}>
+            <Plus size={14} />
+          </button>
+        </div>
+        <div className="flex items-center justify-between mb-2">
+          <button onClick={() => { const idx = years.indexOf(selectedYear); if (idx > 0) setSelectedYear(years[idx - 1]) }} disabled={years.indexOf(selectedYear) <= 0} className="p-1 lg:p-1 p-2 rounded-lg disabled:opacity-20 transition-colors" style={{ background: 'var(--bg-secondary)' }}>
+            <ChevronLeft size={16} style={{ color: 'var(--text-muted)' }} />
+          </button>
+          <span className="text-xl font-bold tabular-nums" style={{ color: 'var(--text-primary)' }}>{selectedYear}</span>
+          <button onClick={() => { const idx = years.indexOf(selectedYear); if (idx < years.length - 1) setSelectedYear(years[idx + 1]) }} disabled={years.indexOf(selectedYear) >= years.length - 1} className="p-1 lg:p-1 p-2 rounded-lg disabled:opacity-20 transition-colors" style={{ background: 'var(--bg-secondary)' }}>
+            <ChevronRight size={16} style={{ color: 'var(--text-muted)' }} />
+          </button>
+        </div>
+        <div className="grid grid-cols-4 gap-1">
+          {years.map(y => (
+            <div key={y} onClick={() => setSelectedYear(y)}
+              className="group relative py-1.5 rounded-lg text-xs font-medium transition-all text-center cursor-pointer"
+              style={{
+                background: y === selectedYear ? 'var(--text-primary)' : 'var(--bg-secondary)',
+                color: y === selectedYear ? 'var(--bg-card)' : 'var(--text-muted)',
+              }}>
+              {y}
+              {years.length > 1 && (
+                <span onClick={e => { e.stopPropagation(); setDeleteYear(y); setShowMobileSidebar(false) }}
+                  className="absolute -top-1 -right-1 w-3.5 h-3.5 rounded-full bg-red-500 text-white text-[7px] flex items-center justify-center opacity-0 group-hover:opacity-100 transition-opacity cursor-pointer">
+                  <Minus size={7} />
+                </span>
+              )}
+            </div>
+          ))}
+        </div>
+      </div>
+
+      <VacayPersons />
+
+      {/* Legend */}
+      {(plan?.holidays_enabled || plan?.company_holidays_enabled || plan?.block_weekends) && (
+        <div className="rounded-xl border p-3" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
+          <span className="text-[11px] font-medium uppercase tracking-wider" style={{ color: 'var(--text-faint)' }}>{t('vacay.legend')}</span>
+          <div className="mt-2 flex flex-wrap gap-x-3 gap-y-1.5">
+            {plan?.holidays_enabled && <LegendItem color="#fecaca" label={t('vacay.publicHoliday')} />}
+            {plan?.company_holidays_enabled && <LegendItem color="#fde68a" label={t('vacay.companyHoliday')} />}
+            {plan?.block_weekends && <LegendItem color="#e5e7eb" label={t('vacay.weekend')} />}
+          </div>
+        </div>
+      )}
+
+      <VacayStats />
+    </>
+  )
+
+  return (
+    <div className="min-h-screen" style={{ background: 'var(--bg-primary)' }}>
+      <Navbar />
+
+      <div style={{ paddingTop: 'var(--nav-h)' }}>
+        <div className="max-w-[1800px] mx-auto px-3 sm:px-4 py-4 sm:py-6">
+          {/* Header */}
+          <div className="flex items-center justify-between mb-4 sm:mb-5">
+            <div className="flex items-center gap-3">
+              <div className="w-9 h-9 rounded-xl flex items-center justify-center" style={{ background: 'var(--bg-secondary)' }}>
+                <CalendarDays size={18} style={{ color: 'var(--text-primary)' }} />
+              </div>
+              <div>
+                <h1 className="text-lg sm:text-xl font-bold" style={{ color: 'var(--text-primary)' }}>Vacay</h1>
+                <p className="text-xs hidden sm:block" style={{ color: 'var(--text-muted)' }}>{t('vacay.subtitle')}</p>
+              </div>
+            </div>
+            <div className="flex items-center gap-2">
+              {/* Mobile sidebar toggle */}
+              <button
+                onClick={() => setShowMobileSidebar(true)}
+                className="lg:hidden flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm transition-colors"
+                style={{ background: 'var(--bg-secondary)', color: 'var(--text-muted)' }}
+              >
+                <SlidersHorizontal size={14} />
+              </button>
+              <button
+                onClick={() => setShowSettings(true)}
+                className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm transition-colors"
+                style={{ background: 'var(--bg-secondary)', color: 'var(--text-muted)' }}
+              >
+                <Settings size={14} />
+                <span className="hidden sm:inline">{t('vacay.settings')}</span>
+              </button>
+            </div>
+          </div>
+
+          {/* Main layout */}
+          <div className="flex gap-4 items-start">
+            {/* Desktop Sidebar */}
+            <div className="hidden lg:flex w-[240px] shrink-0 flex-col gap-3 sticky top-[70px]">
+              {sidebarContent}
+            </div>
+
+            {/* Calendar */}
+            <div className="flex-1 min-w-0">
+              <VacayCalendar />
+            </div>
+          </div>
+        </div>
+      </div>
+
+      {/* Mobile Sidebar Drawer */}
+      {showMobileSidebar && ReactDOM.createPortal(
+        <div className="fixed inset-0 lg:hidden" style={{ zIndex: 99980 }}>
+          <div className="absolute inset-0" style={{ background: 'rgba(0,0,0,0.4)' }} onClick={() => setShowMobileSidebar(false)} />
+          <div className="absolute left-0 top-0 bottom-0 w-[280px] overflow-y-auto p-3 flex flex-col gap-3"
+            style={{ background: 'var(--bg-primary)', boxShadow: '4px 0 24px rgba(0,0,0,0.15)', animation: 'slideInLeft 0.2s ease-out' }}>
+            {sidebarContent}
+          </div>
+        </div>,
+        document.body
+      )}
+
+      {/* Settings Modal */}
+      <Modal isOpen={showSettings} onClose={() => setShowSettings(false)} title={t('vacay.settings')} size="md">
+        <VacaySettings onClose={() => setShowSettings(false)} />
+      </Modal>
+
+      {/* Delete Year Modal */}
+      <Modal isOpen={deleteYear !== null} onClose={() => setDeleteYear(null)} title={t('vacay.removeYear')} size="sm">
+        <div className="space-y-4">
+          <div className="flex gap-3 p-3 rounded-lg" style={{ background: 'rgba(239,68,68,0.08)', border: '1px solid rgba(239,68,68,0.15)' }}>
+            <AlertTriangle size={18} className="text-red-500 shrink-0 mt-0.5" />
+            <div>
+              <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>
+                {t('vacay.removeYearConfirm', { year: deleteYear })}
+              </p>
+              <p className="text-xs mt-1" style={{ color: 'var(--text-muted)' }}>
+                {t('vacay.removeYearHint')}
+              </p>
+            </div>
+          </div>
+          <div className="flex gap-3 justify-end">
+            <button onClick={() => setDeleteYear(null)} className="px-4 py-2 text-sm rounded-lg transition-colors" style={{ color: 'var(--text-muted)', border: '1px solid var(--border-primary)' }}>
+              {t('common.cancel')}
+            </button>
+            <button onClick={async () => { await removeYear(deleteYear); setDeleteYear(null) }} className="px-4 py-2 text-sm bg-red-500 hover:bg-red-600 text-white rounded-lg transition-colors">
+              {t('vacay.remove')}
+            </button>
+          </div>
+        </div>
+      </Modal>
+
+      {/* Incoming invite — forced fullscreen modal */}
+      {incomingInvites.length > 0 && ReactDOM.createPortal(
+        <div className="fixed inset-0 flex items-center justify-center px-4"
+          style={{ zIndex: 99995, backgroundColor: 'rgba(0,0,0,0.7)', backdropFilter: 'blur(8px)' }}>
+          {incomingInvites.map(inv => (
+            <div key={inv.id} className="w-full max-w-md rounded-2xl shadow-2xl overflow-hidden"
+              style={{ background: 'var(--bg-card)', animation: 'modalIn 0.25s ease-out' }}>
+              <div className="px-6 pt-6 pb-4 text-center">
+                <div className="w-14 h-14 rounded-full mx-auto mb-4 flex items-center justify-center text-lg font-bold"
+                  style={{ background: 'var(--bg-secondary)', color: 'var(--text-primary)' }}>
+                  {inv.username?.[0]?.toUpperCase()}
+                </div>
+                <h2 className="text-lg font-bold mb-1" style={{ color: 'var(--text-primary)' }}>
+                  {t('vacay.inviteTitle')}
+                </h2>
+                <p className="text-sm" style={{ color: 'var(--text-muted)' }}>
+                  <span className="font-semibold" style={{ color: 'var(--text-primary)' }}>{inv.username}</span> {t('vacay.inviteWantsToFuse')}
+                </p>
+              </div>
+              <div className="px-6 pb-4 space-y-2">
+                <InfoItem icon={Eye} text={t('vacay.fuseInfo1')} />
+                <InfoItem icon={Pencil} text={t('vacay.fuseInfo2')} />
+                <InfoItem icon={Trash2} text={t('vacay.fuseInfo3')} />
+                <InfoItem icon={ShieldCheck} text={t('vacay.fuseInfo4')} />
+                <InfoItem icon={Unlink} text={t('vacay.fuseInfo5')} />
+              </div>
+              <div className="px-6 pb-6 flex gap-3">
+                <button onClick={() => declineInvite(inv.plan_id)}
+                  className="flex-1 px-4 py-2.5 text-sm font-medium rounded-xl transition-colors"
+                  style={{ color: 'var(--text-muted)', border: '1px solid var(--border-primary)' }}>
+                  {t('vacay.decline')}
+                </button>
+                <button onClick={() => acceptInvite(inv.plan_id)}
+                  className="flex-1 px-4 py-2.5 text-sm font-medium rounded-xl transition-colors"
+                  style={{ background: 'var(--text-primary)', color: 'var(--bg-card)' }}>
+                  {t('vacay.acceptFusion')}
+                </button>
+              </div>
+            </div>
+          ))}
+        </div>,
+        document.body
+      )}
+
+      <style>{`
+        @keyframes slideInLeft {
+          from { transform: translateX(-100%); }
+          to { transform: translateX(0); }
+        }
+      `}</style>
+    </div>
+  )
+}
+
+function InfoItem({ icon: Icon, text }) {
+  return (
+    <div className="flex items-start gap-3 px-3 py-2 rounded-lg" style={{ background: 'var(--bg-secondary)' }}>
+      <Icon size={15} className="shrink-0 mt-0.5" style={{ color: 'var(--text-muted)' }} />
+      <span className="text-xs" style={{ color: 'var(--text-primary)' }}>{text}</span>
+    </div>
+  )
+}
+
+function LegendItem({ color, label }) {
+  return (
+    <div className="flex items-center gap-2">
+      <span className="w-4 h-3 rounded" style={{ background: color, border: `1px solid ${color}` }} />
+      <span className="text-[11px]" style={{ color: 'var(--text-muted)' }}>{label}</span>
+    </div>
+  )
+}

client/src/store/authStore.js

@@ -8,6 +8,8 @@ export const useAuthStore = create((set, get) => ({
   isAuthenticated: !!localStorage.getItem('auth_token'),
   isLoading: false,
   error: null,
+  demoMode: localStorage.getItem('demo_mode') === 'true',
+  hasMapsKey: false,
 
   login: async (email, password) => {
     set({ isLoading: true, error: null })
@@ -129,4 +131,34 @@ export const useAuthStore = create((set, get) => ({
     await authApi.deleteAvatar()
     set(state => ({ user: { ...state.user, avatar_url: null } }))
   },
+
+  setDemoMode: (val) => {
+    if (val) localStorage.setItem('demo_mode', 'true')
+    else localStorage.removeItem('demo_mode')
+    set({ demoMode: val })
+  },
+
+  setHasMapsKey: (val) => set({ hasMapsKey: val }),
+
+  demoLogin: async () => {
+    set({ isLoading: true, error: null })
+    try {
+      const data = await authApi.demoLogin()
+      localStorage.setItem('auth_token', data.token)
+      set({
+        user: data.user,
+        token: data.token,
+        isAuthenticated: true,
+        isLoading: false,
+        demoMode: true,
+        error: null,
+      })
+      connect(data.token)
+      return data
+    } catch (err) {
+      const error = err.response?.data?.error || 'Demo-Login fehlgeschlagen'
+      set({ isLoading: false, error })
+      throw new Error(error)
+    }
+  },
 }))

client/src/store/vacayStore.js

@@ -0,0 +1,188 @@
+import { create } from 'zustand'
+import apiClient from '../api/client'
+
+const ax = apiClient
+const api = {
+  getPlan: () => ax.get('/addons/vacay/plan').then(r => r.data),
+  updatePlan: (data) => ax.put('/addons/vacay/plan', data).then(r => r.data),
+  updateColor: (color, targetUserId) => ax.put('/addons/vacay/color', { color, target_user_id: targetUserId }).then(r => r.data),
+  invite: (userId) => ax.post('/addons/vacay/invite', { user_id: userId }).then(r => r.data),
+  acceptInvite: (planId) => ax.post('/addons/vacay/invite/accept', { plan_id: planId }).then(r => r.data),
+  declineInvite: (planId) => ax.post('/addons/vacay/invite/decline', { plan_id: planId }).then(r => r.data),
+  cancelInvite: (userId) => ax.post('/addons/vacay/invite/cancel', { user_id: userId }).then(r => r.data),
+  dissolve: () => ax.post('/addons/vacay/dissolve').then(r => r.data),
+  availableUsers: () => ax.get('/addons/vacay/available-users').then(r => r.data),
+  getYears: () => ax.get('/addons/vacay/years').then(r => r.data),
+  addYear: (year) => ax.post('/addons/vacay/years', { year }).then(r => r.data),
+  removeYear: (year) => ax.delete(`/addons/vacay/years/${year}`).then(r => r.data),
+  getEntries: (year) => ax.get(`/addons/vacay/entries/${year}`).then(r => r.data),
+  toggleEntry: (date, targetUserId) => ax.post('/addons/vacay/entries/toggle', { date, target_user_id: targetUserId }).then(r => r.data),
+  toggleCompanyHoliday: (date) => ax.post('/addons/vacay/entries/company-holiday', { date }).then(r => r.data),
+  getStats: (year) => ax.get(`/addons/vacay/stats/${year}`).then(r => r.data),
+  updateStats: (year, days, targetUserId) => ax.put(`/addons/vacay/stats/${year}`, { vacation_days: days, target_user_id: targetUserId }).then(r => r.data),
+  getCountries: () => ax.get('/addons/vacay/holidays/countries').then(r => r.data),
+  getHolidays: (year, country) => ax.get(`/addons/vacay/holidays/${year}/${country}`).then(r => r.data),
+}
+
+export const useVacayStore = create((set, get) => ({
+  plan: null,
+  users: [],
+  pendingInvites: [],
+  incomingInvites: [],
+  isOwner: true,
+  isFused: false,
+  years: [],
+  entries: [],
+  companyHolidays: [],
+  stats: [],
+  selectedYear: new Date().getFullYear(),
+  selectedUserId: null,
+  holidays: {},  // date -> { name, localName }
+  loading: false,
+
+  setSelectedYear: (year) => set({ selectedYear: year }),
+  setSelectedUserId: (id) => set({ selectedUserId: id }),
+
+  loadPlan: async () => {
+    const data = await api.getPlan()
+    set({
+      plan: data.plan,
+      users: data.users,
+      pendingInvites: data.pendingInvites,
+      incomingInvites: data.incomingInvites,
+      isOwner: data.isOwner,
+      isFused: data.isFused,
+    })
+  },
+
+  updatePlan: async (updates) => {
+    const data = await api.updatePlan(updates)
+    set({ plan: data.plan })
+    await get().loadEntries()
+    await get().loadStats()
+    await get().loadHolidays()
+  },
+
+  updateColor: async (color, targetUserId) => {
+    await api.updateColor(color, targetUserId)
+    await get().loadPlan()
+    await get().loadEntries()
+  },
+
+  invite: async (userId) => {
+    await api.invite(userId)
+    await get().loadPlan()
+  },
+
+  acceptInvite: async (planId) => {
+    await api.acceptInvite(planId)
+    await get().loadAll()
+  },
+
+  declineInvite: async (planId) => {
+    await api.declineInvite(planId)
+    await get().loadPlan()
+  },
+
+  cancelInvite: async (userId) => {
+    await api.cancelInvite(userId)
+    await get().loadPlan()
+  },
+
+  dissolve: async () => {
+    await api.dissolve()
+    await get().loadAll()
+  },
+
+  loadYears: async () => {
+    const data = await api.getYears()
+    set({ years: data.years })
+    if (data.years.length > 0) {
+      set({ selectedYear: data.years[data.years.length - 1] })
+    }
+  },
+
+  addYear: async (year) => {
+    const data = await api.addYear(year)
+    set({ years: data.years })
+    await get().loadStats(year)
+  },
+
+  removeYear: async (year) => {
+    const data = await api.removeYear(year)
+    set({ years: data.years })
+  },
+
+  loadEntries: async (year) => {
+    const y = year || get().selectedYear
+    const data = await api.getEntries(y)
+    set({ entries: data.entries, companyHolidays: data.companyHolidays })
+  },
+
+  toggleEntry: async (date, targetUserId) => {
+    await api.toggleEntry(date, targetUserId)
+    await get().loadEntries()
+    await get().loadStats()
+  },
+
+  toggleCompanyHoliday: async (date) => {
+    await api.toggleCompanyHoliday(date)
+    await get().loadEntries()
+  },
+
+  loadStats: async (year) => {
+    const y = year || get().selectedYear
+    const data = await api.getStats(y)
+    set({ stats: data.stats })
+  },
+
+  updateVacationDays: async (year, days, targetUserId) => {
+    await api.updateStats(year, days, targetUserId)
+    await get().loadStats(year)
+  },
+
+  loadHolidays: async (year) => {
+    const y = year || get().selectedYear
+    const plan = get().plan
+    if (!plan?.holidays_enabled || !plan?.holidays_region) {
+      set({ holidays: {} })
+      return
+    }
+    const country = plan.holidays_region.split('-')[0]
+    const region = plan.holidays_region.includes('-') ? plan.holidays_region : null
+    try {
+      const data = await api.getHolidays(y, country)
+      // Check if this country HAS regional holidays
+      const hasRegions = data.some(h => h.counties && h.counties.length > 0)
+      // If country has regions but no region selected yet, only show global ones
+      // Actually: don't show ANY holidays until region is selected
+      if (hasRegions && !region) {
+        set({ holidays: {} })
+        return
+      }
+      const map = {}
+      data.forEach(h => {
+        if (h.global || !h.counties || (region && h.counties.includes(region))) {
+          map[h.date] = { name: h.name, localName: h.localName }
+        }
+      })
+      set({ holidays: map })
+    } catch {
+      set({ holidays: {} })
+    }
+  },
+
+  loadAll: async () => {
+    set({ loading: true })
+    try {
+      await get().loadPlan()
+      await get().loadYears()
+      const year = get().selectedYear
+      await get().loadEntries(year)
+      await get().loadStats(year)
+      await get().loadHolidays(year)
+    } finally {
+      set({ loading: false })
+    }
+  },
+}))

client/vite.config.js

@@ -1,8 +1,91 @@
 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import { VitePWA } from 'vite-plugin-pwa'
 
 export default defineConfig({
-  plugins: [react()],
+  plugins: [
+    react(),
+    VitePWA({
+      registerType: 'autoUpdate',
+      workbox: {
+        globPatterns: ['**/*.{js,css,html,svg,png,woff,woff2,ttf}'],
+        navigateFallback: 'index.html',
+        navigateFallbackDenylist: [/^\/api/, /^\/uploads/],
+        runtimeCaching: [
+          {
+            // Carto map tiles (default provider)
+            urlPattern: /^https:\/\/[a-d]\.basemaps\.cartocdn\.com\/.*/i,
+            handler: 'CacheFirst',
+            options: {
+              cacheName: 'map-tiles',
+              expiration: { maxEntries: 1000, maxAgeSeconds: 30 * 24 * 60 * 60 },
+              cacheableResponse: { statuses: [0, 200] },
+            },
+          },
+          {
+            // OpenStreetMap tiles (fallback / alternative)
+            urlPattern: /^https:\/\/[a-c]\.tile\.openstreetmap\.org\/.*/i,
+            handler: 'CacheFirst',
+            options: {
+              cacheName: 'map-tiles',
+              expiration: { maxEntries: 1000, maxAgeSeconds: 30 * 24 * 60 * 60 },
+              cacheableResponse: { statuses: [0, 200] },
+            },
+          },
+          {
+            // Leaflet CSS/JS from unpkg CDN
+            urlPattern: /^https:\/\/unpkg\.com\/.*/i,
+            handler: 'CacheFirst',
+            options: {
+              cacheName: 'cdn-libs',
+              expiration: { maxEntries: 30, maxAgeSeconds: 365 * 24 * 60 * 60 },
+              cacheableResponse: { statuses: [0, 200] },
+            },
+          },
+          {
+            // API calls — prefer network, fall back to cache
+            urlPattern: /\/api\/.*/i,
+            handler: 'NetworkFirst',
+            options: {
+              cacheName: 'api-data',
+              expiration: { maxEntries: 200, maxAgeSeconds: 24 * 60 * 60 },
+              networkTimeoutSeconds: 5,
+              cacheableResponse: { statuses: [0, 200] },
+            },
+          },
+          {
+            // Uploaded files (photos, covers, documents)
+            urlPattern: /\/uploads\/.*/i,
+            handler: 'CacheFirst',
+            options: {
+              cacheName: 'user-uploads',
+              expiration: { maxEntries: 300, maxAgeSeconds: 30 * 24 * 60 * 60 },
+              cacheableResponse: { statuses: [0, 200] },
+            },
+          },
+        ],
+      },
+      manifest: {
+        name: 'NOMAD \u2014 Travel Planner',
+        short_name: 'NOMAD',
+        description: 'Navigation Organizer for Maps, Activities & Destinations',
+        theme_color: '#111827',
+        background_color: '#0f172a',
+        display: 'standalone',
+        scope: '/',
+        start_url: '/',
+        orientation: 'any',
+        categories: ['travel', 'navigation'],
+        icons: [
+          { src: 'icons/apple-touch-icon-180x180.png', sizes: '180x180', type: 'image/png' },
+          { src: 'icons/icon-192x192.png', sizes: '192x192', type: 'image/png' },
+          { src: 'icons/icon-512x512.png', sizes: '512x512', type: 'image/png' },
+          { src: 'icons/icon-512x512.png', sizes: '512x512', type: 'image/png', purpose: 'maskable' },
+          { src: 'icons/icon.svg', sizes: 'any', type: 'image/svg+xml' },
+        ],
+      },
+    }),
+  ],
   server: {
     port: 5173,
     proxy: {

docker-compose.yml

@@ -6,7 +6,7 @@ services:
       - "3000:3000"
     environment:
       - NODE_ENV=production
-      - JWT_SECRET=${JWT_SECRET:-change-me-to-a-long-random-string}
+      - JWT_SECRET=${JWT_SECRET:-}
       # - ALLOWED_ORIGINS=https://yourdomain.com  # Optional: restrict CORS to specific origins
       - PORT=3000
     volumes:

server/package-lock.json

@@ -1,18 +1,20 @@
 {
   "name": "nomad-server",
-  "version": "2.0.0",
+  "version": "2.5.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "nomad-server",
-      "version": "2.0.0",
+      "version": "2.5.2",
       "dependencies": {
         "archiver": "^6.0.1",
         "bcryptjs": "^2.4.3",
+        "better-sqlite3": "^12.8.0",
         "cors": "^2.8.5",
         "dotenv": "^16.4.1",
         "express": "^4.18.3",
+        "helmet": "^8.1.0",
         "jsonwebtoken": "^9.0.2",
         "multer": "^1.4.5-lts.1",
         "node-cron": "^4.2.1",
@@ -216,12 +218,46 @@
         "bare-path": "^3.0.0"
       }
     },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/bcryptjs": {
       "version": "2.4.3",
       "resolved": "https://registry.npmjs.org/bcryptjs/-/bcryptjs-2.4.3.tgz",
       "integrity": "sha512-V/Hy/X9Vt7f3BbPJEi8BdVFMByHi+jNXrYkW3huaybV/kQ0KJg0Y6PkEMbn+zeT+i+SiKZ/HMqJGIIt4LZDqNQ==",
       "license": "MIT"
     },
+    "node_modules/better-sqlite3": {
+      "version": "12.8.0",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.8.0.tgz",
+      "integrity": "sha512-RxD2Vd96sQDjQr20kdP+F+dK/1OUNiVOl200vKBZY8u0vTwysfolF6Hq+3ZK2+h8My9YvZhHsF+RSGZW2VYrPQ==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "bindings": "^1.5.0",
+        "prebuild-install": "^7.1.1"
+      },
+      "engines": {
+        "node": "20.x || 22.x || 23.x || 24.x || 25.x"
+      }
+    },
     "node_modules/binary-extensions": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
@@ -235,6 +271,26 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "license": "MIT",
+      "dependencies": {
+        "file-uri-to-path": "1.0.0"
+      }
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
     "node_modules/bluebird": {
       "version": "3.7.2",
       "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
@@ -291,6 +347,30 @@
         "node": ">=8"
       }
     },
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
     "node_modules/buffer-crc32": {
       "version": "0.2.13",
       "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
@@ -386,6 +466,12 @@
         "fsevents": "~2.3.2"
       }
     },
+    "node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "license": "ISC"
+    },
     "node_modules/compress-commons": {
       "version": "5.0.3",
       "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-5.0.3.tgz",
@@ -539,6 +625,30 @@
         "ms": "2.0.0"
       }
     },
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "mimic-response": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
     "node_modules/depd": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
@@ -558,6 +668,15 @@
         "npm": "1.2.8000 || >= 1.4.16"
       }
     },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/dotenv": {
       "version": "16.6.1",
       "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
@@ -647,6 +766,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/end-of-stream": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
+      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
+      "license": "MIT",
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
     "node_modules/es-define-property": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
@@ -701,6 +829,15 @@
         "bare-events": "^2.7.0"
       }
     },
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "license": "(MIT OR WTFPL)",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/express": {
       "version": "4.22.1",
       "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
@@ -753,6 +890,12 @@
       "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
       "license": "MIT"
     },
+    "node_modules/file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
+      "license": "MIT"
+    },
     "node_modules/fill-range": {
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@@ -802,6 +945,12 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "license": "MIT"
+    },
     "node_modules/fs-extra": {
       "version": "11.3.4",
       "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.4.tgz",
@@ -883,6 +1032,12 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
+      "license": "MIT"
+    },
     "node_modules/glob": {
       "version": "8.1.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz",
@@ -995,6 +1150,15 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/helmet": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.1.0.tgz",
+      "integrity": "sha512-jOiHyAZsmnr8LqoPGmCjYAaiuWwjAPLgY8ZX2XrmHawt99/u1y6RgrZMTeoPfpUbV96HOalYgz1qzkRbw54Pmg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/http-errors": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
@@ -1027,6 +1191,26 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/ignore-by-default": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/ignore-by-default/-/ignore-by-default-1.0.1.tgz",
@@ -1051,6 +1235,12 @@
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "license": "ISC"
+    },
     "node_modules/ipaddr.js": {
       "version": "1.9.1",
       "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
@@ -1332,6 +1522,18 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/minimatch": {
       "version": "10.2.4",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
@@ -1369,6 +1571,12 @@
         "mkdirp": "bin/cmd.js"
       }
     },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "license": "MIT"
+    },
     "node_modules/ms": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
@@ -1394,6 +1602,12 @@
         "node": ">= 6.0.0"
       }
     },
+    "node_modules/napi-build-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
+      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
+      "license": "MIT"
+    },
     "node_modules/negotiator": {
       "version": "0.6.3",
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
@@ -1403,6 +1617,18 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/node-abi": {
+      "version": "3.89.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.89.0.tgz",
+      "integrity": "sha512-6u9UwL0HlAl21+agMN3YAMXcKByMqwGx+pq+P76vii5f7hTPtKDp08/H9py6DY+cfDw7kQNTGEj/rly3IgbNQA==",
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/node-cron": {
       "version": "4.2.1",
       "resolved": "https://registry.npmjs.org/node-cron/-/node-cron-4.2.1.tgz",
@@ -1571,6 +1797,33 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/prebuild-install": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
+      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
+      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^2.0.0",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
+      },
+      "bin": {
+        "prebuild-install": "bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/process-nextick-args": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
@@ -1597,6 +1850,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/pump": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
+      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
+      "license": "MIT",
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
     "node_modules/qs": {
       "version": "6.14.2",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
@@ -1636,6 +1899,21 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
     "node_modules/readable-stream": {
       "version": "3.6.2",
       "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
@@ -1860,6 +2138,51 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
+    },
     "node_modules/simple-update-notifier": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/simple-update-notifier/-/simple-update-notifier-2.0.0.tgz",
@@ -1910,6 +2233,15 @@
         "safe-buffer": "~5.2.0"
       }
     },
+    "node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/supports-color": {
       "version": "5.5.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
@@ -1923,6 +2255,34 @@
         "node": ">=4"
       }
     },
+    "node_modules/tar-fs": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/tar-fs/node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/tar-stream": {
       "version": "3.1.8",
       "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.8.tgz",
@@ -1991,6 +2351,18 @@
       "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
       "license": "MIT"
     },
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/type-is": {
       "version": "1.6.18",
       "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",

server/package.json

@@ -1,17 +1,19 @@
 {
   "name": "nomad-server",
-  "version": "2.0.0",
+  "version": "2.5.5",
   "main": "src/index.js",
   "scripts": {
-    "start": "node --experimental-sqlite src/index.js",
+    "start": "node src/index.js",
     "dev": "nodemon src/index.js"
   },
   "dependencies": {
     "archiver": "^6.0.1",
     "bcryptjs": "^2.4.3",
+    "better-sqlite3": "^12.8.0",
     "cors": "^2.8.5",
     "dotenv": "^16.4.1",
     "express": "^4.18.3",
+    "helmet": "^8.1.0",
     "jsonwebtoken": "^9.0.2",
     "multer": "^1.4.5-lts.1",
     "node-cron": "^4.2.1",

server/reset-admin.js

@@ -1,9 +1,9 @@
 const path = require('path');
-const { DatabaseSync } = require('node:sqlite');
+const Database = require('better-sqlite3');
 const bcrypt = require('bcryptjs');
 
 const dbPath = path.join(__dirname, 'data/travel.db');
-const db = new DatabaseSync(dbPath);
+const db = new Database(dbPath);
 
 const hash = bcrypt.hashSync('admin123', 10);
 const existing = db.prepare('SELECT id FROM users WHERE email = ?').get('admin@admin.com');

server/src/db/database.js

@@ -1,4 +1,4 @@
-const { DatabaseSync } = require('node:sqlite');
+const Database = require('better-sqlite3');
 const path = require('path');
 const fs = require('fs');
 const bcrypt = require('bcryptjs');
@@ -19,7 +19,7 @@ function initDb() {
     _db = null;
   }
 
-  _db = new DatabaseSync(dbPath);
+  _db = new Database(dbPath);
   _db.exec('PRAGMA journal_mode = WAL');
   _db.exec('PRAGMA busy_timeout = 5000');
   _db.exec('PRAGMA foreign_keys = ON');
@@ -35,6 +35,10 @@ function initDb() {
       maps_api_key TEXT,
       unsplash_api_key TEXT,
       openweather_api_key TEXT,
+      avatar TEXT,
+      oidc_sub TEXT,
+      oidc_issuer TEXT,
+      last_login DATETIME,
       created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
       updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
@@ -55,6 +59,8 @@ function initDb() {
       start_date TEXT,
       end_date TEXT,
       currency TEXT DEFAULT 'EUR',
+      cover_image TEXT,
+      is_archived INTEGER DEFAULT 0,
       created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
       updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
@@ -65,6 +71,7 @@ function initDb() {
       day_number INTEGER NOT NULL,
       date TEXT,
       notes TEXT,
+      title TEXT,
       UNIQUE(trip_id, day_number)
     );
 
@@ -73,6 +80,7 @@ function initDb() {
       name TEXT NOT NULL,
       color TEXT DEFAULT '#6366f1',
       icon TEXT DEFAULT '📍',
+      user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
       created_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
 
@@ -153,6 +161,7 @@ function initDb() {
       id INTEGER PRIMARY KEY AUTOINCREMENT,
       trip_id INTEGER NOT NULL REFERENCES trips(id) ON DELETE CASCADE,
       place_id INTEGER REFERENCES places(id) ON DELETE SET NULL,
+      reservation_id INTEGER REFERENCES reservations(id) ON DELETE SET NULL,
       filename TEXT NOT NULL,
       original_name TEXT NOT NULL,
       file_size INTEGER,
@@ -171,6 +180,8 @@ function initDb() {
       location TEXT,
       confirmation_number TEXT,
       notes TEXT,
+      status TEXT DEFAULT 'pending',
+      type TEXT DEFAULT 'other',
       created_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
 
@@ -211,6 +222,82 @@ function initDb() {
       sort_order INTEGER DEFAULT 0,
       created_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
+
+    -- Addon system
+    CREATE TABLE IF NOT EXISTS addons (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      description TEXT,
+      type TEXT NOT NULL DEFAULT 'global',
+      icon TEXT DEFAULT 'Puzzle',
+      enabled INTEGER DEFAULT 0,
+      config TEXT DEFAULT '{}',
+      sort_order INTEGER DEFAULT 0
+    );
+
+    -- Vacay addon tables
+    CREATE TABLE IF NOT EXISTS vacay_plans (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      block_weekends INTEGER DEFAULT 1,
+      holidays_enabled INTEGER DEFAULT 0,
+      holidays_region TEXT DEFAULT '',
+      company_holidays_enabled INTEGER DEFAULT 1,
+      carry_over_enabled INTEGER DEFAULT 1,
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+      UNIQUE(owner_id)
+    );
+
+    CREATE TABLE IF NOT EXISTS vacay_plan_members (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      plan_id INTEGER NOT NULL REFERENCES vacay_plans(id) ON DELETE CASCADE,
+      user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      status TEXT DEFAULT 'pending',
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+      UNIQUE(plan_id, user_id)
+    );
+
+    CREATE TABLE IF NOT EXISTS vacay_user_colors (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      plan_id INTEGER NOT NULL REFERENCES vacay_plans(id) ON DELETE CASCADE,
+      color TEXT DEFAULT '#6366f1',
+      UNIQUE(user_id, plan_id)
+    );
+
+    CREATE TABLE IF NOT EXISTS vacay_years (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      plan_id INTEGER NOT NULL REFERENCES vacay_plans(id) ON DELETE CASCADE,
+      year INTEGER NOT NULL,
+      UNIQUE(plan_id, year)
+    );
+
+    CREATE TABLE IF NOT EXISTS vacay_user_years (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      plan_id INTEGER NOT NULL REFERENCES vacay_plans(id) ON DELETE CASCADE,
+      year INTEGER NOT NULL,
+      vacation_days INTEGER DEFAULT 30,
+      carried_over INTEGER DEFAULT 0,
+      UNIQUE(user_id, plan_id, year)
+    );
+
+    CREATE TABLE IF NOT EXISTS vacay_entries (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      plan_id INTEGER NOT NULL REFERENCES vacay_plans(id) ON DELETE CASCADE,
+      user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      date TEXT NOT NULL,
+      note TEXT DEFAULT '',
+      UNIQUE(user_id, plan_id, date)
+    );
+
+    CREATE TABLE IF NOT EXISTS vacay_company_holidays (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      plan_id INTEGER NOT NULL REFERENCES vacay_plans(id) ON DELETE CASCADE,
+      date TEXT NOT NULL,
+      note TEXT DEFAULT '',
+      UNIQUE(plan_id, date)
+    );
   `);
 
   // Create indexes for performance
@@ -233,50 +320,80 @@ function initDb() {
     CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
   `);
 
-  // Migrations
+  // Versioned migrations — each runs exactly once
+  _db.exec('CREATE TABLE IF NOT EXISTS schema_version (version INTEGER NOT NULL)');
+  const versionRow = _db.prepare('SELECT version FROM schema_version').get();
+  let currentVersion = versionRow?.version ?? 0;
+
+  // Existing or fresh DBs may already have columns the migrations add.
+  // Detect by checking for a column from migration 1 (unsplash_api_key).
+  if (currentVersion === 0) {
+    const hasUnsplash = _db.prepare(
+      "SELECT 1 FROM pragma_table_info('users') WHERE name = 'unsplash_api_key'"
+    ).get();
+    if (hasUnsplash) {
+      // All columns from CREATE TABLE already exist — skip ALTER migrations
+      currentVersion = 19;
+      _db.prepare('INSERT INTO schema_version (version) VALUES (?)').run(currentVersion);
+      console.log('[DB] Schema already up-to-date, setting version to', currentVersion);
+    } else {
+      _db.prepare('INSERT INTO schema_version (version) VALUES (?)').run(0);
+    }
+  }
+
   const migrations = [
-    `ALTER TABLE users ADD COLUMN unsplash_api_key TEXT`,
-    `ALTER TABLE users ADD COLUMN openweather_api_key TEXT`,
-    `ALTER TABLE places ADD COLUMN duration_minutes INTEGER DEFAULT 60`,
-    `ALTER TABLE places ADD COLUMN notes TEXT`,
-    `ALTER TABLE places ADD COLUMN image_url TEXT`,
-    `ALTER TABLE places ADD COLUMN transport_mode TEXT DEFAULT 'walking'`,
-    `ALTER TABLE days ADD COLUMN title TEXT`,
-    `ALTER TABLE reservations ADD COLUMN status TEXT DEFAULT 'pending'`,
-    `ALTER TABLE trip_files ADD COLUMN reservation_id INTEGER REFERENCES reservations(id) ON DELETE SET NULL`,
-    `ALTER TABLE reservations ADD COLUMN type TEXT DEFAULT 'other'`,
-    `ALTER TABLE trips ADD COLUMN cover_image TEXT`,
-    `ALTER TABLE day_notes ADD COLUMN icon TEXT DEFAULT '📝'`,
-    `ALTER TABLE trips ADD COLUMN is_archived INTEGER DEFAULT 0`,
-    `ALTER TABLE categories ADD COLUMN user_id INTEGER REFERENCES users(id) ON DELETE SET NULL`,
-    `ALTER TABLE users ADD COLUMN avatar TEXT`,
+    // 1–18: ALTER TABLE additions
+    () => _db.exec('ALTER TABLE users ADD COLUMN unsplash_api_key TEXT'),
+    () => _db.exec('ALTER TABLE users ADD COLUMN openweather_api_key TEXT'),
+    () => _db.exec('ALTER TABLE places ADD COLUMN duration_minutes INTEGER DEFAULT 60'),
+    () => _db.exec('ALTER TABLE places ADD COLUMN notes TEXT'),
+    () => _db.exec('ALTER TABLE places ADD COLUMN image_url TEXT'),
+    () => _db.exec("ALTER TABLE places ADD COLUMN transport_mode TEXT DEFAULT 'walking'"),
+    () => _db.exec('ALTER TABLE days ADD COLUMN title TEXT'),
+    () => _db.exec("ALTER TABLE reservations ADD COLUMN status TEXT DEFAULT 'pending'"),
+    () => _db.exec('ALTER TABLE trip_files ADD COLUMN reservation_id INTEGER REFERENCES reservations(id) ON DELETE SET NULL'),
+    () => _db.exec("ALTER TABLE reservations ADD COLUMN type TEXT DEFAULT 'other'"),
+    () => _db.exec('ALTER TABLE trips ADD COLUMN cover_image TEXT'),
+    () => _db.exec("ALTER TABLE day_notes ADD COLUMN icon TEXT DEFAULT '📝'"),
+    () => _db.exec('ALTER TABLE trips ADD COLUMN is_archived INTEGER DEFAULT 0'),
+    () => _db.exec('ALTER TABLE categories ADD COLUMN user_id INTEGER REFERENCES users(id) ON DELETE SET NULL'),
+    () => _db.exec('ALTER TABLE users ADD COLUMN avatar TEXT'),
+    () => _db.exec('ALTER TABLE users ADD COLUMN oidc_sub TEXT'),
+    () => _db.exec('ALTER TABLE users ADD COLUMN oidc_issuer TEXT'),
+    () => _db.exec('ALTER TABLE users ADD COLUMN last_login DATETIME'),
+    // 19: budget_items table rebuild (NOT NULL → nullable persons)
+    () => {
+      const schema = _db.prepare("SELECT sql FROM sqlite_master WHERE name = 'budget_items'").get();
+      if (schema?.sql?.includes('NOT NULL DEFAULT 1')) {
+        _db.exec(`
+          CREATE TABLE budget_items_new (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            trip_id INTEGER NOT NULL REFERENCES trips(id) ON DELETE CASCADE,
+            category TEXT NOT NULL DEFAULT 'Sonstiges',
+            name TEXT NOT NULL,
+            total_price REAL NOT NULL DEFAULT 0,
+            persons INTEGER DEFAULT NULL,
+            days INTEGER DEFAULT NULL,
+            note TEXT,
+            sort_order INTEGER DEFAULT 0,
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+          );
+          INSERT INTO budget_items_new SELECT * FROM budget_items;
+          DROP TABLE budget_items;
+          ALTER TABLE budget_items_new RENAME TO budget_items;
+        `);
+      }
+    },
+    // Future migrations go here (append only, never reorder)
   ];
 
-  // Recreate budget_items to allow NULL persons (SQLite can't ALTER NOT NULL)
-  try {
-    const hasNotNull = _db.prepare("SELECT sql FROM sqlite_master WHERE name = 'budget_items'").get()
-    if (hasNotNull?.sql?.includes('NOT NULL DEFAULT 1')) {
-      _db.exec(`
-        CREATE TABLE budget_items_new (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          trip_id INTEGER NOT NULL REFERENCES trips(id) ON DELETE CASCADE,
-          category TEXT NOT NULL DEFAULT 'Sonstiges',
-          name TEXT NOT NULL,
-          total_price REAL NOT NULL DEFAULT 0,
-          persons INTEGER DEFAULT NULL,
-          days INTEGER DEFAULT NULL,
-          note TEXT,
-          sort_order INTEGER DEFAULT 0,
-          created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-        );
-        INSERT INTO budget_items_new SELECT * FROM budget_items;
-        DROP TABLE budget_items;
-        ALTER TABLE budget_items_new RENAME TO budget_items;
-      `)
+  if (currentVersion < migrations.length) {
+    for (let i = currentVersion; i < migrations.length; i++) {
+      console.log(`[DB] Running migration ${i + 1}/${migrations.length}`);
+      migrations[i]();
     }
-  } catch (e) { /* table doesn't exist yet or already migrated */ }
-  for (const sql of migrations) {
-    try { _db.exec(sql); } catch (e) { /* column already exists */ }
+    _db.prepare('UPDATE schema_version SET version = ?').run(migrations.length);
+    console.log(`[DB] Migrations complete — schema version ${migrations.length}`);
   }
 
   // First registered user becomes admin — no default admin seed needed
@@ -304,15 +421,45 @@ function initDb() {
   } catch (err) {
     console.error('Error seeding categories:', err.message);
   }
+
+  // Seed: default addons
+  try {
+    const existingAddons = _db.prepare('SELECT COUNT(*) as count FROM addons').get();
+    if (existingAddons.count === 0) {
+      const defaultAddons = [
+        { id: 'packing', name: 'Packing List', description: 'Pack your bags with checklists per trip', type: 'trip', icon: 'ListChecks', sort_order: 0 },
+        { id: 'budget', name: 'Budget Planner', description: 'Track expenses and plan your travel budget', type: 'trip', icon: 'Wallet', sort_order: 1 },
+        { id: 'documents', name: 'Documents', description: 'Store and manage travel documents', type: 'trip', icon: 'FileText', sort_order: 2 },
+        { id: 'vacay', name: 'Vacay', description: 'Personal vacation day planner with calendar view', type: 'global', icon: 'CalendarDays', sort_order: 10 },
+        { id: 'atlas', name: 'Atlas', description: 'World map of your visited countries with travel stats', type: 'global', icon: 'Globe', sort_order: 11 },
+      ];
+      const insertAddon = _db.prepare('INSERT INTO addons (id, name, description, type, icon, enabled, sort_order) VALUES (?, ?, ?, ?, ?, 1, ?)');
+      for (const a of defaultAddons) insertAddon.run(a.id, a.name, a.description, a.type, a.icon, a.sort_order);
+      console.log('Default addons seeded');
+    }
+  } catch (err) {
+    console.error('Error seeding addons:', err.message);
+  }
 }
 
 // Initialize on module load
 initDb();
 
+// Demo mode: seed admin + demo user + example trips
+if (process.env.DEMO_MODE === 'true') {
+  try {
+    const { seedDemoData } = require('../demo/demo-seed');
+    seedDemoData(_db);
+  } catch (err) {
+    console.error('[Demo] Seed error:', err.message);
+  }
+}
+
 // Proxy so all route modules always use the current _db instance
 // without needing a server restart after reinitialize()
 const db = new Proxy({}, {
   get(_, prop) {
+    if (!_db) throw new Error('Database connection is not available (restore in progress?)');
     const val = _db[prop];
     return typeof val === 'function' ? val.bind(_db) : val;
   },

server/src/demo/demo-reset.js

@@ -0,0 +1,84 @@
+const fs = require('fs');
+const path = require('path');
+
+const dataDir = path.join(__dirname, '../../data');
+const dbPath = path.join(dataDir, 'travel.db');
+const baselinePath = path.join(dataDir, 'travel-baseline.db');
+
+function resetDemoUser() {
+  if (!fs.existsSync(baselinePath)) {
+    console.log('[Demo Reset] No baseline found, skipping. Admin must save baseline first.');
+    return;
+  }
+
+  const { db, closeDb, reinitialize } = require('../db/database');
+
+  // Save admin's current credentials and API keys (these should survive the reset)
+  const adminEmail = process.env.DEMO_ADMIN_EMAIL || 'admin@nomad.app';
+  let adminData = null;
+  try {
+    adminData = db.prepare(
+      'SELECT password_hash, maps_api_key, openweather_api_key, unsplash_api_key, avatar FROM users WHERE email = ?'
+    ).get(adminEmail);
+  } catch (e) {
+    console.error('[Demo Reset] Failed to read admin data:', e.message);
+  }
+
+  // Flush WAL to main DB file
+  try { db.exec('PRAGMA wal_checkpoint(TRUNCATE)'); } catch (e) {}
+
+  // Close DB connection
+  closeDb();
+
+  // Restore baseline
+  try {
+    fs.copyFileSync(baselinePath, dbPath);
+    // Remove WAL/SHM files if they exist (stale from old connection)
+    try { fs.unlinkSync(dbPath + '-wal'); } catch (e) {}
+    try { fs.unlinkSync(dbPath + '-shm'); } catch (e) {}
+  } catch (e) {
+    console.error('[Demo Reset] Failed to restore baseline:', e.message);
+    reinitialize();
+    return;
+  }
+
+  // Reinitialize DB connection with restored baseline
+  reinitialize();
+
+  // Restore admin's latest credentials (in case admin changed password/API keys after baseline was saved)
+  if (adminData) {
+    try {
+      const { db: freshDb } = require('../db/database');
+      freshDb.prepare(
+        'UPDATE users SET password_hash = ?, maps_api_key = ?, openweather_api_key = ?, unsplash_api_key = ?, avatar = ? WHERE email = ?'
+      ).run(
+        adminData.password_hash,
+        adminData.maps_api_key,
+        adminData.openweather_api_key,
+        adminData.unsplash_api_key,
+        adminData.avatar,
+        adminEmail
+      );
+    } catch (e) {
+      console.error('[Demo Reset] Failed to restore admin credentials:', e.message);
+    }
+  }
+
+  console.log('[Demo Reset] Database restored from baseline');
+}
+
+function saveBaseline() {
+  const { db } = require('../db/database');
+
+  // Flush WAL so baseline file is self-contained
+  try { db.exec('PRAGMA wal_checkpoint(TRUNCATE)'); } catch (e) {}
+
+  fs.copyFileSync(dbPath, baselinePath);
+  console.log('[Demo] Baseline saved');
+}
+
+function hasBaseline() {
+  return fs.existsSync(baselinePath);
+}
+
+module.exports = { resetDemoUser, saveBaseline, hasBaseline };

server/src/demo/demo-seed.js

@@ -0,0 +1,278 @@
+const bcrypt = require('bcryptjs');
+
+function seedDemoData(db) {
+  const ADMIN_USER = process.env.DEMO_ADMIN_USER || 'admin';
+  const ADMIN_EMAIL = process.env.DEMO_ADMIN_EMAIL || 'admin@nomad.app';
+  const ADMIN_PASS = process.env.DEMO_ADMIN_PASS || 'admin12345';
+  const DEMO_EMAIL = 'demo@nomad.app';
+  const DEMO_PASS = 'demo12345';
+
+  // Create admin user if not exists
+  let admin = db.prepare('SELECT id FROM users WHERE email = ?').get(ADMIN_EMAIL);
+  if (!admin) {
+    const hash = bcrypt.hashSync(ADMIN_PASS, 10);
+    const r = db.prepare('INSERT INTO users (username, email, password_hash, role) VALUES (?, ?, ?, ?)').run(ADMIN_USER, ADMIN_EMAIL, hash, 'admin');
+    admin = { id: Number(r.lastInsertRowid) };
+    console.log('[Demo] Admin user created');
+  } else {
+    admin.id = Number(admin.id);
+  }
+
+  // Create demo user if not exists
+  let demo = db.prepare('SELECT id FROM users WHERE email = ?').get(DEMO_EMAIL);
+  if (!demo) {
+    const hash = bcrypt.hashSync(DEMO_PASS, 10);
+    const r = db.prepare('INSERT INTO users (username, email, password_hash, role) VALUES (?, ?, ?, ?)').run('demo', DEMO_EMAIL, hash, 'user');
+    demo = { id: Number(r.lastInsertRowid) };
+    console.log('[Demo] Demo user created');
+  } else {
+    demo.id = Number(demo.id);
+  }
+
+  // Disable registration in demo mode
+  db.prepare("INSERT OR REPLACE INTO app_settings (key, value) VALUES ('allow_registration', 'false')").run();
+
+  // Check if admin already has example trips
+  const adminTrips = db.prepare('SELECT COUNT(*) as count FROM trips WHERE user_id = ?').get(admin.id);
+  if (adminTrips.count > 0) {
+    console.log('[Demo] Example trips already exist, ensuring demo membership');
+    ensureDemoMembership(db, admin.id, demo.id);
+    return { adminId: admin.id, demoId: demo.id };
+  }
+
+  console.log('[Demo] Seeding example trips...');
+  seedExampleTrips(db, admin.id, demo.id);
+
+  // Auto-save baseline after first seed
+  const { saveBaseline, hasBaseline } = require('./demo-reset');
+  if (!hasBaseline()) {
+    saveBaseline();
+  }
+
+  return { adminId: admin.id, demoId: demo.id };
+}
+
+function ensureDemoMembership(db, adminId, demoId) {
+  const trips = db.prepare('SELECT id FROM trips WHERE user_id = ?').all(adminId);
+  const insertMember = db.prepare('INSERT OR IGNORE INTO trip_members (trip_id, user_id, invited_by) VALUES (?, ?, ?)');
+  for (const trip of trips) {
+    insertMember.run(trip.id, demoId, adminId);
+  }
+}
+
+function seedExampleTrips(db, adminId, demoId) {
+  const insertTrip = db.prepare('INSERT INTO trips (user_id, title, description, start_date, end_date, currency) VALUES (?, ?, ?, ?, ?, ?)');
+  const insertDay = db.prepare('INSERT INTO days (trip_id, day_number, date) VALUES (?, ?, ?)');
+  const insertPlace = db.prepare('INSERT INTO places (trip_id, name, lat, lng, address, category_id, place_time, duration_minutes, notes, image_url, google_place_id, website, phone) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
+  const insertAssignment = db.prepare('INSERT INTO day_assignments (day_id, place_id, order_index) VALUES (?, ?, ?)');
+  const insertPacking = db.prepare('INSERT INTO packing_items (trip_id, name, checked, category, sort_order) VALUES (?, ?, ?, ?, ?)');
+  const insertBudget = db.prepare('INSERT INTO budget_items (trip_id, category, name, total_price, persons, note) VALUES (?, ?, ?, ?, ?, ?)');
+  const insertReservation = db.prepare('INSERT INTO reservations (trip_id, day_id, title, reservation_time, confirmation_number, status, type, location) VALUES (?, ?, ?, ?, ?, ?, ?, ?)');
+  const insertMember = db.prepare('INSERT OR IGNORE INTO trip_members (trip_id, user_id, invited_by) VALUES (?, ?, ?)');
+  const insertNote = db.prepare('INSERT INTO day_notes (day_id, trip_id, text, time, icon, sort_order) VALUES (?, ?, ?, ?, ?, ?)');
+
+  // Category IDs: 1=Hotel, 2=Restaurant, 3=Attraction, 5=Transport, 7=Bar/Cafe, 8=Beach, 9=Nature, 6=Entertainment
+
+  // ─── Trip 1: Tokyo & Kyoto ─────────────────────────────────────────────────
+  const trip1 = insertTrip.run(adminId, 'Tokyo & Kyoto', 'Two weeks in Japan — from the neon-lit streets of Tokyo to the serene temples of Kyoto.', '2026-04-15', '2026-04-21', 'JPY');
+  const t1 = Number(trip1.lastInsertRowid);
+
+  const t1days = [];
+  for (let i = 0; i < 7; i++) {
+    const d = insertDay.run(t1, i + 1, `2026-04-${15 + i}`);
+    t1days.push(Number(d.lastInsertRowid));
+  }
+
+  const t1places = [
+    [t1, 'Hotel Shinjuku Granbell', 35.6938, 139.7035, '2-14-5 Kabukicho, Shinjuku City, Tokyo 160-0021, Japan', 1, '15:00', 60, 'Check-in from 3 PM. Steps from Shinjuku Station.', null, 'ChIJdaGEJBeMGGARYgt8sLBv6lM', 'https://www.grfranbellhotel.jp/shinjuku/', '+81 3-5155-2666'],
+    [t1, 'Senso-ji Temple', 35.7148, 139.7967, '2 Chome-3-1 Asakusa, Taito City, Tokyo 111-0032, Japan', 3, '09:00', 90, 'Oldest temple in Tokyo. Fewer tourists in the early morning.', null, 'ChIJ8T1GpMGOGGARDYGSgpoOdfg', 'https://www.senso-ji.jp/', '+81 3-3842-0181'],
+    [t1, 'Shibuya Crossing', 35.6595, 139.7004, '2 Chome-2-1 Dogenzaka, Shibuya City, Tokyo 150-0043, Japan', 3, '18:00', 45, 'World\'s busiest pedestrian crossing. Most impressive at night.', null, 'ChIJLyzOhmyLGGARMKWbl5z6wGg', null, null],
+    [t1, 'Tsukiji Outer Market', 35.6654, 139.7707, '4 Chome-16-2 Tsukiji, Chuo City, Tokyo 104-0045, Japan', 2, '08:00', 120, 'Fresh sushi for breakfast! Explore the street food stalls.', null, 'ChIJq2i1dZCLGGAR1TfoBRo25VU', 'https://www.tsukiji.or.jp/', null],
+    [t1, 'Meiji Jingu Shrine', 35.6764, 139.6993, '1-1 Yoyogikamizonocho, Shibuya City, Tokyo 151-8557, Japan', 3, '10:00', 75, 'Peaceful oasis in the middle of the city. Walk through the forest to the shrine.', null, 'ChIJ5SuJSByMGGARMg9qOlTFgkc', 'https://www.meijijingu.or.jp/', '+81 3-3379-5511'],
+    [t1, 'Akihabara Electric Town', 35.7023, 139.7745, 'Sotokanda, Chiyoda City, Tokyo, Japan', 3, '14:00', 180, 'Electric Town — anime, manga, electronics. Retro gaming shops!', null, 'ChIJGz1usEyMGGAR1mYByqOOJao', null, null],
+    [t1, 'Shinkansen to Kyoto', 35.6812, 139.7671, '1 Chome Marunouchi, Chiyoda City, Tokyo 100-0005, Japan', 5, '08:30', 140, 'Nozomi Shinkansen, approx. 2h15. Window seat for Mt. Fuji views!', null, 'ChIJC3Cf2PuLGGAROO00ukl8JwA', null, null],
+    [t1, 'Hotel Granvia Kyoto', 34.9856, 135.7580, 'Karasuma-dori Shiokoji-sagaru, Shimogyo-ku, Kyoto 600-8216, Japan', 1, '14:00', 60, 'Right at Kyoto Station. Perfect base for day trips.', null, 'ChIJUf6MDFcIAWARLihjKC9FWDY', 'https://www.granvia-kyoto.co.jp/', '+81 75-344-8888'],
+    [t1, 'Fushimi Inari Taisha', 34.9671, 135.7727, '68 Fukakusa Yabunouchicho, Fushimi Ward, Kyoto 612-0882, Japan', 3, '07:00', 150, '10,000 vermillion torii gates. Start early for empty paths!', null, 'ChIJIW0JRbMIAWARPYEzP5LVHGE', 'http://inari.jp/', '+81 75-641-7331'],
+    [t1, 'Kinkaku-ji (Golden Pavilion)', 35.0394, 135.7292, '1 Kinkakujicho, Kita Ward, Kyoto 603-8361, Japan', 3, '10:00', 60, 'The golden temple reflected in the mirror pond. Iconic photo spot.', null, 'ChIJvUbrwCCoAWAR5-uyAXPzBHg', null, '+81 75-461-0013'],
+    [t1, 'Arashiyama Bamboo Grove', 35.0095, 135.6673, 'Sagatenryuji Susukinobabacho, Ukyo Ward, Kyoto 616-8385, Japan', 9, '09:00', 90, 'Magical bamboo forest. Best visited in the morning before the crowds.', null, 'ChIJFS4EvA6pAWARQsAPVijvW7I', null, null],
+    [t1, 'Nishiki Market', 35.0050, 135.7647, 'Nishiki-koji Dori, Nakagyo Ward, Kyoto 604-8054, Japan', 2, '12:00', 90, 'Kyoto\'s kitchen street. Try the matcha ice cream and fresh mochi!', null, 'ChIJ09zzUigJAWARXzIdh1NE3hQ', 'http://www.kyoto-nishiki.or.jp/', null],
+    [t1, 'Gion District', 35.0037, 135.7755, 'Gionmachi Minamigawa, Higashiyama Ward, Kyoto 605-0074, Japan', 3, '17:00', 120, 'Historic geisha district. Best chance of spotting a maiko in the evening.', null, 'ChIJ7WWWjfYJAWARGqEHAfXIzgQ', null, null],
+  ];
+
+  const t1pIds = t1places.map(p => Number(insertPlace.run(...p).lastInsertRowid));
+
+  // Day 1: Hotel Check-in, Shibuya
+  insertAssignment.run(t1days[0], t1pIds[0], 0);
+  insertAssignment.run(t1days[0], t1pIds[2], 1);
+  insertNote.run(t1days[0], t1, 'Pick up Pocket WiFi at airport', '13:00', 'Info', 0.5);
+  // Day 2: Tsukiji, Senso-ji, Akihabara
+  insertAssignment.run(t1days[1], t1pIds[3], 0);
+  insertAssignment.run(t1days[1], t1pIds[1], 1);
+  insertAssignment.run(t1days[1], t1pIds[5], 2);
+  // Day 3: Meiji Shrine, free afternoon
+  insertAssignment.run(t1days[2], t1pIds[4], 0);
+  insertNote.run(t1days[2], t1, 'Explore Harajuku after the shrine', '12:00', 'MapPin', 1);
+  // Day 4: Shinkansen to Kyoto, Hotel
+  insertAssignment.run(t1days[3], t1pIds[6], 0);
+  insertAssignment.run(t1days[3], t1pIds[7], 1);
+  insertNote.run(t1days[3], t1, 'Sit on right side for Mt. Fuji views!', '08:30', 'Train', 0.5);
+  // Day 5: Fushimi Inari, Nishiki Market
+  insertAssignment.run(t1days[4], t1pIds[8], 0);
+  insertAssignment.run(t1days[4], t1pIds[11], 1);
+  // Day 6: Kinkaku-ji, Arashiyama
+  insertAssignment.run(t1days[5], t1pIds[9], 0);
+  insertAssignment.run(t1days[5], t1pIds[10], 1);
+  // Day 7: Gion
+  insertAssignment.run(t1days[6], t1pIds[12], 0);
+  insertNote.run(t1days[6], t1, 'Last evening — farewell dinner at Pontocho Alley', '19:00', 'Star', 1);
+
+  // Packing
+  const t1packing = [
+    ['Passport', 1, 'Documents', 0], ['Japan Rail Pass', 1, 'Documents', 1],
+    ['Power adapter Type A/B', 0, 'Electronics', 2], ['Camera + charger', 0, 'Electronics', 3],
+    ['Comfortable walking shoes', 0, 'Clothing', 4], ['Rain jacket', 0, 'Clothing', 5],
+    ['Sunscreen', 0, 'Toiletries', 6], ['Travel first aid kit', 0, 'Toiletries', 7],
+    ['Pocket WiFi confirmation', 1, 'Electronics', 8], ['Yen cash', 0, 'Documents', 9],
+  ];
+  t1packing.forEach(p => insertPacking.run(t1, ...p));
+
+  // Budget
+  insertBudget.run(t1, 'Accommodation', 'Hotel Shinjuku (3 nights)', 67500, 2, 'Double room');
+  insertBudget.run(t1, 'Accommodation', 'Hotel Granvia Kyoto (4 nights)', 102000, 2, 'Superior room');
+  insertBudget.run(t1, 'Transport', 'Flights FRA-NRT return', 180000, 2, 'Lufthansa direct');
+  insertBudget.run(t1, 'Transport', 'Japan Rail Pass (7 days)', 57000, 2, 'Ordinary');
+  insertBudget.run(t1, 'Food', 'Daily food budget', 52500, 2, 'Approx. 7,500 JPY/day');
+  insertBudget.run(t1, 'Activities', 'Temple entries & experiences', 18000, 2, null);
+
+  // Reservations
+  insertReservation.run(t1, t1days[0], 'Hotel Shinjuku Check-in', '15:00', 'SG-2026-78432', 'confirmed', 'hotel', 'Shinjuku, Tokyo');
+  insertReservation.run(t1, t1days[3], 'Shinkansen Tokyo → Kyoto', '08:30', 'JR-NOZOMI-445', 'confirmed', 'transport', 'Tokyo Station');
+
+  insertMember.run(t1, demoId, adminId);
+
+  // ─── Trip 2: Barcelona Long Weekend ────────────────────────────────────────
+  const trip2 = insertTrip.run(adminId, 'Barcelona Long Weekend', 'Gaudi, tapas, and Mediterranean vibes — a long weekend in the Catalan capital.', '2026-05-21', '2026-05-24', 'EUR');
+  const t2 = Number(trip2.lastInsertRowid);
+
+  const t2days = [];
+  for (let i = 0; i < 4; i++) {
+    const d = insertDay.run(t2, i + 1, `2026-05-${21 + i}`);
+    t2days.push(Number(d.lastInsertRowid));
+  }
+
+  const t2places = [
+    [t2, 'W Barcelona', 41.3686, 2.1920, 'Placa de la Rosa dels Vents 1, 08039 Barcelona, Spain', 1, '14:00', 60, 'Right on the beach. Rooftop bar with panoramic views!', null, 'ChIJKfj5C8yjpBIRCPC3RPI0JO4', 'https://www.marriott.com/hotels/travel/bcnwh-w-barcelona/', '+34 932 95 28 00'],
+    [t2, 'Sagrada Familia', 41.4036, 2.1744, 'C/ de Mallorca, 401, 08013 Barcelona, Spain', 3, '10:00', 120, 'Gaudi\'s masterpiece. Book tickets online in advance — sells out fast!', null, 'ChIJk_s92NyipBIRUMnDG8Kq2Js', 'https://sagradafamilia.org/', '+34 932 08 04 14'],
+    [t2, 'Park Guell', 41.4145, 2.1527, '08024 Barcelona, Spain', 3, '09:00', 90, 'Mosaic terrace with city views. Book early for the Monumental Zone.', null, 'ChIJ4eQMeOmipBIRb65JRUzGE8k', 'https://parkguell.barcelona/', '+34 934 09 18 31'],
+    [t2, 'La Boqueria Market', 41.3816, 2.1717, 'La Rambla, 91, 08001 Barcelona, Spain', 2, '12:00', 75, 'Famous market on La Rambla. Fresh juice, jamon iberico, and seafood!', null, 'ChIJB_RfKcuipBIRkPKW7MzVGKg', 'http://www.boqueria.barcelona/', '+34 933 18 25 84'],
+    [t2, 'Barceloneta Beach', 41.3784, 2.1925, 'Passeig Maritim de la Barceloneta, 08003 Barcelona, Spain', 8, '16:00', 120, 'City beach to unwind after sightseeing. Great chiringuitos nearby.', null, 'ChIJAQCl79-ipBIRUKF3myrMYkM', null, null],
+    [t2, 'Gothic Quarter', 41.3834, 2.1762, 'Barri Gotic, 08002 Barcelona, Spain', 3, '15:00', 90, 'Medieval lanes, the cathedral, and Placa Reial. Get lost in the alleys!', null, 'ChIJ4_xkvv2ipBIRrK3bdd-lHgo', null, null],
+    [t2, 'Casa Batllo', 41.3916, 2.1650, 'Passeig de Gracia, 43, 08007 Barcelona, Spain', 3, '11:00', 75, 'Gaudi\'s dragon house. The facade alone is worth the visit.', null, 'ChIJ-2VKIcaipBIRKK63H5PYjqQ', 'https://www.casabatllo.es/', '+34 932 16 03 06'],
+    [t2, 'El Born & Tapas', 41.3856, 2.1825, 'El Born, 08003 Barcelona, Spain', 7, '20:00', 120, 'Trendy neighborhood with the best tapas bars. Try Cal Pep or El Xampanyet!', null, 'ChIJNY56dxuipBIRbqjSczmLvIA', null, null],
+  ];
+
+  const t2pIds = t2places.map(p => Number(insertPlace.run(...p).lastInsertRowid));
+
+  // Day 1: Arrival, Beach, El Born
+  insertAssignment.run(t2days[0], t2pIds[0], 0);
+  insertAssignment.run(t2days[0], t2pIds[4], 1);
+  insertAssignment.run(t2days[0], t2pIds[7], 2);
+  // Day 2: Sagrada Familia, Casa Batllo, La Boqueria
+  insertAssignment.run(t2days[1], t2pIds[1], 0);
+  insertAssignment.run(t2days[1], t2pIds[6], 1);
+  insertAssignment.run(t2days[1], t2pIds[3], 2);
+  insertNote.run(t2days[1], t2, 'Tickets already booked for 10:00 AM slot', '09:30', 'Ticket', 0.5);
+  // Day 3: Park Guell, Gothic Quarter
+  insertAssignment.run(t2days[2], t2pIds[2], 0);
+  insertAssignment.run(t2days[2], t2pIds[5], 1);
+  // Day 4: Beach morning, departure
+  insertAssignment.run(t2days[3], t2pIds[4], 0);
+  insertNote.run(t2days[3], t2, 'Flight departs at 18:30 — leave hotel by 15:00', '14:00', 'Plane', 1);
+
+  // Packing
+  ['Passport', 'Sunscreen SPF50', 'Swimwear', 'Sunglasses', 'Comfortable sandals', 'Beach towel'].forEach((name, i) => {
+    insertPacking.run(t2, name, 0, i < 1 ? 'Documents' : 'Summer', i);
+  });
+
+  // Budget
+  insertBudget.run(t2, 'Accommodation', 'W Barcelona (3 nights)', 780, 2, 'Sea View Room');
+  insertBudget.run(t2, 'Transport', 'Flights BER-BCN return', 180, 2, 'Eurowings');
+  insertBudget.run(t2, 'Food', 'Restaurants & tapas', 300, 2, 'Approx. 75 EUR/day');
+  insertBudget.run(t2, 'Activities', 'Sagrada Familia + Park Guell + Casa Batllo', 95, 2, 'Online tickets');
+
+  insertReservation.run(t2, t2days[1], 'Sagrada Familia Entry', '10:00', 'SF-2026-11234', 'confirmed', 'activity', 'Eixample, Barcelona');
+
+  insertMember.run(t2, demoId, adminId);
+
+  // ─── Trip 3: New York City ─────────────────────────────────────────────────
+  const trip3 = insertTrip.run(adminId, 'New York City', 'The city that never sleeps — iconic landmarks, world-class food, and Broadway lights.', '2026-09-18', '2026-09-22', 'USD');
+  const t3 = Number(trip3.lastInsertRowid);
+
+  const t3days = [];
+  for (let i = 0; i < 5; i++) {
+    const d = insertDay.run(t3, i + 1, `2026-09-${18 + i}`);
+    t3days.push(Number(d.lastInsertRowid));
+  }
+
+  const t3places = [
+    [t3, 'The Plaza Hotel', 40.7645, -73.9744, '768 5th Ave, New York, NY 10019, USA', 1, '15:00', 60, 'Iconic luxury hotel on Central Park. The lobby alone is worth a visit.', null, 'ChIJYbISlAVYwokRn6ORbSPV0xk', 'https://www.theplazany.com/', '+1 212-759-3000'],
+    [t3, 'Statue of Liberty', 40.6892, -74.0445, 'Liberty Island, New York, NY 10004, USA', 3, '09:00', 180, 'Book crown access tickets months in advance. Ferry from Battery Park.', null, 'ChIJPTacEpBQwokRKwIlDXelxkA', 'https://www.nps.gov/stli/', '+1 212-363-3200'],
+    [t3, 'Central Park', 40.7829, -73.9654, 'Central Park, New York, NY 10024, USA', 9, '10:00', 120, 'Bethesda Fountain, Bow Bridge, and Strawberry Fields. Rent bikes!', null, 'ChIJ4zGFAZpYwokRGUGph3Mf37k', 'https://www.centralparknyc.org/', null],
+    [t3, 'Times Square', 40.7580, -73.9855, 'Manhattan, NY 10036, USA', 3, '19:00', 60, 'The crossroads of the world. Best experienced at night with all the lights.', null, 'ChIJmQJIxlVYwokRLgeuocVOGVU', 'https://www.timessquarenyc.org/', null],
+    [t3, 'Empire State Building', 40.7484, -73.9857, '350 5th Ave, New York, NY 10118, USA', 3, '11:00', 90, '86th floor observation deck. Go at sunset for the best views.', null, 'ChIJaXQRs6lZwokRY6EFpJnhNNE', 'https://www.esbnyc.com/', '+1 212-736-3100'],
+    [t3, 'Brooklyn Bridge', 40.7061, -73.9969, 'Brooklyn Bridge, New York, NY 10038, USA', 3, '16:00', 75, 'Walk from Manhattan to Brooklyn. DUMBO has great pizza and views.', null, 'ChIJK3vOQyNawokRXEYwET2GUtY', null, null],
+    [t3, 'The Metropolitan Museum of Art', 40.7794, -73.9632, '1000 5th Ave, New York, NY 10028, USA', 3, '10:00', 180, 'One of the world\'s greatest art museums. Could spend days here.', null, 'ChIJb8Jg766MwokR1YWG0nV7k-E', 'https://www.metmuseum.org/', '+1 212-535-7710'],
+    [t3, 'Joe\'s Pizza', 40.7309, -73.9969, '7 Carmine St, New York, NY 10014, USA', 2, '13:00', 30, 'New York\'s most famous pizza slice. Cash only, always a line, always worth it.', null, 'ChIJrfCL1IZZwokRwO3NKN22ZBc', 'http://www.joespizzanyc.com/', '+1 212-366-1182'],
+    [t3, 'Top of the Rock', 40.7593, -73.9794, '30 Rockefeller Plaza, New York, NY 10112, USA', 3, '17:30', 60, 'Better views than Empire State because you can SEE the Empire State.', null, 'ChIJ_y2Fb1JYwokRT_iGzhTLdBo', 'https://www.topoftherocknyc.com/', '+1 212-698-2000'],
+    [t3, 'Chelsea Market', 40.7424, -74.0061, '75 9th Ave, New York, NY 10011, USA', 2, '12:00', 90, 'Food hall in a converted factory. Lobster rolls, tacos, doughnuts, and more.', null, 'ChIJw2FNFyZZwokRcP9th_vIbkE', 'https://www.chelseamarket.com/', null],
+    [t3, 'Broadway Show', 40.7590, -73.9845, 'Broadway, Manhattan, NY 10019, USA', 6, '20:00', 150, 'Can\'t visit NYC without seeing a show. Book TKTS booth for discounts.', null, 'ChIJMYQhxFtYwokR7cJBcNqfKDY', null, null],
+  ];
+
+  const t3pIds = t3places.map(p => Number(insertPlace.run(...p).lastInsertRowid));
+
+  // Day 1: Arrival, Times Square, Broadway
+  insertAssignment.run(t3days[0], t3pIds[0], 0);
+  insertAssignment.run(t3days[0], t3pIds[3], 1);
+  insertAssignment.run(t3days[0], t3pIds[10], 2);
+  // Day 2: Statue of Liberty, Brooklyn Bridge, Joe's Pizza
+  insertAssignment.run(t3days[1], t3pIds[1], 0);
+  insertAssignment.run(t3days[1], t3pIds[5], 1);
+  insertAssignment.run(t3days[1], t3pIds[7], 2);
+  insertNote.run(t3days[1], t3, 'First ferry at 8:30 AM — arrive early at Battery Park', '08:00', 'Ship', 0.5);
+  // Day 3: Central Park, Met Museum, Top of the Rock sunset
+  insertAssignment.run(t3days[2], t3pIds[2], 0);
+  insertAssignment.run(t3days[2], t3pIds[6], 1);
+  insertAssignment.run(t3days[2], t3pIds[8], 2);
+  // Day 4: Empire State Building, Chelsea Market, shopping
+  insertAssignment.run(t3days[3], t3pIds[4], 0);
+  insertAssignment.run(t3days[3], t3pIds[9], 1);
+  insertNote.run(t3days[3], t3, 'SoHo and 5th Avenue shopping in the afternoon', '14:00', 'ShoppingBag', 1.5);
+  // Day 5: Free morning, departure
+  insertNote.run(t3days[4], t3, 'Flight departs JFK at 17:00 — last bagel at Russ & Daughters!', '10:00', 'Plane', 0);
+
+  // Packing
+  const t3packing = [
+    ['Passport', 1, 'Documents', 0], ['ESTA confirmation', 1, 'Documents', 1],
+    ['Travel insurance', 0, 'Documents', 2], ['Comfortable sneakers', 0, 'Clothing', 3],
+    ['Light jacket', 0, 'Clothing', 4], ['Portable charger', 0, 'Electronics', 5],
+    ['Camera', 0, 'Electronics', 6], ['Subway card (OMNY)', 0, 'Transport', 7],
+  ];
+  t3packing.forEach(p => insertPacking.run(t3, ...p));
+
+  // Budget
+  insertBudget.run(t3, 'Accommodation', 'The Plaza Hotel (4 nights)', 2400, 2, 'Park View Room');
+  insertBudget.run(t3, 'Transport', 'Flights FRA-JFK return', 850, 2, 'United Airlines');
+  insertBudget.run(t3, 'Food', 'Daily food budget', 500, 2, 'Approx. 100 USD/day');
+  insertBudget.run(t3, 'Activities', 'Statue of Liberty + Empire State + Top of the Rock + Met', 180, 2, 'CityPASS');
+  insertBudget.run(t3, 'Entertainment', 'Broadway show tickets', 300, 2, 'Hamilton or Wicked');
+
+  insertReservation.run(t3, t3days[0], 'The Plaza Hotel Check-in', '15:00', 'PZ-2026-55891', 'confirmed', 'hotel', '768 5th Ave, New York');
+  insertReservation.run(t3, t3days[0], 'Broadway Show', '20:00', 'BW-HAM-2026-1192', 'pending', 'activity', 'Richard Rodgers Theatre');
+  insertReservation.run(t3, t3days[1], 'Statue of Liberty Ferry', '08:30', 'SOL-2026-3347', 'confirmed', 'transport', 'Battery Park');
+
+  insertMember.run(t3, demoId, adminId);
+
+  console.log('[Demo] 3 example trips seeded and shared with demo user');
+}
+
+module.exports = { seedDemoData };

server/src/index.js

@@ -1,6 +1,7 @@
 require('dotenv').config();
 const express = require('express');
 const cors = require('cors');
+const helmet = require('helmet');
 const path = require('path');
 const fs = require('fs');
 
@@ -42,16 +43,11 @@ app.use(cors({
   origin: corsOrigin,
   credentials: true
 }));
-app.use(express.json());
-
-// Security headers
-app.use((req, res, next) => {
-  res.setHeader('X-Content-Type-Options', 'nosniff');
-  res.setHeader('X-Frame-Options', 'DENY');
-  res.setHeader('X-XSS-Protection', '1; mode=block');
-  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-  next();
-});
+app.use(helmet({
+  contentSecurityPolicy: false,   // managed by frontend meta tag or reverse proxy
+  crossOriginEmbedderPolicy: false, // allows loading external images (maps, etc.)
+}));
+app.use(express.json({ limit: '100kb' }));
 app.use(express.urlencoded({ extended: true }));
 
 // Serve uploaded files
@@ -76,7 +72,9 @@ const settingsRoutes = require('./routes/settings');
 const budgetRoutes = require('./routes/budget');
 const backupRoutes = require('./routes/backup');
 
+const oidcRoutes = require('./routes/oidc');
 app.use('/api/auth', authRoutes);
+app.use('/api/auth/oidc', oidcRoutes);
 app.use('/api/trips', tripsRoutes);
 app.use('/api/trips/:tripId/days', daysRoutes);
 app.use('/api/trips/:tripId/places', placesRoutes);
@@ -89,6 +87,21 @@ app.use('/api', assignmentsRoutes);
 app.use('/api/tags', tagsRoutes);
 app.use('/api/categories', categoriesRoutes);
 app.use('/api/admin', adminRoutes);
+
+// Public addons endpoint (authenticated but not admin-only)
+const { authenticate: addonAuth } = require('./middleware/auth');
+const { db: addonDb } = require('./db/database');
+app.get('/api/addons', addonAuth, (req, res) => {
+  const addons = addonDb.prepare('SELECT id, name, type, icon, enabled FROM addons WHERE enabled = 1 ORDER BY sort_order').all();
+  res.json({ addons: addons.map(a => ({ ...a, enabled: !!a.enabled })) });
+});
+
+// Addon routes
+const vacayRoutes = require('./routes/vacay');
+app.use('/api/addons/vacay', vacayRoutes);
+const atlasRoutes = require('./routes/atlas');
+app.use('/api/addons/atlas', atlasRoutes);
+
 app.use('/api/maps', mapsRoutes);
 app.use('/api/weather', weatherRoutes);
 app.use('/api/settings', settingsRoutes);
@@ -115,9 +128,32 @@ const PORT = process.env.PORT || 3001;
 const server = app.listen(PORT, () => {
   console.log(`NOMAD API running on port ${PORT}`);
   console.log(`Environment: ${process.env.NODE_ENV || 'development'}`);
+  if (process.env.DEMO_MODE === 'true') console.log('Demo mode: ENABLED');
   scheduler.start();
+  scheduler.startDemoReset();
   const { setupWebSocket } = require('./websocket');
   setupWebSocket(server);
 });
 
+// Graceful shutdown
+function shutdown(signal) {
+  console.log(`\n${signal} received — shutting down gracefully...`);
+  scheduler.stop();
+  server.close(() => {
+    console.log('HTTP server closed');
+    const { closeDb } = require('./db/database');
+    closeDb();
+    console.log('Shutdown complete');
+    process.exit(0);
+  });
+  // Force exit after 10s if connections don't close
+  setTimeout(() => {
+    console.error('Forced shutdown after timeout');
+    process.exit(1);
+  }, 10000);
+}
+
+process.on('SIGTERM', () => shutdown('SIGTERM'));
+process.on('SIGINT', () => shutdown('SIGINT'));
+
 module.exports = app;

server/src/middleware/auth.js

@@ -53,4 +53,11 @@ const adminOnly = (req, res, next) => {
   next();
 };
 
-module.exports = { authenticate, optionalAuth, adminOnly };
+const demoUploadBlock = (req, res, next) => {
+  if (process.env.DEMO_MODE === 'true' && req.user?.email === 'demo@nomad.app') {
+    return res.status(403).json({ error: 'Uploads are disabled in demo mode. Self-host NOMAD for full functionality.' });
+  }
+  next();
+};
+
+module.exports = { authenticate, optionalAuth, adminOnly, demoUploadBlock };

server/src/routes/admin.js

@@ -1,5 +1,7 @@
 const express = require('express');
 const bcrypt = require('bcryptjs');
+const { execSync } = require('child_process');
+const path = require('path');
 const { db } = require('../db/database');
 const { authenticate, adminOnly } = require('../middleware/auth');
 
@@ -11,9 +13,16 @@ router.use(authenticate, adminOnly);
 // GET /api/admin/users
 router.get('/users', (req, res) => {
   const users = db.prepare(
-    'SELECT id, username, email, role, created_at, updated_at FROM users ORDER BY created_at DESC'
+    'SELECT id, username, email, role, created_at, updated_at, last_login FROM users ORDER BY created_at DESC'
   ).all();
-  res.json({ users });
+  // Add online status from WebSocket connections
+  let onlineUserIds = new Set();
+  try {
+    const { getOnlineUserIds } = require('../websocket');
+    onlineUserIds = getOnlineUserIds();
+  } catch { /* */ }
+  const usersWithStatus = users.map(u => ({ ...u, online: onlineUserIds.has(u.id) }));
+  res.json({ users: usersWithStatus });
 });
 
 // POST /api/admin/users
@@ -104,10 +113,142 @@ router.get('/stats', (req, res) => {
   const totalUsers = db.prepare('SELECT COUNT(*) as count FROM users').get().count;
   const totalTrips = db.prepare('SELECT COUNT(*) as count FROM trips').get().count;
   const totalPlaces = db.prepare('SELECT COUNT(*) as count FROM places').get().count;
-  const totalPhotos = db.prepare('SELECT COUNT(*) as count FROM photos').get().count;
   const totalFiles = db.prepare('SELECT COUNT(*) as count FROM trip_files').get().count;
 
-  res.json({ totalUsers, totalTrips, totalPlaces, totalPhotos, totalFiles });
+  res.json({ totalUsers, totalTrips, totalPlaces, totalFiles });
+});
+
+// GET /api/admin/oidc — get OIDC config
+router.get('/oidc', (req, res) => {
+  const get = (key) => db.prepare("SELECT value FROM app_settings WHERE key = ?").get(key)?.value || '';
+  res.json({
+    issuer: get('oidc_issuer'),
+    client_id: get('oidc_client_id'),
+    client_secret: get('oidc_client_secret'),
+    display_name: get('oidc_display_name'),
+  });
+});
+
+// PUT /api/admin/oidc — update OIDC config
+router.put('/oidc', (req, res) => {
+  const { issuer, client_id, client_secret, display_name } = req.body;
+  const set = (key, val) => db.prepare("INSERT OR REPLACE INTO app_settings (key, value) VALUES (?, ?)").run(key, val || '');
+  set('oidc_issuer', issuer);
+  set('oidc_client_id', client_id);
+  set('oidc_client_secret', client_secret);
+  set('oidc_display_name', display_name);
+  res.json({ success: true });
+});
+
+// POST /api/admin/save-demo-baseline (demo mode only)
+router.post('/save-demo-baseline', (req, res) => {
+  if (process.env.DEMO_MODE !== 'true') {
+    return res.status(404).json({ error: 'Not found' });
+  }
+  try {
+    const { saveBaseline } = require('../demo/demo-reset');
+    saveBaseline();
+    res.json({ success: true, message: 'Demo baseline saved. Hourly resets will restore to this state.' });
+  } catch (err) {
+    res.status(500).json({ error: 'Failed to save baseline: ' + err.message });
+  }
+});
+
+// ── Version check ──────────────────────────────────────────
+
+// Detect if running inside Docker
+const isDocker = (() => {
+  try {
+    const fs = require('fs');
+    return fs.existsSync('/.dockerenv') || (fs.existsSync('/proc/1/cgroup') && fs.readFileSync('/proc/1/cgroup', 'utf8').includes('docker'));
+  } catch { return false }
+})();
+
+router.get('/version-check', async (req, res) => {
+  const { version: currentVersion } = require('../../package.json');
+  try {
+    const resp = await fetch(
+      'https://api.github.com/repos/mauriceboe/NOMAD/releases/latest',
+      { headers: { 'Accept': 'application/vnd.github.v3+json', 'User-Agent': 'NOMAD-Server' } }
+    );
+    if (!resp.ok) return res.json({ current: currentVersion, latest: currentVersion, update_available: false });
+    const data = await resp.json();
+    const latest = (data.tag_name || '').replace(/^v/, '');
+    const update_available = latest && latest !== currentVersion && compareVersions(latest, currentVersion) > 0;
+    res.json({ current: currentVersion, latest, update_available, release_url: data.html_url || '', is_docker: isDocker });
+  } catch {
+    res.json({ current: currentVersion, latest: currentVersion, update_available: false, is_docker: isDocker });
+  }
+});
+
+function compareVersions(a, b) {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const na = pa[i] || 0, nb = pb[i] || 0;
+    if (na > nb) return 1;
+    if (na < nb) return -1;
+  }
+  return 0;
+}
+
+// POST /api/admin/update — pull latest code, install deps, restart
+router.post('/update', async (req, res) => {
+  const rootDir = path.resolve(__dirname, '../../..');
+  const serverDir = path.resolve(__dirname, '../..');
+  const clientDir = path.join(rootDir, 'client');
+  const steps = [];
+
+  try {
+    // 1. git pull
+    const pullOutput = execSync('git pull origin main', { cwd: rootDir, timeout: 60000, encoding: 'utf8' });
+    steps.push({ step: 'git pull', success: true, output: pullOutput.trim() });
+
+    // 2. npm install server
+    execSync('npm install --production', { cwd: serverDir, timeout: 120000, encoding: 'utf8' });
+    steps.push({ step: 'npm install (server)', success: true });
+
+    // 3. npm install + build client (production only)
+    if (process.env.NODE_ENV === 'production') {
+      execSync('npm install', { cwd: clientDir, timeout: 120000, encoding: 'utf8' });
+      execSync('npm run build', { cwd: clientDir, timeout: 120000, encoding: 'utf8' });
+      steps.push({ step: 'npm install + build (client)', success: true });
+    }
+
+    // Read new version
+    delete require.cache[require.resolve('../../package.json')];
+    const { version: newVersion } = require('../../package.json');
+    steps.push({ step: 'version', version: newVersion });
+
+    // 4. Send response before restart
+    res.json({ success: true, steps, restarting: true });
+
+    // 5. Graceful restart — exit and let process manager (Docker/systemd/pm2) restart
+    setTimeout(() => {
+      console.log('[Update] Restarting after update...');
+      process.exit(0);
+    }, 1000);
+  } catch (err) {
+    steps.push({ step: 'error', success: false, output: err.message });
+    res.status(500).json({ success: false, steps });
+  }
+});
+
+// ── Addons ─────────────────────────────────────────────────
+
+router.get('/addons', (req, res) => {
+  const addons = db.prepare('SELECT * FROM addons ORDER BY sort_order, id').all();
+  res.json({ addons: addons.map(a => ({ ...a, enabled: !!a.enabled, config: JSON.parse(a.config || '{}') })) });
+});
+
+router.put('/addons/:id', (req, res) => {
+  const addon = db.prepare('SELECT * FROM addons WHERE id = ?').get(req.params.id);
+  if (!addon) return res.status(404).json({ error: 'Addon not found' });
+  const { enabled, config } = req.body;
+  if (enabled !== undefined) db.prepare('UPDATE addons SET enabled = ? WHERE id = ?').run(enabled ? 1 : 0, req.params.id);
+  if (config !== undefined) db.prepare('UPDATE addons SET config = ? WHERE id = ?').run(JSON.stringify(config), req.params.id);
+  const updated = db.prepare('SELECT * FROM addons WHERE id = ?').get(req.params.id);
+  res.json({ addon: { ...updated, enabled: !!updated.enabled, config: JSON.parse(updated.config || '{}') } });
 });
 
 module.exports = router;

server/src/routes/atlas.js

@@ -0,0 +1,254 @@
+const express = require('express');
+const { db } = require('../db/database');
+const { authenticate } = require('../middleware/auth');
+
+const router = express.Router();
+router.use(authenticate);
+
+// Country code lookup from coordinates (bounding box approach)
+// Covers most countries — not pixel-perfect but good enough for visited-country tracking
+const COUNTRY_BOXES = {
+  AF:[60.5,29.4,75,38.5],AL:[19,39.6,21.1,42.7],DZ:[-8.7,19,12,37.1],AD:[1.4,42.4,1.8,42.7],AO:[11.7,-18.1,24.1,-4.4],
+  AR:[-73.6,-55.1,-53.6,-21.8],AM:[43.4,38.8,46.6,41.3],AU:[112.9,-43.6,153.6,-10.7],AT:[9.5,46.4,17.2,49],AZ:[44.8,38.4,50.4,41.9],
+  BR:[-73.9,-33.8,-34.8,5.3],BE:[2.5,49.5,6.4,51.5],BG:[22.4,41.2,28.6,44.2],CA:[-141,41.7,-52.6,83.1],CL:[-75.6,-55.9,-66.9,-17.5],
+  CN:[73.6,18.2,134.8,53.6],CO:[-79.1,-4.3,-66.9,12.5],HR:[13.5,42.4,19.5,46.6],CZ:[12.1,48.6,18.9,51.1],DK:[8,54.6,15.2,57.8],
+  EG:[24.7,22,37,31.7],EE:[21.8,57.5,28.2,59.7],FI:[20.6,59.8,31.6,70.1],FR:[-5.1,41.3,9.6,51.1],DE:[5.9,47.3,15.1,55.1],
+  GR:[19.4,34.8,29.7,41.8],HU:[16,45.7,22.9,48.6],IS:[-24.5,63.4,-13.5,66.6],IN:[68.2,6.7,97.4,35.5],ID:[95.3,-11,141,5.9],
+  IR:[44.1,25.1,63.3,39.8],IQ:[38.8,29.1,48.6,37.4],IE:[-10.5,51.4,-6,55.4],IL:[34.3,29.5,35.9,33.3],IT:[6.6,36.6,18.5,47.1],
+  JP:[129.4,31.1,145.5,45.5],KE:[33.9,-4.7,41.9,5.5],KR:[126,33.2,129.6,38.6],LV:[21,55.7,28.2,58.1],LT:[21,53.9,26.8,56.5],
+  LU:[5.7,49.4,6.5,50.2],MY:[99.6,0.9,119.3,7.4],MX:[-118.4,14.5,-86.7,32.7],MA:[-13.2,27.7,-1,35.9],NL:[3.4,50.8,7.2,53.5],
+  NZ:[166.4,-47.3,178.5,-34.4],NO:[4.6,58,31.1,71.2],PK:[60.9,23.7,77.1,37.1],PE:[-81.3,-18.4,-68.7,-0.1],PH:[117,5,126.6,18.5],
+  PL:[14.1,49,24.1,54.9],PT:[-9.5,36.8,-6.2,42.2],RO:[20.2,43.6,29.7,48.3],RU:[19.6,41.2,180,81.9],SA:[34.6,16.4,55.7,32.2],
+  RS:[18.8,42.2,23,46.2],SK:[16.8,47.7,22.6,49.6],SI:[13.4,45.4,16.6,46.9],ZA:[16.5,-34.8,32.9,-22.1],ES:[-9.4,36,-0.2,43.8],
+  SE:[11.1,55.3,24.2,69.1],CH:[6,45.8,10.5,47.8],TH:[97.3,5.6,105.6,20.5],TR:[26,36,44.8,42.1],UA:[22.1,44.4,40.2,52.4],
+  AE:[51.6,22.6,56.4,26.1],GB:[-8,49.9,2,60.9],US:[-125,24.5,-66.9,49.4],VN:[102.1,8.6,109.5,23.4],
+};
+
+function getCountryFromCoords(lat, lng) {
+  for (const [code, [minLng, minLat, maxLng, maxLat]] of Object.entries(COUNTRY_BOXES)) {
+    if (lat >= minLat && lat <= maxLat && lng >= minLng && lng <= maxLng) {
+      return code;
+    }
+  }
+  return null;
+}
+
+function getCountryFromAddress(address) {
+  if (!address) return null;
+  // Take last segment after comma, trim
+  const parts = address.split(',').map(s => s.trim()).filter(Boolean);
+  if (parts.length === 0) return null;
+  const last = parts[parts.length - 1];
+  // Try to match known country names to codes
+  const NAME_TO_CODE = {
+    'germany':'DE','deutschland':'DE','france':'FR','frankreich':'FR','spain':'ES','spanien':'ES',
+    'italy':'IT','italien':'IT','united kingdom':'GB','uk':'GB','england':'GB','united states':'US',
+    'usa':'US','netherlands':'NL','niederlande':'NL','austria':'AT','österreich':'AT','switzerland':'CH',
+    'schweiz':'CH','portugal':'PT','greece':'GR','griechenland':'GR','turkey':'TR','türkei':'TR',
+    'croatia':'HR','kroatien':'HR','czech republic':'CZ','tschechien':'CZ','czechia':'CZ',
+    'poland':'PL','polen':'PL','sweden':'SE','schweden':'SE','norway':'NO','norwegen':'NO',
+    'denmark':'DK','dänemark':'DK','finland':'FI','finnland':'FI','belgium':'BE','belgien':'BE',
+    'ireland':'IE','irland':'IE','hungary':'HU','ungarn':'HU','romania':'RO','rumänien':'RO',
+    'bulgaria':'BG','bulgarien':'BG','japan':'JP','china':'CN','australia':'AU','australien':'AU',
+    'canada':'CA','kanada':'CA','mexico':'MX','mexiko':'MX','brazil':'BR','brasilien':'BR',
+    'argentina':'AR','argentinien':'AR','thailand':'TH','indonesia':'ID','indonesien':'ID',
+    'india':'IN','indien':'IN','egypt':'EG','ägypten':'EG','morocco':'MA','marokko':'MA',
+    'south africa':'ZA','südafrika':'ZA','new zealand':'NZ','neuseeland':'NZ','iceland':'IS','island':'IS',
+    'luxembourg':'LU','luxemburg':'LU','slovenia':'SI','slowenien':'SI','slovakia':'SK','slowakei':'SK',
+    'estonia':'EE','estland':'EE','latvia':'LV','lettland':'LV','lithuania':'LT','litauen':'LT',
+    'serbia':'RS','serbien':'RS','israel':'IL','russia':'RU','russland':'RU','ukraine':'UA',
+    'vietnam':'VN','south korea':'KR','südkorea':'KR','philippines':'PH','philippinen':'PH',
+    'malaysia':'MY','colombia':'CO','kolumbien':'CO','peru':'PE','chile':'CL','iran':'IR',
+    'iraq':'IQ','irak':'IQ','pakistan':'PK','kenya':'KE','kenia':'KE','nigeria':'NG',
+    'saudi arabia':'SA','saudi-arabien':'SA','albania':'AL','albanien':'AL',
+    '日本':'JP','中国':'CN','한국':'KR','대한민국':'KR','ไทย':'TH',
+  };
+  const normalized = last.toLowerCase();
+  if (NAME_TO_CODE[normalized]) return NAME_TO_CODE[normalized];
+  // Try original case (for non-Latin scripts like 日本)
+  if (NAME_TO_CODE[last]) return NAME_TO_CODE[last];
+  // Try 2-letter code directly
+  if (last.length === 2 && last === last.toUpperCase()) return last;
+  return null;
+}
+
+// GET /api/addons/atlas/stats
+router.get('/stats', (req, res) => {
+  const userId = req.user.id;
+
+  // Get all trips (own + shared)
+  const trips = db.prepare(`
+    SELECT DISTINCT t.* FROM trips t
+    LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ?
+    WHERE t.user_id = ? OR m.user_id = ?
+    ORDER BY t.start_date DESC
+  `).all(userId, userId, userId);
+
+  // Get all places from those trips
+  const tripIds = trips.map(t => t.id);
+  if (tripIds.length === 0) {
+    return res.json({ countries: [], trips: [], stats: { totalTrips: 0, totalPlaces: 0, totalCountries: 0, totalDays: 0 } });
+  }
+
+  const placeholders = tripIds.map(() => '?').join(',');
+  const places = db.prepare(`SELECT * FROM places WHERE trip_id IN (${placeholders})`).all(...tripIds);
+
+  // Extract countries
+  const countrySet = new Map(); // code -> { code, places: [], trips: Set }
+  for (const place of places) {
+    let code = getCountryFromAddress(place.address);
+    if (!code && place.lat && place.lng) {
+      code = getCountryFromCoords(place.lat, place.lng);
+    }
+    if (code) {
+      if (!countrySet.has(code)) {
+        countrySet.set(code, { code, places: [], tripIds: new Set() });
+      }
+      countrySet.get(code).places.push({ id: place.id, name: place.name, lat: place.lat, lng: place.lng });
+      countrySet.get(code).tripIds.add(place.trip_id);
+    }
+  }
+
+  // Calculate total days across all trips
+  let totalDays = 0;
+  for (const trip of trips) {
+    if (trip.start_date && trip.end_date) {
+      const start = new Date(trip.start_date);
+      const end = new Date(trip.end_date);
+      const diff = Math.ceil((end - start) / (1000 * 60 * 60 * 24)) + 1;
+      if (diff > 0) totalDays += diff;
+    }
+  }
+
+  const countries = [...countrySet.values()].map(c => {
+    const countryTrips = trips.filter(t => c.tripIds.has(t.id));
+    const dates = countryTrips.map(t => t.start_date).filter(Boolean).sort();
+    return {
+      code: c.code,
+      placeCount: c.places.length,
+      tripCount: c.tripIds.size,
+      firstVisit: dates[0] || null,
+      lastVisit: dates[dates.length - 1] || null,
+    };
+  });
+
+  // Unique cities (extract city from address — second to last comma segment)
+  // Strip postal codes and normalize to avoid duplicates like "Tokyo" vs "Tokyo 131-0045"
+  const citySet = new Set();
+  for (const place of places) {
+    if (place.address) {
+      const parts = place.address.split(',').map(s => s.trim()).filter(Boolean);
+      let raw = parts.length >= 2 ? parts[parts.length - 2] : parts[0];
+      if (raw) {
+        const city = raw.replace(/[\d\-−〒]+/g, '').trim().toLowerCase();
+        if (city) citySet.add(city);
+      }
+    }
+  }
+  const totalCities = citySet.size;
+
+  // Most visited country
+  const mostVisited = countries.length > 0 ? countries.reduce((a, b) => a.placeCount > b.placeCount ? a : b) : null;
+
+  // Continent breakdown
+  const CONTINENT_MAP = {
+    AF:'Africa',AL:'Europe',DZ:'Africa',AD:'Europe',AO:'Africa',AR:'South America',AM:'Asia',AU:'Oceania',AT:'Europe',AZ:'Asia',
+    BR:'South America',BE:'Europe',BG:'Europe',CA:'North America',CL:'South America',CN:'Asia',CO:'South America',HR:'Europe',CZ:'Europe',DK:'Europe',
+    EG:'Africa',EE:'Europe',FI:'Europe',FR:'Europe',DE:'Europe',GR:'Europe',HU:'Europe',IS:'Europe',IN:'Asia',ID:'Asia',
+    IR:'Asia',IQ:'Asia',IE:'Europe',IL:'Asia',IT:'Europe',JP:'Asia',KE:'Africa',KR:'Asia',LV:'Europe',LT:'Europe',
+    LU:'Europe',MY:'Asia',MX:'North America',MA:'Africa',NL:'Europe',NZ:'Oceania',NO:'Europe',PK:'Asia',PE:'South America',PH:'Asia',
+    PL:'Europe',PT:'Europe',RO:'Europe',RU:'Europe',SA:'Asia',RS:'Europe',SK:'Europe',SI:'Europe',ZA:'Africa',ES:'Europe',
+    SE:'Europe',CH:'Europe',TH:'Asia',TR:'Europe',UA:'Europe',AE:'Asia',GB:'Europe',US:'North America',VN:'Asia',NG:'Africa',
+  };
+  const continents = {};
+  countries.forEach(c => {
+    const cont = CONTINENT_MAP[c.code] || 'Other';
+    continents[cont] = (continents[cont] || 0) + 1;
+  });
+
+  // Last trip (most recent past trip)
+  const now = new Date().toISOString().split('T')[0];
+  const pastTrips = trips.filter(t => t.end_date && t.end_date <= now).sort((a, b) => b.end_date.localeCompare(a.end_date));
+  const lastTrip = pastTrips[0] ? { id: pastTrips[0].id, title: pastTrips[0].title, start_date: pastTrips[0].start_date, end_date: pastTrips[0].end_date } : null;
+  // Find country for last trip
+  if (lastTrip) {
+    const lastTripPlaces = places.filter(p => p.trip_id === lastTrip.id);
+    for (const p of lastTripPlaces) {
+      let code = getCountryFromAddress(p.address);
+      if (!code && p.lat && p.lng) code = getCountryFromCoords(p.lat, p.lng);
+      if (code) { lastTrip.countryCode = code; break; }
+    }
+  }
+
+  // Next trip (earliest future trip)
+  const futureTrips = trips.filter(t => t.start_date && t.start_date > now).sort((a, b) => a.start_date.localeCompare(b.start_date));
+  const nextTrip = futureTrips[0] ? { id: futureTrips[0].id, title: futureTrips[0].title, start_date: futureTrips[0].start_date } : null;
+  if (nextTrip) {
+    const diff = Math.ceil((new Date(nextTrip.start_date) - new Date()) / (1000 * 60 * 60 * 24));
+    nextTrip.daysUntil = Math.max(0, diff);
+  }
+
+  // Travel streak (consecutive years with at least one trip)
+  const tripYears = new Set(trips.filter(t => t.start_date).map(t => parseInt(t.start_date.split('-')[0])));
+  let streak = 0;
+  const currentYear = new Date().getFullYear();
+  for (let y = currentYear; y >= 2000; y--) {
+    if (tripYears.has(y)) streak++;
+    else break;
+  }
+  const firstYear = tripYears.size > 0 ? Math.min(...tripYears) : null;
+
+  res.json({
+    countries,
+    stats: {
+      totalTrips: trips.length,
+      totalPlaces: places.length,
+      totalCountries: countries.length,
+      totalDays,
+      totalCities,
+    },
+    mostVisited,
+    continents,
+    lastTrip,
+    nextTrip,
+    streak,
+    firstYear,
+    tripsThisYear: trips.filter(t => t.start_date && t.start_date.startsWith(String(currentYear))).length,
+  });
+});
+
+// GET /api/addons/atlas/country/:code — details for a country
+router.get('/country/:code', (req, res) => {
+  const userId = req.user.id;
+  const code = req.params.code.toUpperCase();
+
+  const trips = db.prepare(`
+    SELECT DISTINCT t.* FROM trips t
+    LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ?
+    WHERE t.user_id = ? OR m.user_id = ?
+  `).all(userId, userId, userId);
+
+  const tripIds = trips.map(t => t.id);
+  if (tripIds.length === 0) return res.json({ places: [], trips: [] });
+
+  const placeholders = tripIds.map(() => '?').join(',');
+  const places = db.prepare(`SELECT * FROM places WHERE trip_id IN (${placeholders})`).all(...tripIds);
+
+  const matchingPlaces = [];
+  const matchingTripIds = new Set();
+
+  for (const place of places) {
+    let pCode = getCountryFromAddress(place.address);
+    if (!pCode && place.lat && place.lng) pCode = getCountryFromCoords(place.lat, place.lng);
+    if (pCode === code) {
+      matchingPlaces.push({ id: place.id, name: place.name, address: place.address, lat: place.lat, lng: place.lng, trip_id: place.trip_id });
+      matchingTripIds.add(place.trip_id);
+    }
+  }
+
+  const matchingTrips = trips.filter(t => matchingTripIds.has(t.id)).map(t => ({ id: t.id, title: t.title, start_date: t.start_date, end_date: t.end_date }));
+
+  res.json({ places: matchingPlaces, trips: matchingTrips });
+});
+
+module.exports = router;

server/src/routes/auth.js

@@ -7,7 +7,7 @@ const fs = require('fs');
 const { v4: uuid } = require('uuid');
 const fetch = require('node-fetch');
 const { db } = require('../db/database');
-const { authenticate } = require('../middleware/auth');
+const { authenticate, demoUploadBlock } = require('../middleware/auth');
 
 const router = express.Router();
 const { JWT_SECRET } = require('../config');
@@ -65,7 +65,37 @@ router.get('/app-config', (req, res) => {
   const userCount = db.prepare('SELECT COUNT(*) as count FROM users').get().count;
   const setting = db.prepare("SELECT value FROM app_settings WHERE key = 'allow_registration'").get();
   const allowRegistration = userCount === 0 || (setting?.value ?? 'true') === 'true';
-  res.json({ allow_registration: allowRegistration, has_users: userCount > 0 });
+  const isDemo = process.env.DEMO_MODE === 'true';
+  const { version } = require('../../package.json');
+  const hasGoogleKey = !!db.prepare("SELECT maps_api_key FROM users WHERE role = 'admin' AND maps_api_key IS NOT NULL AND maps_api_key != '' LIMIT 1").get();
+  const oidcDisplayName = db.prepare("SELECT value FROM app_settings WHERE key = 'oidc_display_name'").get()?.value || null;
+  const oidcConfigured = !!(
+    db.prepare("SELECT value FROM app_settings WHERE key = 'oidc_issuer'").get()?.value &&
+    db.prepare("SELECT value FROM app_settings WHERE key = 'oidc_client_id'").get()?.value
+  );
+  res.json({
+    allow_registration: isDemo ? false : allowRegistration,
+    has_users: userCount > 0,
+    version,
+    has_maps_key: hasGoogleKey,
+    oidc_configured: oidcConfigured,
+    oidc_display_name: oidcConfigured ? (oidcDisplayName || 'SSO') : undefined,
+    demo_mode: isDemo,
+    demo_email: isDemo ? 'demo@nomad.app' : undefined,
+    demo_password: isDemo ? 'demo12345' : undefined,
+  });
+});
+
+// POST /api/auth/demo-login (demo mode only)
+router.post('/demo-login', (req, res) => {
+  if (process.env.DEMO_MODE !== 'true') {
+    return res.status(404).json({ error: 'Not found' });
+  }
+  const user = db.prepare('SELECT * FROM users WHERE email = ?').get('demo@nomad.app');
+  if (!user) return res.status(500).json({ error: 'Demo user not found' });
+  const token = generateToken(user);
+  const { password_hash, maps_api_key, openweather_api_key, unsplash_api_key, ...safe } = user;
+  res.json({ token, user: { ...safe, avatar_url: avatarUrl(user) } });
 });
 
 // POST /api/auth/register
@@ -137,6 +167,7 @@ router.post('/login', authLimiter, (req, res) => {
     return res.status(401).json({ error: 'Ungültige E-Mail oder Passwort' });
   }
 
+  db.prepare('UPDATE users SET last_login = CURRENT_TIMESTAMP WHERE id = ?').run(user.id);
   const token = generateToken(user);
   const { password_hash, maps_api_key, openweather_api_key, unsplash_api_key, ...userWithoutSensitive } = user;
 
@@ -146,7 +177,7 @@ router.post('/login', authLimiter, (req, res) => {
 // GET /api/auth/me
 router.get('/me', authenticate, (req, res) => {
   const user = db.prepare(
-    'SELECT id, username, email, role, avatar, created_at FROM users WHERE id = ?'
+    'SELECT id, username, email, role, avatar, oidc_issuer, created_at FROM users WHERE id = ?'
   ).get(req.user.id);
 
   if (!user) {
@@ -156,6 +187,37 @@ router.get('/me', authenticate, (req, res) => {
   res.json({ user: { ...user, avatar_url: avatarUrl(user) } });
 });
 
+// PUT /api/auth/me/password
+router.put('/me/password', authenticate, (req, res) => {
+  if (process.env.DEMO_MODE === 'true' && req.user.email === 'demo@nomad.app') {
+    return res.status(403).json({ error: 'Password change is disabled in demo mode.' });
+  }
+  const { new_password } = req.body;
+  if (!new_password) return res.status(400).json({ error: 'New password is required' });
+  if (new_password.length < 8) return res.status(400).json({ error: 'Password must be at least 8 characters' });
+
+  const hash = bcrypt.hashSync(new_password, 10);
+  db.prepare('UPDATE users SET password_hash = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?').run(hash, req.user.id);
+  res.json({ success: true });
+});
+
+// DELETE /api/auth/me — delete own account
+router.delete('/me', authenticate, (req, res) => {
+  // Block demo user
+  if (process.env.DEMO_MODE === 'true' && req.user.email === 'demo@nomad.app') {
+    return res.status(403).json({ error: 'Account deletion is disabled in demo mode.' });
+  }
+  // Prevent deleting last admin
+  if (req.user.role === 'admin') {
+    const adminCount = db.prepare("SELECT COUNT(*) as count FROM users WHERE role = 'admin'").get().count;
+    if (adminCount <= 1) {
+      return res.status(400).json({ error: 'Cannot delete the last admin account' });
+    }
+  }
+  db.prepare('DELETE FROM users WHERE id = ?').run(req.user.id);
+  res.json({ success: true });
+});
+
 // PUT /api/auth/me/maps-key
 router.put('/me/maps-key', authenticate, (req, res) => {
   const { maps_api_key } = req.body;
@@ -222,7 +284,7 @@ router.get('/me/settings', authenticate, (req, res) => {
 });
 
 // POST /api/auth/avatar — upload avatar
-router.post('/avatar', authenticate, avatarUpload.single('avatar'), (req, res) => {
+router.post('/avatar', authenticate, demoUploadBlock, avatarUpload.single('avatar'), (req, res) => {
   if (!req.file) return res.status(400).json({ error: 'No image uploaded' });
 
   const current = db.prepare('SELECT avatar FROM users WHERE id = ?').get(req.user.id);
@@ -331,7 +393,7 @@ router.get('/travel-stats', authenticate, (req, res) => {
     SELECT COUNT(DISTINCT t.id) as trips,
            COUNT(DISTINCT d.id) as days
     FROM trips t
-    LEFT JOIN days d ON t.id = d.id
+    LEFT JOIN days d ON d.trip_id = t.id
     LEFT JOIN trip_members tm ON t.id = tm.trip_id
     WHERE (t.user_id = ? OR tm.user_id = ?) AND t.is_archived = 0
   `).get(userId, userId);

server/src/routes/backup.js

@@ -138,25 +138,37 @@ async function restoreFromZip(zipPath, res) {
     // Step 1: close DB connection BEFORE touching the file (required on Windows)
     closeDb();
 
-    // Step 2: remove WAL/SHM and overwrite DB file
-    const dbDest = path.join(dataDir, 'travel.db');
-    for (const ext of ['', '-wal', '-shm']) {
-      try { fs.unlinkSync(dbDest + ext); } catch (e) {}
-    }
-    fs.copyFileSync(extractedDb, dbDest);
+    try {
+      // Step 2: remove WAL/SHM and overwrite DB file
+      const dbDest = path.join(dataDir, 'travel.db');
+      for (const ext of ['', '-wal', '-shm']) {
+        try { fs.unlinkSync(dbDest + ext); } catch (e) {}
+      }
+      fs.copyFileSync(extractedDb, dbDest);
 
-    // Step 3: restore uploads
-    const extractedUploads = path.join(extractDir, 'uploads');
-    if (fs.existsSync(extractedUploads)) {
-      if (fs.existsSync(uploadsDir)) fs.rmSync(uploadsDir, { recursive: true, force: true });
-      fs.cpSync(extractedUploads, uploadsDir, { recursive: true });
+      // Step 3: restore uploads — overwrite in-place instead of rmSync
+      // (rmSync fails with EBUSY because express.static holds the directory)
+      const extractedUploads = path.join(extractDir, 'uploads');
+      if (fs.existsSync(extractedUploads)) {
+        // Clear contents of each subdirectory without removing the root uploads dir
+        for (const sub of fs.readdirSync(uploadsDir)) {
+          const subPath = path.join(uploadsDir, sub);
+          if (fs.statSync(subPath).isDirectory()) {
+            for (const file of fs.readdirSync(subPath)) {
+              try { fs.unlinkSync(path.join(subPath, file)); } catch (e) {}
+            }
+          }
+        }
+        // Copy restored files over
+        fs.cpSync(extractedUploads, uploadsDir, { recursive: true, force: true });
+      }
+    } finally {
+      // Step 4: ALWAYS reopen DB — even if file copy failed, so the server stays functional
+      reinitialize();
     }
 
     fs.rmSync(extractDir, { recursive: true, force: true });
 
-    // Step 4: reopen DB with restored data
-    reinitialize();
-
     res.json({ success: true });
   } catch (err) {
     console.error('Restore error:', err);

server/src/routes/files.js

@@ -4,7 +4,7 @@ const path = require('path');
 const fs = require('fs');
 const { v4: uuidv4 } = require('uuid');
 const { db, canAccessTrip } = require('../db/database');
-const { authenticate } = require('../middleware/auth');
+const { authenticate, demoUploadBlock } = require('../middleware/auth');
 const { broadcast } = require('../websocket');
 
 const router = express.Router({ mergeParams: true });
@@ -35,6 +35,11 @@ const upload = multer({
       'text/plain',
       'text/csv',
     ];
+    const ext = path.extname(file.originalname).toLowerCase();
+    const blockedExts = ['.svg', '.html', '.htm', '.xml'];
+    if (blockedExts.includes(ext) || file.mimetype.includes('svg')) {
+      return cb(new Error('File type not allowed'));
+    }
     if (allowed.includes(file.mimetype) || file.mimetype.startsWith('image/')) {
       cb(null, true);
     } else {
@@ -72,7 +77,7 @@ router.get('/', authenticate, (req, res) => {
 });
 
 // POST /api/trips/:tripId/files
-router.post('/', authenticate, upload.single('file'), (req, res) => {
+router.post('/', authenticate, demoUploadBlock, upload.single('file'), (req, res) => {
   const { tripId } = req.params;
   const { place_id, description, reservation_id } = req.body;
 

server/src/routes/maps.js

@@ -17,6 +17,34 @@ function getMapsKey(userId) {
 const photoCache = new Map();
 const PHOTO_TTL = 12 * 60 * 60 * 1000; // 12 hours
 
+// Nominatim search (OpenStreetMap) — free fallback when no Google API key
+async function searchNominatim(query, lang) {
+  const params = new URLSearchParams({
+    q: query,
+    format: 'json',
+    addressdetails: '1',
+    limit: '10',
+    'accept-language': lang || 'en',
+  });
+  const response = await fetch(`https://nominatim.openstreetmap.org/search?${params}`, {
+    headers: { 'User-Agent': 'NOMAD Travel Planner (https://github.com/mauriceboe/NOMAD)' },
+  });
+  if (!response.ok) throw new Error('Nominatim API error');
+  const data = await response.json();
+  return data.map(item => ({
+    google_place_id: null,
+    osm_id: `${item.osm_type}/${item.osm_id}`,
+    name: item.name || item.display_name?.split(',')[0] || '',
+    address: item.display_name || '',
+    lat: parseFloat(item.lat) || null,
+    lng: parseFloat(item.lon) || null,
+    rating: null,
+    website: null,
+    phone: null,
+    source: 'openstreetmap',
+  }));
+}
+
 // POST /api/maps/search
 router.post('/search', authenticate, async (req, res) => {
   const { query } = req.body;
@@ -24,8 +52,16 @@ router.post('/search', authenticate, async (req, res) => {
   if (!query) return res.status(400).json({ error: 'Suchanfrage ist erforderlich' });
 
   const apiKey = getMapsKey(req.user.id);
+
+  // No Google API key → use Nominatim (OpenStreetMap)
   if (!apiKey) {
-    return res.status(400).json({ error: 'Google Maps API-Schlüssel nicht konfiguriert. Bitte in den Einstellungen hinzufügen.' });
+    try {
+      const places = await searchNominatim(query, req.query.lang);
+      return res.json({ places, source: 'openstreetmap' });
+    } catch (err) {
+      console.error('Nominatim search error:', err);
+      return res.status(500).json({ error: 'Fehler bei der OpenStreetMap Suche' });
+    }
   }
 
   try {
@@ -54,9 +90,10 @@ router.post('/search', authenticate, async (req, res) => {
       rating: p.rating || null,
       website: p.websiteUri || null,
       phone: p.nationalPhoneNumber || null,
+      source: 'google',
     }));
 
-    res.json({ places });
+    res.json({ places, source: 'google' });
   } catch (err) {
     console.error('Maps search error:', err);
     res.status(500).json({ error: 'Fehler bei der Google Places Suche' });

server/src/routes/oidc.js

@@ -0,0 +1,206 @@
+const express = require('express');
+const crypto = require('crypto');
+const fetch = require('node-fetch');
+const jwt = require('jsonwebtoken');
+const { db } = require('../db/database');
+const { JWT_SECRET } = require('../config');
+
+const router = express.Router();
+
+// In-memory state store for CSRF protection (state → { createdAt, redirectUri })
+const pendingStates = new Map();
+const STATE_TTL = 5 * 60 * 1000; // 5 minutes
+
+// Cleanup expired states periodically
+setInterval(() => {
+  const now = Date.now();
+  for (const [state, data] of pendingStates) {
+    if (now - data.createdAt > STATE_TTL) pendingStates.delete(state);
+  }
+}, 60 * 1000);
+
+// Read OIDC config from app_settings
+function getOidcConfig() {
+  const get = (key) => db.prepare("SELECT value FROM app_settings WHERE key = ?").get(key)?.value || null;
+  const issuer = get('oidc_issuer');
+  const clientId = get('oidc_client_id');
+  const clientSecret = get('oidc_client_secret');
+  const displayName = get('oidc_display_name') || 'SSO';
+  if (!issuer || !clientId || !clientSecret) return null;
+  return { issuer: issuer.replace(/\/+$/, ''), clientId, clientSecret, displayName };
+}
+
+// Cache discovery document
+let discoveryCache = null;
+let discoveryCacheTime = 0;
+const DISCOVERY_TTL = 60 * 60 * 1000; // 1 hour
+
+async function discover(issuer) {
+  if (discoveryCache && Date.now() - discoveryCacheTime < DISCOVERY_TTL && discoveryCache._issuer === issuer) {
+    return discoveryCache;
+  }
+  const res = await fetch(`${issuer}/.well-known/openid-configuration`);
+  if (!res.ok) throw new Error('Failed to fetch OIDC discovery document');
+  const doc = await res.json();
+  doc._issuer = issuer;
+  discoveryCache = doc;
+  discoveryCacheTime = Date.now();
+  return doc;
+}
+
+function generateToken(user) {
+  return jwt.sign(
+    { id: user.id, username: user.username, email: user.email, role: user.role },
+    JWT_SECRET,
+    { expiresIn: '24h' }
+  );
+}
+
+function frontendUrl(path) {
+  const base = process.env.NODE_ENV === 'production' ? '' : 'http://localhost:5173';
+  return base + path;
+}
+
+// GET /api/auth/oidc/login — redirect to OIDC provider
+router.get('/login', async (req, res) => {
+  const config = getOidcConfig();
+  if (!config) return res.status(400).json({ error: 'OIDC not configured' });
+
+  try {
+    const doc = await discover(config.issuer);
+    const state = crypto.randomBytes(32).toString('hex');
+    const proto = req.headers['x-forwarded-proto'] || req.protocol;
+    const host = req.headers['x-forwarded-host'] || req.headers.host;
+    const redirectUri = `${proto}://${host}/api/auth/oidc/callback`;
+
+    pendingStates.set(state, { createdAt: Date.now(), redirectUri });
+
+    const params = new URLSearchParams({
+      response_type: 'code',
+      client_id: config.clientId,
+      redirect_uri: redirectUri,
+      scope: 'openid email profile',
+      state,
+    });
+
+    res.redirect(`${doc.authorization_endpoint}?${params}`);
+  } catch (err) {
+    console.error('[OIDC] Login error:', err.message);
+    res.status(500).json({ error: 'OIDC login failed' });
+  }
+});
+
+// GET /api/auth/oidc/callback — handle provider callback
+router.get('/callback', async (req, res) => {
+  const { code, state, error: oidcError } = req.query;
+
+  if (oidcError) {
+    console.error('[OIDC] Provider error:', oidcError);
+    return res.redirect(frontendUrl('/login?oidc_error=' + encodeURIComponent(oidcError)));
+  }
+
+  if (!code || !state) {
+    return res.redirect(frontendUrl('/login?oidc_error=missing_params'));
+  }
+
+  const pending = pendingStates.get(state);
+  if (!pending) {
+    return res.redirect(frontendUrl('/login?oidc_error=invalid_state'));
+  }
+  pendingStates.delete(state);
+
+  const config = getOidcConfig();
+  if (!config) return res.redirect(frontendUrl('/login?oidc_error=not_configured'));
+
+  try {
+    const doc = await discover(config.issuer);
+
+    // Exchange code for tokens
+    const tokenRes = await fetch(doc.token_endpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: pending.redirectUri,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+      }),
+    });
+
+    const tokenData = await tokenRes.json();
+    if (!tokenRes.ok || !tokenData.access_token) {
+      console.error('[OIDC] Token exchange failed:', tokenData);
+      return res.redirect(frontendUrl('/login?oidc_error=token_failed'));
+    }
+
+    // Get user info
+    const userInfoRes = await fetch(doc.userinfo_endpoint, {
+      headers: { Authorization: `Bearer ${tokenData.access_token}` },
+    });
+    const userInfo = await userInfoRes.json();
+
+    if (!userInfo.email) {
+      return res.redirect(frontendUrl('/login?oidc_error=no_email'));
+    }
+
+    const email = userInfo.email.toLowerCase();
+    const name = userInfo.name || userInfo.preferred_username || email.split('@')[0];
+    const sub = userInfo.sub;
+
+    // Find existing user by OIDC sub or email
+    let user = db.prepare('SELECT * FROM users WHERE oidc_sub = ? AND oidc_issuer = ?').get(sub, config.issuer);
+    if (!user) {
+      user = db.prepare('SELECT * FROM users WHERE LOWER(email) = ?').get(email);
+    }
+
+    if (user) {
+      // Existing user — link OIDC if not already linked
+      if (!user.oidc_sub) {
+        db.prepare('UPDATE users SET oidc_sub = ?, oidc_issuer = ? WHERE id = ?').run(sub, config.issuer, user.id);
+      }
+    } else {
+      // New user — check if registration is allowed
+      const userCount = db.prepare('SELECT COUNT(*) as count FROM users').get().count;
+      const isFirstUser = userCount === 0;
+
+      if (!isFirstUser) {
+        const setting = db.prepare("SELECT value FROM app_settings WHERE key = 'allow_registration'").get();
+        if (setting?.value === 'false') {
+          return res.redirect(frontendUrl('/login?oidc_error=registration_disabled'));
+        }
+      }
+
+      // Create user (first user = admin)
+      const role = isFirstUser ? 'admin' : 'user';
+      // Generate a random password hash (user won't use password login)
+      const randomPass = crypto.randomBytes(32).toString('hex');
+      const bcrypt = require('bcryptjs');
+      const hash = bcrypt.hashSync(randomPass, 10);
+
+      // Ensure unique username
+      let username = name.replace(/[^a-zA-Z0-9_-]/g, '').substring(0, 30) || 'user';
+      const existing = db.prepare('SELECT id FROM users WHERE LOWER(username) = LOWER(?)').get(username);
+      if (existing) username = `${username}_${Date.now() % 10000}`;
+
+      const result = db.prepare(
+        'INSERT INTO users (username, email, password_hash, role, oidc_sub, oidc_issuer) VALUES (?, ?, ?, ?, ?, ?)'
+      ).run(username, email, hash, role, sub, config.issuer);
+
+      user = { id: Number(result.lastInsertRowid), username, email, role };
+    }
+
+    // Update last login
+    db.prepare('UPDATE users SET last_login = CURRENT_TIMESTAMP WHERE id = ?').run(user.id);
+
+    // Generate JWT and redirect to frontend
+    const token = generateToken(user);
+    // In dev mode, frontend runs on a different port
+    res.redirect(frontendUrl(`/login#token=${token}`));
+  } catch (err) {
+    console.error('[OIDC] Callback error:', err);
+    res.redirect(frontendUrl('/login?oidc_error=server_error'));
+  }
+});
+
+module.exports = router;

server/src/routes/photos.js

@@ -4,7 +4,7 @@ const path = require('path');
 const fs = require('fs');
 const { v4: uuidv4 } = require('uuid');
 const { db, canAccessTrip } = require('../db/database');
-const { authenticate } = require('../middleware/auth');
+const { authenticate, demoUploadBlock } = require('../middleware/auth');
 
 const router = express.Router({ mergeParams: true });
 
@@ -25,10 +25,12 @@ const upload = multer({
   storage,
   limits: { fileSize: 10 * 1024 * 1024 }, // 10MB
   fileFilter: (req, file, cb) => {
-    if (file.mimetype.startsWith('image/')) {
+    const ext = path.extname(file.originalname).toLowerCase();
+    const allowedExts = ['.jpg', '.jpeg', '.png', '.gif', '.webp'];
+    if (file.mimetype.startsWith('image/') && !file.mimetype.includes('svg') && allowedExts.includes(ext)) {
       cb(null, true);
     } else {
-      cb(new Error('Nur Bilddateien sind erlaubt'));
+      cb(new Error('Only jpg, png, gif, webp images allowed'));
     }
   },
 });
@@ -68,7 +70,7 @@ router.get('/', authenticate, (req, res) => {
 });
 
 // POST /api/trips/:tripId/photos
-router.post('/', authenticate, upload.array('photos', 20), (req, res) => {
+router.post('/', authenticate, demoUploadBlock, upload.array('photos', 20), (req, res) => {
   const { tripId } = req.params;
   const { day_id, place_id, caption } = req.body;
 

server/src/routes/trips.js

@@ -4,7 +4,7 @@ const path = require('path');
 const fs = require('fs');
 const { v4: uuidv4 } = require('uuid');
 const { db, canAccessTrip, isOwner } = require('../db/database');
-const { authenticate } = require('../middleware/auth');
+const { authenticate, demoUploadBlock } = require('../middleware/auth');
 const { broadcast } = require('../websocket');
 
 const router = express.Router();
@@ -24,8 +24,13 @@ const uploadCover = multer({
   storage: coverStorage,
   limits: { fileSize: 20 * 1024 * 1024 },
   fileFilter: (req, file, cb) => {
-    if (file.mimetype.startsWith('image/')) cb(null, true);
-    else cb(new Error('Nur Bilder erlaubt'));
+    const ext = path.extname(file.originalname).toLowerCase();
+    const allowedExts = ['.jpg', '.jpeg', '.png', '.gif', '.webp'];
+    if (file.mimetype.startsWith('image/') && !file.mimetype.includes('svg') && allowedExts.includes(ext)) {
+      cb(null, true);
+    } else {
+      cb(new Error('Only jpg, png, gif, webp images allowed'));
+    }
   },
 });
 
@@ -139,7 +144,7 @@ router.put('/:id', authenticate, (req, res) => {
 });
 
 // POST /api/trips/:id/cover
-router.post('/:id/cover', authenticate, uploadCover.single('cover'), (req, res) => {
+router.post('/:id/cover', authenticate, demoUploadBlock, uploadCover.single('cover'), (req, res) => {
   if (!isOwner(req.params.id, req.user.id))
     return res.status(403).json({ error: 'Nur der Eigentümer kann das Titelbild ändern' });
 

server/src/routes/vacay.js

@@ -0,0 +1,582 @@
+const express = require('express');
+const { db } = require('../db/database');
+const { authenticate } = require('../middleware/auth');
+
+// In-memory cache for holiday API results (key: "year-country", ttl: 24h)
+const holidayCache = new Map();
+const CACHE_TTL = 24 * 60 * 60 * 1000;
+
+const router = express.Router();
+router.use(authenticate);
+
+// Broadcast vacay updates to all users in the same plan
+function notifyPlanUsers(planId, excludeUserId, event = 'vacay:update') {
+  try {
+    const { broadcastToUser } = require('../websocket');
+    const plan = db.prepare('SELECT owner_id FROM vacay_plans WHERE id = ?').get(planId);
+    if (!plan) return;
+    const userIds = [plan.owner_id];
+    const members = db.prepare("SELECT user_id FROM vacay_plan_members WHERE plan_id = ? AND status = 'accepted'").all(planId);
+    members.forEach(m => userIds.push(m.user_id));
+    userIds.filter(id => id !== excludeUserId).forEach(id => broadcastToUser(id, { type: event }));
+  } catch { /* */ }
+}
+
+// ── Helpers ────────────────────────────────────────────────
+
+// Get or create the user's own plan
+function getOwnPlan(userId) {
+  let plan = db.prepare('SELECT * FROM vacay_plans WHERE owner_id = ?').get(userId);
+  if (!plan) {
+    db.prepare('INSERT INTO vacay_plans (owner_id) VALUES (?)').run(userId);
+    plan = db.prepare('SELECT * FROM vacay_plans WHERE owner_id = ?').get(userId);
+    const yr = new Date().getFullYear();
+    db.prepare('INSERT OR IGNORE INTO vacay_years (plan_id, year) VALUES (?, ?)').run(plan.id, yr);
+    // Create user config for current year
+    db.prepare('INSERT OR IGNORE INTO vacay_user_years (user_id, plan_id, year, vacation_days, carried_over) VALUES (?, ?, ?, 30, 0)').run(userId, plan.id, yr);
+  }
+  return plan;
+}
+
+// Get the plan the user is currently part of (own or fused)
+function getActivePlan(userId) {
+  // Check if user has accepted a fusion
+  const membership = db.prepare(`
+    SELECT plan_id FROM vacay_plan_members WHERE user_id = ? AND status = 'accepted'
+  `).get(userId);
+  if (membership) {
+    return db.prepare('SELECT * FROM vacay_plans WHERE id = ?').get(membership.plan_id);
+  }
+  return getOwnPlan(userId);
+}
+
+function getActivePlanId(userId) {
+  return getActivePlan(userId).id;
+}
+
+// Get all users in a plan (owner + accepted members)
+function getPlanUsers(planId) {
+  const plan = db.prepare('SELECT * FROM vacay_plans WHERE id = ?').get(planId);
+  if (!plan) return [];
+  const owner = db.prepare('SELECT id, username, email FROM users WHERE id = ?').get(plan.owner_id);
+  const members = db.prepare(`
+    SELECT u.id, u.username, u.email FROM vacay_plan_members m
+    JOIN users u ON m.user_id = u.id
+    WHERE m.plan_id = ? AND m.status = 'accepted'
+  `).all(planId);
+  return [owner, ...members];
+}
+
+// ── Plan ───────────────────────────────────────────────────
+
+router.get('/plan', (req, res) => {
+  const plan = getActivePlan(req.user.id);
+  const activePlanId = plan.id;
+
+  // Get user colors
+  const users = getPlanUsers(activePlanId).map(u => {
+    const colorRow = db.prepare('SELECT color FROM vacay_user_colors WHERE user_id = ? AND plan_id = ?').get(u.id, activePlanId);
+    return { ...u, color: colorRow?.color || '#6366f1' };
+  });
+
+  // Pending invites (sent from this plan)
+  const pendingInvites = db.prepare(`
+    SELECT m.id, m.user_id, u.username, u.email, m.created_at
+    FROM vacay_plan_members m JOIN users u ON m.user_id = u.id
+    WHERE m.plan_id = ? AND m.status = 'pending'
+  `).all(activePlanId);
+
+  // Pending invites FOR this user (from others)
+  const incomingInvites = db.prepare(`
+    SELECT m.id, m.plan_id, u.username, u.email, m.created_at
+    FROM vacay_plan_members m
+    JOIN vacay_plans p ON m.plan_id = p.id
+    JOIN users u ON p.owner_id = u.id
+    WHERE m.user_id = ? AND m.status = 'pending'
+  `).all(req.user.id);
+
+  res.json({
+    plan: {
+      ...plan,
+      block_weekends: !!plan.block_weekends,
+      holidays_enabled: !!plan.holidays_enabled,
+      company_holidays_enabled: !!plan.company_holidays_enabled,
+      carry_over_enabled: !!plan.carry_over_enabled,
+    },
+    users,
+    pendingInvites,
+    incomingInvites,
+    isOwner: plan.owner_id === req.user.id,
+    isFused: users.length > 1,
+  });
+});
+
+router.put('/plan', async (req, res) => {
+  const planId = getActivePlanId(req.user.id);
+  const { block_weekends, holidays_enabled, holidays_region, company_holidays_enabled, carry_over_enabled } = req.body;
+
+  const updates = [];
+  const params = [];
+  if (block_weekends !== undefined) { updates.push('block_weekends = ?'); params.push(block_weekends ? 1 : 0); }
+  if (holidays_enabled !== undefined) { updates.push('holidays_enabled = ?'); params.push(holidays_enabled ? 1 : 0); }
+  if (holidays_region !== undefined) { updates.push('holidays_region = ?'); params.push(holidays_region); }
+  if (company_holidays_enabled !== undefined) { updates.push('company_holidays_enabled = ?'); params.push(company_holidays_enabled ? 1 : 0); }
+
+  if (carry_over_enabled !== undefined) { updates.push('carry_over_enabled = ?'); params.push(carry_over_enabled ? 1 : 0); }
+
+  if (updates.length > 0) {
+    params.push(planId);
+    db.prepare(`UPDATE vacay_plans SET ${updates.join(', ')} WHERE id = ?`).run(...params);
+  }
+
+  // If company holidays re-enabled, remove vacation entries that overlap with company holidays
+  if (company_holidays_enabled === true) {
+    const companyDates = db.prepare('SELECT date FROM vacay_company_holidays WHERE plan_id = ?').all(planId);
+    for (const { date } of companyDates) {
+      db.prepare('DELETE FROM vacay_entries WHERE plan_id = ? AND date = ?').run(planId, date);
+    }
+  }
+
+  // If public holidays enabled (or region changed), remove vacation entries that land on holidays
+  // Only if a full region is selected (for countries that require it)
+  const updatedPlan = db.prepare('SELECT * FROM vacay_plans WHERE id = ?').get(planId);
+  if (updatedPlan.holidays_enabled && updatedPlan.holidays_region) {
+    const country = updatedPlan.holidays_region.split('-')[0];
+    const region = updatedPlan.holidays_region.includes('-') ? updatedPlan.holidays_region : null;
+    const years = db.prepare('SELECT year FROM vacay_years WHERE plan_id = ?').all(planId);
+    for (const { year } of years) {
+      try {
+        const cacheKey = `${year}-${country}`;
+        let holidays = holidayCache.get(cacheKey)?.data;
+        if (!holidays) {
+          const resp = await fetch(`https://date.nager.at/api/v3/PublicHolidays/${year}/${country}`);
+          holidays = await resp.json();
+          holidayCache.set(cacheKey, { data: holidays, time: Date.now() });
+        }
+        const hasRegions = holidays.some(h => h.counties && h.counties.length > 0);
+        // If country has regions but no region selected, skip cleanup
+        if (hasRegions && !region) continue;
+        for (const h of holidays) {
+          if (h.global || !h.counties || (region && h.counties.includes(region))) {
+            db.prepare('DELETE FROM vacay_entries WHERE plan_id = ? AND date = ?').run(planId, h.date);
+            db.prepare('DELETE FROM vacay_company_holidays WHERE plan_id = ? AND date = ?').run(planId, h.date);
+          }
+        }
+      } catch { /* API error, skip */ }
+    }
+  }
+
+  // If carry-over was just disabled, reset all carried_over values to 0
+  if (carry_over_enabled === false) {
+    db.prepare('UPDATE vacay_user_years SET carried_over = 0 WHERE plan_id = ?').run(planId);
+  }
+
+  // If carry-over was just enabled, recalculate all years
+  if (carry_over_enabled === true) {
+    const years = db.prepare('SELECT year FROM vacay_years WHERE plan_id = ? ORDER BY year').all(planId);
+    const users = getPlanUsers(planId);
+    for (let i = 0; i < years.length - 1; i++) {
+      const yr = years[i].year;
+      const nextYr = years[i + 1].year;
+      for (const u of users) {
+        const used = db.prepare("SELECT COUNT(*) as count FROM vacay_entries WHERE user_id = ? AND plan_id = ? AND date LIKE ?").get(u.id, planId, `${yr}-%`).count;
+        const config = db.prepare('SELECT * FROM vacay_user_years WHERE user_id = ? AND plan_id = ? AND year = ?').get(u.id, planId, yr);
+        const total = (config ? config.vacation_days : 30) + (config ? config.carried_over : 0);
+        const carry = Math.max(0, total - used);
+        db.prepare(`
+          INSERT INTO vacay_user_years (user_id, plan_id, year, vacation_days, carried_over) VALUES (?, ?, ?, 30, ?)
+          ON CONFLICT(user_id, plan_id, year) DO UPDATE SET carried_over = ?
+        `).run(u.id, planId, nextYr, carry, carry);
+      }
+    }
+  }
+
+  notifyPlanUsers(planId, req.user.id, 'vacay:settings');
+
+  const updated = db.prepare('SELECT * FROM vacay_plans WHERE id = ?').get(planId);
+  res.json({
+    plan: { ...updated, block_weekends: !!updated.block_weekends, holidays_enabled: !!updated.holidays_enabled, company_holidays_enabled: !!updated.company_holidays_enabled, carry_over_enabled: !!updated.carry_over_enabled }
+  });
+});
+
+// ── User color ─────────────────────────────────────────────
+
+router.put('/color', (req, res) => {
+  const { color, target_user_id } = req.body;
+  const planId = getActivePlanId(req.user.id);
+  const userId = target_user_id ? parseInt(target_user_id) : req.user.id;
+  const planUsers = getPlanUsers(planId);
+  if (!planUsers.find(u => u.id === userId)) {
+    return res.status(403).json({ error: 'User not in plan' });
+  }
+  db.prepare(`
+    INSERT INTO vacay_user_colors (user_id, plan_id, color) VALUES (?, ?, ?)
+    ON CONFLICT(user_id, plan_id) DO UPDATE SET color = excluded.color
+  `).run(userId, planId, color || '#6366f1');
+  notifyPlanUsers(planId, req.user.id, 'vacay:update');
+  res.json({ success: true });
+});
+
+// ── Invite / Accept / Decline / Dissolve ───────────────────
+
+// Invite a user
+router.post('/invite', (req, res) => {
+  const { user_id } = req.body;
+  if (!user_id) return res.status(400).json({ error: 'user_id required' });
+  if (user_id === req.user.id) return res.status(400).json({ error: 'Cannot invite yourself' });
+
+  const targetUser = db.prepare('SELECT id, username FROM users WHERE id = ?').get(user_id);
+  if (!targetUser) return res.status(404).json({ error: 'User not found' });
+
+  const plan = getActivePlan(req.user.id);
+
+  // Check if already invited or member
+  const existing = db.prepare('SELECT id, status FROM vacay_plan_members WHERE plan_id = ? AND user_id = ?').get(plan.id, user_id);
+  if (existing) {
+    if (existing.status === 'accepted') return res.status(400).json({ error: 'Already fused' });
+    if (existing.status === 'pending') return res.status(400).json({ error: 'Invite already pending' });
+  }
+
+  // Check if target user is already fused with someone else
+  const targetFusion = db.prepare("SELECT id FROM vacay_plan_members WHERE user_id = ? AND status = 'accepted'").get(user_id);
+  if (targetFusion) return res.status(400).json({ error: 'User is already fused with another plan' });
+
+  db.prepare('INSERT INTO vacay_plan_members (plan_id, user_id, status) VALUES (?, ?, ?)').run(plan.id, user_id, 'pending');
+
+  // Broadcast via WebSocket if available
+  try {
+    const { broadcastToUser } = require('../websocket');
+    broadcastToUser(user_id, {
+      type: 'vacay:invite',
+      from: { id: req.user.id, username: req.user.username },
+      planId: plan.id,
+    });
+  } catch { /* websocket not available */ }
+
+  res.json({ success: true });
+});
+
+// Accept invite
+router.post('/invite/accept', (req, res) => {
+  const { plan_id } = req.body;
+  const invite = db.prepare("SELECT * FROM vacay_plan_members WHERE plan_id = ? AND user_id = ? AND status = 'pending'").get(plan_id, req.user.id);
+  if (!invite) return res.status(404).json({ error: 'No pending invite' });
+
+  // Accept
+  db.prepare("UPDATE vacay_plan_members SET status = 'accepted' WHERE id = ?").run(invite.id);
+
+  // Migrate user's own entries into the fused plan
+  const ownPlan = db.prepare('SELECT id FROM vacay_plans WHERE owner_id = ?').get(req.user.id);
+  if (ownPlan && ownPlan.id !== plan_id) {
+    // Move entries
+    db.prepare('UPDATE vacay_entries SET plan_id = ? WHERE plan_id = ? AND user_id = ?').run(plan_id, ownPlan.id, req.user.id);
+    // Copy year configs
+    const ownYears = db.prepare('SELECT * FROM vacay_user_years WHERE user_id = ? AND plan_id = ?').all(req.user.id, ownPlan.id);
+    for (const y of ownYears) {
+      db.prepare('INSERT OR IGNORE INTO vacay_user_years (user_id, plan_id, year, vacation_days, carried_over) VALUES (?, ?, ?, ?, ?)').run(req.user.id, plan_id, y.year, y.vacation_days, y.carried_over);
+    }
+    // Copy color
+    const colorRow = db.prepare('SELECT color FROM vacay_user_colors WHERE user_id = ? AND plan_id = ?').get(req.user.id, ownPlan.id);
+    if (colorRow) {
+      db.prepare('INSERT OR IGNORE INTO vacay_user_colors (user_id, plan_id, color) VALUES (?, ?, ?)').run(req.user.id, plan_id, colorRow.color);
+    }
+  }
+
+  // Auto-change color if it collides with existing plan users
+  const COLORS = ['#6366f1','#ec4899','#14b8a6','#8b5cf6','#ef4444','#3b82f6','#22c55e','#06b6d4','#f43f5e','#a855f7','#10b981','#0ea5e9','#64748b','#be185d','#0d9488'];
+  const existingColors = db.prepare('SELECT color FROM vacay_user_colors WHERE plan_id = ? AND user_id != ?').all(plan_id, req.user.id).map(r => r.color);
+  const myColor = db.prepare('SELECT color FROM vacay_user_colors WHERE user_id = ? AND plan_id = ?').get(req.user.id, plan_id);
+  if (myColor && existingColors.includes(myColor.color)) {
+    const available = COLORS.find(c => !existingColors.includes(c));
+    if (available) {
+      db.prepare('UPDATE vacay_user_colors SET color = ? WHERE user_id = ? AND plan_id = ?').run(available, req.user.id, plan_id);
+    }
+  }
+
+  // Ensure years exist in target plan
+  const targetYears = db.prepare('SELECT year FROM vacay_years WHERE plan_id = ?').all(plan_id);
+  for (const y of targetYears) {
+    db.prepare('INSERT OR IGNORE INTO vacay_user_years (user_id, plan_id, year, vacation_days, carried_over) VALUES (?, ?, ?, 30, 0)').run(req.user.id, plan_id, y.year);
+  }
+
+  // Notify all plan users (not just owner)
+  notifyPlanUsers(plan_id, req.user.id, 'vacay:accepted');
+
+  res.json({ success: true });
+});
+
+// Decline invite
+router.post('/invite/decline', (req, res) => {
+  const { plan_id } = req.body;
+  db.prepare("DELETE FROM vacay_plan_members WHERE plan_id = ? AND user_id = ? AND status = 'pending'").run(plan_id, req.user.id);
+
+  notifyPlanUsers(plan_id, req.user.id, 'vacay:declined');
+
+  res.json({ success: true });
+});
+
+// Cancel pending invite (by inviter)
+router.post('/invite/cancel', (req, res) => {
+  const { user_id } = req.body;
+  const plan = getActivePlan(req.user.id);
+  db.prepare("DELETE FROM vacay_plan_members WHERE plan_id = ? AND user_id = ? AND status = 'pending'").run(plan.id, user_id);
+
+  try {
+    const { broadcastToUser } = require('../websocket');
+    broadcastToUser(user_id, { type: 'vacay:cancelled' });
+  } catch { /* */ }
+
+  res.json({ success: true });
+});
+
+// Dissolve fusion
+router.post('/dissolve', (req, res) => {
+  const plan = getActivePlan(req.user.id);
+  const isOwner = plan.owner_id === req.user.id;
+
+  // Collect all user IDs and company holidays before dissolving
+  const allUserIds = getPlanUsers(plan.id).map(u => u.id);
+  const companyHolidays = db.prepare('SELECT date, note FROM vacay_company_holidays WHERE plan_id = ?').all(plan.id);
+
+  if (isOwner) {
+    const members = db.prepare("SELECT user_id FROM vacay_plan_members WHERE plan_id = ? AND status = 'accepted'").all(plan.id);
+    for (const m of members) {
+      const memberPlan = getOwnPlan(m.user_id);
+      db.prepare('UPDATE vacay_entries SET plan_id = ? WHERE plan_id = ? AND user_id = ?').run(memberPlan.id, plan.id, m.user_id);
+      // Copy company holidays to member's own plan
+      for (const ch of companyHolidays) {
+        db.prepare('INSERT OR IGNORE INTO vacay_company_holidays (plan_id, date, note) VALUES (?, ?, ?)').run(memberPlan.id, ch.date, ch.note);
+      }
+    }
+    db.prepare('DELETE FROM vacay_plan_members WHERE plan_id = ?').run(plan.id);
+  } else {
+    const ownPlan = getOwnPlan(req.user.id);
+    db.prepare('UPDATE vacay_entries SET plan_id = ? WHERE plan_id = ? AND user_id = ?').run(ownPlan.id, plan.id, req.user.id);
+    // Copy company holidays to own plan
+    for (const ch of companyHolidays) {
+      db.prepare('INSERT OR IGNORE INTO vacay_company_holidays (plan_id, date, note) VALUES (?, ?, ?)').run(ownPlan.id, ch.date, ch.note);
+    }
+    db.prepare("DELETE FROM vacay_plan_members WHERE plan_id = ? AND user_id = ?").run(plan.id, req.user.id);
+  }
+
+  // Notify all former plan members
+  try {
+    const { broadcastToUser } = require('../websocket');
+    allUserIds.filter(id => id !== req.user.id).forEach(id => broadcastToUser(id, { type: 'vacay:dissolved' }));
+  } catch { /* */ }
+
+  res.json({ success: true });
+});
+
+// ── Available users to invite ──────────────────────────────
+
+router.get('/available-users', (req, res) => {
+  const planId = getActivePlanId(req.user.id);
+  // All users except: self, already in this plan, already fused elsewhere
+  const users = db.prepare(`
+    SELECT u.id, u.username, u.email FROM users u
+    WHERE u.id != ?
+    AND u.id NOT IN (SELECT user_id FROM vacay_plan_members WHERE plan_id = ?)
+    AND u.id NOT IN (SELECT user_id FROM vacay_plan_members WHERE status = 'accepted')
+    AND u.id NOT IN (SELECT owner_id FROM vacay_plans WHERE id IN (
+      SELECT plan_id FROM vacay_plan_members WHERE status = 'accepted'
+    ))
+    ORDER BY u.username
+  `).all(req.user.id, planId);
+  res.json({ users });
+});
+
+// ── Years ──────────────────────────────────────────────────
+
+router.get('/years', (req, res) => {
+  const planId = getActivePlanId(req.user.id);
+  const years = db.prepare('SELECT year FROM vacay_years WHERE plan_id = ? ORDER BY year').all(planId);
+  res.json({ years: years.map(y => y.year) });
+});
+
+router.post('/years', (req, res) => {
+  const { year } = req.body;
+  if (!year) return res.status(400).json({ error: 'Year required' });
+  const planId = getActivePlanId(req.user.id);
+  try {
+    db.prepare('INSERT INTO vacay_years (plan_id, year) VALUES (?, ?)').run(planId, year);
+    const plan = db.prepare('SELECT * FROM vacay_plans WHERE id = ?').get(planId);
+    const carryOverEnabled = plan ? !!plan.carry_over_enabled : true;
+    const users = getPlanUsers(planId);
+    for (const u of users) {
+      // Calculate carry-over from previous year if enabled
+      let carriedOver = 0;
+      if (carryOverEnabled) {
+        const prevConfig = db.prepare('SELECT * FROM vacay_user_years WHERE user_id = ? AND plan_id = ? AND year = ?').get(u.id, planId, year - 1);
+        if (prevConfig) {
+          const used = db.prepare("SELECT COUNT(*) as count FROM vacay_entries WHERE user_id = ? AND plan_id = ? AND date LIKE ?").get(u.id, planId, `${year - 1}-%`).count;
+          const total = prevConfig.vacation_days + prevConfig.carried_over;
+          carriedOver = Math.max(0, total - used);
+        }
+      }
+      db.prepare('INSERT OR IGNORE INTO vacay_user_years (user_id, plan_id, year, vacation_days, carried_over) VALUES (?, ?, ?, 30, ?)').run(u.id, planId, year, carriedOver);
+    }
+  } catch { /* exists */ }
+  notifyPlanUsers(planId, req.user.id, 'vacay:settings');
+  const years = db.prepare('SELECT year FROM vacay_years WHERE plan_id = ? ORDER BY year').all(planId);
+  res.json({ years: years.map(y => y.year) });
+});
+
+router.delete('/years/:year', (req, res) => {
+  const year = parseInt(req.params.year);
+  const planId = getActivePlanId(req.user.id);
+  db.prepare('DELETE FROM vacay_years WHERE plan_id = ? AND year = ?').run(planId, year);
+  db.prepare("DELETE FROM vacay_entries WHERE plan_id = ? AND date LIKE ?").run(planId, `${year}-%`);
+  db.prepare("DELETE FROM vacay_company_holidays WHERE plan_id = ? AND date LIKE ?").run(planId, `${year}-%`);
+  notifyPlanUsers(planId, req.user.id, 'vacay:settings');
+  const years = db.prepare('SELECT year FROM vacay_years WHERE plan_id = ? ORDER BY year').all(planId);
+  res.json({ years: years.map(y => y.year) });
+});
+
+// ── Entries ────────────────────────────────────────────────
+
+router.get('/entries/:year', (req, res) => {
+  const year = req.params.year;
+  const planId = getActivePlanId(req.user.id);
+  const entries = db.prepare(`
+    SELECT e.*, u.username as person_name, COALESCE(c.color, '#6366f1') as person_color
+    FROM vacay_entries e
+    JOIN users u ON e.user_id = u.id
+    LEFT JOIN vacay_user_colors c ON c.user_id = e.user_id AND c.plan_id = e.plan_id
+    WHERE e.plan_id = ? AND e.date LIKE ?
+  `).all(planId, `${year}-%`);
+  const companyHolidays = db.prepare("SELECT * FROM vacay_company_holidays WHERE plan_id = ? AND date LIKE ?").all(planId, `${year}-%`);
+  res.json({ entries, companyHolidays });
+});
+
+router.post('/entries/toggle', (req, res) => {
+  const { date, target_user_id } = req.body;
+  if (!date) return res.status(400).json({ error: 'date required' });
+  const planId = getActivePlanId(req.user.id);
+  // Allow toggling for another user if they are in the same plan
+  let userId = req.user.id;
+  if (target_user_id && parseInt(target_user_id) !== req.user.id) {
+    const planUsers = getPlanUsers(planId);
+    const tid = parseInt(target_user_id);
+    if (!planUsers.find(u => u.id === tid)) {
+      return res.status(403).json({ error: 'User not in plan' });
+    }
+    userId = tid;
+  }
+  const existing = db.prepare('SELECT id FROM vacay_entries WHERE user_id = ? AND date = ? AND plan_id = ?').get(userId, date, planId);
+  if (existing) {
+    db.prepare('DELETE FROM vacay_entries WHERE id = ?').run(existing.id);
+    notifyPlanUsers(planId, req.user.id);
+    res.json({ action: 'removed' });
+  } else {
+    db.prepare('INSERT INTO vacay_entries (plan_id, user_id, date, note) VALUES (?, ?, ?, ?)').run(planId, userId, date, '');
+    notifyPlanUsers(planId, req.user.id);
+    res.json({ action: 'added' });
+  }
+});
+
+router.post('/entries/company-holiday', (req, res) => {
+  const { date, note } = req.body;
+  const planId = getActivePlanId(req.user.id);
+  const existing = db.prepare('SELECT id FROM vacay_company_holidays WHERE plan_id = ? AND date = ?').get(planId, date);
+  if (existing) {
+    db.prepare('DELETE FROM vacay_company_holidays WHERE id = ?').run(existing.id);
+    notifyPlanUsers(planId, req.user.id);
+    res.json({ action: 'removed' });
+  } else {
+    db.prepare('INSERT INTO vacay_company_holidays (plan_id, date, note) VALUES (?, ?, ?)').run(planId, date, note || '');
+    // Remove any vacation entries on this date
+    db.prepare('DELETE FROM vacay_entries WHERE plan_id = ? AND date = ?').run(planId, date);
+    notifyPlanUsers(planId, req.user.id);
+    res.json({ action: 'added' });
+  }
+});
+
+// ── Stats ──────────────────────────────────────────────────
+
+router.get('/stats/:year', (req, res) => {
+  const year = parseInt(req.params.year);
+  const planId = getActivePlanId(req.user.id);
+  const plan = db.prepare('SELECT * FROM vacay_plans WHERE id = ?').get(planId);
+  const carryOverEnabled = plan ? !!plan.carry_over_enabled : true;
+  const users = getPlanUsers(planId);
+
+  const stats = users.map(u => {
+    const used = db.prepare("SELECT COUNT(*) as count FROM vacay_entries WHERE user_id = ? AND plan_id = ? AND date LIKE ?").get(u.id, planId, `${year}-%`).count;
+    const config = db.prepare('SELECT * FROM vacay_user_years WHERE user_id = ? AND plan_id = ? AND year = ?').get(u.id, planId, year);
+    const vacationDays = config ? config.vacation_days : 30;
+    const carriedOver = carryOverEnabled ? (config ? config.carried_over : 0) : 0;
+    const total = vacationDays + carriedOver;
+    const remaining = total - used;
+    const colorRow = db.prepare('SELECT color FROM vacay_user_colors WHERE user_id = ? AND plan_id = ?').get(u.id, planId);
+
+    // Auto-update carry-over into next year (only if enabled)
+    const nextYearExists = db.prepare('SELECT id FROM vacay_years WHERE plan_id = ? AND year = ?').get(planId, year + 1);
+    if (nextYearExists && carryOverEnabled) {
+      const carry = Math.max(0, remaining);
+      db.prepare(`
+        INSERT INTO vacay_user_years (user_id, plan_id, year, vacation_days, carried_over) VALUES (?, ?, ?, 30, ?)
+        ON CONFLICT(user_id, plan_id, year) DO UPDATE SET carried_over = ?
+      `).run(u.id, planId, year + 1, carry, carry);
+    }
+
+    return {
+      user_id: u.id, person_name: u.username, person_color: colorRow?.color || '#6366f1',
+      year, vacation_days: vacationDays, carried_over: carriedOver,
+      total_available: total, used, remaining,
+    };
+  });
+
+  res.json({ stats });
+});
+
+// Update vacation days for a year (own or fused partner)
+router.put('/stats/:year', (req, res) => {
+  const year = parseInt(req.params.year);
+  const { vacation_days, target_user_id } = req.body;
+  const planId = getActivePlanId(req.user.id);
+  const userId = target_user_id ? parseInt(target_user_id) : req.user.id;
+  const planUsers = getPlanUsers(planId);
+  if (!planUsers.find(u => u.id === userId)) {
+    return res.status(403).json({ error: 'User not in plan' });
+  }
+  db.prepare(`
+    INSERT INTO vacay_user_years (user_id, plan_id, year, vacation_days, carried_over) VALUES (?, ?, ?, ?, 0)
+    ON CONFLICT(user_id, plan_id, year) DO UPDATE SET vacation_days = excluded.vacation_days
+  `).run(userId, planId, year, vacation_days);
+  notifyPlanUsers(planId, req.user.id);
+  res.json({ success: true });
+});
+
+// ── Public Holidays API (proxy to Nager.Date) ─────────────
+
+router.get('/holidays/countries', async (req, res) => {
+  const cacheKey = 'countries';
+  const cached = holidayCache.get(cacheKey);
+  if (cached && Date.now() - cached.time < CACHE_TTL) return res.json(cached.data);
+  try {
+    const resp = await fetch('https://date.nager.at/api/v3/AvailableCountries');
+    const data = await resp.json();
+    holidayCache.set(cacheKey, { data, time: Date.now() });
+    res.json(data);
+  } catch {
+    res.status(502).json({ error: 'Failed to fetch countries' });
+  }
+});
+
+router.get('/holidays/:year/:country', async (req, res) => {
+  const { year, country } = req.params;
+  const cacheKey = `${year}-${country}`;
+  const cached = holidayCache.get(cacheKey);
+  if (cached && Date.now() - cached.time < CACHE_TTL) return res.json(cached.data);
+  try {
+    const resp = await fetch(`https://date.nager.at/api/v3/PublicHolidays/${year}/${country}`);
+    const data = await resp.json();
+    holidayCache.set(cacheKey, { data, time: Date.now() });
+    res.json(data);
+  } catch {
+    res.status(502).json({ error: 'Failed to fetch holidays' });
+  }
+});
+
+module.exports = router;

server/src/scheduler.js

@@ -102,4 +102,27 @@ function start() {
   console.log(`[Auto-Backup] Geplant: ${settings.interval} (${expression}), Aufbewahrung: ${settings.keep_days === 0 ? 'immer' : settings.keep_days + ' Tage'}`);
 }
 
-module.exports = { start, loadSettings, saveSettings, VALID_INTERVALS };
+// Demo mode: hourly reset of demo user data
+let demoTask = null;
+
+function startDemoReset() {
+  if (demoTask) { demoTask.stop(); demoTask = null; }
+  if (process.env.DEMO_MODE !== 'true') return;
+
+  demoTask = cron.schedule('0 * * * *', () => {
+    try {
+      const { resetDemoUser } = require('./demo/demo-reset');
+      resetDemoUser();
+    } catch (err) {
+      console.error('[Demo Reset] Error:', err.message);
+    }
+  });
+  console.log('[Demo] Hourly reset scheduled (at :00 every hour)');
+}
+
+function stop() {
+  if (currentTask) { currentTask.stop(); currentTask = null; }
+  if (demoTask) { demoTask.stop(); demoTask = null; }
+}
+
+module.exports = { start, stop, startDemoReset, loadSettings, saveSettings, VALID_INTERVALS };

server/src/websocket.js

@@ -141,4 +141,26 @@ function broadcast(tripId, eventType, payload, excludeSid) {
   }
 }
 
-module.exports = { setupWebSocket, broadcast };
+function broadcastToUser(userId, payload) {
+  if (!wss) return;
+  for (const ws of wss.clients) {
+    if (ws.readyState !== 1) continue;
+    const user = socketUser.get(ws);
+    if (user && user.id === userId) {
+      ws.send(JSON.stringify(payload));
+    }
+  }
+}
+
+function getOnlineUserIds() {
+  const ids = new Set();
+  if (!wss) return ids;
+  for (const ws of wss.clients) {
+    if (ws.readyState !== 1) continue;
+    const user = socketUser.get(ws);
+    if (user) ids.add(user.id);
+  }
+  return ids;
+}
+
+module.exports = { setupWebSocket, broadcast, broadcastToUser, getOnlineUserIds };